1519 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Erik Moeller	d2652ef6cd	Add reference to funding.json (required by floss.fund application)	2025-03-06 15:54:36 +01:00
Alex Pyrgiotis	a6aa66f925	Remove a stale Shiboken6 pin ... Remove the Shiboken6 pin for our Linux and macOS platforms, since a new upstream package has been released, that has wheels for every platform. Also, remove the `sed` command from our dangerzone.spec, whose purpose was to nullify this pin for our Fedora packages. Fixes #1061	2025-02-19 11:43:30 +02:00
Alex Pyrgiotis	856de3fd46	grype: Ignore CVE-2025-0665 ... Ignore the CVE-2025-0665 vulnerability, since it's a libcurl one, and the Dangerzone container does not make network calls. Also, it seems that Debian Bookworm is not affected.	2025-02-10 12:31:08 +02:00
Alex Pyrgiotis	88a6b37770	Add support for Python 3.13 ... Bump our max supported Python version to 3.13, now that PySide6 supports it. Fixes #992	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	fb90243668	Symlink /usr in Debian container image ... Update our Dockerfile and entrypoint script in order to reuse the /usr dir in the inner and outer container image. Refs #1048	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	9724a16d81	Mask some extra paths in gVisor's OCI config ... Mask some paths of the outer container in the OCI config of the inner container. This is done to avoid leaking any sensitive information from Podman / Docker / gVisor, since we reuse the same rootfs Refs #1048	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	cf43a7a0c4	docs: Add design document for artifact reproducibility ... Refs #1047	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	cae4187550	Update RELEASE.md ... Co-authored-by: Alexis Métaireau <alexis@freedom.press>	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	cfa4478ace	ci: Add a CI job that enforces image reproducibility ... Add a CI job that uses the `reproduce.py` dev script to enforce image reproducibility, for every PR that we send to the repo. Fixes #1047	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	2557be9bc0	dev_scripts: Add script for enforcing image reproducibility ... Add a dev script for Linux platforms that verifies that a source image can be reproducibly built from the current Git commit. The reproducibility check is enforced by the `diffoci` tool, which is downloaded as part of running the script.	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	235d71354a	Allow setting a tag for the container image ... Allow setting a tag for the container image, when building it with the `build-image.py` script. This should be used for development purposes only, since the proper image name should be dictated by the script.	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	5d49f5abdb	ci: Scan the latest image for CVEs ... Update the Debian snapshot date to the current one, so that we always scan the latest image for CVEs. Refs #1057	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	0ce7773ca1	Render the Dockerfile from a template and some params ... Allow updating the Dockerfile from a template and some envs, so that it's easier to bump the dates in it.	2025-01-27 21:40:27 +02:00
Alex Pyrgiotis	fa27f4b063	Add jinja2-cli package dependency ... Add jinja2-cli as a package dependency, since it will be used to create the Dockerfile from some user parameters and a template.	2025-01-23 23:26:56 +02:00
Alex Pyrgiotis	8e8a515b64	Allow using the container engine cache when building our image ... Remove our suggestions for not using the container cache, which stemmed from the fact that our Dangerzone image was not reproducible. Now that we have switched to Debian Stable and the Dockerfile is all we need to reproducibly build the exact same container image, we can just use the cache to speed up builds.	2025-01-23 23:25:43 +02:00
Alex Pyrgiotis	270cae1bc0	Rename vendor-pymupdf.py to debian-vendor-pymupdf.py ... Rename the `vendor-pymupdf.py` script to `debian-vendor-pymupdf.py`, since it's used only when building Debian packages.	2025-01-23 23:25:43 +02:00
Alex Pyrgiotis	14bb6c0e39	Do not use poetry.lock when building the container image ... Remove all the scaffolding in our `build-image.py` script for using the `poetry.lock` file, now that we install PyMuPDF from the Debian repos.	2025-01-23 23:25:39 +02:00
Alex Pyrgiotis	033ce0986d	Switch base image to Debian Stable ... Switch base image from Alpine Linux to Debian Stable, in order to reduce our image footprint, improve our security posture, and build our container image reproducibly. Fixes #1046 Refs #1047	2025-01-23 23:24:48 +02:00
Alex Pyrgiotis	935396565c	Reuse the same rootfs for the inner and outer container ... Remove the need to copy the Dangerzone container image (used by the inner container) within a wrapper gVisor image (used by the outer container). Instead, use the root of the container filesystem for both containers. We can do this safely because we don't mount any secrets to the container, and because gVisor offers a read-only view of the underlying filesystem Fixes #1048	2025-01-23 23:24:48 +02:00
Alex Pyrgiotis	e29837cb43	Copy gVisor public key and a helper script in container helpers ... Download and copy the following artifacts that will be used for building a Debian-based Dangerzone container image in the subsequent commits: * The APT key for the gVisor repo [1] * A helper script for building reproducible Debian images [2] [1] https://gvisor.dev/archive.key [2] d15cf12b26/repro-sources-list.sh	2025-01-23 23:24:48 +02:00
Alex Pyrgiotis	8568b4bb9d	Move container-only build context to dangerzone/container ... Move container-only build context (currently just the entrypoint script) from `dangerzone/gvisor_wrapper` to `dangerzone/container_helpers`. Update the rest of the scripts to use this location as well.	2025-01-23 23:24:48 +02:00
Alex Pyrgiotis	be1fa7a395	Whitespace fixes	2025-01-23 23:24:47 +02:00
Alexis Métaireau	b2f4e2d523	Bump poetry.lock	2025-01-23 16:26:07 +01:00
Alexis Métaireau	7409966253	Remove ${Python3:Depends} as it's not used at the moment.	2025-01-23 16:26:06 +01:00
Alexis Métaireau	40fb6579f6	Alternatives for debian/control	2025-01-23 16:26:06 +01:00
Alexis Métaireau	6ae91b024e	Use platformdirs to find user configuration files ... The previous library we were using for this (`appdirs`) is dead upstream and not supported anymore in debian testing. Fixes #1058	2025-01-23 16:26:06 +01:00
Alexis Métaireau	c2841dcc08	Run ruff format	2025-01-23 14:48:33 +01:00
Alexis Métaireau	df5ccb3f75	Fedora: bypass the shiboken specific version.	2025-01-23 14:39:50 +01:00
Alexis Métaireau	9c6c2e1051	build: pin shiboken6 to specific versions	2025-01-23 12:52:48 +01:00
Alexis Métaireau	23f3ad1f46	doc: bump the Docker Desktop version as part of the RELEASE procedure	2025-01-21 10:21:24 +01:00
Alexis Métaireau	970a82f432	Bind Alert instances to the main window alert property	2025-01-21 10:21:24 +01:00
Alexis Métaireau	3d5cacfffb	Warn users if the minimum version of Docker Desktop is not met ... This only happens on Windows and macOS. Fixes #693	2025-01-21 10:21:24 +01:00
Alexis Métaireau	c407e2ff84	doc: update Debian Trixie installation instructions ... Starting with Debian Trixie, `apt secure` relies on `sqv` to do its verification, which doesn't support the GPG keybox database format. At the same time, using the standard PGP base64 format makes the verification fail for versions of `apt secure` which relies on `gpg`, as the subkey isn't detected there. Fixes #1055	2025-01-20 14:10:15 +01:00
Alexis Métaireau	7f418118e6	CI: Drop Fedora 39 from the CI checks	2025-01-16 11:51:22 +01:00
Alexis Métaireau	02602b072a	Remove intermediate variables for conversion start/end logs ... Also, state that the logs are incomplete in the header.	2025-01-16 11:35:07 +01:00
Alexis Métaireau	acf20ef700	Add a --debug flag to the CLI to help retrieve more logs ... When the flag is set, the `RUNSC_DEBUG=1` environment variable is added to the outer container, and stderr is captured in a separate thread, before printing its output.	2025-01-16 11:35:06 +01:00
Alexis Métaireau	3499010d8e	docs(install): store GPG keys in the base64 format	2025-01-15 19:48:00 +01:00
Alexis Métaireau	2423fc18c5	CI: Store the signature key using the base64 format ... The GPG binary format used until now doesn't seem to please `sqv` which is now used by default on debian trixie. Fixes #1052	2025-01-15 19:39:02 +01:00
Alexis Métaireau	1298e9c398	build: add build_scripts/env.py to the hashed files ... It contains information that define the build environments, and as such, modifying it should result in a new release of the dev containers.	2025-01-08 06:18:30 +01:00
Alexis Métaireau	00e58a8707	build: add poetry-plugin-export to the dependencies ... Since Poetry 2.0.0, the `export` command has been removed and it's advised to use the "poetry-plugin-export" package instead. This commit adds this dependency to the different places it's needed (debian environments, CI, build instructions, etc).	2025-01-08 06:18:01 +01:00
Alexis Métaireau	77975a8e50	Update links to the 0.8.1 release	2024-12-24 18:11:17 +01:00
Alexis Métaireau	5b9e9c82fc	Add a security advisory for gst-plugins-base	2024-12-24 18:11:17 +01:00
Alexis Métaireau	f4fa1f87eb	Bump version to 0.8.1	2024-12-24 18:11:17 +01:00
Alexis Métaireau	eb345562da	Lint: Add click to the dependencies used by mypy	2024-12-17 17:44:51 +01:00
jkarasti	d080d03f5a	Lint: Enable isort (I) rules	2024-12-17 17:44:32 +01:00
jkarasti	767bfa7e48	Lint: Fix unused-variable (F841)	2024-12-17 17:44:32 +01:00
jkarasti	37ec91aae2	Lint: Fix f-string-missing-placeholders (F541)	2024-12-17 17:44:32 +01:00
jkarasti	cecfe63338	Lint: Fix unused-import (F401)	2024-12-17 17:44:32 +01:00
jkarasti	4da6b92e12	Format: Run ruff format over the source code	2024-12-17 17:44:31 +01:00
jkarasti	b06d1aebed	Lint: Remove unused black and isort dependencies	2024-12-17 17:44:30 +01:00