Scenario: release_signatures

Threat model for Dangerzone

Findings

Data Flows

Affected Components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;
        ]

        component_Certum_Card_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Certum Card";
            URL = "component_Certum_Card.html";
            tooltip = "Certum Card";
            margin = 0.02;
        ]

        component_YubiKey_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "YubiKey";
            URL = "component_YubiKey.html";
            tooltip = "YubiKey";
            margin = 0.02;
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Sign release\nbinary for Linux";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Certum_Card_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sign Windows\nbinary";    ]
    component_Certum_Card_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Windows signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_YubiKey_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Sign Apple binary";    ]
    component_YubiKey_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apple signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Create GitHub\nrelease";    ]
}

Sequence Diagram

sequenceDiagram
    participant dev as dev
    link dev: Component @ component_dev.html
    participant Build_machines as Build machines
    link Build_machines: Component @ component_Build_machines.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant Certum_Card as Certum Card
    link Certum_Card: Component @ component_Certum_Card.html
    participant YubiKey as YubiKey
    link YubiKey: Component @ component_YubiKey.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html

    dev->>Build_machines: 1. Kick off release build
    Build_machines->>GitHub_Container_Registry: 2. Build and publish signed container image
    Build_machines->>Build_machines: 3. Sign release binary for Linux
    Build_machines->>Certum_Card: 4. Sign Windows binary
    Certum_Card->>Build_machines: 5. Windows signature result
    Build_machines->>YubiKey: 6. Sign Apple binary
    YubiKey->>Build_machines: 7. Apple signature result
    Build_machines->>DZ_Linux_package_server: 8. Push signed builds to Linux repos
    Build_machines->>DZ_GitHub_repo: 9. Create GitHub release

Show data flows

ID	Name	Source	Sink	Type
1	Kick off release build	dev	Build machines	Request
2	Build and publish signed container image	Build machines	GitHub Container Registry	Request
3	Sign release binary for Linux	Build machines	Build machines	Request
4	Sign Windows binary	Build machines	Certum Card	Request
5	Windows signature result	Certum Card	Build machines	Request
6	Sign Apple binary	Build machines	YubiKey	Request
7	Apple signature result	YubiKey	Build machines	Request
8	Push signed builds to Linux repos	Build machines	DZ Linux package server	Request
9	Create GitHub release	Build machines	DZ GitHub repo	Request

Applicable threats

Threat ID	Description	Target Component	Mitigations
DZ-1-DEPS		Build machines	verifies resources.deps
CAPEC-145	Checksum Spoofing	Build machines	uses strong crypto
CAPEC-440	Hardware Integrity Attack	Build machines	is verifiable
CAPEC-440	Hardware Integrity Attack	Certum Card	is verifiable
CAPEC-440	Hardware Integrity Attack	YubiKey	is verifiable
CAPEC-473	Signature Spoof	Build machines	uses strong crypto
CAPEC-582	Route Disabling	Build machines	works offline
CAPEC-582	Route Disabling	GitHub Container Registry	works offline
CAPEC-582	Route Disabling	Certum Card	works offline
CAPEC-582	Route Disabling	DZ Linux package server	works offline
CAPEC-582	Route Disabling	DZ GitHub repo	works offline
CAPEC-639	Probe System Files	GitHub Container Registry	is sandboxed
CAPEC-639	Probe System Files	DZ container image	is sandboxed
CAPEC-639	Probe System Files	DZ release binary	is sandboxed
CAPEC-639	Probe System Files	Release Signature Data	is sandboxed
CAPEC-639	Probe System Files	DZ Linux package server	is sandboxed
CAPEC-639	Probe System Files	DZ GitHub repo	is sandboxed

Back to Summary