Welcome to SecureDrop’s developer documentation!

This documentation is intended for contributors to the SecureDrop project. If you are looking for information on how to install, use or maintain SecureDrop, please see our documentation for sources, journalists and administrators.

Getting Started

• Contributing to SecureDrop
  • Programmers
  • Technical Writers
  • UX Contributors
  • Translators
• Setting Up the Development Environment
  • Overview
  • Quick Start
  • Setting Up a Multi-Machine Environment
• Making a PR to SecureDrop
  • Forking and Cloning the Project
  • Make Your Changes and Push to the Fork
  • Making a Pull Request to Get Your Changes Merged in develop Branch
• Translations
  • Quick Start Guide
  • Weblate
  • How-To Guides
• Contributing Guidelines
  • Signing Commits
  • Code Review
  • Branching Strategy
  • Automated Testing
  • Code Style
  • Type Hints in Python code
  • Git History
  • Privileges
  • Other Tips
• Tips & Tricks
  • Using Tor Browser with the Development Environment
  • Upgrading or Adding Python Dependencies
  • Architecture Diagrams
• Policy on Supported Languages
  • Definitions
  • Thresholds for Translation and Review Coverage
  • Granting Support for a Language
  • Revoking Support for a Language
  • Adding a New Language for Translation
  • Technical Limitations
• Continuous Integration
  • Basics
  • Pull requests
  • Special branch prefixes
  • Nightlies
  • Workstation CI
• Dependency specification and update policies
  • Adding a dependency
  • Updating dependencies
  • Specifying version constraints
  • Dependency diff review procedure
  • Auditing Rust dependencies
• Reproducible builds
  • Goals
  • Build environment
  • Build metadata
  • Reproducible wheels
  • Not reproducible
  • Tools
• End-of-Life Maintenance Guidelines
  • Overview
  • EOL Tracking and Monitoring
  • SecureDrop Server Components
  • SecureDrop Workstation Components
  • Communication Protocol
• Language toolchains
  • Python
  • Rust
  • Node.js

SecureDrop Server

• Journalist Interface API
  • Versioning
  • Content Type
  • Authentication
  • Errors
  • Endpoints
  • Removed functionality
• Development of Securedrop-Admin in the Admin Directory
• Development of SecureDropUpdater in the journalist_gui Directory
  • Installing the Dependencies in a Virtual Environment
  • To Update the UI Design
  • Using Resources in the UI
  • Adding and Running Test Cases
• Virtual Environments: Servers
  • Staging
  • Production
• Virtual Environments: Admin Workstation
  • Linux
• Virtual Environments: Using Qubes
  • Overview
  • Download Ubuntu server ISO
  • Create the base VM
  • Boot into installation media
  • Initial VM configuration
  • Clone VMs
  • SecureDrop Installation
  • Managing Qubes RPC for Admin API capability
  • Creating staging instance
  • Accessing the Journalist Interface (Staging) in Whonix-based VMs
• Upgrade Testing using Molecule
  • Upgrade testing using locally-built packages
  • Upgrade testing using apt-test.freedom.press
• Database Migrations
  • Migration Files
  • Deployment
  • Developer Workflow
• Internationalization (i18n)
  • What languages are available where?
  • Development tasks
  • Release Management
  • Weblate administration
• Documentation Guidelines
  • Documentation versions
  • Updating Documentation
  • Testing Documentation Changes
  • Pushing to a contributor fork
  • Updating Screenshots
  • Updating Upgrade Guides
  • Style Guide
• Testing SecureDrop
• Testing: Application Tests
  • Running the Application Tests
  • Updating the Application Tests
• Testing: Configuration Tests
  • Installation
  • Running the Config Tests
  • Updating the Config Tests
  • Config Test Layout
  • Running the CI Staging Environment
• demo.securedrop.org
  • How it works
  • Containers
  • Troubleshooting
• Package repositories
  • Test repositories
  • QA repositories
  • Production repositories
  • How it works technically
• Debian packages
  • About dbgsym packages
• Updating OSSEC Rules
  • Alerting Strategy
  • Using ossec-logtest
  • Writing Automated Tests for OSSEC Rules
  • Adding new OSSEC rules
  • Deployment
• Generating AppArmor Profiles for Tor and Apache
• Portable SecureDrop Demo
  • Hardware
• Release Management
  • Pre-Release
  • Release Process
  • Post-Release
  • Releases that only modify code on Tails workstations
• Build metadata
  • Build logs
  • buildinfo
• Linux kernel maintenance
  • Testing a new kernel manually
• Updating Tor
  • Identifying new releases
  • Testing
  • Promoting

SecureDrop Workstation

• Setting up the SecureDrop Workstation
  • Install Qubes
  • Development Environment
  • Staging Environment
• SecureDrop Workstation Development
  • Testing
  • Automatic updates
  • Manually updating dom0 code
  • Building workstation Debian packages
  • Building workstation RPM packages
• SecureDrop Workstation Release Management
• Release a Debian package
  • Step 0: Tracking issue
  • Step 1: Create a release candidate (RC) tag
  • Step 2: Build and deploy the package to apt-test
  • Step 3: Begin QA
  • Step 4: Create a release tag
  • Step 5: Build and deploy the packages to apt-qa
  • Step 6: Perform the apt-qa preflight check
  • Step 7: Deploy the package to apt-prod
• Release an RPM package
  • Release securedrop-workstation-dom0-config
• Signing procedures
  • Sign the tag with the SecureDrop release key
  • Regenerate and sign the apt release file
  • Sign the RPM package
• Post-Release tasks
• SecureDrop Client Development
  • Developer Setup
  • How to Find Help
  • Client Architecture
  • Client Database Structure
  • Tests
  • Contributing
• SecureDrop App Development
  • Repository Overview
  • Development Setup
  • Synchronization Behavior