DA Privacy Kit v0.1.0b4

A review release of DA Privacy Kit's public beta. Two rounds of testing on real machines (Linux Mint, KDE Plasma
on CachyOS, Fedora, Ubuntu and Omarchy) found about 180 problems, from wrong results to things written where they
shouldn't be. All of them are fixed here. Tor or Mullvad Browser in memory, What does this app keep? and Try an app had
a review of their own. 0.1.0b3 was a test build that was never published; this release includes everything in it.

Warning

Still a public beta: expect bugs. It is best used to scan, to learn about your own system and to try its
tools: don't rely on it yet for critical privacy matters. Several fixes and tools run commands with
administrator rights, so keep backups. It is no replacement for Tails or
Qubes OS, and it isn't antivirus.

New

• Keep the browser download for next time. In Tools → Tor or Mullvad Browser in memory, the download dialog
  has a tick, off by default: Keep the download for next time. The archive and its signature are then kept in
  ~/.cache/daprivacyscanner/browsers/, so the next set-up needn't download it again. A kept copy goes through the
  same checks as an archive you pick yourself:

  • the project's server is asked for the latest version, and a kept copy that is out of date is refused, with the
    new version offered for download;
  • its signature is verified again.

  The dialog says what keeping means: the file on your disk tells anyone who looks that the browser was set up on
  this computer, and deleting it later doesn't erase it. Kept copies are listed in the panel with Delete….

Privacy fixes

• Scans no longer write anything into your home folder.
  • On Fedora, every scan copied about 105 MB of package lists into ~/.cache.
  • Checking Flatpak made ~/.local/share/flatpak.
  • The online package test kept 269 MB of lists in ~/.cache. They now go in memory and are removed at once, and
    the copy an earlier version left is removed.
• The Outbox no longer writes the names of the files you share into the system journal. Its notification only
  ever counted them, but its log listed every name. The app's own units and timers now log counts only.
• Tor or Mullvad Browser in memory:
  • Your user name, home folder and computer name could be read from inside the browser's sandbox. The sandbox's
    first process carried them. A website that took the browser over can't read them now.
  • The sandbox's local-network fence missed some networks. It covered only the network card the browser's
    network was copied from. It now refuses every network this computer is on: a second card, Docker's or a virtual
    machine's network, a VPN's private ranges.
  • The sandbox no longer gets your real network addresses. Before, it showed your real IPv6 address and your
    router's hardware address. It now has addresses of its own.
  • More of the computer is hidden from the browser: the graphics card's serial number, the addresses of
    Bluetooth input devices, and the sizes of your disks and swap.
  • tor runs in a sandbox of its own, without the display, its X11 cookie, your sound or the browser's profile.
  • Closing a window opened by a right-click entry no longer wipes ~/TempBrowser. Every "Verify download…" or
    "Remove metadata…" window is a copy of the app, and closing one overwrote and deleted ~/TempBrowser, a download
    not saved yet with it. Only the window that opened ~/TempBrowser closes it now.
  • Add a file to upload… no longer follows a link a website planted in the Downloads folder. Before, such a link
    could have copied a file such as an SSH key to where the browser can read it.
  • View offline… with a Flatpak viewer no longer opens the file online. If that app was already open, the file
    was handed to the open copy, which has the network and keeps history. It is now refused while the app is open,
    and the viewer runs in Flatpak's strictest sandbox: no network, no files of yours, no sound, and no help from the
    desktop's file services, which could fetch a web address for it.
  • No more dated journal lines about the browser's sessions. Closing ~/TempBrowser left one every time, and
    quitting the app printed which browser had been used.
  • Downloads and the TempOutbox:
    • a download changed in place is judged again;
    • the TempOutbox no longer passes on a file that is still being copied in;
    • a crafted download can no longer stall the panel.
• What does this app keep? no longer names your own documents. A document an app saves often was listed by name.
  It is now only counted, as the page promises. The system journal no longer records which app you watched.
• Try an app:
  • quitting the app's window now discards the trial, which could stay on the disk with everything the tried app
    wrote;
  • a trial with the observed network now ends if the app is killed;
  • the tried program can no longer read your environment.

Wrong results fixed

• Secure Boot showed as "not supported" on every UEFI computer. The check read the wrong EFI variable.
• KDE Connect still showed as running after you removed it. It does run until you log out, from the program you
  removed: the check now says so, and the guide stops it.
• Fedora: firewalld 2.x's zones are read correctly, and so is NetworkManager's own setting for random hardware
  addresses, which outranked the app's. Security updates are counted by package, not by date.
• KDE Plasma:
  • thumbnails are found as Qt writes them;
  • the recent-files lock for Gwenview and Okular now holds;
  • the fix that keeps KDE Connect from being started again works at once, not only after you next log in.
• Kernel options are read as the kernel reads them: the last value given wins.
• Easy fixes no longer undo a stricter setting. After you chose to keep the system journal in memory only, Easy
  fixes offered a two-week limit that replaced it. Changes that two checks share are listed once.
• Undoing a fix says what really happened. It said "put back" while a folder in memory was still mounted.
• Turning Avahi off lasts. The printer service started it again at every boot. It is now masked, not only
  disabled, and undoing the fix unmasks it.
• Arch and Omarchy: install commands use pacman -Syu. Package lists that were never downloaded no longer read
  as "everything is up to date": the check says it couldn't tell.

Tools

• What does this app keep? finds more of what an app leaves:
  • the recent-files and file-metadata records GTK, Qt and Cinnamon write, KDE's compressed thumbnail names, and
    names with brackets or &;
  • an app that is already open behind a launcher script, such as LibreOffice, is now refused instead of giving an
    empty result;
  • a disk mounted in your home folder or during the watch is watched, or the page says why it can't be;
  • under heavy load it no longer takes kernel memory without limit, and events it had to drop are counted.
• Try an app:
  • the network report names each connection by the site it asked for, also when sites share an address;
  • a Box whose program fails at start says so in a dialog;
  • a newer program kept in a Box replaces the old one.
• Logging out with ~/TempBrowser open:
  • KDE Plasma: it is closed properly, with no password. Plasma closes the app's window, the app overwrites what
    is in it, and the computer unmounts it once you are logged out.
  • Cinnamon: quit the app before logging out (see below).

Install

Download DAPrivacyKit-0.1.0b4-x86_64.AppImage, make it executable and run it:

chmod +x DAPrivacyKit-0.1.0b4-x86_64.AppImage
./DAPrivacyKit-0.1.0b4-x86_64.AppImage
./DAPrivacyKit-0.1.0b4-x86_64.AppImage --install-helper    # once, recommended: the administrator helper

Coming from 0.1.0b2, replace the old file. History, accepted findings and the last report are kept in your home
folder, not in the AppImage, so they carry over. The administrator helper has changed: if you installed it, the
app says the installed one is from another version. Install this version's from the app, or with --install-helper
as above.

It needs x86-64 Linux with WebKitGTK 4.1 for its window:

Distribution
Ubuntu, Mint, Debian	sudo apt install gir1.2-webkit2-4.1
Fedora	sudo dnf install webkit2gtk4.1
Arch, CachyOS	sudo pacman -S webkit2gtk-4.1

The README says what it is; the
manual covers the rest.

Verify

The release is signed with the Digital Archon release key,
docs/release-key.asc, whose
fingerprint is:

3AA5 C061 33BB C05A 4151  EA41 5B59 48EB 785E D3AF

If you have 0.1.0b2, open Tools → Verify a download and choose the new AppImage. With its .asc beside it, it
should say Verified: made by Digital Archon. By hand, with the AppImage, its .asc and its .sha256 in one folder:

curl -sSfO https://raw.githubusercontent.com/DigitalArchon/DAPrivacyKit/v0.1.0b4/docs/release-key.asc
gpg --import release-key.asc
gpg --verify DAPrivacyKit-0.1.0b4-x86_64.AppImage.asc DAPrivacyKit-0.1.0b4-x86_64.AppImage
sha256sum -c DAPrivacyKit-0.1.0b4-x86_64.AppImage.sha256

gpg should say Good signature from "Digital Archon Release Signing", with the fingerprint above (its
warning that the key isn't certified is normal).

SHA-256: ad2b91bed1009df37b9f216ae19bd619d6d7e6257f1be4bb2e94404dc79aa71d

The AppImage is reproducible: packaging/verify-release.sh v0.1.0b4 in a clone (rootless Podman) builds the
tag and compares the result with this release, byte for byte. See
packaging/README.md.

Known limitations

As in 0.1.0b1:

• made for and tested on Cinnamon (Linux Mint) and KDE Plasma 6 only;
• some checks need administrator access;
• deleting is not erasing;
• x86-64 only.

The 0.1.0b1 notes have the full list.

New in this release:

• On Cinnamon, quit the app before you log out. Logging out ends the app along with the display, before it can
  overwrite ~/TempBrowser, which can then stay mounted until you restart.
• What the browser's sandbox can't hide, now said in the panel:
  • when the computer was started, and the login session's number: restart between sessions to keep them apart;
  • your disks' device names.
• What a tried app can read: the kernel's command line and the boot ID. Hiding them would break apps that start
  sandboxes of their own.

Feedback

Bugs and ideas: issues, with a redacted report if it
helps (Export… with Redact ticked; read it first, since an issue is public). Security problems: please
report privately as described in
SECURITY.md.

Licensed GPL-3.0-or-later.