Component: FPF apt repository
Defined in model.py:289
Serves FPF packages plus the mirrored Tor apt packages.
Threats Affecting This Component
| Threat | Status | Risk | After mitigations | Mitigations |
|---|---|---|---|---|
| APT server man-in-the-middle and replaying old packages THREAT53 | partially mitigated | 6 medium | 3 low | Valid-Until for apt packages |
| SecureDrop APT servers are compromised or APT server man-in-the middle attack with malicious packages. THREAT54 | mitigated | 6 medium | 3 low | All SecureDrop and tor releases (Release file and tag) signed with airgapped key; tag verified before building debian packages |
| Tor (now FPF) apt repo compromised THREAT44 | mitigated | 3 low | 3 low | All SecureDrop and tor releases (Release file and tag) signed with airgapped key |