ic-git verifier

Checks ic-git sites against their on-chain record, runs only their verified scripts, and lets them call only approved canisters.

Sites served by ic-git (a git host on the Internet Computer) publish a record of each page they serve to a public registry contract on chain. This extension checks every page it opens on those sites against that record before anything on it runs: the page's hash, the git commit it came from (every object checked against its own hash), and that everything it loads is pinned. If the page is not the recorded one -- because a proxy, gateway or anyone in between changed it -- the page is stopped and you are told which check failed. If it is, only the verified page's own scripts are allowed to run. It also checks what the page talks to. Before the page may call a canister, the extension reads that canister's code hash and controllers from the Internet Computer's signed state certificate, verified against the network's public key. A backend that only ic-git controls, running the build its voters approved and recorded on chain, is allowed; so are the Internet Computer's own system canisters (its ledgers and the cycles minting canister), and a canister nobody controls, whose code can never change. A backend whose owner can change it without a vote is allowed with a warning. A backend ic-git controls that runs no approved build, or a canister whose state cannot be certified, is blocked; so, in Chrome, is any canister not judged with the site (Firefox judges one the first time the page calls it). The extension says which canister and why. It reads public records only: the page itself, the ic-git canister's public queries, and the registry through two public Ethereum RPC endpoints that must agree. To look a site's record up it has to name the site (and, for the backend check, the canisters it calls), so the operators of those endpoints -- the Internet Computer's public API gateway and the two RPC providers -- see which ic-git site is being checked and from which network address, when you open it and every ten minutes after while the browser stays open (and, in Firefox, when the page first calls a canister not yet checked). That is all it sends: no page content, nothing you type, no identifier, and nothing to the extension's authors, who run no server and collect nothing. Its source, and the hash of every file in this package, are public and recorded on chain, so you can check the copy you installed: see docs/EXTENSION.md in the ic-git repository.