Alexis Métaireau
a647485fdb
Update the docs
Tests / windows (push) Has been cancelled
Tests / macOS (arch64) (push) Has been cancelled
Tests / macOS (x86_64) (push) Has been cancelled
Tests / build-deb (debian bookworm) (push) Has been cancelled
Tests / build-deb (debian bullseye) (push) Has been cancelled
Tests / build-deb (debian trixie) (push) Has been cancelled
Tests / build-deb (ubuntu 20.04) (push) Has been cancelled
Tests / build-deb (ubuntu 22.04) (push) Has been cancelled
Tests / build-deb (ubuntu 24.04) (push) Has been cancelled
Tests / build-deb (ubuntu 24.10) (push) Has been cancelled
Tests / install-deb (debian bookworm) (push) Has been cancelled
Tests / install-deb (debian bullseye) (push) Has been cancelled
Tests / install-deb (debian trixie) (push) Has been cancelled
Tests / install-deb (ubuntu 20.04) (push) Has been cancelled
Tests / install-deb (ubuntu 22.04) (push) Has been cancelled
Tests / install-deb (ubuntu 24.04) (push) Has been cancelled
Tests / install-deb (ubuntu 24.10) (push) Has been cancelled
Tests / build-install-rpm (fedora 40) (push) Has been cancelled
Tests / build-install-rpm (fedora 41) (push) Has been cancelled
Tests / run tests (debian bookworm) (push) Has been cancelled
Tests / run tests (debian bullseye) (push) Has been cancelled
Tests / run tests (debian trixie) (push) Has been cancelled
Tests / run tests (fedora 40) (push) Has been cancelled
Tests / run tests (fedora 41) (push) Has been cancelled
Tests / run tests (ubuntu 20.04) (push) Has been cancelled
Tests / run tests (ubuntu 22.04) (push) Has been cancelled
Tests / run tests (ubuntu 24.04) (push) Has been cancelled
Tests / run tests (ubuntu 24.10) (push) Has been cancelled
Release multi-arch container image / merge (push) Has been cancelled
Release multi-arch container image / provenance (push) Has been cancelled
2025-02-11 17:43:05 +01:00
Alexis Métaireau
769a78dd27
Reorganize the registry.py module to be simpler
2025-02-11 17:20:01 +01:00
Alexis Métaireau
46f510ab79
Check if the logIndex is greater than the last known one before upgrading
...
Each signature is logged to Rekor, and the log index is then part of
the signature itself. Ensuring that the logIndex is greater in the given
container image signature makes it possible to ensure that we're only
going forward in time, and avoid installing older container images
thinking that they are new than the current one.
2025-02-11 16:13:28 +01:00
Alexis Métaireau
8159d6ccb7
FIXUP: Update the default provenance workflow
2025-02-11 16:13:28 +01:00
Alexis Métaireau
5c2c401be6
DEMO Time!
2025-02-11 16:13:28 +01:00
Alexis Métaireau
a9043cef2c
Fix cli.py
2025-02-11 16:13:28 +01:00
Alexis Métaireau
d95d46ecc4
Add the ability to download diffoci for multiple platforms
2025-02-11 16:13:28 +01:00
Alexis Métaireau
351653ff37
Build images every day, on main and test/ commits
2025-02-11 16:13:28 +01:00
Alexis Métaireau
0daeeb867e
Check signatures before invoking the container.
...
Also, check for new container images when starting the application.
This replaces the usage of `share/image-id.txt` to ensure the image is trusted.
2025-02-11 16:13:27 +01:00
Alexis Métaireau
a5b5a78215
Fixup: remove rntime.py
2025-02-11 16:13:27 +01:00
Alexis Métaireau
dca0bd4bf2
Fixup: update docs
2025-02-11 16:13:27 +01:00
Alexis Métaireau
02e62c93f6
Fixup: use digest instead of hash
2025-02-11 16:13:27 +01:00
Alexis Métaireau
9a44110313
CI: Rename github workflow for multi-arch images publication
2025-02-11 16:13:27 +01:00
Alexis Métaireau
7d26c798c6
Fixup: registry, split Accept lines
2025-02-11 16:13:27 +01:00
Alexis Métaireau
8041ae2fb6
feat(icu): Add verification support for multi-arch images
2025-02-11 16:13:27 +01:00
Alexis Métaireau
2d9c00d681
fixup: Fix docs
2025-02-11 16:13:27 +01:00
Alex Pyrgiotis
1b7cfe4c7f
WIP: Add CI job for multi-arch builds
2025-02-11 16:13:27 +01:00
Alex Pyrgiotis
5accaef357
WIP: Verify local image
2025-02-11 16:13:27 +01:00
Alex Pyrgiotis
b42833df47
WIP: Make verify-attestation work for SLSA 3 attestations
2025-02-11 16:13:26 +01:00
Alexis Métaireau
858d31458b
fix(icu): update documentation and fixes
2025-02-11 16:13:26 +01:00
Alexis Métaireau
3b858dac27
Get image name from signatures for air-gapped archives
...
This allows to be sure that the image name is verified by a known public
key, rather than relying on an input by the user, which can lead to issues.
2025-02-11 16:13:26 +01:00
Alexis Métaireau
c6f5e61e0b
Add a dangerzone-image prepare-archive command
2025-02-11 16:13:26 +01:00
Alexis Métaireau
4d27449351
Locally store the signatures for oci-images archives
...
On air-gapped environements, it's now possible to load signatures
generated by `cosign save` commands. The signatures embedded in this
format will be converted to the one used by `cosign download signature`.
2025-02-11 16:13:26 +01:00
Alexis Métaireau
f30ced7834
Allow installation on air-gapped systems
...
- Verify the archive against the known public signature
- Prepare a new archive format (with signature removed)
- Load the new image and retag it with the expected tag
During this process, the signatures are lost and should instead be
converted to a known format. Additionally, the name fo the repository
should ideally come from the signatures rather than from the command
line.
2025-02-11 16:13:26 +01:00
Alexis Métaireau
d4547b8964
Ensure cosign is installed before trying to use it
2025-02-11 16:13:26 +01:00
Alexis Métaireau
9b60a101a1
Add a dev_scripts/dangerzone-image
2025-02-11 16:13:26 +01:00
Alexis Métaireau
2e7af4aebf
Some more refactoring
2025-02-11 16:13:26 +01:00
Alexis Métaireau
5921289454
Refactoring of dangerzone/updater/*
2025-02-11 16:13:26 +01:00
Alexis Métaireau
ab15d25a18
Move regsitry and cosign utilities to dangerzone/updater/*.
...
Placing these inside the `dangerzone` python package enables an
inclusion with the software itself, and also makes it possible for
end-users to attest the image.
2025-02-11 16:13:25 +01:00
Alexis Métaireau
225839960c
Verify podman/docker images against locally stored signatures
2025-02-11 16:13:25 +01:00
Alexis Métaireau
83a38eab0d
Automate the verification of image signatures
2025-02-11 16:13:25 +01:00
Alexis Métaireau
1ea76ded9b
Add an utility to retrieve manifest info
2025-02-11 16:13:25 +01:00
Alexis Métaireau
66ac7e56f8
Add a script to verify Github attestations
2025-02-11 16:13:25 +01:00
Alexis Métaireau
3f428d4824
FIXUP: test
2025-02-11 16:13:25 +01:00
Alexis Métaireau
2839c3b1ff
Add logs
2025-02-11 16:13:25 +01:00
Alexis Métaireau
fa540e53fa
Remove the tag from the attestation, what we attest is the hash, so no need for it
2025-02-11 16:13:25 +01:00
Alexis Métaireau
56b464fe58
Add the tag to the subject
2025-02-11 16:13:25 +01:00
Alexis Métaireau
2235cb1b36
Get the tag from git before retagging it
2025-02-11 16:13:25 +01:00
Alexis Métaireau
4c78a0117c
Checkout with depth:0 otherwise git commands aren't functional
2025-02-11 16:13:24 +01:00
Alexis Métaireau
13d12de087
Build: Use Github runners to build and sign container images on new tags
2025-02-11 16:13:24 +01:00
Alex Pyrgiotis
856de3fd46
grype: Ignore CVE-2025-0665
...
Tests / macOS (x86_64) (push) Has been cancelled
Scan latest app and container / security-scan-container (push) Has been cancelled
Scan latest app and container / security-scan-app (push) Has been cancelled
Tests / windows (push) Has been cancelled
Tests / macOS (arch64) (push) Has been cancelled
Tests / build-deb (debian bookworm) (push) Has been cancelled
Tests / build-deb (debian bullseye) (push) Has been cancelled
Tests / build-deb (debian trixie) (push) Has been cancelled
Tests / build-deb (ubuntu 20.04) (push) Has been cancelled
Tests / build-deb (ubuntu 22.04) (push) Has been cancelled
Tests / build-deb (ubuntu 24.04) (push) Has been cancelled
Tests / build-deb (ubuntu 24.10) (push) Has been cancelled
Tests / install-deb (debian bookworm) (push) Has been cancelled
Tests / install-deb (debian bullseye) (push) Has been cancelled
Tests / install-deb (debian trixie) (push) Has been cancelled
Tests / install-deb (ubuntu 20.04) (push) Has been cancelled
Tests / install-deb (ubuntu 22.04) (push) Has been cancelled
Tests / install-deb (ubuntu 24.04) (push) Has been cancelled
Tests / install-deb (ubuntu 24.10) (push) Has been cancelled
Tests / build-install-rpm (fedora 40) (push) Has been cancelled
Tests / build-install-rpm (fedora 41) (push) Has been cancelled
Tests / run tests (debian bookworm) (push) Has been cancelled
Tests / run tests (debian bullseye) (push) Has been cancelled
Tests / run tests (debian trixie) (push) Has been cancelled
Tests / run tests (fedora 40) (push) Has been cancelled
Tests / run tests (fedora 41) (push) Has been cancelled
Tests / run tests (ubuntu 20.04) (push) Has been cancelled
Tests / run tests (ubuntu 22.04) (push) Has been cancelled
Tests / run tests (ubuntu 24.04) (push) Has been cancelled
Tests / run tests (ubuntu 24.10) (push) Has been cancelled
Ignore the CVE-2025-0665 vulnerability, since it's a libcurl one, and
the Dangerzone container does not make network calls. Also, it seems
that Debian Bookworm is not affected.
2025-02-10 12:31:08 +02:00
Alex Pyrgiotis
88a6b37770
Add support for Python 3.13
...
Scan latest app and container / security-scan-container (push) Has been cancelled
Scan latest app and container / security-scan-app (push) Has been cancelled
Tests / windows (push) Has been cancelled
Tests / macOS (arch64) (push) Has been cancelled
Tests / build-deb (ubuntu 22.04) (push) Has been cancelled
Tests / macOS (x86_64) (push) Has been cancelled
Tests / build-deb (debian bookworm) (push) Has been cancelled
Tests / build-deb (debian bullseye) (push) Has been cancelled
Tests / build-deb (debian trixie) (push) Has been cancelled
Tests / build-deb (ubuntu 20.04) (push) Has been cancelled
Tests / build-deb (ubuntu 24.04) (push) Has been cancelled
Tests / build-deb (ubuntu 24.10) (push) Has been cancelled
Tests / install-deb (debian bookworm) (push) Has been cancelled
Tests / install-deb (debian bullseye) (push) Has been cancelled
Tests / install-deb (debian trixie) (push) Has been cancelled
Tests / install-deb (ubuntu 20.04) (push) Has been cancelled
Tests / install-deb (ubuntu 22.04) (push) Has been cancelled
Tests / install-deb (ubuntu 24.04) (push) Has been cancelled
Tests / install-deb (ubuntu 24.10) (push) Has been cancelled
Tests / build-install-rpm (fedora 40) (push) Has been cancelled
Tests / build-install-rpm (fedora 41) (push) Has been cancelled
Tests / run tests (debian bookworm) (push) Has been cancelled
Tests / run tests (debian bullseye) (push) Has been cancelled
Tests / run tests (debian trixie) (push) Has been cancelled
Tests / run tests (fedora 40) (push) Has been cancelled
Tests / run tests (fedora 41) (push) Has been cancelled
Tests / run tests (ubuntu 20.04) (push) Has been cancelled
Tests / run tests (ubuntu 22.04) (push) Has been cancelled
Tests / run tests (ubuntu 24.04) (push) Has been cancelled
Tests / run tests (ubuntu 24.10) (push) Has been cancelled
Bump our max supported Python version to 3.13, now that PySide6 supports
it.
Fixes #992
2025-01-27 21:40:27 +02:00
Alex Pyrgiotis
fb90243668
Symlink /usr in Debian container image
...
Update our Dockerfile and entrypoint script in order to reuse the /usr
dir in the inner and outer container image.
Refs #1048
2025-01-27 21:40:27 +02:00
Alex Pyrgiotis
9724a16d81
Mask some extra paths in gVisor's OCI config
...
Mask some paths of the outer container in the OCI config of the inner
container. This is done to avoid leaking any sensitive information from
Podman / Docker / gVisor, since we reuse the same rootfs
Refs #1048
2025-01-27 21:40:27 +02:00
Alex Pyrgiotis
cf43a7a0c4
docs: Add design document for artifact reproducibility
...
Refs #1047
2025-01-27 21:40:27 +02:00
Alex Pyrgiotis
cae4187550
Update RELEASE.md
...
Co-authored-by: Alexis Métaireau <alexis@freedom.press>
2025-01-27 21:40:27 +02:00
Alex Pyrgiotis
cfa4478ace
ci: Add a CI job that enforces image reproducibility
...
Add a CI job that uses the `reproduce.py` dev script to enforce image
reproducibility, for every PR that we send to the repo.
Fixes #1047
2025-01-27 21:40:27 +02:00
Alex Pyrgiotis
2557be9bc0
dev_scripts: Add script for enforcing image reproducibility
...
Add a dev script for Linux platforms that verifies that a source image
can be reproducibly built from the current Git commit. The
reproducibility check is enforced by the `diffoci` tool, which is
downloaded as part of running the script.
2025-01-27 21:40:27 +02:00
Alex Pyrgiotis
235d71354a
Allow setting a tag for the container image
...
Allow setting a tag for the container image, when building it with the
`build-image.py` script. This should be used for development purposes
only, since the proper image name should be dictated by the script.
2025-01-27 21:40:27 +02:00
Alex Pyrgiotis
5d49f5abdb
ci: Scan the latest image for CVEs
...
Update the Debian snapshot date to the current one, so that we always
scan the latest image for CVEs.
Refs #1057
2025-01-27 21:40:27 +02:00
