DZ-1-DEPS:

Comment

Check that every component that explicitly loads dependencies also verifies them.

Unknown

Severity

occurrences in scenarios

Frequency

Affected Components

Affected Scenarios

Requirements and Mitigations

Requirements

Component properties that must be true for this threat to apply:

Mitigations

Component properties that mitigate this threat:

Affected Components

Component	Description	Boundary
Build machines	Build machines (Mac minis) operated by FPF Infra	FPF-operated Tailnet

Affected Scenarios

release — affects: Build machines

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Certum_Card_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Certum Card";
            URL = "component_Certum_Card.html";
            tooltip = "Certum Card";
            margin = 0.02;
        ]

        component_YubiKey_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "YubiKey";
            URL = "component_YubiKey.html";
            tooltip = "YubiKey";
            margin = 0.02;
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_External_github_repositories_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "External github\nrepositories";
            URL = "component_External_github_repositories.html";
            tooltip = "External github repositories";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_External_github_repositories_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Download embedded\nassets";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Build DZ binaries";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Sign release\nbinary for Linux";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Certum_Card_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Sign Windows\nbinary";    ]
    component_Certum_Card_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Windows signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_YubiKey_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Sign Apple binary";    ]
    component_YubiKey_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Apple signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "10. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "11. Create GitHub\nrelease";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "12. Embed sandbox\npublic key";    ]
    actor_dev_FPF_operated_Tailnet -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "13. Update release\nreference";    ]
}

release_basic — affects: Build machines

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_External_github_repositories_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "External github\nrepositories";
            URL = "component_External_github_repositories.html";
            tooltip = "External github repositories";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        server_dangerzone_rocks_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "dangerzone.rocks";
            URL = "component_dangerzone_rocks.html";
            tooltip = "dangerzone.rocks";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_External_github_repositories_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Download embedded\nassets";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Build DZ binaries";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Create GitHub\nrelease";    ]
    actor_dev_FPF_operated_Tailnet -> server_dangerzone_rocks_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Update release\nreference";    ]
}

release_signatures — affects: Build machines

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Certum_Card_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Certum Card";
            URL = "component_Certum_Card.html";
            tooltip = "Certum Card";
            margin = 0.02;
        ]

        component_YubiKey_FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "YubiKey";
            URL = "component_YubiKey.html";
            tooltip = "YubiKey";
            margin = 0.02;
        ]

        actor_dev_FPF_operated_Tailnet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "dev";
            URL = "component_dev.html";
            tooltip = "dev";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_DZ_GitHub_repo_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "DZ GitHub repo";
            URL = "component_DZ_GitHub_repo.html";
            tooltip = "DZ GitHub repo";
            margin = 0.02;
        ]

        server_DZ_Linux_package_server_Internet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "DZ Linux package\nserver";
            URL = "component_DZ_Linux_package_server.html";
            tooltip = "DZ Linux package server";
            margin = 0.02;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

    }

    actor_dev_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Kick off release\nbuild";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Build and publish\nsigned container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Sign release\nbinary for Linux";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Certum_Card_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sign Windows\nbinary";    ]
    component_Certum_Card_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Windows signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_YubiKey_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Sign Apple binary";    ]
    component_YubiKey_FPF_operated_Tailnet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apple signature\nresult";    ]
    server_Build_machines_FPF_operated_Tailnet -> server_DZ_Linux_package_server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Push signed\nbuilds to Linux\nrepos";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_DZ_GitHub_repo_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "9. Create GitHub\nrelease";    ]
}

release_sandbox — affects: Build machines

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_FPF_operated_Tailnet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <FPF-operated Tailnet>;
        ]

        server_Build_machines_FPF_operated_Tailnet [
            shape = box;
            color = black;
            fontcolor = black;
            label = "Build machines";
            URL = "component_Build_machines.html";
            tooltip = "Build machines";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_Cosign_Binary__build_machines__FPF_operated_Tailnet [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Cosign Binary\n(build machines)";
            URL = "component_Cosign_Binary__build_machines_.html";
            tooltip = "Cosign Binary (build machines)";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Internet {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <Internet>;
        ]

        externalentity_GitHub_Container_Registry_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "GitHub Container\nRegistry";
            URL = "component_GitHub_Container_Registry.html";
            tooltip = "GitHub Container Registry";
            margin = 0.02;
        ]

        externalentity_Rekor_Log_Server_Internet [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Rekor Log Server";
            URL = "component_Rekor_Log_Server.html";
            tooltip = "Rekor Log Server";
            margin = 0.02;
        ]

    }

    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "2. Push container to\nGHCR";    ]
    component_Cosign_Binary__build_machines__FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "3. Sign remote\nsandbox image";    ]
    component_Cosign_Binary__build_machines__FPF_operated_Tailnet -> externalentity_Rekor_Log_Server_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "4. Publish rekor\nlogs";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "5. Request signed\nsandbox tarball";    ]
    externalentity_GitHub_Container_Registry_Internet -> server_Build_machines_FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "6. Response with the\nsigned sandbox +\nsignatures";    ]
    server_Build_machines_FPF_operated_Tailnet -> component_Cosign_Binary__build_machines__FPF_operated_Tailnet [        color = black;        fontcolor = black;        dir = forward;        label = "7. Generate the\nsandbox tarball from\nthe pulled container\nimage";    ]
    server_Build_machines_FPF_operated_Tailnet -> externalentity_GitHub_Container_Registry_Internet [        color = black;        fontcolor = black;        dir = forward;        label = "8. Tag remote\nsandbox";    ]
}

Back to Summary