Media
2 items
Description
Checks wallet code against signed releases. Chrome warns; Firefox can block unapproved code. TensorCash Code Verify compares the code a wallet website serves to your browser with release manifests that TensorCash has rebuilt from the published source and signed. It covers the wallet sites listed in the extension (currently the TensorCash Web Wallet at app.tscweb.xyz and the wallet at wallettensor.cash). What the badge means: - Green check: every file the page loaded, including the page itself, is part of one signed release, and the hashes are of the bytes the page received. - Amber "?": the files match a signed release, but on Chrome some had to be re-fetched, so nothing proves they are the bytes that ran. Firefox verifies the exact bytes. - Amber "!": the site is serving a build that has not been attested, or no signed release exists yet. - Red cross: a file differs from the signed release, code was loaded from outside the site, a redirect or service worker was involved, or the page carries inline scripts. Firefox only: an optional enforce mode (off by default, per site in the options page) withholds any script, worker, WebAssembly, stylesheet or page that is not part of a signed release, before it runs. The manifests are DSSE envelopes signed with Ed25519; the public key is pinned in the extension and shown on its options page. Manifests are fetched from integrity.tensorcash.org. The extension sends no page content, hashes or reports anywhere; "Copy report" puts a JSON report on your clipboard for you to share if you choose. A green badge means the site served a build TensorCash rebuilt from tagged public source and signed. It is not a security audit of that wallet, and it cannot see what other extensions or malware do to the page. Source: https://git.tensorcash.org/tensorcash/code-verify-extension (MIT). Builds are reproducible: two runs of scripts/build.py give identical ZIP hashes, published with each release.