Trustalpha

What each way of building and running moxzi actors asks you to trust, and what an on-chain build proves.

Each way of running moxzi asks you to trust someone. This page lists who, so you can choose the right one.

Who you trust#

	You trust	Who can read your source or state
`moxzi build`	Your machine and the moxzi files on it	You
`moxzid`	The server's operator	The operator, and anyone with the token
`moxzi-web`	The web page and its origin	Any script on the page
On-chain build	The Internet Computer subnet, and the compiler canister's current module	The canister's controllers

What an on-chain build proves#

An on-chain build record says: this compiler module, given these files and these options, produced a module with this hash. Anyone can check each part:

The compiler module's hash comes from the Internet Computer, not from the canister. Compare it with the compiler.wasm in a moxzi release (moxzi verify --expect-module).
The source hashes can be compared with your own files (moxzi verify --entry).
The result can be reproduced by building the same files locally, which produces the same bytes.

It doesn't prove that the source is safe, or that the canister you install the module into is controlled by who you think. And a canister's controllers can upgrade it, so check the compiler's module hash, not only its canister id.

Local builds#

moxzi build prints the hash of the compiler it used on every build, and moxzi info prints the compiler's and linker's hashes. Compare them with the release's SHA256SUMS. Anything that can change files on your machine can change your build.

moxzid#

The operator of a moxzid server can read and change every actor's state and code. The bearer token controls access to the whole server. Callers aren't authenticated: x-caller is a claim, not a signature. See Authentication.

The browser#

Actors in a page run inside the page's JavaScript. Any script the page loads can call them, read their state, and change their stored data.

Certificates#

Only the Internet Computer can produce certified responses, because they're signed by a subnet. moxzid and moxzi-web report that no certificate is available, rather than producing one that can't be trusted.