From b016ae782bdf8559e6350b43d45e2cec8ca29a3b Mon Sep 17 00:00:00 2001 From: DarkFeather Date: Fri, 6 Dec 2019 17:08:05 -0600 Subject: [PATCH] Created warrant_canary and first signature --- README.md | 14 ++++++- canary | 22 ++++++++++ canary.asc | 32 +++++++++++++++ warrant_canary | 107 +++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 174 insertions(+), 1 deletion(-) create mode 100644 canary create mode 100644 canary.asc create mode 100755 warrant_canary diff --git a/README.md b/README.md index 4c1bed3..e39d871 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,16 @@ # WarrantCanary Warrant canaries are a security industry standard for ensuring our network has not been compromised. -https://en.wikipedia.org/wiki/Warrant_canary \ No newline at end of file +https://en.wikipedia.org/wiki/Warrant_canary + +## ./warrant_canary +``` +Use this script to seed or verify a warrant canary +Usage: ./warrant_canary -V # Verify the AniNIX's warrant canary + ./warrant_canary -V -k KEY -K KEYSERVER -c CANARY # Verify another warrant canary + ./warrant_canary -s # Seed a warrant canary. +Add -v to increase verbosity. +``` + +## ./canary.asc +This is the AniNIX's current warrant canary. diff --git a/canary b/canary new file mode 100644 index 0000000..be3efa6 --- /dev/null +++ b/canary @@ -0,0 +1,22 @@ + +As of 2019-12-06, aninix.net has not received any National Security Letters or FISA court orders, and we have not been subject to any gag order(s) by a FISA court, or any other similar court(s) of any government. AniNIX has never placed any backdoors in our hardware or software and has not received any requests to do so. AniNIX has never disclosed any user communications to any third party. No searches or seizures of any kind have ever been performed on AniNIX assets. + +The next two updates should be on or before: +* 2020-03-05 +* 2020-06-03 + +Recent news: +* https://www.aljazeera.com/blogs/americas/2019/12/chile-protesters-rich-powerful-threw-stone-191206211320350.html +* https://www.npr.org/2019/12/06/785671274/remembering-tetsu-nakamura-japanese-doctor-who-spent-decades-working-in-afghanis + +To verify this message, on the terminal import our public key from pool.sks-keyservers.net and verify the canary: +$ gpg --keyserver pool.sks-keyservers.net --recv-key 1CC1E3F4ED06F296 +$ gpg2 --fingerprint 1CC1E3F4ED06F296 +pub ed25519 2019-05-19 [SC] [expires: 2021-05-18] + 904D E627 5579 CB58 9D85 720C 1CC1 E3F4 ED06 F296 +uid [ultimate] Shikoba Kage +sub cv25519 2019-05-19 [E] [expires: 2021-05-18] +$ gpg --verify <(curl -s https://foundation.aninix.net/AniNIX/WarrantCanary/raw/branch/master/canary.asc) 2>&1 | grep 'Good signature' +gpg: Good signature from "Shikoba Kage " + +There will most likely be other lines in the output from that last command, but as long as it says "Good signature", the verification worked correctly. diff --git a/canary.asc b/canary.asc new file mode 100644 index 0000000..d81deea --- /dev/null +++ b/canary.asc @@ -0,0 +1,32 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + + +As of 2019-12-06, aninix.net has not received any National Security Letters or FISA court orders, and we have not been subject to any gag order(s) by a FISA court, or any other similar court(s) of any government. AniNIX has never placed any backdoors in our hardware or software and has not received any requests to do so. AniNIX has never disclosed any user communications to any third party. No searches or seizures of any kind have ever been performed on AniNIX assets. + +The next two updates should be on or before: +* 2020-03-05 +* 2020-06-03 + +Recent news: +* https://www.aljazeera.com/blogs/americas/2019/12/chile-protesters-rich-powerful-threw-stone-191206211320350.html +* https://www.npr.org/2019/12/06/785671274/remembering-tetsu-nakamura-japanese-doctor-who-spent-decades-working-in-afghanis + +To verify this message, on the terminal import our public key from pool.sks-keyservers.net and verify the canary: +$ gpg --keyserver pool.sks-keyservers.net --recv-key 1CC1E3F4ED06F296 +$ gpg2 --fingerprint 1CC1E3F4ED06F296 +pub ed25519 2019-05-19 [SC] [expires: 2021-05-18] + 904D E627 5579 CB58 9D85 720C 1CC1 E3F4 ED06 F296 +uid [ultimate] Shikoba Kage +sub cv25519 2019-05-19 [E] [expires: 2021-05-18] +$ gpg --verify <(curl -s https://foundation.aninix.net/AniNIX/WarrantCanary/raw/branch/master/canary.asc) 2>&1 | grep 'Good signature' +gpg: Good signature from "Shikoba Kage " + +There will most likely be other lines in the output from that last command, but as long as it says "Good signature", the verification worked correctly. +-----BEGIN PGP SIGNATURE----- + +iHUEARYKAB0WIQSQTeYnVXnLWJ2FcgwcweP07QbylgUCXerfBQAKCRAcweP07Qby +lny4AQDuEc/4nlBcZXeU1CzMiYE5lMvTHCRZJXkpF5sVzJ+ytAEAoLT6yaYrFtMl +BZWZScUx3lsJ0Q/k/pEcV5XabVFVfQA= +=z9mI +-----END PGP SIGNATURE----- diff --git a/warrant_canary b/warrant_canary new file mode 100755 index 0000000..14bf992 --- /dev/null +++ b/warrant_canary @@ -0,0 +1,107 @@ +#!/bin/bash + +source /opt/aninix/Uniglot/Bash/header + +unset canaryText +# cscanary=https://cryptostorm.is/canary.txt +# cskeyserver=pgp.mit.edu +# cskey=E9C7C942 +keyserver=pool.sks-keyservers.net +key=1CC1E3F4ED06F296 +canary=https://foundation.aninix.net/AniNIX/WarrantCanary/raw/branch/master/canary.asc +alJazeera='https://www.aljazeera.com/xml/rss/all.xml' +npr='https://www.npr.org/rss/rss.php?id=1004' + +function Usage() { + # Show helptext + # param retcode: what to exit + retcode=$1 + echo "Usage: $0 -V # Verify the AniNIX's warrant canary" + echo " $0 -V -k KEY -K KEYSERVER -c CANARY # Verify another warrant canary" + echo " $0 -s # Seed a warrant canary." + echo "Add -v to increase verbosity." + exit $retcode +} + +function ConfirmGPGKeys() { + # Try to make sure we either have or can pull the key + if ! gpg2 --fingerprint "$key"; then + gpg --keyserver "$keyserver" --recv-key "$key" + if ! [ $? -eq 0 ] || gpg2 --fingerprint "$key"; then + echo Cannot pull the key: "$key". + exit 1; + fi + fi +} + +function RecentNews() { + # Pull the first recent news article from an RSS feed. + # param rssFeed: the url to pull + rssFeed="$1" + curl -s "$rssFeed" | tr '<' '\n' | egrep -m 5 link | tail -n 1 | cut -f 2 -d '>' | cut -f 1 -d '?' +} + +function CanarySeed() { + header Creating and signing a canary message + time=`date +%s` + cat > ./canary << EOM + +As of $(date +%F), aninix.net has not received any National Security Letters or FISA court orders, and we have not been subject to any gag order(s) by a FISA court, or any other similar court(s) of any government. AniNIX has never placed any backdoors in our hardware or software and has not received any requests to do so. AniNIX has never disclosed any user communications to any third party. No searches or seizures of any kind have ever been performed on AniNIX assets. + +The next two updates should be on or before: +* `date -d @$(( $time + 7776000 )) +%F` +* `date -d @$(( $time + 15552000 )) +%F` + +Recent news: +* $(RecentNews "$alJazeera") +* $(RecentNews "$npr") + +To verify this message, on the terminal import our public key from $keyserver and verify the canary: +$ gpg --keyserver $keyserver --recv-key $key +$ gpg2 --fingerprint $key +$(gpg2 --fingerprint $key) +$ gpg --verify <(curl -s $canary) 2>&1 | grep 'Good signature' +gpg: Good signature from "Shikoba Kage " + +There will most likely be other lines in the output from that last command, but as long as it says "Good signature", the verification worked correctly. +EOM + gpg --default-key "$key" --personal-digest-preferences sha512 --clear-sign ./canary + retcode=$? + if [ $retcode -eq 0 ]; then header Success; else errorheader Fail; fi + exit $retcode +} + +function CanaryVerify() { + # Verify a canary + header Fingerprinting: + ConfirmGPGKeys + echo + header Verification: + if [ -f "$canary" ]; then + canaryText="$(cat "$canary")" + else + canaryText="$(curl -s "$canary")" + fi + gpg --verify <(echo "$canaryText") 2>&1 | grep -v 'WARNING: not a detached signature' + retcode=$? + echo + header Human-readable text: + echo "$canaryText" | grep -B 99 'To verify this' | grep -v 'To verify this' + exit $retcode +} + +# Parse arguments +while getopts 'c:hk:K:svV' OPTION; do + case "$OPTION" in + c) canary="$OPTARG" ;; + h) echo Use this script to seed or verify a warrant canary; Usage 0 ;; + k) key="$OPTARG" ;; + K) keyserver="$OPTARG" ;; + s) CanarySeed ;; + v) set -x ;; + V) CanaryVerify ;; + *) Usage 1 ;; + esac +done + +CanaryVerify