INSTALL.md

Operating System support

Dangerzone can run on various Operating Systems (OS), and has automated tests for most of them. This section explains which OS we support, how long we support each version, and how do we test Dangerzone against these.

You can find general support information in this table, and more details in the following sections.

(Unless specified, the architecture of the OS is AMD64)

Notes:

⥿ We provide support for Windows 10 on a best effort basis, given that it is currently end of life.

✢ Qubes OS support assumes the use of a Fedora template. The supported releases follow our general support for Fedora.

◎ More information in the runner-images repository

Note on unsupported Linux distros

.deb and .rpm packages are provided for supported distributions. Users of other Debian-based or Fedora-based distros — that are not listed above — may be able to install Dangerzone through these packages. Unfortunately, Dangerzone is not tested against these distros, and might fail to install, update, run, or be broken in subtle ways.

Please, proceed at your own risks, only if you know what you're doing.

MacOS

• Download Dangerzone 0.10.0 for Mac (Apple Silicon CPU)
• Download Dangerzone 0.10.0 for Mac (Intel CPU)

You can also install Dangerzone for Mac using Homebrew: brew install --cask dangerzone

Windows

• Download Dangerzone 0.10.0 for Windows

Podman sets the bottom line:

Since Podman uses WSL, you need a recent release of Windows 10 or Windows 11. On x64, WSL requires build 18362 or later, and 19041 or later is required for arm64 systems. Internally, WSL uses virtualization, so your system must support and have hardware virtualization enabled. If you are running Windows on a VM, you must have a VM that supports nested virtualization.

Linux

Dangerzone is available for:

• Ubuntu 25.10 (questing)
• Ubuntu 25.04 (plucky)
• Ubuntu 24.04 (noble)
• Ubuntu 22.04 (jammy)
• Debian 14 (forky)
• Debian 13 (trixie)
• Debian 12 (bookworm)
• Debian 11 (bullseye), support will be dropped in future releases.
• Fedora 43
• Fedora 42
• Fedora 41
• Tails
• Qubes OS (beta support)

Ubuntu, Debian

Add our repository following these instructions:

Download the GPG key for the repo:

sudo apt-get update && sudo apt-get install -y gpg ca-certificates
sudo mkdir -p /etc/apt/keyrings
sudo gpg --keyserver hkps://keys.openpgp.org \
    --no-default-keyring --no-permission-warning --homedir $(mktemp -d) \
    --keyring gnupg-ring:/etc/apt/keyrings/fpf-apt-tools-archive-keyring.gpg \
    --recv-keys DE28AB241FA48260FAC9B8BAA7C9B38522604281
sudo chmod +r /etc/apt/keyrings/fpf-apt-tools-archive-keyring.gpg

Add the URL of the repo in your APT sources:

. /etc/os-release
echo "deb [signed-by=/etc/apt/keyrings/fpf-apt-tools-archive-keyring.gpg] \
    https://packages.freedom.press/apt-tools-prod ${VERSION_CODENAME?} main" \
    | sudo tee /etc/apt/sources.list.d/fpf-apt-tools.list

Install Dangerzone:

sudo apt update
sudo apt install -y dangerzone

Fedora

Type the following commands in a terminal:

sudo dnf config-manager addrepo --from-repofile=https://packages.freedom.press/yum-tools-prod/dangerzone/dangerzone.repo
sudo dnf install dangerzone

Verifying Dangerzone GPG key

--------------------------------------------------------------------------------
Total                                           389 kB/s | 732 MB     32:07
Dangerzone repository                           3.8 MB/s | 3.8 kB     00:00
Importing GPG key 0x22604281:
 Userid     : "Dangerzone Release Key <dangerzone-release-key@freedom.press>"
 Fingerprint: DE28 AB24 1FA4 8260 FAC9 B8BA A7C9 B385 2260 4281
 From       : /etc/pki/rpm-gpg/RPM-GPG-dangerzone.pub
Is this ok [y/N]:

Fedora Atomic (Silverblue, Kinoite, etc.)

Type the following commands in a terminal:

curl -o - https://packages.freedom.press/yum-tools-prod/dangerzone/dangerzone.repo \
    | sudo tee /etc/yum.repos.d/dangerzone.repo > /dev/null
rpm-ostree install dangerzone

After the above command completes, restart your computer to complete the installation.

Qubes OS

The following steps must be completed once. Make sure you run them in the specified qubes.

Overview of the qubes you'll create:

In dom0:

Create a disposable, offline app qube (dz-dvm), based on your default template. This will be the qube where the documents will be sanitized:

qvm-create --class AppVM --label red --template fedora-42 \
    --prop netvm="" --prop template_for_dispvms=True \
    --prop default_dispvm='' dz-dvm

Add an RPC policy (/etc/qubes/policy.d/50-dangerzone.policy) that will allow launching a disposable qube (dz-dvm) when Dangerzone converts a document, with the following contents:

dz.Convert         *       @anyvm       @dispvm:dz-dvm  allow

In the fedora-42 template

Install Dangerzone:

sudo dnf config-manager addrepo --from-repofile=https://packages.freedom.press/yum-tools-prod/dangerzone/dangerzone.repo
sudo dnf install dangerzone-qubes

While Dangerzone gets installed, you will be prompted to accept a signing key. Expand the instructions in the Verifying Dangerzone GPG key section to verify the key.

Finally, shutdown the template and restart the qubes where you want to use Dangerzone in. Go to "Qube Settings" -> choose the "Applications" tab, click on "Refresh applications", and then move "Dangerzone" from the "Available" column to "Selected".

You can now launch Dangerzone from the list of applications for your qube, and pass it a file to sanitize.

Tails

Dangerzone is not yet available by default in Tails, but we have collaborated with the Tails team to offer manual installation instructions for Tails users.

Build from source

If you'd like to build from source, follow the build instructions.

Verifying PGP signatures

You can verify that the package you download is legitimate and hasn't been tampered with by verifying its PGP signature. For Windows and macOS, this step is optional and provides defense in depth: the Dangerzone binaries include operating system-specific signatures, and you can just rely on those alone if you'd like.

Obtaining signing key

Our binaries are signed with a PGP key owned by Freedom of the Press Foundation:

• Name: Dangerzone Release Key
• PGP public key fingerprint DE28 AB24 1FA4 8260 FAC9 B8BA A7C9 B385 2260 4281
  • You can download this key from the keys.openpgp.org keyserver.

(You can also cross-check this fingerprint with the fingerprint in our Mastodon page and the fingerprint in the footer of our official site)

You must have GnuPG installed to verify signatures. For macOS you probably want GPGTools, and for Windows you probably want Gpg4win.

Signatures

Our GitHub Releases page hosts the following files:

• Windows installer (Dangerzone-<version>.msi)
• macOS archives (Dangerzone-<version>-<arch>.dmg)
• Container images (container-<version>-<arch>.tar)
• Source package (dangerzone-<version>.tar.gz)

All these files are accompanied by signatures (as .asc files). We'll explain how to verify them below, using 0.6.1 as an example.

Verifying

Once you have imported the Dangerzone release key into your GnuPG keychain, downloaded the binary and .asc signature, you can verify the binary in a terminal like this:

For the Windows binary:

gpg --verify Dangerzone-0.6.1.msi.asc Dangerzone-0.6.1.msi

For the macOS binaries (depending on your architecture):

gpg --verify Dangerzone-0.6.1-arm64.dmg.asc Dangerzone-0.6.1-arm64.dmg
gpg --verify Dangerzone-0.6.1-i686.dmg.asc Dangerzone-0.6.1-i686.dmg

For the container images:

gpg --verify container-0.6.1-i686.tar.asc container-0.6.1-i686.tar

For the source package:

gpg --verify dangerzone-0.6.1.tar.gz.asc dangerzone-0.6.1.tar.gz

We also hash all the above files with SHA-256, and provide a list of these hashes as a separate file (checksums-0.6.1.txt). This file is signed as well, and the signature is embedded within it. You can download this file and verify it with:

gpg --verify checksums.txt

The expected output looks like this:

gpg: Signature made Mon Apr 22 09:29:22 2024 PDT
gpg:                using RSA key 04CABEB5DD76BACF2BD43D2FF3ACC60F62EA51CB
gpg: Good signature from "Dangerzone Release Key <dangerzone-release-key@freedom.press>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: DE28 AB24 1FA4 8260 FAC9  B8BA A7C9 B385 2260 4281
     Subkey fingerprint: 04CA BEB5 DD76 BACF 2BD4  3D2F F3AC C60F 62EA 51CB

If you don't see Good signature from, there might be a problem with the integrity of the file (malicious or otherwise), and you should not install the package.

The WARNING: shown above, is not a problem with the package, it only means you haven't defined a level of "trust" for Dangerzone's PGP key.

If you want to learn more about verifying PGP signatures, the guides for Qubes OS and the Tor Project may be useful.