In version 0.10.0, Dangerzone — a Freedom of the Press Foundation open-source tool that protects journalists while they view electronic documents — introduced a feature that allows users to auto-update the container used to do conversions. This article goes through why that matters and how we implemented it: attesting the provenance of the images, making them reproducible, and signing them using an auditable system. Signatures are stored in a transparency log and verified prior to any download and use.
Find out more on the Dangerzone blog.
