Scenario: release

Threat model for Dangerzone build and release process

Findings

Data Flows

Affected Components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;
        ]

        component_Certum_Card_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Certum Card";
            URL = "component_Certum_Card.html";
            tooltip = "Certum Card";
            margin = 0.02;
        ]

        component_YubiKey_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "YubiKey";
            URL = "component_YubiKey.html";
            tooltip = "YubiKey";
            margin = 0.02;
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_External_github_repositories_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "External github\nrepositories";
            URL = "component_External_github_repositories.html";
            tooltip = "External github repositories";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_External_github_repositories_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Download embedded\nassets";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Build DZ binaries";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Sign release\nbinary for Linux";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Certum_Card_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Sign Windows\nbinary";    ]
    component_Certum_Card_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Windows signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_YubiKey_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Sign Apple binary";    ]
    component_YubiKey_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Apple signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "10. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "11. Create GitHub\nrelease";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "12. Embed sandbox\npublic key";    ]
    actor_dev_FPF_operated_Tailnet -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "13. Update release\nreference";    ]
}

Sequence Diagram

sequenceDiagram
    participant dev as dev
    link dev: Component @ component_dev.html
    participant Build_machines as Build machines
    link Build_machines: Component @ component_Build_machines.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant External_github_repositories as External github repositories
    link External_github_repositories: Component @ component_External_github_repositories.html
    participant Certum_Card as Certum Card
    link Certum_Card: Component @ component_Certum_Card.html
    participant YubiKey as YubiKey
    link YubiKey: Component @ component_YubiKey.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html
    participant dangerzone_rocks as dangerzone.rocks
    link dangerzone_rocks: Component @ component_dangerzone_rocks.html

    dev->>Build_machines: 1. Kick off release build
    Build_machines->>GitHub_Container_Registry: 2. Build and publish signed container image
    Build_machines->>External_github_repositories: 3. Download embedded assets
    Build_machines->>Build_machines: 4. Build DZ binaries
    Build_machines->>Build_machines: 5. Sign release binary for Linux
    Build_machines->>Certum_Card: 6. Sign Windows binary
    Certum_Card->>Build_machines: 7. Windows signature result
    Build_machines->>YubiKey: 8. Sign Apple binary
    YubiKey->>Build_machines: 9. Apple signature result
    Build_machines->>DZ_Linux_package_server: 10. Push signed builds to Linux repos
    Build_machines->>DZ_GitHub_repo: 11. Create GitHub release
    Build_machines->>Build_machines: 12. Embed sandbox public key
    dev->>dangerzone_rocks: 13. Update release reference

Show data flows

ID	Name	Source	Sink	Type
1	Kick off release build	dev	Build machines	Request
2	Build and publish signed container image	Build machines	GitHub Container Registry	Request
3	Download embedded assets	Build machines	External github repositories	Request
4	Build DZ binaries	Build machines	Build machines	Request
5	Sign release binary for Linux	Build machines	Build machines	Request
6	Sign Windows binary	Build machines	Certum Card	Request
7	Windows signature result	Certum Card	Build machines	Request
8	Sign Apple binary	Build machines	YubiKey	Request
9	Apple signature result	YubiKey	Build machines	Request
10	Push signed builds to Linux repos	Build machines	DZ Linux package server	Request
11	Create GitHub release	Build machines	DZ GitHub repo	Request
12	Embed sandbox public key	Build machines	Build machines	Request
13	Update release reference	dev	dangerzone.rocks	Request

Applicable threats

Threat ID	Description	Target Component	Mitigations
DZ-1-DEPS		Build machines	verifies resources.deps
CAPEC-145	Checksum Spoofing	Build machines	uses strong crypto
CAPEC-439	Manipulation During Distribution	External github repositories	is verifiable
CAPEC-439	Manipulation During Distribution	dangerzone.rocks	is verifiable
CAPEC-440	Hardware Integrity Attack	Build machines	is verifiable
CAPEC-440	Hardware Integrity Attack	Certum Card	is verifiable
CAPEC-440	Hardware Integrity Attack	YubiKey	is verifiable
CAPEC-473	Signature Spoof	Build machines	uses strong crypto
CAPEC-582	Route Disabling	Build machines	works offline
CAPEC-582	Route Disabling	GitHub Container Registry	works offline
CAPEC-582	Route Disabling	External github repositories	works offline
CAPEC-582	Route Disabling	Certum Card	works offline
CAPEC-582	Route Disabling	DZ Linux package server	works offline
CAPEC-582	Route Disabling	DZ GitHub repo	works offline
CAPEC-582	Route Disabling	dangerzone.rocks	works offline
CAPEC-639	Probe System Files	GitHub Container Registry	is sandboxed
CAPEC-639	Probe System Files	DZ container image	is sandboxed
CAPEC-639	Probe System Files	External github repositories	is sandboxed
CAPEC-639	Probe System Files	Embedded Sandbox	is sandboxed
CAPEC-639	Probe System Files	DZ release binary	is sandboxed
CAPEC-639	Probe System Files	Release Signature Data	is sandboxed
CAPEC-639	Probe System Files	DZ Linux package server	is sandboxed
CAPEC-639	Probe System Files	DZ GitHub repo	is sandboxed
CAPEC-639	Probe System Files	Sandbox Public Key	is sandboxed
CAPEC-639	Probe System Files	dangerzone.rocks	is sandboxed
CAPEC-639	Probe System Files	Release reference	is sandboxed

Back to Summary