Initial AD port

themes/after-dark/docs/content/feature/release-hashes.md

@@ -0,0 +1,44 @@
++++
+title = "Release Hashes"
+description = "Verify you are using genuine After Dark software."
+categories = ["security"]
+tags = ["validate", "privacy", "security", "cryptography", "npm", "git"]
+features = ["code highlighter", "related content"]
+[[copyright]]
+  owner = "Josh Habdas"
+  date = "2019"
+  license = "agpl-3.0-or-later"
++++
+
+After Dark utilizes the {{< external href="https://www.npmjs.com" text="NPM" />}} CLI to produce a unique cryptographic hash each release, enabling any copy to be uniquely identified regardless of its source.
+
+Release hashes use the <abbr title="Secure Hashing Algorithm">SHA-512</abbr> algorithm and look like this:
+
+{{< hackcss-alert type="success" >}}
+<samp>VWcn7AxXUkZRGsRIM/6A5RjqW7DOPH+XbnLGRp7hpr0TCH/9l31ug2h2JaIlEvsDzOPRcZDBdyZvJ4mSm/Rqjg==</samp>
+{{< /hackcss-alert >}}
+
+
+Each release a new hash is generated in the following locations:
+
+- Embedded using PGP in the {{< external href="https://git.habd.as/comfusion/after-dark/releases" text="release source" />}} `git tag` message.
+- Codified into the {{< external href="https://registry.npmjs.org/after-dark/latest" text="latest" />}} or {{< external href="https://registry.npmjs.org/after-dark/6.7.9" text="version-specific" />}} NPM package metadata.
+- Embedded inside the After Dark [Online Help](../online-help) documentation.
+
+Upon receiving your copy of After Dark you may use the release hash to verify you are using an unadulterated version of the software.
+
+Run the [Release Validator](/validate) to quickly check your release offline:
+
+{{< hackcss-card header="Interactive Release Validator" >}}
+<iframe title="Validate Release" scrolling="no" width="100%" height="360" src="/validate"></iframe>
+{{< /hackcss-card >}}
+
+For a more thorough inspection do the following:
+
+1. Install the {{< external href="https://docs.npmjs.com/cli/npm" text="npm cli" />}} on your machine.
+2. Navigate to `themes/after-dark` from within your site.
+3. Run `npm i && npm run integrity` to generate your SHA-512 hash.
+4. Compare your hash to the hash generated during a signed release.
+5. If equal, verify the GPG signature used to sign that release.
+
+If inspection fails run the [Upgrade Script](../upgrade-script/) and try again.