Verify this release

Release see /release.json · build …

Every file of the Dayline web app is listed with its SHA-256 hash in /release.json (the same list in sha256sum format: /SHA256SUMS). The release hash is the SHA-256 of that SHA256SUMS file: one hash that names every file. The app page pins each script and stylesheet it loads with a Subresource Integrity hash, so a browser refuses a changed copy of them, and the offline copy the service worker keeps is checked against hashes built into it.

What this does and doesn’t prove

This page and the list come from the same server as the app. They show that the files your browser received match the list for this release. They don’t prove the code is honest: a server that wanted to could serve you a different list together with different code. That check needs copies of the list kept by people other than us, and the source code.

The source isn’t public yet. So today nobody outside can rebuild a release and check what its code does. We plan to publish it, and we haven’t yet. Until then, “we can’t read your entries” rests on trust in us, as the app says.

1. Check in this browser

Downloads every listed file again, without the cache, and compares its hash with the list.

Check the files

2. Check from a terminal

Fetches the list and every file, then checks them with shasum (macOS) or sha256sum (Linux). Keep the printed release hash: if someone else’s copy for the same release differs, one of you was served something else.

o=https://YOUR-DAYLINE-ADDRESS
mkdir dayline-check && cd dayline-check
curl -fsS "$o/SHA256SUMS" -o SHA256SUMS
shasum -a 256 SHA256SUMS        # the release hash
while read -r h p; do
  case "$p" in index.html) u=/index.html ;; *.html) u="/${p%.html}" ;; *) u="/$p" ;; esac
  mkdir -p "$(dirname "$p")" && curl -fsSL "$o$u" -o "$p"
done < SHA256SUMS
shasum -a 256 -c SHA256SUMS      # every line must say OK

3. Rebuild from source

When the source of a release is public: check out its tag, install exactly the lockfile and build, then compare your files with the published list.

npm ci
npm run build
npm run release:hashes -- --compare https://YOUR-DAYLINE-ADDRESS/release.json

The build has no timestamps or machine paths in it, so the same source and lockfile should give the same files. We haven’t had that confirmed by an independent build yet.