Security

Identity and Access Management is a critical aspect of cloud security, and as such, security is a top priority in the development and maintenance of Granted. If you have any security questions you may email granted-support@fwdcloudsec.org.

Design notes

Granted utilises the AWS Go SDK v2 for all credential exchange processes including handling of the AWS SSO login process. This SDK is officially supported by AWS.

Release Verification

Granted binaries are signed with our GPG key. You can verify the integrity and authenticity of a Granted binary by following the process below.

Prior to verifying a release you must import our GPG key

# get the key from Keybase, GitHub, or https://docs.granted.dev/security, and save it as granted.asc.
gpg import granted.asc

Download the Granted release artifact you wish to verify (we will use the Linux x86_64 version as an example):
```
curl -OL releases.granted.dev/granted/v0.38.0/granted_0.38.0_linux_x86_64.tar.gz
```

Download the checksums for the release:

curl -OL releases.granted.dev/granted/v0.38.0/checksums.txt

Download the signature file:

curl -OL releases.granted.dev/granted/v0.38.0/checksums.txt.sig

Verify the integrity of the release artifact:
Terminal window
```
shasum -a 256 -c checksums.txt --ignore-missing
```
You should see an output similar to the below:
```
granted_0.38.0_linux_x86_64.tar.gz: OK
```
Verify the integrity and authenticity of the checksums:
```
gpg --verify ./checksums.txt.sig
```

Firefox addon security

The Granted Firefox addon operates with the minimum possible permissions and does not have the ability to read information from any web pages. By design, the extension does not have permission to read any information from the DOM when you are accessing cloud provider consoles. The extension uses a Background Script which can’t directly access web page content.

The permissions that this extension requires are:

Permission	Reason
contextualIdentities	used to manage tab containers via the contextualIdentity API
cookies	required to access container tab stores in order to list available identities
tabs	required to open a new tab in a container
storage	required to store information on the list of available containers

Additionally, the source code for the addon is available on GitHub under the MIT licence. Security-conscious users may opt to build the extension from source and install it locally: instructions on how to do so are available in the GitHub repository.

Vulnerability Reporting

We deeply appreciate any effort to discover and disclose any security vulnerabilities in Granted. We currently do not operate a public bounty program but individuals may be acknowledged in security notifications as appropriate.

If you would like to report a vulnerability in Granted, please email granted-support@fwdcloudsec.org rather than raising an issue on GitHub. We ask that you follow the responsible disclosure model. You may encrypt your message with our PGP key printed below.

PGP Public Key

Our release signing PGP public key has fingerprint 59AD 05A4 DA73 FD45 BABB 0D14 236F B5E3 8552 8EB4. A copy of the public key is included below.

Linux package signing key

Our Linux APT repository is signed with a separate GPG key. The key is available at https://apt.releases.granted.dev/gpg and has the fingerprint B608 F73B 86DF B0E0 C49E B973 CBCC 5289 67C2 0914. A copy of the public key is included below:

Legacy keys

Keys used prior to v0.39.0 (Common Fate era)

Legacy release signing key

Fingerprint: 65AB 725B 01E6 5C85 051F 9FD5 5024 78AB E3D8 ED71

Previously available on Keybase.

Legacy Linux package signing key

Fingerprint: 783A 4D1A 3057 4D2A BED0 49DD DE9D 631D 2D1D C944

Previously available at https://apt.releases.commonfate.io/gpg.