Ukwakhiwa kabusha okungaphindwa kwezinhlelo ze-VPN: ukuvumelana kufakazelani
Ukwakhiwa kabusha okuhambisanayo kuxhumanisa ifayela le-binary elisatshalalisiwe nomthombo nemithi eshiwo. Akusho lutho mayelana nensizakalo ye-VPN engemuva kwalelo fayela noma amarekhodi ayo.
Ukukwazi ukuphinda kukhiqizwe kuyisici somugqa wokuhlinzeka: okokufaka okushiwo okufanayo kufanele kukhiqize umkhiqizo ofanayo. Kumklami we-VPN, leso sitatimende sihlanganisa isifaki osilande nayo nomthombo kanye nochungechunge lwamathuluzi umuntu ongayakha kabusha. Akusho lutho mayelana nensizakalo umklami axhuma kuyo.
Ngakho umbuzo owusizo mncane futhi unokuphenduleka. Ingabe iphrojekthi ishicilela inqubo, futhi ingabe umkhiqizo wakho othile uyahambisana nayo?
Lapho ukwakhiwa kuyeka ukuba nokunquma
Izihlanganisi zifaka amasitampu esikhathi, izindlela eziphelele namagama amasheya okwakha ngaphandle uma zivinjelwe. Izingobo zokugcina zirekhoda ukulandelana kwamafayela nezikhathi zokushintsha, izixhumanisi zishintsha okukhiphayo ngenguqulo yochungechunge lwamathuluzi, futhi ukucindezelwa okuhambisanayo kungahlela kabusha amabhulokhi. Okukodwa kwalokhu kwenza ukwakhiwa okubili komthombo ofanayo kwehluke ngamabhayithi ngaphandle kokuthi kwenzeke into ethusayo. Ukunquma kufakwa ekwakhiweni ngobunjiniyela, akukaze kuzuzwe njengefa ngokuzenzakalela.
Iphrojekthi ethi ingaphindwa kufanele isho ukujwayeza esikushitshile: amasitampu esikhathi anganyakazi, izindlela ezihlelwe, okufakwe kungobo zokugcina okuhlelwe, izinguqulo zomhlanganisi nezethembiso eziboshwe. Ngaphandle kwalolo hlu, ukungavumelani akukwazi ukuchazwa, ngoba isikhala sokuhluka okusemthethweni asichaziwe.
Okokufaka okushiwo nakho kufanele kuphelele. I-URL yesitoreji ngaphandle kwethegi akuyona ukubuyekezwa, ifayela lokukhiya ngaphandle kwe-hash akulona iqoqo lezinto ezithembwayo, futhi iskripthi sokwakha esilanda ithuluzi ngesikhathi sokusebenza sinokokufaka okungeke kukwazi ukuboshwa muntu. Igwebu ngalinye liba umehluko kamuva. Qedela uhlu ngaphambi kokuqhathanisa noma yini, ngoba uhlu olungaphelele alunakwehluleka ngendlela enencazelo.
| Input | How it drifts | What pins it |
|---|---|---|
| Source | Branch moves after release | Commit hash in the build metadata |
| Toolchain | Compiler patch level differs | Container image digest |
| Packaging | Archive order and mtimes vary | Normalised archive settings |
Ukuqhathanisa kuhlola ini ngempela
Uhlangothi oluzimele lwakha kabusha endaweni eshiwo futhi luqhathanisa okukhiphayo nomkhiqizo oshicilelwe. Ukufana ngamabhithi kuyindlela eqinile; isinyathelo sokujwayeza esibhalwe phansi, lapho umehluko oqoshiwe uhlehliswa khona futhi imiphumela ibe isifana, kuyindlela ebuthakathaka kodwa elusizo.
Ukuqhathanisa kumayelana ne-binary. Isiginesha siphendula omunye umbuzo: sihlanganisa ukukhishwa nokhiye nokhiye nobuwena, futhi iphrojekthi ingaba neziginesha ezivumelekile phezu kwemikhiqizo okungekho muntu owake wayakha kabusha. Ukuhlola okubili kuyahlangana phezulu esikhundleni sokuthatha indawo yokunye.
sha256sum wireguard-installer.msi gpg --verify wireguard-installer.msi.sig wireguard-installer.msi
Gijimisa kokubili ngaphambi kokufaka, futhi uqhathanise i-hash naleyo eshicilelwe okukhishwa nendawo efanayo. I-hash evumelana nekhasi lomthengisi ifakazela ukuthi ukulanda kufike kuphelele; i-binary eyakhiwe kabusha evumelana ne-hash eshicilelwe ngumthengisi ifakazela okunamandla mayelana nendlela eyakhiwa ngayo.
Kungani ukungavumelani kungeyona ubufakazi bokugxambukela
Ukungavumelani okuningi kuvela kokokufaka okungekho muntu owakulawula. Ukukhishwa kwe-patch ehlukile komhlanganisi, indlela yokwakha eyavuzela kusimboli zokulungisa amaphutha, indawo eshintshe ukulandelana kokuhlunga, noma isinyathelo sokupakisha esisetshenziswe ngemuva kokuqhathanisa — konke kukhiqiza i-hash ehlukile kunomsebenzi othembekile.
Ngakho ukungavumelani kufanele kufundwe ngokuqhathanisa nenqubo ebhalwe phansi ngaphambi kokuba kube indaba. Uma inqubo ibopha konke futhi umehluko uhlala ungachazwanga, lokho kuwukutholakala kwangempela okufanele kulethwe kuphrojekthi. Uma inqubo ithule ngokupakisha, umehluko ungase ulindelekile ngokuphelele.
Ukulingana nakho kubalulekile lapha: ukuvumelana akufakazeli ukuthi umthombo awunazo iziphambeko, kufakazela kuphela ukuthi i-binary iyahambisana nawo. Ikhodi ehlolwe kahle nekhodi engaphindwa iyizici ezihlukile, futhi iphrojekthi ingaba nokunye ngaphandle kokunye.
Isitatimende sithini mayelana nensizakalo engemuva kohlelo
Umklami wuhlelo olusekhombeni yakho; insizakalo ingamasheva, izinhlelo zama-akhawunti kanye nezinqubomgomo zokugcina kwenye indawo. Ukukwazi ukuphinda kukhawulela okokuqala futhi akusho lutho mayelana nokwesibili, noma isifaki siqinisekiswa ngokucophelela kangakanani.
Ukuhlelwa kwephoyinti lokugcina nakho kungashintsha ngemva kokufakwa, ngokusebenzisa izilungiselelo ezikude noma iphrofayela elawulwa umhlinzeki. Lezo zinguquko zifika ngocingo futhi azimbozwa yinoma iyiphi i-hash oyibale ngaphambi kokuxhuma.
Funda isitatimende endaweni yaso yangempela, bese uhlola umbuzo oseduze ngokwehlukile: umhlinzeki uqopha ini, futhi ngaphansi kwesiphi isigaba somthetho aphendula ngaso izicelo. I-binary eqinisekisiwe nensizakalo engaqinisekisiwe kungaba khona ndawonye, futhi yiso leso simo ukuhlolwa komugqa wokuhlinzeka okwakhelwe ukusenza sibonakale, hhayi ukusilungisa.