Update the sandbox¶
Dangerzone has a mechanism to auto-update the secure sandbox used for document conversion.
This mechanism allows us to ship security fixes without having to do a full-blown release, shortening the time between when security patches are out and when they are used.
This increases the security of the conversion process dramatically, making it harder for an attacker to rely on known and patched exploits in our stack.
In order to ensure the sandbox image is trusted, we sign it with Cosign, which is part of the greater Sigstore ecosystem, and verify it against a key distributed in the Dangerzone application.
Install updates¶
Checking for updates is done automatically when the setting is turned on. In addition, it's possible to check if a new sandbox image has been released and update your local installation with the following command:
Verify locally¶
You can verify that the image you have locally matches the stored signatures, and that these have been signed with a trusted public key. This is not a required step, and will be done automatically by the Dangerzone software on subsequent runs, so this command is mainly provided as a convenience.
The public key used to verify the container signatures is shipped in share/freedomofpress-dangerzone.pub, signed by our main Dangerzone release key. You can verify this signature using gpg.
Checking attestations¶
Each night, new images are built and pushed to the container registry, alongside a provenance attestation. This lets anybody check that the image was originally built by GitHub CI runners, from a defined source repository (in our case freedomofpress/dangerzone).
To verify the attestations against our expectations, clone the GitHub repo that builds our container images, and use the following command:
git clone https://github.com/freedomofpress/dangerzone-image
cd dangerzone-image/
uvx mazette install
uv run image verify-attestation ghcr.io/freedomofpress/dangerzone/v1@sha256:...
In case of success, it will report back:
🎉 Successfully verified image
'ghcr.io/freedomofpress/dangerzone/v1:<tag>@sha256:<digest>'
and its associated claims:
- ✅ SLSA Level 3 provenance
- ✅ GitHub repo: freedomofpress/dangerzone-image
- ✅ GitHub actions workflow: <workflow>
Installing image updates to air-gapped environments¶
To install a container image to an environment without a network connection, three steps are required:
- Prepare the archive
- Transfer the archive to the air-gapped system
- Install the archive on the air-gapped system
This archive will contain all the needed material to verify that the new container image has been signed and is valid.
On the machine on which you prepare the packages (of course, adapt to the architecture you want to target):
On the airgapped machine, copy the file and run the following command:
Configuring the verification material¶
Dangerzone bundles and pins the public key of the Rekor service, which powers the transparency log of Sigstore signatures.
If Sigstore maintainers decide to rotate this key, a new Dangerzone version will be released, bundled with the new key. Power users can specify an updated key in the meantime, by fetching the latest Rekor public key with:
cosign initialize
cat ~/.sigstore/root/tuf-repo-cdn.sigstore.dev/targets/trusted_root.json \
| jq -r .tlogs[0].publicKey.rawBytes \
| base64 -d \
| openssl pkey -pubin > rekor.pub
And set it with the following environment variable: