Merge d7c01e755a into 53a952235c

1. Create a multi-architecture container image for Dangerzone, instead
   of having two different tarballs (or no option at all)
2. Build the Dangerzone container image on our supported architectures
   (linux/amd64 and linux/arm64). It so happens that GitHub also offers
   ARM machine runners, which speeds up the build.
3. Combine the images from these two architectures into one, multi-arch
   image.
4. Generate provenance info for each manifest, and the root manifest
   list.
5. Check the image's reproduciblity.

Also, remove an older CI action, that is now obsolete.

Fixes #1035

.github/workflows/scan.yml

@@ -10,12 +10,7 @@ on:
 
 jobs:
   security-scan-container:
-    strategy:
-      matrix:
-        runs-on:
-          - ubuntu-24.04
-          - ubuntu-24.04-arm
-    runs-on: ${{ matrix.runs-on }}
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -56,12 +51,7 @@ jobs:
           severity-cutoff: critical
 
   security-scan-app:
-    strategy:
-      matrix:
-        runs-on:
-          - ubuntu-24.04
-          - ubuntu-24.04-arm
-    runs-on: ${{ matrix.runs-on }}
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/scan_released.yml

@@ -9,10 +9,11 @@ jobs:
     strategy:
       matrix:
         include:
-          - runs-on: ubuntu-24.04
+          - runs-on: ubuntu-latest
             arch: i686
-          - runs-on: ubuntu-24.04-arm
-            arch: arm64
+          # Do not scan Silicon mac for now to avoid masking release scan results for other plaforms.
+          # - runs-on: macos-latest
+          #   arch: arm64
     runs-on: ${{ matrix.runs-on }}
     steps:
       - name: Checkout
@@ -54,12 +55,7 @@ jobs:
           severity-cutoff: critical
 
   security-scan-app:
-    strategy:
-      matrix:
-        runs-on:
-          - ubuntu-24.04
-          - ubuntu-24.04-arm
-    runs-on: ${{ matrix.runs-on }}
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4

Dockerfile

@@ -185,7 +185,7 @@ RUN mkdir -p \
 # Copy the /etc and /var directories under the new root directory. Also,
 # copy /etc/, /opt, and /usr to the Dangerzone image rootfs.
 #
-# NOTE: We also have to remove the resolv.conf file, in order to not leak any DNS
+# XXX: We also have to remove the resolv.conf file, in order to not leak any DNS
 # servers added there during image build time.
 RUN cp -r /etc /var /new_root/ \
     && rm /new_root/etc/resolv.conf

Dockerfile.in

@@ -185,8 +185,8 @@ RUN mkdir -p \
 # Copy the /etc and /var directories under the new root directory. Also,
 # copy /etc/, /opt, and /usr to the Dangerzone image rootfs.
 #
-# NOTE: We also have to remove the resolv.conf file, in order to not leak any
-# DNS servers added there during image build time.
+# XXX: We also have to remove the resolv.conf file, in order to not leak any DNS
+# servers added there during image build time.
 RUN cp -r /etc /var /new_root/ \
     && rm /new_root/etc/resolv.conf
 RUN cp -r /etc /opt /usr /new_root/home/dangerzone/dangerzone-image/rootfs \

tests/isolation_provider/test_container.py

@@ -8,7 +8,6 @@ from pytest_subprocess import FakeProcess
 from dangerzone import container_utils, errors
 from dangerzone.isolation_provider.container import Container
 from dangerzone.isolation_provider.qubes import is_qubes_native_conversion
-from dangerzone.util import get_resource_path
 
 from .base import IsolationProviderTermination, IsolationProviderTest
 
@@ -48,7 +47,7 @@ class TestContainer(IsolationProviderTest):
         provider.is_available()
 
     def test_install_raise_if_image_cant_be_installed(
-        self, provider: Container, fp: FakeProcess
+        self, mocker: MockerFixture, provider: Container, fp: FakeProcess
     ) -> None:
         """When an image installation fails, an exception should be raised"""
 
@@ -69,13 +68,11 @@ class TestContainer(IsolationProviderTest):
             occurrences=2,
         )
 
+        # Make podman load fail
+        mocker.patch("builtins.open", mocker.mock_open(read_data=""))
+
         fp.register_subprocess(
-            [
-                container_utils.get_runtime(),
-                "load",
-                "-i",
-                get_resource_path("container.tar"),
-            ],
+            [container_utils.get_runtime(), "load"],
             returncode=-1,
         )
 
@@ -83,7 +80,7 @@ class TestContainer(IsolationProviderTest):
             provider.install()
 
     def test_install_raises_if_still_not_installed(
-        self, provider: Container, fp: FakeProcess
+        self, mocker: MockerFixture, provider: Container, fp: FakeProcess
     ) -> None:
         """When an image keep being not installed, it should return False"""
         fp.register_subprocess(
@@ -108,13 +105,10 @@ class TestContainer(IsolationProviderTest):
             occurrences=2,
         )
 
+        # Patch open and podman load so that it works
+        mocker.patch("builtins.open", mocker.mock_open(read_data=""))
         fp.register_subprocess(
-            [
-                container_utils.get_runtime(),
-                "load",
-                "-i",
-                get_resource_path("container.tar"),
-            ],
+            [container_utils.get_runtime(), "load"],
         )
         with pytest.raises(errors.ImageNotPresentException):
             provider.install()
@@ -201,7 +195,7 @@ class TestContainer(IsolationProviderTest):
         reason="Linux specific",
     )
     def test_linux_skips_desktop_version_check_returns_true(
-        self, provider: Container
+        self, mocker: MockerFixture, provider: Container
     ) -> None:
         assert (True, "") == provider.check_docker_desktop_version()