1613 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Alexis Métaireau	d43bbf68fc	Merge 6c3316089f into 83be5fb151	2025-04-16 13:25:28 +00:00
Alexis Métaireau	6c3316089f	Make the upgrade_container_image() callback argument optional	2025-04-16 15:23:55 +02:00
Alexis Métaireau	c39cd4ea47	Allow a different runtime on dangerzone-image commands. ... This can be done with the newly added `--runtime` flag, which needs to be passed to the first group, e.g: ```bash dangerzone-cli --runtime docker COMMAND ```	2025-04-16 13:14:39 +02:00
Alexis Métaireau	46b88716d3	Display the {podman,docker} pull progress when installing a new image ... The progressbars we see when using this same commands on the command line doesn't seem to be passed to the python process here, unfortunately.	2025-04-16 13:14:39 +02:00
Alexis Métaireau	c517c5b3f9	Add a dangerzone-image store-signature CLI command ... This can be useful when signatures are missing from the system, for an already present image, and can be used as a way to fix user issues.	2025-04-16 13:14:39 +02:00
Alexis Métaireau	9aacb0415b	Replace the updater_check setting by updater_check_all ... This new setting triggers the same user prompts, but the actual meaning of it differs, since users will now be accepting to upgrade the container image rather than just checking for new releases. Changing the name of the setting will trigger this prompt for all users, effectively ensuring they want their image to be automatically upgraded.	2025-04-16 13:14:38 +02:00
Alexis Métaireau	62cca90c44	Split updater GUI code from the code checking for release updates ... The code making the actual requests and checks now lives in the `updater.releases` module. The code should be easier to read and to reason about. Tests have been updated to reflect this.	2025-04-16 13:14:38 +02:00
Alexis Métaireau	3398684dae	FIXUP commit for signature tests	2025-04-16 13:14:38 +02:00
Alexis Métaireau	0dff082046	Provide an is_update_available function ... This function does all the needed checks before returning `True`, making it a good external API. Under the hood, the registry now has an `is_new_remote_image_available` which is just for checking the presence of a new image, but doesn't do any verirications on it, and there is also a new `check_signatures_and_logindex` that ensures that these two are valid.	2025-04-16 13:14:38 +02:00
Alexis Métaireau	bb8ea6c0db	FIXUP: Add a comment to update the DEFAULT_LOG_INDEX with releases	2025-04-16 13:14:38 +02:00
Alexis Métaireau	86f46482e5	FIXUP: throw rather than bools	2025-04-16 13:14:38 +02:00
Alexis Métaireau	9b64d393a5	FIXUP: Use user data dir rather than config	2025-04-16 13:14:38 +02:00
Alexis Métaireau	0f2e67298f	FIXUP: Use exceptions to ease the flow	2025-04-16 13:14:38 +02:00
Alexis Métaireau	f136687b41	Introduce a subprocess_run utility function ... This is done to avoid forgetting windows specific arguments when calling `subprocess.run`.	2025-04-16 13:14:38 +02:00
Alexis Métaireau	3b4f8f12be	FIXUP: Use the digest when pulling the container	2025-04-16 13:14:36 +02:00
Alexis Métaireau	affb954103	Add signatures tests	2025-04-16 13:11:39 +02:00
Alexis Métaireau	b6fa4fa35b	parent a19e341378 ... author Alexis Métaireau <alexis@freedom.press> 1739380992 +0100 committer Alexis Métaireau <alexis@freedom.press> 1744646096 +0200 gpgsig -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRFQpTG/4uXFqX2QanGXHqJqP/FbgUCZ/0v0AAKCRDGXHqJqP/F bmA8AP9QZjs6bSmxvmzvYvwJa8wYIo6OsdUyQdoZ4kAMd5X7XwEA+WIbuxU/o2bG KisPBI+N8LSwwIke3eNS+ne6Vil7qwg= =XCYF -----END PGP SIGNATURE----- (WIP) Add tests	2025-04-16 13:11:19 +02:00
Alexis Métaireau	9035620b80	(WIP) Check for container updates rather than using image-id.txt	2025-04-16 13:11:19 +02:00
Alexis Métaireau	c628339250	Add documentation for independent container updates	2025-04-16 13:11:19 +02:00
Alex Pyrgiotis	68f075a315	Publish and attest multi-architecture container images ... A new `dangerzone-image attest-provenance` script is now available, making it possible to verify the attestations of an image published on the github container registry. Container images are now build nightly and uploaded to the container registry.	2025-04-16 13:11:19 +02:00
Alexis Métaireau	92ecad2e81	Download and verify cosign signatures ... Signatures are stored in the OCI Manifest v2 registry [0], and are expected to follow the Cosign Signature Specification [0] The following CLI utilities are provided with `dangerzone-image`: For checking new container images, upgrading them and downloading them: - `upgrade` allows to upgrade the current installed image to the last one available on the OCI registry, downloading and storing the signatures in the process. - `verify-local` allows the verify the currently installed image against downloaded signatures and public key. To prepare and install archives on air-gapped environments: - `prepare-archive` helps to prepare an archive to install on another machine - `load-archive` helps upgrade the local image to the archive given in argument. Signatures are stored locally using the format provided by `cosign download signature`, and the Rekor log index is used to ensure the requested-to-install container image is fresher than the one already present on the system. [0] https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md	2025-04-16 13:11:18 +02:00
Alexis Métaireau	e1bdb75435	Add a dangerzone-image CLI script ... It contains utilities to interact with OCI registries, like getting the list of published tags and getting the content of a manifest. It does so via the use of the Docker Registry API v2 [0]. The script has been added to the `dev_scripts`, and is also installed on the system under `dangerzone-image`. [0] https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry	2025-04-16 13:11:18 +02:00
Alexis Métaireau	83be5fb151	Release container is now using the .tar format ... Update the CI check to account for it.	2025-04-14 15:08:32 +02:00
Alex Pyrgiotis	04096380ff	Include Ubuntu Plucky and Fedora 42 in our nightly repo checks	2025-04-10 12:00:15 +02:00
Alexis Métaireau	21ca927b8b	Send release notes to editorial during the release process	2025-04-09 20:55:31 +02:00
Alexis Métaireau	05040de212	Point download links to the 0.9.0 release	2025-04-09 17:08:50 +02:00
Alexis Métaireau	4014c8591b	Docs: Update the Podman Desktop docs for macOS ... In order to access our custom seccomp policy, we require it to be mounted on the podman machine. Co-Author: Alex Pyrgiotis <alex.p@freedom.press>	2025-04-09 17:04:42 +02:00
Alex Pyrgiotis	6cd706af10	windows: Minor change to uninstallation message ... Refs #1026	2025-04-09 14:26:45 +02:00
Alex Pyrgiotis	634b171b97	windows: Detect Dangerzone 0.8.1 during install ... Detect Dangerzone 0.8.1 versions during install, so that we can prompt users to manually uninstall it. Refs #929	2025-04-09 14:26:44 +02:00
Alexis Métaireau	c99c424f87	Document Podman Desktop experimental support for Windows and macOS	2025-04-08 16:08:55 +02:00
Alex Pyrgiotis	19fa11410b	Update reference template for Qubes to Fedora 41 ... Closes #1078	2025-04-08 16:37:28 +03:00
Alex Pyrgiotis	10be85b9f2	container: Add workarounds for Podman Desktop support on Windows ... In case we run on Windows and use Podman Desktop (for which we currently offer experimental support), we must not pass some Podman flags in order to avoid conversion errors. Refs #1127	2025-04-08 16:36:08 +03:00
Alexis Métaireau	47d732e603	Document the Makefile targets ... It now outputs the following: ``` build-linux Build linux packages (.rpm and .deb) build-macos-arm Build macOS Apple Silicon package (.dmg) build-macos-intel Build macOS intel package (.dmg) Dockerfile Regenerate the Dockerfile from its template fix apply all the suggestions from ruff help Print this message and exit. lint Check the code for linting, formatting, and typing issues with ruff and mypy regenerate-reference-pdfs Regenerate the reference PDFs test Run the tests test-large Run large test set ```	2025-04-08 16:34:34 +03:00
Alexis Métaireau	d6451290db	Move multithreading patch up so that it's working in the GUI	2025-04-08 16:34:34 +03:00
Alex Pyrgiotis	f0bb65cb4e	Bypass a cx-freeze issue for fitz._wxcolors ... Bypass an issue with `cx-freeze` that fails to include the `fitz._wxcolors` module in the final Windows artifact. Refs #1128	2025-04-08 16:34:34 +03:00
Alex Pyrgiotis	0c741359cc	Make our build-image.py script runable on Windows	2025-04-08 16:34:34 +03:00
Alex Pyrgiotis	8c61894e25	Handle the case where Docker is not installed ... Refs #1132	2025-04-08 16:33:15 +03:00
Alex Pyrgiotis	57667a96be	Add a way to unset the container runtime ... Add a way to set the container runtime that Dangerzone uses back to the default.	2025-04-07 18:23:13 +03:00
Alex Pyrgiotis	1a644e2506	Do not install poetry-plugin-export ... Do not unconditionally install the Poetry plugin for exporting dependencies as a requirements.txt file, since it's used only when building a Debian package. Keep it instead in the Linux instructions and when building a Dangerzone environment.	2025-04-07 18:23:10 +03:00
Alex Pyrgiotis	843e68cdf7	Handle the case of empty tesseract dirs during download	2025-04-07 18:22:52 +03:00
Alex Pyrgiotis	33b2a183ce	docs: Improve doit docs	2025-04-07 18:22:52 +03:00
Alex Pyrgiotis	c7121b69a3	Prefer poetry sync to poetry install --sync ... Use `poetry sync` instead of `poetry install --sync`, since the latter is deprecated and will be removed after June 2025, as seen in the following warning message: The `--sync` option is deprecated and slated for removal in the next minor release after June 2025, use the `poetry sync` command instead.	2025-04-07 18:22:50 +03:00
Alex Pyrgiotis	0b3bf89d5b	Implicitly run doit with poetry run ... Implicitly run `doit` with `poetry run`, else `poetry env remove --all` will remove the calling Python interpreter.	2025-04-02 12:01:14 +03:00
Alex Pyrgiotis	e0b10c5e40	doit: Remove tessdata dir from targets ... Remove the tesseract data dir from the doit targets, else we encounter the following error: Traceback (most recent call last): [...] File "[...]/Library/Caches/pypoetry/virtualenvs/dangerzone-52Yr5wv_-py3.11/lib/python3.11/site-packages/doit/dependency.py", line 39, in get_file_md5 with open(path, 'rb') as file_data: ^^^^^^^^^^^^^^^^ IsADirectoryError: [Errno 21] Is a directory: 'share/tessdata'	2025-04-02 11:46:20 +03:00
Alex Pyrgiotis	092eec55d1	doit: Remove unused 'DEBIAN_VERSIONS' variable	2025-04-02 11:45:47 +03:00
Alex Pyrgiotis	14a480c3a3	doit: Fix typo in Fedora targets ... Fix a typo when building a Fedora target. Also, add Fedora 42 support.	2025-04-02 11:44:50 +03:00
Alex Pyrgiotis	9df825db5c	debian: Use abbreviated months in changelog ... Use abbreviated months in the Debian changelog, else we'll have warnings like the following: LINE: -- Freedom of the Press Foundation <info@freedom.press> Mon, 31 March 2025 15:57:18 +0300 dpkg-source: warning: dangerzone/debian/changelog(l5): cannot parse non-conformant date '31 March 20	2025-04-02 11:35:31 +03:00
Alex Pyrgiotis	2ee22a497a	Reinstall deps after doit cleans everything ... Make sure to reinstall the project dependencies once `doit clean` runs, since it also removes itself.	2025-04-02 11:30:31 +03:00
Alex Pyrgiotis	b5c09e51d8	Update minimum Docker Desktop version ... Update the minimum Docker Desktop version prior to the 0.9.0 release. The new version should also fix a recent Docker bug, whereby the container stdout was truncated, and caused our conversions to fail. Fixes #1101	2025-04-01 10:33:57 +03:00
Alex Pyrgiotis	37c7608c0f	Bump download links for 0.9.0	2025-04-01 10:33:57 +03:00