「GNUnet」の版間の差分

提供: ArchWiki
ナビゲーションに移動 検索に移動
(関連記事を追加)
(英語版から転載)
32行目: 32行目:
 
== 使用方法 ==
  
== 使用方法 ==
   
−
=== ダウンロード ===
 +
=== Entering the GNUnet network ===
   
  +
[[Start]] and possibly [[enable]] the {{ic|gnunet}} system service. Some operations will require the {{ic|gnunet}} user service to be started as well.
−
''gnunet-gtk'' を使ってファイルをダウンロードするには、'Filesystem' タブでファイルを検索します。欲しいファイルを見つけたら、他の P2P ファイル共有プログラムと同じようにダウンロードしてください。以下のコマンドで起動します:
  
   
  +
=== Checking the network ===
−
# gnunet-fs-gtk
  
   
  +
You can check the current state of the network by launching the {{ic|gnunet-peerinfo}} command as normal user.
−
=== アップロード ===
  
   
  +
$ gnunet-peerinfo
−
gnunet ネットワークへのファイルのアップロードはやや複雑です。GNUnet ではファイルの 'indexing' とファイルの 'inserting' を区別しています。詳細は [https://gnunet.org フレームワークのウェブサイト] を読んで下さい。以下ではネットワークを使ってデータを共有する方法を説明します。[https://gnunet.org/file-sharing こちらのページ] に書かれていることの簡略版です。
  
   
  +
To know your peer identity launch:
−
以下の手順は手動で行って下さい。アップロードを簡単にする {{AUR|gnunet-fuse}} という名前のモジュールが開発されています。
  
   
  +
$ gnunet-peerinfo -s
−
==== ファイル・ディレクトリのインデックスを作成 ====
  
   
  +
To list the peers you are directly connected with (these are called "neighbours"), launch:
−
gnunet-insert [-n] [-k keword1] [-k keyword 2] [-m TYPE:VALUE] ''filename''
  
   
  +
$ gnunet-core
−
キーワードの追加は必須ではありませんが、推奨されています。GNUnet ではファイル名ではなく、キーワードによって検索するからです。gnunet の依存パッケージとなっている Libextractor がファイルからキーワードを抽出しますが、自分でキーワードを入力するほうが良いでしょう。'-m' オプションはメタデータの意味です。他のユーザーが検索をかけて、あなたのファイルがそれにかかったときに、gnunet が表示する (ファイルに関する) データになります。詳細は gnunet.org のオンラインドキュメントを見て下さい。'-n' オプションを使用するとインデックスが作成されるだけではなく、gnunet の MySQL/sqlite データベースにファイル・ディレクトリが挿入されます。
  
   
  +
=== File sharing ===
−
==== ファイル・ディレクトリのインデックスを解除 ====
  
   
  +
By default the file sharing service runs ''per user'', which means that '''both the system and user {{ic|gnunet}} services''' need to be [[start]]ed. If you want to change this option and run the file sharing ''per machine'', edit {{ic|/etc/gnunet.conf}} accordingly:
−
gnunet-unindex
  
   
  +
[fs]
−
インデックスしたファイルを忘れてしまっても、{{ic|1=GNUNET_HOME=/var/lib/gnunet}} ({{ic|gnunet-setup -d}} によって設定されます) の {{ic|/var/lib/gnunet/data/shared}} ディレクトリで確認できます。
  
  +
...
  +
RUN_PER_USER = NO
  +
...
  +
UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-fs.sock
  +
...
   
  +
==== Searching for a file ====
−
{{Warning|ディレクトリを直接編集してはいけません。gnunet-insert や gnunet-unindex を使って変更してください。gnunet はデータベースを使ってファイルの情報を保存しているため、ディレクトリの中身を削除 (編集) しても gnunet データベースのエントリは削除されません。}}
  
   
  +
Use {{ic|gnunet-search}} to search for a file using keywords (these are not necessarily related to the file's name). For example, to search for files that have been indexed under the “commons” keyword, launch:
−
==== インデックスしたファイルを修正・削除 ====
  
   
  +
$ gnunet-search --timeout='10 s' 'commons'
−
* ファイルを修正した場合、ファイルの URI が変更され、GNUnet は全く違うファイルとして認識します。したがって、(gnunet-unindex コマンドで) 元のファイルのインデックスを解除してから、ファイルを修正し、新しいファイルのインデックスを作成してネットワーク上で利用できるようにしてください。
  
  +
−
* システムからファイルを移動・削除したいときは、まずインデックスの解除を行って下さい。
  
  +
Without specifying a timeout (10 seconds in the example above) {{ic|gnunet-search}} runs forever, waiting for the user to press CTRL-C.
  +
  +
The {{ic|gnunet-search}} command has a {{ic|--printf}} option for manipulating the printed output, somewhat similar to the {{ic|-printf}} option of the [[find|{{ic|find}}]] utility. Please type {{ic|man gnunet-search}} for more details.
  +
  +
===== Saving search results as "GNUnet directories" =====
  +
  +
Use the {{ic|-o}} option of {{ic|gnunet-search}} to save search results as a "GNUnet directories" ({{ic|.gnd}} files) – you might also want to suppress the printed output in this case (the {{ic|-s}} option).
  +
  +
For instance, to search for three seconds and save the results yielded by the “commons” keyword into a file named {{ic|three-seconds-commons.gnd}}, launch:
  +
  +
$ gnunet-search -s -t 3s -o three-seconds-commons.gnd 'commons'
  +
  +
If later you want to inspect the content of {{ic|three-seconds-commons.gnd}} you can launch
  +
  +
$ gnunet-directory three-seconds-commons.gnd
  +
  +
==== Downloading ====
  +
  +
The output of {{ic|gnunet-search}} is by default a list of {{ic|gnunet-download}} commands that you can directly copy and launch as normal user.
  +
  +
For example, using the output generated by {{ic|gnunet-search 'commons'}},
  +
  +
{{hc|$ gnunet-search 'commons'|
  +
#1:
  +
gnunet-download -o "Liotard (2017)_ Fablab - a new space for commons based peer production.pdf" gnunet://fs/chk/C6369DRQ3S8RYK1FD5VDE666W2HVEJ5G5GJRX29BH6ZM08CBRWS7FY9326RBJ4G0N8V1RJ2N802KBYZT7RJT2EDK1J9JR2DXK5MTVM0.4SXJCK9NT5XGCZ0YAJ0ETXJJGY3P2SMNZ0Q94N775YEX9SXS2RW5FWRFK4GMBTP668Z3R8QZZ4WSHW1KG1AVQ5VFC1VF5T3WF57GT58.336423
  +
  +
#2:
  +
gnunet-download -o "Rose, Carol (1986)_ The Comedy of the Commons_ Commerce, Custom, and inherently Public Property.pdf" gnunet://fs/chk/TQK3A2C279EJQ50B1TQWFNTPMGQZJJ4JXYTF2D88D03H038TB7SVVSRBT74FMYPNZ47YZSV096PVVZH0TQ3B8KBVBV2H8GN9VAASTJR.CQ7M7843MGPZCV8M26NKH6EB5MBGZAXRWCF39YS668WM6F22D214GSXNTJ4RYGE7XF68VPZM4C19XR48TT4J8WH8S2E00C96Q8K6790.1593230
  +
  +
#3:
  +
gnunet-download -o "Hardin, Garett (1968)_ Tragedy of the Commons.pdf" gnunet://fs/chk/Y1FD7D123CEGWDW544YDEP15YA5E7ZD2XRSJBNP0847A5JXMMZEZ0XACGRG42BBBTGKZ0ZCBW0A9T6196Z5N26HA6SP1T8GDAT5H5SG.RN38G25DMYG3TBQJEGWDZT2B84N1JYYJZ8VRJ8HG2G1A4EFD4GH5TZXB0RXV7QEMZBSKWCCEF736FXNH6C5BYKG9DSTV99ETFGC93R0.1520328
  +
  +
...}}
  +
  +
you can launch,
  +
  +
{{bc|$ gnunet-download -o "Hardin, Garett (1968)_ Tragedy of the Commons.pdf" gnunet://fs/chk/Y1FD7D123CEGWDW544YDEP15YA5E7ZD2XRSJBNP0847A5JXMMZEZ0XACGRG42BBBTGKZ0ZCBW0A9T6196Z5N26HA6SP1T8GDAT5H5SG.RN38G25DMYG3TBQJEGWDZT2B84N1JYYJZ8VRJ8HG2G1A4EFD4GH5TZXB0RXV7QEMZBSKWCCEF736FXNH6C5BYKG9DSTV99ETFGC93R0.1520328}}
  +
  +
which will download {{ic|Hardin, Garett (1968)_ Tragedy of the Commons.pdf}} in the current directory.
  +
  +
===== Mounting a remote GNUnet directory without downloading it =====
  +
  +
A module, named {{AUR|gnunet-fuse}}, has been developed to mount remote directories from the GNUnet network. With {{ic|gnunet-fuse}}, directories that have been published on the GNUnet network can be mounted as read-only file systems and accessed using normal file operations. In contrast to downloading the directory recursively via {{ic|gnunet-download}}, this has the advantage that files are downloaded on-demand. Only those files (or directories) that you access will be downloaded. For more information please install the module and type {{ic|man gnunet-fuse}}.
  +
  +
==== Uploading ====
  +
  +
Publishing a file on the GNUnet file-sharing network involves choosing keywords that can be later used by other people to search for the file.
  +
  +
Keywords are not strictly required, but they are recommended. This is because GNUnet does not allow searching by filename, but by keywords. The {{Pkg|libextractor}} library, which is a dependency of GNUnet, can automatically extract keywords from a file, but you may wish to enter keywords of your own.
  +
  +
In the following example, we use the keywords "commons" and "state" to publish a file named {{ic|ostrom.pdf}}.
  +
  +
{{hc|$ gnunet-publish -k 'commons' -k 'state' ostrom.pdf|
  +
Publishing `/srv/filesharing/gnunet/ostrom.pdf' done.
  +
URI is `gnunet://fs/chk/M57S...
  +
}}
  +
  +
GNUnet users can now find the file by using the {{ic|gnunet-search}} command.
  +
  +
{{hc|$ gnunet-search 'commons'|
  +
#1:
  +
gnunet-download -o "ostrom.pdf" gnunet://fs/chk/M57S...
  +
}}
  +
  +
To list all the files that are currently published launch {{ic|gnunet-fs -i}}. If later you want to stop sharing a file you can use {{ic|gnunet-unindex ''filename''}} (in our example, {{ic|gnunet-unindex 'ostrom.pdf'}}).
  +
  +
Once a file is published it is not possible to retrieve the keywords whereby the file was indexed (i.e., reverse search). It is always possible however to add further keywords to it.
  +
  +
Please note that it might take some time (up to some hours) till your peers can see your freshly uploaded files.
  +
  +
{{Warning|Unpublishing a file will only stop the current machine from sharing the file, but will '''not''' erase the file from the GNUnet network – which is by design impossible – as other people might have downloaded the file and shared it themselves. By all means {{ic|gnunet-publish}} must be considered '''an irreversible action'''.}}
  +
  +
The {{ic|gnunet-publish}} command offers an option – {{ic|-n}} or equivalently {{ic|--noindex}} – to publish a file without indexing it. When used, GNUnet will perform a full insertion and store the entire file in encrypted form in the GNUnet database.
  +
  +
This option has been created with the purpose of avoiding that who takes physical access to a computer running GNUnet finds out which files are currently being published, in case of censored files in countries with strong censorship. Files published with the {{ic|--noindex}} option will appear as chunks downloaded from the network, and as such cannot be unpublished/unindexed (they have never been indexed in the first place); however it is always possible to specify a low content priority during publication ({{ic|--prio}}) and tell GNUnet that the content that is going to be published is allowed to get lost easily when the database gets full.
  +
  +
For further information, please read [https://docs.gnunet.org/handbook/gnunet.html#File_002dsharing the chapter on file-sharing in the handbook]. See also https://gnunet.org/en/use.html#filesharing.
  +
  +
===== Modifying and removing indexed files =====
  +
  +
* When you modify a file, the URI of the file changes. Therefore, GNUnet considers this to be a completely different file and the indexed file will be considered missing. Therefore, make sure that the original file is unindexed first (using the {{ic|gnunet-unindex}} command), modify the file, and then index the new file to make it accessible through the network.
  +
* If you want to remove a file from your filesystem, then you should unindex it first.
  +
* If you know in advance that a published file will likely need to be updated more or less frequently, see [[#Publishing updatable files]]
  +
  +
==== Downloading + sharing ====
  +
  +
GNUnet file-sharing network is a DHT (see [[Wikipedia:Distributed hash table]]). As peers in the DHT, users store chunks of various files on their disk, ''even from files they do not download or have downloaded''. Which files are stored depends on the DHT distance metric / algorithm.
  +
  +
Technically unless a file has been completely downloaded only parts of it are stored. These are stored in a cache (typically under {{ic|/var/lib/gnunet/.local/share/gnunet}}). If a DHT query finds its way to a peer for one of the cached parts, the peer will provide it. The database used to store the file-sharing blocks is kept finite (below a configurable quota), and all the cached parts can expire to make space for newer files.
  +
  +
If someone shares a file in the GNUnet network the distributed chunks of that file will remain in the network's cache for a while, and the file will remain available even if who shared it goes offline. But if the original publisher goes missing and nobody else shared the file ''explicitly'' (with {{ic|gnunet-publish}}), the file will eventually become unavailable as the peer caches expire or the peers go offline.
  +
  +
The only way to ensure that a file persists in the GNUnet network is then to re-publish it explicitly after downloading it (with {{ic|gnunet-publish}}) and let the machine that publishes the file visit the network regularly.
  +
  +
Publishing a file after downloading will always generate the same URI whereby the file was downloaded ({{ic|gnunet://fs/chk/Y1FD...}} in the example below), independently of the keywords chosen for re-publishing it:
  +
  +
{{hc|$ gnunet-download -o 'Hardin, Garett (1968)_ Tragedy of the Commons.pdf' gnunet://fs/chk/Y1FD...|2=
  +
100% [============================================================]
  +
Downloading `Hardin, Garett (1968)_ Tragedy of the Commons.pdf' done (160 b/s).
  +
}}
  +
  +
{{hc|$ gnunet-publish -k 'tragedy' 'Hardin, Garett (1968)_ Tragedy of the Commons.pdf'|2=
  +
Publishing `/srv/filesharing/gnunet/Hardin, Garett (1968)_ Tragedy of the Commons.pdf' done.
  +
URI is `gnunet://fs/chk/Y1FD...
  +
}}
  +
  +
=== VPN ===
  +
  +
GNUnet provides a VPN, which can be used to share your Internet connection (yes, this may be dangerous, just as running a Tor exit node), or to provide access to services on your host (this should be less dangerous, as long as those services are secure).
  +
  +
For information on how to set up a VPN with GNUnet, see https://gnunet.org/en/use.html#vpn.
  +
  +
=== The GNU Name Service (GNS) ===
  +
  +
The GNU Name Service (GNS) is a fully decentralized alternative to the [[Domain Name System]] (DNS) that should not suffer the same major security flaws as the latter (see [[Wikipedia:Domain Name System#Security issues]]).
  +
  +
For information on how to use GNS, see https://gnunet.org/en/use.html#gns_cli and https://gnunet.org/en/use.html#gns_browser.
  +
  +
=== Chatting with other GNUnet users ===
  +
  +
To chat with GNUnet users the {{ic|gnunet-messenger}} utility is available, ''for which the {{ic|gnunet.service}} [[user unit]] needs to be [[start]]ed'' (possibly along with the {{ic|gnunet.service}} system unit – see [[#Launching the daemon as current user in a multi-user setup]]). For instance, to enter the “miscellanea” room using “alice” as nickname, launch
  +
  +
{{hc|$ gnunet-messenger -e alice -r miscellanea|
  +
* Welcome to the messenger, 'alice'!
  +
* You try to open a room...
  +
* You joined the room.
  +
[EHDA8T] * 'anonymous' opened the room on: 2ABN944E16FTWFMOKTMQ5JMPQ233YSPBKC47XR2DHSPQCQ8GYK80
  +
[EHDA8T] * 'anonymous' gets renamed to 'alice'
  +
█
  +
}}
  +
  +
== App ecosystem ==
  +
  +
=== GNUnet GTK ===
  +
  +
GNUnet GTK is a collection of graphical interfaces for the GNUnet framework. It ships the following [[GTK]] applications:
  +
  +
* {{ic|gnunet-conversation-gtk}}
  +
* {{ic|gnunet-fs-gtk}}
  +
* {{ic|gnunet-namestore-gtk}}
  +
* {{ic|gnunet-peerinfo-gtk}}
  +
* {{ic|gnunet-setup}}
  +
* {{ic|gnunet-statistics-gtk}}
  +
  +
To install GNUnet GTK download the {{AUR|gnunet-gtk}} package.
  +
  +
=== Messenger GTK ===
  +
  +
Currently several graphical user interfaces for chatting on the GNUnet network are being developed. One of these is '''Messenger GTK''' ({{AUR|messenger-gtk}}, or {{AUR|messenger-gtk-git}} for the development version), a mobile-friendly [[GTK]] graphical user interface for chatting with GNUnet users. For chatting via command line, see '''Messenger CLI''' ({{AUR|messenger-cli}} or {{AUR|messenger-cli-git}} for the development version).
  +
  +
=== Web User Interface ===
  +
  +
A Web interface for GNUnet exists and is available as {{AUR|gnunet-webui-git}}.
  +
  +
=== re:claimID ===
  +
  +
[https://gnunet.org/en/reclaim/index.html re:claimID] is a decentralized Identity Provider (IdP) service built on top of the GNU Name System. It allows users to securely share personal information with websites using standardized protocols (OpenID Connect).
  +
  +
For users ''re:claimID'' offers [https://addons.mozilla.org/addon/reclaimid/ an extension for Firefox] and [https://chrome.google.com/webstore/detail/reclaimid/jiogompmdejcnacmlnjhnaicgkefcfll an extension for Chromium] for managing ''re:claimID'' identities in the web browser (the {{AUR|gnunet}} package needs to be installed).
  +
  +
After having installed the extension it will be possible to add a new identity to the local ''re:claimID'' instance and add some attributes to it by visiting https://ui.reclaim/ (the link will not work without the extension installed).
  +
  +
For more information, please refer to [https://gnunet.org/en/reclaim/users.html the manual].
  +
  +
=== GNU Taler ===
  +
  +
GNU Taler is a microtransaction and electronic payment system built on top of GNUnet. Differently than other distributed payment systems Taler is not based on a blockchain, but on blind signatures instead.
  +
  +
For more information please consult [https://taler.net/en/docs.html the official documentation]. See also packages {{AUR|sync}}, {{AUR|taler-exchange}}, {{AUR|taler-mdb}}, {{AUR|taler-merchant}} and {{AUR|taler-twister}}.
  +
  +
=== GNU Anastasis ===
  +
  +
[https://www.gnu.org/software/anastasis/ GNU Anastasis] is a protocol and implementation that allows users to securely deposit core secrets with an open set of escrow providers and to recover these secrets if their original copies are lost. Anastasis is available on AUR ({{AUR|anastasis}} and {{AUR|anastasis-gtk}}). For more information please consult https://www.gnu.org/software/anastasis/ and https://anastasis.lu/.
  +
  +
== Troubleshooting ==
  +
  +
=== GNUnet fails to publish files ===
  +
  +
A common mistake for who does not understand how the GNUnet services work is that of trying to publish files located in the home directory (or in its subdirectories) when the file sharing service is not running for the current user. The problem is that the {{ic|gnunet}} system user (which runs the GNUnet system service) has normally no access to the home directories of other users.
  +
  +
An easy solution is to create a shared directory, where only users that belong to the {{ic|gnunet}} group have write permissions, and use it to place the files that will be published. For instance, {{ic|/srv/filesharing/gnunet}} could be a good choice:
  +
  +
# install -dm775 -g gnunet -o gnunet /srv/filesharing/gnunet
  +
  +
Each user belonging to the {{ic|gnunet}} group can then create a link to it in their home directory,
  +
  +
$ ln -s /srv/filesharing/gnunet ~/Publishing
  +
  +
which can be dereferenced by {{ic|gnunet-publish}}:
  +
  +
{{hc|1=$ (cd ~/Publishing && gnunet-publish -k commons ostrom.pdf) && gnunet-fs -i|2=
  +
/srv/filesharing/gnunet/ostrom.pdf
  +
}}
  +
  +
If you prefer to run the file sharing service as current user, edit {{ic|/etc/gnunet.conf}} accordingly:
  +
  +
[fs]
  +
...
  +
RUN_PER_USER = YES
  +
...
  +
UNIXPATH = $GNUNET_USER_RUNTIME_DIR/gnunet-service-fs.sock
  +
...
  +
  +
=== Low bandwidth ===
  +
  +
It is recommended for file-sharing that you increase GNUnet's bandwidth restrictions from the actually pretty low defaults. The example below sets the WAN and LAN limits to {{ic|unlimited}}.
  +
  +
{{bc|
  +
$ gnunet-config -s ats -o WAN_QUOTA_IN -V unlimited
  +
$ gnunet-config -s ats -o WAN_QUOTA_OUT -V unlimited
  +
$ gnunet-config -s ats -o LAN_QUOTA_IN -V unlimited
  +
$ gnunet-config -s ats -o LAN_QUOTA_OUT -V unlimited
  +
}}
  +
  +
=== /var/lib/gnunet/ grows too big ===
  +
  +
GNUnet's cache is kept finite and cannot grow forever. However the quota reserved for it by default is not small (currently 5 GB). To reduce this number, you must assign your preferred value to the {{ic|QUOTA}} key in the {{ic|datastore}} section of {{ic|/etc/gnunet.conf}}.
  +
  +
{{hc|/etc/gnunet.conf|2=
  +
...
  +
  +
[datastore]
  +
...
  +
QUOTA = 2 GB
  +
...
  +
}}
  +
  +
=== /var/lib/gnunet/ is left after uninstall ===
  +
  +
The {{ic|/var/lib/gnunet/}} directory is the home directory of the {{ic|gnunet}} system user, which is left after uninstalling GNUnet. If you are sure that you are never going to use GNUnet ever again, launch:
  +
  +
{{bc|
  +
# userdel -r gnunet
  +
# groupdel gnunetdns
  +
}}
  +
  +
{{Warning|The identity and all the information about the network cumulatively stored by the current peer will be destroyed – this will not affect files explicitly downloaded in other paths.}}
  +
  +
=== The network is too static ===
  +
  +
By default GNUnet bootstraps itself using a {{ic|hostlist}} file downloaded from internet (plain {{ic|https}}) every time it connects to the network. If you want to instruct it to learn and memorize host lists provided by other peers you need to add the {{ic|-e}} option to the {{ic|OPTIONS}} key under {{ic|hostlist}} in {{ic|/etc/gnunet.conf}}. Further options are also available.
  +
  +
{{hc|/etc/gnunet.conf|2=
  +
...
  +
  +
[hostlist]
  +
...
  +
# Options:
  +
# -p : provide a hostlist as a hostlist servers
  +
# -b : bootstrap using configured hostlist servers
  +
# -e : enable learning advertised hostlists
  +
# -a : advertise hostlist to other servers
  +
OPTIONS = -b -e -a -p
  +
...}}
  +
  +
== Tips and tricks ==
  +
  +
=== Launching the daemon as current user in a multi-user setup ===
  +
  +
After a fresh install the user configuration file is missing. In a multi-user setup this is almost only used (if needed) to [[start]] and [[stop]] the {{ic|gnunet.service}} [[user unit]] while the system daemon is running, hence it is generally enough to create a minimal configuration file containing only:
  +
  +
{{hc|~/.config/gnunet.conf|2=
  +
[arm]
  +
START_SYSTEM_SERVICES = NO
  +
START_USER_SERVICES = YES
  +
}}
  +
  +
Without setting {{ic|START_SYSTEM_SERVICES}} to {{ic|NO}}, launching the daemon as current user while the system daemon is running will result in duplicate processes.
  +
  +
See [https://docs.gnunet.org/handbook/gnunet.html#The-Multi_002dUser-Setup The Multi-User Setup], in the manual for further insight.
  +
  +
=== A button for switching GNUnet on and off ===
  +
  +
If you use [[GNOME]] you might want to install the Systemd Manager shell extension ({{AUR|gnome-shell-extension-systemd-manager}}) and add GNUnet to it:
  +
  +
$ dconf write /org/gnome/shell/extensions/systemd-manager/systemd \
  +
<nowiki>'['\''{"name":"GNUnet system service","service":"gnunet.service","type":"system"}'\'', '\''{"name":"GNUnet user service","service":"gnunet.service","type":"user"}'\'']'</nowiki>
  +
  +
(After installing the extension you might need to restart the session.)
  +
  +
=== Single-user setup ===
  +
  +
The GNUnet peer can be started also from the current user without running the {{ic|gnunet}} system service. For a single-user setup make sure that {{ic|START_SYSTEM_SERVICES}} and {{ic|START_USER_SERVICES}} are set to {{ic|YES}} in {{ic|~/.config/gnunet.conf}}:
  +
  +
{{hc|~/.config/gnunet.conf|2=
  +
[arm]
  +
START_SYSTEM_SERVICES = YES
  +
START_USER_SERVICES = YES
  +
}}
  +
  +
To start the peer as current user, [[start]] the {{ic|gnunet.service}} [[user unit]]. To stop a peer which is running as current user, [[stop]] the {{ic|gnunet.service}} user unit.
  +
  +
For further information, please refer to [https://docs.gnunet.org/handbook/gnunet.html#The-Single_002dUser-Setup the chapter on the single-user setup in the handbook].
  +
  +
=== Publishing updatable files ===
  +
  +
It is possible to publish "updatable" files (i.e., files for which you might want to release a different version in the future, advertising that it is the same file – just updated – and not a different one). To release an updatable file you need to create an ego and use it to sign the file. This is the only way to assure that a malicious party cannot supply counterfeited updates.
  +
  +
To create an ego the {{ic|gnunet-identity}} utility is available, ''for which the {{ic|gnunet.service}} [[user unit]] needs to be [[start]]ed'' (possibly along with the {{ic|gnunet.service}} system unit – see [[#Launching the daemon as current user in a multi-user setup]]). For instance, to create an ego named "caroline", [[start]] the {{ic|gnunet}} user unit and launch:
  +
  +
$ gnunet-identity -C caroline
  +
  +
{{Note|If later you decide to erase this ego you can launch {{ic|gnunet-identity -D caroline}}.}}
  +
  +
Now that you have created an ego, you need to specify a string that identifies the current release of the file (the {{ic|-t}} option), and ''already now the string that will identify your planned next version'' (the {{ic|-N}} option) – you will have to remember the latter. Any content is possible for both strings.
  +
  +
{{hc|1=
  +
$ gnunet-publish -P caroline -t 'diary version 1' -N 'diary version 2' -k 'diary' until-2020/my_diary.md|2=
  +
Publishing `/srv/filesharing/gnunet/until-2020/my_diary.md' done.
  +
URI is `gnunet://fs/chk/AF26...'.
  +
  +
Namespace URI is `gnunet://fs/sks/V3TK.../diary version 1'.
  +
}}
  +
  +
When an update will be ready, you will have to use the same string that you had previously chosen for it ("diary version 2" in our example), possibly accompanying it with another name for a further update (if applicable):
  +
  +
{{hc|1=
  +
$ gnunet-publish -P caroline -t 'diary version 2' -N 'diary version 3' -k 'diary' until-2021/my_diary.md|2=
  +
Publishing `/srv/filesharing/gnunet/until-2021/my_diary.md' done.
  +
URI is `gnunet://fs/chk/5Y7V...'.
  +
  +
Namespace URI is `gnunet://fs/sks/V3TK.../diary version 2'.
  +
}}
  +
  +
If you decide that an update will be the last one, omit the {{ic|-N}} option (will not allow any future updates).
  +
  +
Note that an update with GNUnet will not make the old content unavailable, GNUnet merely allows the publisher to point users to more recent versions.
  +
  +
=== Launching and stopping GNUnet without systemd ===
  +
  +
GNUnet comes with an own daemon management system, the ''Automatic Restart Manager'' (limited to the GNUnet services).
  +
  +
To start the system services manually without [[systemd]] launch the {{ic|gnunet-arm}} utility ''as {{ic|gnunet}} user'':
  +
  +
$ sudo -u gnunet gnunet-arm -c /etc/gnunet.conf -s
  +
  +
To end the system services manually without systemd, launch:
  +
  +
$ sudo -u gnunet gnunet-arm -c /etc/gnunet.conf -e
  +
  +
To start the user services manually without systemd, launch the {{ic|gnunet-arm}} utility ''as current user'':
  +
  +
$ gnunet-arm -c ~/.config/gnunet.conf -s
  +
  +
To end the user services manually without systemd, launch:
  +
  +
$ gnunet-arm -c ~/.config/gnunet.conf -e

2023年5月28日 (日) 15:18時点における版

関連記事

GNUnet は中央サーバーや信頼機関を使わないセキュアなピアツーピアネットワークを提供するフレームワークです。現在、フレームワークを使って実装されたサービスとして検閲を免れるファイル共有があります。

Wikipedia:ja:GNUnet も参照してください。

インストール

GNUnet は gnunetAUR パッケージでインストールできます。グラフィカルインターフェイスも使いたい場合は gnunet-gtkAUR をインストールしてください。

もしくは、最新の git バージョンを gnunet-gitAUR と gnunet-gtk-gitAUR パッケージでインストールすることもできます。

設定

gnunet サービスを起動・有効化してください。

もしくは、ターミナルからピアを今すぐ起動するには: 

# gnunet-arm -s

How to start and stop a GNUnet peer も参照してください。

使用方法

Entering the GNUnet network

Start and possibly enable the gnunet system service. Some operations will require the gnunet user service to be started as well.

Checking the network

You can check the current state of the network by launching the gnunet-peerinfo command as normal user. 

$ gnunet-peerinfo

To know your peer identity launch: 

$ gnunet-peerinfo -s

To list the peers you are directly connected with (these are called "neighbours"), launch: 

$ gnunet-core

File sharing

By default the file sharing service runs per user, which means that both the system and user gnunet services need to be started. If you want to change this option and run the file sharing per machine, edit /etc/gnunet.conf accordingly: 

[fs]
...
RUN_PER_USER = NO
...
UNIXPATH = $GNUNET_RUNTIME_DIR/gnunet-service-fs.sock
...

Searching for a file

Use gnunet-search to search for a file using keywords (these are not necessarily related to the file's name). For example, to search for files that have been indexed under the “commons” keyword, launch: 

$ gnunet-search --timeout='10 s' 'commons'

Without specifying a timeout (10 seconds in the example above) gnunet-search runs forever, waiting for the user to press CTRL-C.

The gnunet-search command has a --printf option for manipulating the printed output, somewhat similar to the -printf option of the find utility. Please type man gnunet-search for more details.

Saving search results as "GNUnet directories"

Use the -o option of gnunet-search to save search results as a "GNUnet directories" (.gnd files) – you might also want to suppress the printed output in this case (the -s option).

For instance, to search for three seconds and save the results yielded by the “commons” keyword into a file named three-seconds-commons.gnd, launch: 

$ gnunet-search -s -t 3s -o three-seconds-commons.gnd 'commons'

If later you want to inspect the content of three-seconds-commons.gnd you can launch 

$ gnunet-directory three-seconds-commons.gnd

Downloading

The output of gnunet-search is by default a list of gnunet-download commands that you can directly copy and launch as normal user.

For example, using the output generated by gnunet-search 'commons', 

$ gnunet-search 'commons'
#1:
gnunet-download -o "Liotard (2017)_ Fablab - a new space for commons based peer production.pdf" gnunet://fs/chk/C6369DRQ3S8RYK1FD5VDE666W2HVEJ5G5GJRX29BH6ZM08CBRWS7FY9326RBJ4G0N8V1RJ2N802KBYZT7RJT2EDK1J9JR2DXK5MTVM0.4SXJCK9NT5XGCZ0YAJ0ETXJJGY3P2SMNZ0Q94N775YEX9SXS2RW5FWRFK4GMBTP668Z3R8QZZ4WSHW1KG1AVQ5VFC1VF5T3WF57GT58.336423

#2:
gnunet-download -o "Rose, Carol (1986)_ The Comedy of the Commons_ Commerce, Custom, and inherently Public Property.pdf" gnunet://fs/chk/TQK3A2C279EJQ50B1TQWFNTPMGQZJJ4JXYTF2D88D03H038TB7SVVSRBT74FMYPNZ47YZSV096PVVZH0TQ3B8KBVBV2H8GN9VAASTJR.CQ7M7843MGPZCV8M26NKH6EB5MBGZAXRWCF39YS668WM6F22D214GSXNTJ4RYGE7XF68VPZM4C19XR48TT4J8WH8S2E00C96Q8K6790.1593230

#3:
gnunet-download -o "Hardin, Garett (1968)_ Tragedy of the Commons.pdf" gnunet://fs/chk/Y1FD7D123CEGWDW544YDEP15YA5E7ZD2XRSJBNP0847A5JXMMZEZ0XACGRG42BBBTGKZ0ZCBW0A9T6196Z5N26HA6SP1T8GDAT5H5SG.RN38G25DMYG3TBQJEGWDZT2B84N1JYYJZ8VRJ8HG2G1A4EFD4GH5TZXB0RXV7QEMZBSKWCCEF736FXNH6C5BYKG9DSTV99ETFGC93R0.1520328

...

you can launch, 

$ gnunet-download -o "Hardin, Garett (1968)_ Tragedy of the Commons.pdf" gnunet://fs/chk/Y1FD7D123CEGWDW544YDEP15YA5E7ZD2XRSJBNP0847A5JXMMZEZ0XACGRG42BBBTGKZ0ZCBW0A9T6196Z5N26HA6SP1T8GDAT5H5SG.RN38G25DMYG3TBQJEGWDZT2B84N1JYYJZ8VRJ8HG2G1A4EFD4GH5TZXB0RXV7QEMZBSKWCCEF736FXNH6C5BYKG9DSTV99ETFGC93R0.1520328

which will download Hardin, Garett (1968)_ Tragedy of the Commons.pdf in the current directory.

Mounting a remote GNUnet directory without downloading it

A module, named gnunet-fuseAUR, has been developed to mount remote directories from the GNUnet network. With gnunet-fuse, directories that have been published on the GNUnet network can be mounted as read-only file systems and accessed using normal file operations. In contrast to downloading the directory recursively via gnunet-download, this has the advantage that files are downloaded on-demand. Only those files (or directories) that you access will be downloaded. For more information please install the module and type man gnunet-fuse.

Uploading

Publishing a file on the GNUnet file-sharing network involves choosing keywords that can be later used by other people to search for the file.

Keywords are not strictly required, but they are recommended. This is because GNUnet does not allow searching by filename, but by keywords. The libextractor library, which is a dependency of GNUnet, can automatically extract keywords from a file, but you may wish to enter keywords of your own.

In the following example, we use the keywords "commons" and "state" to publish a file named ostrom.pdf. 

$ gnunet-publish -k 'commons' -k 'state' ostrom.pdf
Publishing `/srv/filesharing/gnunet/ostrom.pdf' done.
URI is `gnunet://fs/chk/M57S...

GNUnet users can now find the file by using the gnunet-search command. 

$ gnunet-search 'commons'
#1:
gnunet-download -o "ostrom.pdf" gnunet://fs/chk/M57S...

To list all the files that are currently published launch gnunet-fs -i. If later you want to stop sharing a file you can use gnunet-unindex filename (in our example, gnunet-unindex 'ostrom.pdf').

Once a file is published it is not possible to retrieve the keywords whereby the file was indexed (i.e., reverse search). It is always possible however to add further keywords to it.

Please note that it might take some time (up to some hours) till your peers can see your freshly uploaded files.

警告: Unpublishing a file will only stop the current machine from sharing the file, but will not erase the file from the GNUnet network – which is by design impossible – as other people might have downloaded the file and shared it themselves. By all means gnunet-publish must be considered an irreversible action.

The gnunet-publish command offers an option – -n or equivalently --noindex – to publish a file without indexing it. When used, GNUnet will perform a full insertion and store the entire file in encrypted form in the GNUnet database.

This option has been created with the purpose of avoiding that who takes physical access to a computer running GNUnet finds out which files are currently being published, in case of censored files in countries with strong censorship. Files published with the --noindex option will appear as chunks downloaded from the network, and as such cannot be unpublished/unindexed (they have never been indexed in the first place); however it is always possible to specify a low content priority during publication (--prio) and tell GNUnet that the content that is going to be published is allowed to get lost easily when the database gets full.

For further information, please read the chapter on file-sharing in the handbook. See also https://gnunet.org/en/use.html#filesharing.

Modifying and removing indexed files
  • When you modify a file, the URI of the file changes. Therefore, GNUnet considers this to be a completely different file and the indexed file will be considered missing. Therefore, make sure that the original file is unindexed first (using the gnunet-unindex command), modify the file, and then index the new file to make it accessible through the network.
  • If you want to remove a file from your filesystem, then you should unindex it first.
  • If you know in advance that a published file will likely need to be updated more or less frequently, see #Publishing updatable files

Downloading + sharing

GNUnet file-sharing network is a DHT (see Wikipedia:Distributed hash table). As peers in the DHT, users store chunks of various files on their disk, even from files they do not download or have downloaded. Which files are stored depends on the DHT distance metric / algorithm.

Technically unless a file has been completely downloaded only parts of it are stored. These are stored in a cache (typically under /var/lib/gnunet/.local/share/gnunet). If a DHT query finds its way to a peer for one of the cached parts, the peer will provide it. The database used to store the file-sharing blocks is kept finite (below a configurable quota), and all the cached parts can expire to make space for newer files.

If someone shares a file in the GNUnet network the distributed chunks of that file will remain in the network's cache for a while, and the file will remain available even if who shared it goes offline. But if the original publisher goes missing and nobody else shared the file explicitly (with gnunet-publish), the file will eventually become unavailable as the peer caches expire or the peers go offline.

The only way to ensure that a file persists in the GNUnet network is then to re-publish it explicitly after downloading it (with gnunet-publish) and let the machine that publishes the file visit the network regularly.

Publishing a file after downloading will always generate the same URI whereby the file was downloaded (gnunet://fs/chk/Y1FD... in the example below), independently of the keywords chosen for re-publishing it: 

$ gnunet-download -o 'Hardin, Garett (1968)_ Tragedy of the Commons.pdf' gnunet://fs/chk/Y1FD...
100% [============================================================]
Downloading `Hardin, Garett (1968)_ Tragedy of the Commons.pdf' done (160 b/s).
$ gnunet-publish -k 'tragedy' 'Hardin, Garett (1968)_ Tragedy of the Commons.pdf'
Publishing `/srv/filesharing/gnunet/Hardin, Garett (1968)_ Tragedy of the Commons.pdf' done.
URI is `gnunet://fs/chk/Y1FD...

VPN

GNUnet provides a VPN, which can be used to share your Internet connection (yes, this may be dangerous, just as running a Tor exit node), or to provide access to services on your host (this should be less dangerous, as long as those services are secure).

For information on how to set up a VPN with GNUnet, see https://gnunet.org/en/use.html#vpn.

The GNU Name Service (GNS)

The GNU Name Service (GNS) is a fully decentralized alternative to the Domain Name System (DNS) that should not suffer the same major security flaws as the latter (see Wikipedia:Domain Name System#Security issues).

For information on how to use GNS, see https://gnunet.org/en/use.html#gns_cli and https://gnunet.org/en/use.html#gns_browser.

Chatting with other GNUnet users

To chat with GNUnet users the gnunet-messenger utility is available, for which the gnunet.service user unit needs to be started (possibly along with the gnunet.service system unit – see #Launching the daemon as current user in a multi-user setup). For instance, to enter the “miscellanea” room using “alice” as nickname, launch 

$ gnunet-messenger -e alice -r miscellanea
* Welcome to the messenger, 'alice'!
* You try to open a room...
* You joined the room.
[EHDA8T] * 'anonymous' opened the room on: 2ABN944E16FTWFMOKTMQ5JMPQ233YSPBKC47XR2DHSPQCQ8GYK80
[EHDA8T] * 'anonymous' gets renamed to 'alice'
█

App ecosystem

GNUnet GTK

GNUnet GTK is a collection of graphical interfaces for the GNUnet framework. It ships the following GTK applications:

  • gnunet-conversation-gtk
  • gnunet-fs-gtk
  • gnunet-namestore-gtk
  • gnunet-peerinfo-gtk
  • gnunet-setup
  • gnunet-statistics-gtk

To install GNUnet GTK download the gnunet-gtkAUR package.

Messenger GTK

Currently several graphical user interfaces for chatting on the GNUnet network are being developed. One of these is Messenger GTK (messenger-gtkAUR, or messenger-gtk-gitAUR for the development version), a mobile-friendly GTK graphical user interface for chatting with GNUnet users. For chatting via command line, see Messenger CLI (messenger-cliAUR or messenger-cli-gitAUR for the development version).

Web User Interface

A Web interface for GNUnet exists and is available as gnunet-webui-gitAUR.

re:claimID

re:claimID is a decentralized Identity Provider (IdP) service built on top of the GNU Name System. It allows users to securely share personal information with websites using standardized protocols (OpenID Connect).

For users re:claimID offers an extension for Firefox and an extension for Chromium for managing re:claimID identities in the web browser (the gnunetAUR package needs to be installed).

After having installed the extension it will be possible to add a new identity to the local re:claimID instance and add some attributes to it by visiting https://ui.reclaim/ (the link will not work without the extension installed).

For more information, please refer to the manual.

GNU Taler

GNU Taler is a microtransaction and electronic payment system built on top of GNUnet. Differently than other distributed payment systems Taler is not based on a blockchain, but on blind signatures instead.

For more information please consult the official documentation. See also packages syncAUR, taler-exchangeAUR, taler-mdbAUR, taler-merchantAUR and taler-twisterAUR.

GNU Anastasis

GNU Anastasis is a protocol and implementation that allows users to securely deposit core secrets with an open set of escrow providers and to recover these secrets if their original copies are lost. Anastasis is available on AUR (anastasisAUR and anastasis-gtkAUR). For more information please consult https://www.gnu.org/software/anastasis/ and https://anastasis.lu/.

Troubleshooting

GNUnet fails to publish files

A common mistake for who does not understand how the GNUnet services work is that of trying to publish files located in the home directory (or in its subdirectories) when the file sharing service is not running for the current user. The problem is that the gnunet system user (which runs the GNUnet system service) has normally no access to the home directories of other users.

An easy solution is to create a shared directory, where only users that belong to the gnunet group have write permissions, and use it to place the files that will be published. For instance, /srv/filesharing/gnunet could be a good choice: 

# install -dm775 -g gnunet -o gnunet /srv/filesharing/gnunet

Each user belonging to the gnunet group can then create a link to it in their home directory, 

$ ln -s /srv/filesharing/gnunet ~/Publishing

which can be dereferenced by gnunet-publish: 

$ (cd ~/Publishing && gnunet-publish -k commons ostrom.pdf) && gnunet-fs -i
/srv/filesharing/gnunet/ostrom.pdf

If you prefer to run the file sharing service as current user, edit /etc/gnunet.conf accordingly: 

[fs]
...
RUN_PER_USER = YES
...
UNIXPATH = $GNUNET_USER_RUNTIME_DIR/gnunet-service-fs.sock
...

Low bandwidth

It is recommended for file-sharing that you increase GNUnet's bandwidth restrictions from the actually pretty low defaults. The example below sets the WAN and LAN limits to unlimited. 

$ gnunet-config -s ats -o WAN_QUOTA_IN -V unlimited
$ gnunet-config -s ats -o WAN_QUOTA_OUT -V unlimited
$ gnunet-config -s ats -o LAN_QUOTA_IN -V unlimited
$ gnunet-config -s ats -o LAN_QUOTA_OUT -V unlimited

/var/lib/gnunet/ grows too big

GNUnet's cache is kept finite and cannot grow forever. However the quota reserved for it by default is not small (currently 5 GB). To reduce this number, you must assign your preferred value to the QUOTA key in the datastore section of /etc/gnunet.conf. 

/etc/gnunet.conf
...

[datastore]
...
QUOTA = 2 GB
...

/var/lib/gnunet/ is left after uninstall

The /var/lib/gnunet/ directory is the home directory of the gnunet system user, which is left after uninstalling GNUnet. If you are sure that you are never going to use GNUnet ever again, launch: 

# userdel -r gnunet
# groupdel gnunetdns
警告: The identity and all the information about the network cumulatively stored by the current peer will be destroyed – this will not affect files explicitly downloaded in other paths.

The network is too static

By default GNUnet bootstraps itself using a hostlist file downloaded from internet (plain https) every time it connects to the network. If you want to instruct it to learn and memorize host lists provided by other peers you need to add the -e option to the OPTIONS key under hostlist in /etc/gnunet.conf. Further options are also available. 

/etc/gnunet.conf
...

[hostlist]
...
# Options:
# -p : provide a hostlist as a hostlist servers
# -b : bootstrap using configured hostlist servers
# -e : enable learning advertised hostlists
# -a : advertise hostlist to other servers
OPTIONS = -b -e -a -p
...

Tips and tricks

Launching the daemon as current user in a multi-user setup

After a fresh install the user configuration file is missing. In a multi-user setup this is almost only used (if needed) to start and stop the gnunet.service user unit while the system daemon is running, hence it is generally enough to create a minimal configuration file containing only: 

~/.config/gnunet.conf
[arm]
START_SYSTEM_SERVICES = NO
START_USER_SERVICES = YES

Without setting START_SYSTEM_SERVICES to NO, launching the daemon as current user while the system daemon is running will result in duplicate processes.

See The Multi-User Setup, in the manual for further insight.

A button for switching GNUnet on and off

If you use GNOME you might want to install the Systemd Manager shell extension (gnome-shell-extension-systemd-managerAUR) and add GNUnet to it: 

$ dconf write /org/gnome/shell/extensions/systemd-manager/systemd \
	'['\''{"name":"GNUnet system service","service":"gnunet.service","type":"system"}'\'', '\''{"name":"GNUnet user service","service":"gnunet.service","type":"user"}'\'']'

(After installing the extension you might need to restart the session.)

Single-user setup

The GNUnet peer can be started also from the current user without running the gnunet system service. For a single-user setup make sure that START_SYSTEM_SERVICES and START_USER_SERVICES are set to YES in ~/.config/gnunet.conf: 

~/.config/gnunet.conf
[arm]
START_SYSTEM_SERVICES = YES
START_USER_SERVICES = YES

To start the peer as current user, start the gnunet.service user unit. To stop a peer which is running as current user, stop the gnunet.service user unit.

For further information, please refer to the chapter on the single-user setup in the handbook.

Publishing updatable files

It is possible to publish "updatable" files (i.e., files for which you might want to release a different version in the future, advertising that it is the same file – just updated – and not a different one). To release an updatable file you need to create an ego and use it to sign the file. This is the only way to assure that a malicious party cannot supply counterfeited updates.

To create an ego the gnunet-identity utility is available, for which the gnunet.service user unit needs to be started (possibly along with the gnunet.service system unit – see #Launching the daemon as current user in a multi-user setup). For instance, to create an ego named "caroline", start the gnunet user unit and launch: 

$ gnunet-identity -C caroline
ノート: If later you decide to erase this ego you can launch gnunet-identity -D caroline.

Now that you have created an ego, you need to specify a string that identifies the current release of the file (the -t option), and already now the string that will identify your planned next version (the -N option) – you will have to remember the latter. Any content is possible for both strings. 

$ gnunet-publish -P caroline -t 'diary version 1' -N 'diary version 2' -k 'diary' until-2020/my_diary.md
Publishing `/srv/filesharing/gnunet/until-2020/my_diary.md' done.
URI is `gnunet://fs/chk/AF26...'.

Namespace URI is `gnunet://fs/sks/V3TK.../diary version 1'.

When an update will be ready, you will have to use the same string that you had previously chosen for it ("diary version 2" in our example), possibly accompanying it with another name for a further update (if applicable): 

$ gnunet-publish -P caroline -t 'diary version 2' -N 'diary version 3' -k 'diary' until-2021/my_diary.md
Publishing `/srv/filesharing/gnunet/until-2021/my_diary.md' done.
URI is `gnunet://fs/chk/5Y7V...'.

Namespace URI is `gnunet://fs/sks/V3TK.../diary version 2'.

If you decide that an update will be the last one, omit the -N option (will not allow any future updates).

Note that an update with GNUnet will not make the old content unavailable, GNUnet merely allows the publisher to point users to more recent versions.

Launching and stopping GNUnet without systemd

GNUnet comes with an own daemon management system, the Automatic Restart Manager (limited to the GNUnet services).

To start the system services manually without systemd launch the gnunet-arm utility as gnunet user: 

$ sudo -u gnunet gnunet-arm -c /etc/gnunet.conf -s

To end the system services manually without systemd, launch: 

$ sudo -u gnunet gnunet-arm -c /etc/gnunet.conf -e

To start the user services manually without systemd, launch the gnunet-arm utility as current user: 

$ gnunet-arm -c ~/.config/gnunet.conf -s

To end the user services manually without systemd, launch: 

$ gnunet-arm -c ~/.config/gnunet.conf -e
「https://wiki.archlinux.jp/index.php?title=GNUnet&oldid=31838」から取得