Dangerzone Threat Model

convert

Threat model for Dangerzone

28 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_Random_doc_source_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Random doc\nsource";
            URL = "component_Random_doc_source.html";
            tooltip = "Random doc source";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        subgraph cluster_boundary_Docker_Podman_VM {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <Docker/Podman VM>;
            ]

            subgraph cluster_boundary_Outer_container {
                graph [
                    fontsize = 10;
                    fontcolor = black;
                    style = dashed;
                    color = firebrick2;
                    label = <Outer container>;
                ]

                subgraph cluster_boundary_gVisor_sandbox {
                    graph [
                        fontsize = 10;
                        fontcolor = black;
                        style = dashed;
                        color = firebrick2;
                        label = <gVisor sandbox>;
                    ]

                    component_LibreOffice_gVisor_sandbox [
                        shape = circle;
                        color = black;
                        fontcolor = black;
                        label = "LibreOffice";
                        URL = "component_LibreOffice.html";
                        tooltip = "LibreOffice";
                        margin = 0.02;
                    ]

                    component_doc_to_pixels_py_gVisor_sandbox [
                        shape = circle;
                        color = black;
                        fontcolor = black;
                        label = "doc_to_pixels.py";
                        URL = "component_doc_to_pixels_py.html";
                        tooltip = "doc_to_pixels.py";
                        margin = 0.02;
                    ]

                }

                component_entrypoint_py_Outer_container [
                    shape = circle;
                    color = black;
                    fontcolor = black;
                    label = "entrypoint.py";
                    URL = "component_entrypoint_py.html";
                    tooltip = "entrypoint.py";
                    margin = 0.02;
                ]

            }

            component_Container_runtime_Docker_Podman_VM [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "Container\nruntime";
                URL = "component_Container_runtime.html";
                tooltip = "Container runtime";
                margin = 0.02;
            ]

        }

        component_Container_manager_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Container\nmanager";
            URL = "component_Container_manager.html";
            tooltip = "Container manager";
            margin = 0.02;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        component_PDF_reader_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "PDF reader";
            URL = "component_PDF_reader.html";
            tooltip = "PDF reader";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    actor_User_Local_host -> externalentity_Random_doc_source_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Request untrusted\ndoc from remote\nsource";    ]
    externalentity_Random_doc_source_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Receive untrusted\ndoc from remote\nsource and store it\nlocally";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "3. Start the\nDangerzone App";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "4. Invoke\nDocker/Podman to\ncheck if the\ncontainer image is\npresent and\ninstalled";    ]
    component_Container_manager_Local_host -> component_Container_runtime_Docker_Podman_VM [        color = black;        fontcolor = black;        dir = forward;        label = "5. Is the image\npresent in the VM?";    ]
    component_Container_runtime_Docker_Podman_VM -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. Image is present";    ]
    component_Container_manager_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "7. Reply to\nDangerzone APP that\nthe container image\nis installed";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "8. Select documents\nfor conversion";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "9. Request a Linux\ncontainer for\nconversion";    ]
    component_Container_manager_Local_host -> component_Container_runtime_Docker_Podman_VM [        color = black;        fontcolor = black;        dir = forward;        label = "10. Start a Linux\ncontainer";    ]
    component_Container_runtime_Docker_Podman_VM -> component_entrypoint_py_Outer_container [        color = black;        fontcolor = black;        dir = forward;        label = "11. Run entrypoint\nscript of Linux\ncontainer";    ]
    component_entrypoint_py_Outer_container -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "12. Start the\nDangerzone converter\nin the gVisor\nsandbox";    ]
    component_DZ_App_Local_host -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "13. Send the\nsuspicious document\nto the stdin of the\ngVisor sandbox";    ]
    component_doc_to_pixels_py_gVisor_sandbox -> component_LibreOffice_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "14. Convert the\nsuspicious doc to\nPDF (if not already)";    ]
    component_LibreOffice_gVisor_sandbox -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "15. Receive\nsuspicious doc as\nPDF";    ]
    component_doc_to_pixels_py_gVisor_sandbox -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "16. Rasterize PDF\ninto pixels and\nwrite them to the\ngVisor sandbox's\nstdout";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "17. Reconstruct a\nsafe doc from pixels\nto PDF (and\noptionally OCR it)";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "18. Save safe PDF\nwith a '-safe.pdf'\nprefix";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "19. Archive the\nsuspicious PDF into\nthe 'unsafe/'\ndirectory";    ]
    component_DZ_App_Local_host -> component_PDF_reader_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "20. Open the PDF\nusing the program of\nthe user's choice,\nor the default one";    ]
}

Sequence Diagram

sequenceDiagram
    participant User as User
    link User: Component @ component_User.html
    participant Random_doc_source as Random doc source
    link Random_doc_source: Component @ component_Random_doc_source.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant Container_manager as Container manager
    link Container_manager: Component @ component_Container_manager.html
    participant Container_runtime as Container runtime
    link Container_runtime: Component @ component_Container_runtime.html
    participant entrypoint_py as entrypoint.py
    link entrypoint_py: Component @ component_entrypoint_py.html
    participant doc_to_pixels_py as doc_to_pixels.py
    link doc_to_pixels_py: Component @ component_doc_to_pixels_py.html
    participant LibreOffice as LibreOffice
    link LibreOffice: Component @ component_LibreOffice.html
    participant PDF_reader as PDF reader
    link PDF_reader: Component @ component_PDF_reader.html

    User->>Random_doc_source: 1. Request untrusted doc from remote source
    Random_doc_source-->>Host_storage: 2. Receive untrusted doc from remote source and store it locally
    User->>DZ_App: 3. Start the Dangerzone App
    DZ_App->>Container_manager: 4. Invoke Docker/Podman to check if the container image is present and installed
    Container_manager->>Container_runtime: 5. Is the image present in the VM?
    Container_runtime-->>Container_manager: 6. Image is present
    Container_manager-->>DZ_App: 7. Reply to Dangerzone APP that the container image is installed
    User->>DZ_App: 8. Select documents for conversion
    DZ_App->>Container_manager: 9. Request a Linux container for conversion
    Container_manager->>Container_runtime: 10. Start a Linux container
    Container_runtime->>entrypoint_py: 11. Run entrypoint script of Linux container
    entrypoint_py->>doc_to_pixels_py: 12. Start the Dangerzone converter in the gVisor sandbox
    DZ_App->>doc_to_pixels_py: 13. Send the suspicious document to the stdin of the gVisor sandbox
    doc_to_pixels_py->>LibreOffice: 14. Convert the suspicious doc to PDF (if not already)
    LibreOffice->>doc_to_pixels_py: 15. Receive suspicious doc as PDF
    doc_to_pixels_py->>DZ_App: 16. Rasterize PDF into pixels and write them to the gVisor sandbox's stdout
    DZ_App->>Host_storage: 17. Reconstruct a safe doc from pixels to PDF (and optionally OCR it)
    DZ_App->>Host_storage: 18. Save safe PDF with a '-safe.pdf' prefix
    DZ_App->>Host_storage: 19. Archive the suspicious PDF into the 'unsafe/' directory
    DZ_App->>PDF_reader: 20. Open the PDF using the program of the user's choice, or the default one

convert_basic

Threat model for Dangerzone

16 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        subgraph cluster_boundary_Docker_Podman_VM {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <Docker/Podman VM>;
            ]

            subgraph cluster_boundary_Outer_container {
                graph [
                    fontsize = 10;
                    fontcolor = black;
                    style = dashed;
                    color = firebrick2;
                    label = <Outer container>;
                ]

                subgraph cluster_boundary_gVisor_sandbox {
                    graph [
                        fontsize = 10;
                        fontcolor = black;
                        style = dashed;
                        color = firebrick2;
                        label = <gVisor sandbox>;
                    ]

                    component_doc_to_pixels_py_gVisor_sandbox [
                        shape = circle;
                        color = black;
                        fontcolor = black;
                        label = "doc_to_pixels.py";
                        URL = "component_doc_to_pixels_py.html";
                        tooltip = "doc_to_pixels.py";
                        margin = 0.02;
                    ]

                }

            }

        }

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "1. Start the\nDangerzone App";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Select documents\nfor conversion";    ]
    component_DZ_App_Local_host -> component_doc_to_pixels_py_gVisor_sandbox [        color = black;        fontcolor = black;        dir = forward;        label = "3. Send the\nsuspicious document\nto the stdin of the\ngVisor sandbox";    ]
    component_doc_to_pixels_py_gVisor_sandbox -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "4. Rasterize PDF\ninto pixels and\nwrite them to the\ngVisor sandbox's\nstdout";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "5. Reconstruct a\nsafe doc from pixels\nto PDF (and\noptionally OCR it)";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. Save safe PDF\nwith a '-safe.pdf'\nprefix";    ]
}

Sequence Diagram

sequenceDiagram
    participant User as User
    link User: Component @ component_User.html
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant doc_to_pixels_py as doc_to_pixels.py
    link doc_to_pixels_py: Component @ component_doc_to_pixels_py.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html

    User->>DZ_App: 1. Start the Dangerzone App
    User->>DZ_App: 2. Select documents for conversion
    DZ_App->>doc_to_pixels_py: 3. Send the suspicious document to the stdin of the gVisor sandbox
    doc_to_pixels_py->>DZ_App: 4. Rasterize PDF into pixels and write them to the gVisor sandbox's stdout
    DZ_App->>Host_storage: 5. Reconstruct a safe doc from pixels to PDF (and optionally OCR it)
    DZ_App->>Host_storage: 6. Save safe PDF with a '-safe.pdf' prefix

release

Threat model for Dangerzone build and release process

26 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;
        ]

        component_Certum_Card_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Certum Card";
            URL = "component_Certum_Card.html";
            tooltip = "Certum Card";
            margin = 0.02;
        ]

        component_YubiKey_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "YubiKey";
            URL = "component_YubiKey.html";
            tooltip = "YubiKey";
            margin = 0.02;
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_External_github_repositories_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "External github\nrepositories";
            URL = "component_External_github_repositories.html";
            tooltip = "External github repositories";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_External_github_repositories_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Download embedded\nassets";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Build DZ binaries";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Sign release\nbinary for Linux";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Certum_Card_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Sign Windows\nbinary";    ]
    component_Certum_Card_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Windows signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_YubiKey_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Sign Apple binary";    ]
    component_YubiKey_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Apple signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "10. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "11. Create GitHub\nrelease";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "12. Embed sandbox\npublic key";    ]
    actor_dev_FPF_operated_Tailnet -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "13. Update release\nreference";    ]
}

Sequence Diagram

sequenceDiagram
    participant dev as dev
    link dev: Component @ component_dev.html
    participant Build_machines as Build machines
    link Build_machines: Component @ component_Build_machines.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant External_github_repositories as External github repositories
    link External_github_repositories: Component @ component_External_github_repositories.html
    participant Certum_Card as Certum Card
    link Certum_Card: Component @ component_Certum_Card.html
    participant YubiKey as YubiKey
    link YubiKey: Component @ component_YubiKey.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html
    participant dangerzone_rocks as dangerzone.rocks
    link dangerzone_rocks: Component @ component_dangerzone_rocks.html

    dev->>Build_machines: 1. Kick off release build
    Build_machines->>GitHub_Container_Registry: 2. Build and publish signed container image
    Build_machines->>External_github_repositories: 3. Download embedded assets
    Build_machines->>Build_machines: 4. Build DZ binaries
    Build_machines->>Build_machines: 5. Sign release binary for Linux
    Build_machines->>Certum_Card: 6. Sign Windows binary
    Certum_Card->>Build_machines: 7. Windows signature result
    Build_machines->>YubiKey: 8. Sign Apple binary
    YubiKey->>Build_machines: 9. Apple signature result
    Build_machines->>DZ_Linux_package_server: 10. Push signed builds to Linux repos
    Build_machines->>DZ_GitHub_repo: 11. Create GitHub release
    Build_machines->>Build_machines: 12. Embed sandbox public key
    dev->>dangerzone_rocks: 13. Update release reference

release_basic

Threat model for Dangerzone

22 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_External_github_repositories_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "External github\nrepositories";
            URL = "component_External_github_repositories.html";
            tooltip = "External github repositories";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_External_github_repositories_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Download embedded\nassets";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Build DZ binaries";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Create GitHub\nrelease";    ]
    actor_dev_FPF_operated_Tailnet -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Update release\nreference";    ]
}

Sequence Diagram

sequenceDiagram
    participant dev as dev
    link dev: Component @ component_dev.html
    participant Build_machines as Build machines
    link Build_machines: Component @ component_Build_machines.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant External_github_repositories as External github repositories
    link External_github_repositories: Component @ component_External_github_repositories.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html
    participant dangerzone_rocks as dangerzone.rocks
    link dangerzone_rocks: Component @ component_dangerzone_rocks.html

    dev->>Build_machines: 1. Kick off release build
    Build_machines->>GitHub_Container_Registry: 2. Build and publish signed container image
    Build_machines->>External_github_repositories: 3. Download embedded assets
    Build_machines->>Build_machines: 4. Build DZ binaries
    Build_machines->>DZ_Linux_package_server: 5. Push signed builds to Linux repos
    Build_machines->>DZ_GitHub_repo: 6. Create GitHub release
    dev->>dangerzone_rocks: 7. Update release reference

release_signatures

Threat model for Dangerzone

17 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;
        ]

        component_Certum_Card_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Certum Card";
            URL = "component_Certum_Card.html";
            tooltip = "Certum Card";
            margin = 0.02;
        ]

        component_YubiKey_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "YubiKey";
            URL = "component_YubiKey.html";
            tooltip = "YubiKey";
            margin = 0.02;
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Sign release\nbinary for Linux";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Certum_Card_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sign Windows\nbinary";    ]
    component_Certum_Card_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Windows signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_YubiKey_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Sign Apple binary";    ]
    component_YubiKey_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apple signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Create GitHub\nrelease";    ]
}

Sequence Diagram

sequenceDiagram
    participant dev as dev
    link dev: Component @ component_dev.html
    participant Build_machines as Build machines
    link Build_machines: Component @ component_Build_machines.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant Certum_Card as Certum Card
    link Certum_Card: Component @ component_Certum_Card.html
    participant YubiKey as YubiKey
    link YubiKey: Component @ component_YubiKey.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html

    dev->>Build_machines: 1. Kick off release build
    Build_machines->>GitHub_Container_Registry: 2. Build and publish signed container image
    Build_machines->>Build_machines: 3. Sign release binary for Linux
    Build_machines->>Certum_Card: 4. Sign Windows binary
    Certum_Card->>Build_machines: 5. Windows signature result
    Build_machines->>YubiKey: 6. Sign Apple binary
    YubiKey->>Build_machines: 7. Apple signature result
    Build_machines->>DZ_Linux_package_server: 8. Push signed builds to Linux repos
    Build_machines->>DZ_GitHub_repo: 9. Create GitHub release

release_sandbox

Build and sign sandbox threat model

25 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;
        ]

        component_Cosign_Binary__build_machines__FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Cosign Binary\n(build machines)";
            URL = "component_Cosign_Binary__build_machines_.html";
            tooltip = "Cosign Binary (build machines)";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        externalentity_Rekor_Log_Server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Rekor Log Server";
            URL = "component_Rekor_Log_Server.html";
            tooltip = "Rekor Log Server";
            margin = 0.02;
        ]

    }

    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Push container to\nGHCR";    ]
    component_Cosign_Binary__build_machines__FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Sign remote\nsandbox image";    ]
    component_Cosign_Binary__build_machines__FPF_operated_Tailnet -> externalentity_Rekor_Log_Server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Publish rekor\nlogs";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Request signed\nsandbox tarball";    ]
    externalentity_GitHub_Container_Registry_Internet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Response with the\nsigned sandbox +\nsignatures";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Cosign_Binary__build_machines__FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Generate the\nsandbox tarball from\nthe pulled container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Tag remote\nsandbox";    ]
}

Sequence Diagram

sequenceDiagram
    participant Build_machines as Build machines
    link Build_machines: Component @ component_Build_machines.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant Cosign_Binary__build_machines_ as Cosign Binary (build machines)
    link Cosign_Binary__build_machines_: Component @ component_Cosign_Binary__build_machines_.html
    participant Rekor_Log_Server as Rekor Log Server
    link Rekor_Log_Server: Component @ component_Rekor_Log_Server.html

    Build_machines->>GitHub_Container_Registry: 1. Build container image
    Build_machines->>GitHub_Container_Registry: 2. Push container to GHCR
    Cosign_Binary__build_machines_->>GitHub_Container_Registry: 3. Sign remote sandbox image
    Cosign_Binary__build_machines_->>Rekor_Log_Server: 4. Publish rekor logs
    Build_machines->>GitHub_Container_Registry: 5. Request signed sandbox tarball
    GitHub_Container_Registry->>Build_machines: 6. Response with the signed sandbox + signatures
    Build_machines->>Cosign_Binary__build_machines_: 7. Generate the sandbox tarball from the pulled container image
    Build_machines->>GitHub_Container_Registry: 8. Tag remote sandbox

update

Install or update

24 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_GitHub_release_server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub release\nserver";
            URL = "component_GitHub_release_server.html";
            tooltip = "GitHub release server";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    component_DZ_App_Local_host -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Check for newer\nreleases";    ]
    externalentity_DZ_GitHub_repo_Internet -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Send changelog\nfor new release and\nprompt user to\ninstall";    ]
    actor_User_Local_host -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Check\ndangerzone.rocks for\nlatest install";    ]
    server_dangerzone_rocks_Internet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "4. (Linux) Redirect\nto installation docs";    ]
    actor_User_Local_host -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. (Linux) Request\nbinary/image";    ]
    server_DZ_Linux_package_server_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. (Linux) Receive\nbinary/image";    ]
    server_dangerzone_rocks_Internet -> externalentity_GitHub_release_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "7. (Win / macOS)\nRedirects to GH\nrelease page\nbinaries";    ]
    server_dangerzone_rocks_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "8. (Win / macOS)\nReceive install\nbinary";    ]
}

Sequence Diagram

sequenceDiagram
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html
    participant User as User
    link User: Component @ component_User.html
    participant dangerzone_rocks as dangerzone.rocks
    link dangerzone_rocks: Component @ component_dangerzone_rocks.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html
    participant GitHub_release_server as GitHub release server
    link GitHub_release_server: Component @ component_GitHub_release_server.html

    DZ_App->>DZ_GitHub_repo: 1. Check for newer releases
    DZ_GitHub_repo-->>DZ_App: 2. Send changelog for new release and prompt user to install
    User->>dangerzone_rocks: 3. Check dangerzone.rocks for latest install
    dangerzone_rocks->>DZ_GitHub_repo: 4. (Linux) Redirect to installation docs
    User->>DZ_Linux_package_server: 5. (Linux) Request binary/image
    DZ_Linux_package_server->>Host_storage: 6. (Linux) Receive binary/image
    dangerzone_rocks->>GitHub_release_server: 7. (Win / macOS) Redirects to GH release page binaries
    dangerzone_rocks->>Host_storage: 8. (Win / macOS) Receive install binary

update_linux

Update & Installation on Linux

21 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    component_DZ_App_Local_host -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Check for newer\nreleases";    ]
    externalentity_DZ_GitHub_repo_Internet -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Send changelog\nfor new release and\nprompt user to\ninstall";    ]
    actor_User_Local_host -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Check\ndangerzone.rocks for\nlatest install";    ]
    server_dangerzone_rocks_Internet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "4. (Linux) Redirect\nto installation docs";    ]
    actor_User_Local_host -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. (Linux) Request\nbinary/image";    ]
    server_DZ_Linux_package_server_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. (Linux) Receive\nbinary/image";    ]
}

Sequence Diagram

sequenceDiagram
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html
    participant User as User
    link User: Component @ component_User.html
    participant dangerzone_rocks as dangerzone.rocks
    link dangerzone_rocks: Component @ component_dangerzone_rocks.html
    participant DZ_Linux_package_server as DZ Linux package server
    link DZ_Linux_package_server: Component @ component_DZ_Linux_package_server.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html

    DZ_App->>DZ_GitHub_repo: 1. Check for newer releases
    DZ_GitHub_repo-->>DZ_App: 2. Send changelog for new release and prompt user to install
    User->>dangerzone_rocks: 3. Check dangerzone.rocks for latest install
    dangerzone_rocks->>DZ_GitHub_repo: 4. (Linux) Redirect to installation docs
    User->>DZ_Linux_package_server: 5. (Linux) Request binary/image
    DZ_Linux_package_server->>Host_storage: 6. (Linux) Receive binary/image

update_windows

Update & Installation on Windows

22 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        externalentity_GitHub_release_server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub release\nserver";
            URL = "component_GitHub_release_server.html";
            tooltip = "GitHub release server";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    component_DZ_App_Local_host -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Check for newer\nreleases";    ]
    externalentity_DZ_GitHub_repo_Internet -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. Send changelog\nfor new release and\nprompt user to\ninstall";    ]
    actor_User_Local_host -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Check\ndangerzone.rocks for\nlatest install";    ]
    server_dangerzone_rocks_Internet -> externalentity_GitHub_release_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "4. (Win / macOS)\nRedirects to GH\nrelease page\nbinaries";    ]
    server_dangerzone_rocks_Internet -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "5. (Win / macOS)\nReceive install\nbinary";    ]
}

Sequence Diagram

sequenceDiagram
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant DZ_GitHub_repo as DZ GitHub repo
    link DZ_GitHub_repo: Component @ component_DZ_GitHub_repo.html
    participant User as User
    link User: Component @ component_User.html
    participant dangerzone_rocks as dangerzone.rocks
    link dangerzone_rocks: Component @ component_dangerzone_rocks.html
    participant GitHub_release_server as GitHub release server
    link GitHub_release_server: Component @ component_GitHub_release_server.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html

    DZ_App->>DZ_GitHub_repo: 1. Check for newer releases
    DZ_GitHub_repo-->>DZ_App: 2. Send changelog for new release and prompt user to install
    User->>dangerzone_rocks: 3. Check dangerzone.rocks for latest install
    dangerzone_rocks->>GitHub_release_server: 4. (Win / macOS) Redirects to GH release page binaries
    dangerzone_rocks->>Host_storage: 5. (Win / macOS) Receive install binary

upgrade_sandbox

Threat model for Dangerzone's sandbox container update and verification process

20 findings

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        externalentity_Rekor_Log_Server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Rekor Log Server";
            URL = "component_Rekor_Log_Server.html";
            tooltip = "Rekor Log Server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Local_host {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Local host>;
        ]

        component_Container_manager_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Container\nmanager";
            URL = "component_Container_manager.html";
            tooltip = "Container manager";
            margin = 0.02;
        ]

        component_Cosign_Binary__embedded__Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Cosign Binary\n(embedded)";
            URL = "component_Cosign_Binary__embedded_.html";
            tooltip = "Cosign Binary (embedded)";
            margin = 0.02;
        ]

        component_DZ_App_Local_host [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DZ App";
            URL = "component_DZ_App.html";
            tooltip = "DZ App";
            margin = 0.02;
        ]

        datastore_Host_storage_Local_host [
            shape = cylinder;
            color = black;
            fontcolor = black;
            label = "Host storage";
            URL = "component_Host_storage.html";
            tooltip = "Host storage";
            margin = 0.02;
        ]

        actor_User_Local_host [
            shape = square;
            color = black;
            fontcolor = black;
            label = "User";
            URL = "component_User.html";
            tooltip = "User";
            margin = 0.02;
        ]

    }

    component_DZ_App_Local_host -> actor_User_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "1. Should enable\nsandbox updates?";    ]
    actor_User_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "2. User consent";    ]
    component_DZ_App_Local_host -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Query registry";    ]
    externalentity_GitHub_Container_Registry_Internet -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "4. Registry response";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "5. Store remote log\nindex";    ]
    datastore_Host_storage_Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "6. Read current log\nindex";    ]
    component_DZ_App_Local_host -> component_Container_manager_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "7. Pull sandbox\nimage";    ]
    component_DZ_App_Local_host -> component_Cosign_Binary__embedded__Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "8. Verify sandbox\nsignatures";    ]
    component_Cosign_Binary__embedded__Local_host -> externalentity_Rekor_Log_Server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Verify rekor log";    ]
    component_Cosign_Binary__embedded__Local_host -> component_DZ_App_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "10. Signature\nverification result";    ]
    component_DZ_App_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "11. Store signatures";    ]
    component_Container_manager_Local_host -> datastore_Host_storage_Local_host [        color = black;        fontcolor = black;        dir = forward;        label = "12. Install sandbox";    ]
    component_Container_manager_Local_host -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "13. Pull sandbox\nimage";    ]
}

Sequence Diagram

sequenceDiagram
    participant DZ_App as DZ App
    link DZ_App: Component @ component_DZ_App.html
    participant User as User
    link User: Component @ component_User.html
    participant GitHub_Container_Registry as GitHub Container Registry
    link GitHub_Container_Registry: Component @ component_GitHub_Container_Registry.html
    participant Host_storage as Host storage
    link Host_storage: Component @ component_Host_storage.html
    participant Container_manager as Container manager
    link Container_manager: Component @ component_Container_manager.html
    participant Cosign_Binary__embedded_ as Cosign Binary (embedded)
    link Cosign_Binary__embedded_: Component @ component_Cosign_Binary__embedded_.html
    participant Rekor_Log_Server as Rekor Log Server
    link Rekor_Log_Server: Component @ component_Rekor_Log_Server.html

    DZ_App->>User: 1. Should enable sandbox updates?
    User->>DZ_App: 2. User consent
    DZ_App->>GitHub_Container_Registry: 3. Query registry
    GitHub_Container_Registry->>DZ_App: 4. Registry response
    DZ_App->>Host_storage: 5. Store remote log index
    Host_storage->>DZ_App: 6. Read current log index
    DZ_App->>Container_manager: 7. Pull sandbox image
    DZ_App->>Cosign_Binary__embedded_: 8. Verify sandbox signatures
    Cosign_Binary__embedded_->>Rekor_Log_Server: 9. Verify rekor log
    Cosign_Binary__embedded_->>DZ_App: 10. Signature verification result
    DZ_App->>Host_storage: 11. Store signatures
    Container_manager->>Host_storage: 12. Install sandbox
    Container_manager->>GitHub_Container_Registry: 13. Pull sandbox image

Back to Summary