ic-git verifier

Checks ic-git sites against their on-chain record and shows only the checked page, running only its verified scripts.

Sites served by ic-git (a git host on the Internet Computer) publish a record of each page they serve to a public registry contract on chain. This extension checks every page it opens on those sites against that record before anything on it runs: the page's hash, the git commit it came from (every object checked against its own hash), and that everything it loads is pinned. If the page is not the recorded one -- because a proxy, gateway or anyone in between changed it -- the page is stopped and you are told which check failed. If it is, only the verified page's own scripts are allowed to run. It reads public records only: the page itself, the ic-git canister's public queries, and the registry through two public Ethereum RPC endpoints that must agree. To look a site's record up it has to name the site, so the operators of those endpoints -- the Internet Computer's public API gateway and the two RPC providers -- see which ic-git site is being checked and from which network address, when you open it and every ten minutes after while the browser stays open. That is all it sends: no page content, nothing you type, no identifier, and nothing to the extension's authors, who run no server and collect nothing. Its source, and the hash of every file in this package, are public and recorded on chain, so you can check the copy you installed: see docs/EXTENSION.md in the ic-git repository.