By contributing to this project, you agree to abide by our Code of Conduct.
securedrop-https-everywhere-ruleset is used to create a signed HTTPS Everywhere ruleset that maps full-length .onion addresses to user-friendly onion names for some news organizations listed in the SecureDrop directory. Any time a new onion name is approved, we add its mapping to our HTTPS Everywhere ruleset and deploy it to https://securedrop.org/https-everywhere/ . Tor Browser automatically includes our ruleset in the default HTTPS Everywhere extension and checks for updates on startup. (Tor Browser will soon switch to checking https://securedrop.org/https-everywhere-2021/ which uses our new release signing key).
First, install poetry and run poetry install --with=dev.
You can create a test key for signing using:
make test-key
which will create test-key.jwk in your current working directory.
-
Ensure they are in the official SecureDrop directory. If they are not, go through the IVF process with the organization.
-
Add their domain name and the requested URL to the
onboarded.txtvia PR into this repository. We match the domain based on the landing page of the organization, comparing thenetlocin a URL with structurescheme://netloc/path;parameters?query#fragment. -
Next, generate and sign the update ruleset using the following command (requires signing key, please ping a key holder for assistance):
make rules
- Commit all files generated by the script above and open a Pull Request to this repository. Once the PR is merged, the rulesets will automatically be deployed to production.
Inspect the diff. If it looks good, commit the resulting index.html and all files to be served. To test locally, run
make serve
And configure your browser to use http://localhost:4080/https-everywhere/.
Upon merge the container will be published to quay.io/freedomofpress and the new tag will be deployed automatically.