alee/fieldwitness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rebrand SooSeF to FieldWitness

Browse Source 
Complete project rebrand for better positioning in the press freedom
and digital security space. FieldWitness communicates both field
deployment and evidence testimony — appropriate for the target audience
of journalists, NGOs, and human rights organizations.

Rename mapping:
- soosef → fieldwitness (package, CLI, all imports)
- soosef.stegasoo → fieldwitness.stego
- soosef.verisoo → fieldwitness.attest
- ~/.soosef/ → ~/.fwmetadata/ (innocuous data dir name)
- SOOSEF_DATA_DIR → FIELDWITNESS_DATA_DIR
- SoosefConfig → FieldWitnessConfig
- SoosefError → FieldWitnessError

Also includes:
- License switch from MIT to GPL-3.0
- C2PA bridge module (Phase 0-2 MVP): cert.py, export.py, vendor_assertions.py
- README repositioned to lead with provenance/federation, stego backgrounded
- Threat model skeleton at docs/security/threat-model.md
- Planning docs: docs/planning/c2pa-integration.md, docs/planning/gtm-feasibility.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Aaron D. Lee
2026-04-02 15:05:13 -04:00
parent 6325e86873
commit 490f9d4a1d
188 changed files with 4588 additions and 2017 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
deploy/config-presets/README.md
View File

@@ -1,7 +1,7 @@
# SooSeF Threat Level Configuration Presets
# FieldWitness Threat Level Configuration Presets
Select a preset based on your operational environment. Copy the appropriate
JSON file to `~/.soosef/config.json` (or let the setup wizard choose one).
JSON file to `~/.fwmetadata/config.json` (or let the setup wizard choose one).
## Presets
@@ -40,7 +40,7 @@ Specific journalist or org targeted by state actor (Pegasus-level).
```bash
# Copy preset to config location
cp deploy/config-presets/high-threat.json ~/.soosef/config.json
cp deploy/config-presets/high-threat.json ~/.fwmetadata/config.json
# Or via CLI (future: soosef init --threat-level high)
# Or via CLI (future: fieldwitness init --threat-level high)
```

42
deploy/docker/Dockerfile
View File

@@ -1,13 +1,13 @@
# SooSeF Federation Server
# FieldWitness Federation Server
# Multi-stage build for minimal image size.
#
# Tier 2: Org server (full features — web UI, attestation, federation, stego)
# docker build -t soosef-server .
# docker run -v soosef-data:/data -p 5000:5000 -p 8000:8000 soosef-server
# docker build -t fieldwitness-server .
# docker run -v fieldwitness-data:/data -p 5000:5000 -p 8000:8000 fieldwitness-server
#
# Tier 3: Federation relay (attestation + federation only, no stego, no web UI)
# docker build --target relay -t soosef-relay .
# docker run -v relay-data:/data -p 8000:8000 soosef-relay
# docker build --target relay -t fieldwitness-relay .
# docker run -v relay-data:/data -p 8000:8000 fieldwitness-relay
# === Stage 1: Build dependencies ===
FROM python:3.12-slim-bookworm AS builder
@@ -22,8 +22,8 @@ WORKDIR /build
COPY . .
# Install into a virtual environment for clean copying
RUN python -m venv /opt/soosef-env \
&& /opt/soosef-env/bin/pip install --no-cache-dir \
RUN python -m venv /opt/fieldwitness-env \
&& /opt/fieldwitness-env/bin/pip install --no-cache-dir \
".[web,cli,attest,stego-dct,api,federation]"
# === Stage 2: Federation relay (minimal) ===
@@ -32,21 +32,21 @@ FROM python:3.12-slim-bookworm AS relay
RUN apt-get update && apt-get install -y --no-install-recommends \
libjpeg62-turbo libopenblas0 \
&& rm -rf /var/lib/apt/lists/* \
&& useradd -m -s /bin/bash soosef
&& useradd -m -s /bin/bash fieldwitness
COPY --from=builder /opt/soosef-env /opt/soosef-env
COPY --from=builder /opt/fieldwitness-env /opt/fieldwitness-env
ENV PATH="/opt/soosef-env/bin:$PATH" \
SOOSEF_DATA_DIR=/data \
ENV PATH="/opt/fieldwitness-env/bin:$PATH" \
FIELDWITNESS_DATA_DIR=/data \
PYTHONUNBUFFERED=1
VOLUME /data
EXPOSE 8000
USER soosef
USER fieldwitness
# Federation relay: only the verisoo API with federation endpoints
CMD ["uvicorn", "soosef.verisoo.api:app", "--host", "0.0.0.0", "--port", "8000"]
# Federation relay: only the attest API with federation endpoints
CMD ["uvicorn", "fieldwitness.attest.api:app", "--host", "0.0.0.0", "--port", "8000"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"
@@ -57,25 +57,25 @@ FROM python:3.12-slim-bookworm AS server
RUN apt-get update && apt-get install -y --no-install-recommends \
libjpeg62-turbo libopenblas0 \
&& rm -rf /var/lib/apt/lists/* \
&& useradd -m -s /bin/bash soosef
&& useradd -m -s /bin/bash fieldwitness
COPY --from=builder /opt/soosef-env /opt/soosef-env
COPY --from=builder /opt/fieldwitness-env /opt/fieldwitness-env
# Copy frontend templates and static assets
COPY frontends/ /opt/soosef-env/lib/python3.12/site-packages/frontends/
COPY frontends/ /opt/fieldwitness-env/lib/python3.12/site-packages/frontends/
ENV PATH="/opt/soosef-env/bin:$PATH" \
SOOSEF_DATA_DIR=/data \
ENV PATH="/opt/fieldwitness-env/bin:$PATH" \
FIELDWITNESS_DATA_DIR=/data \
PYTHONUNBUFFERED=1
VOLUME /data
EXPOSE 5000 8000
USER soosef
USER fieldwitness
# Init on first run, then start web UI (HTTPS by default with self-signed cert).
# Use --no-https explicitly if running behind a TLS-terminating reverse proxy.
CMD ["sh", "-c", "soosef init 2>/dev/null; soosef serve --host 0.0.0.0"]
CMD ["sh", "-c", "fieldwitness init 2>/dev/null; fieldwitness serve --host 0.0.0.0"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:5000/health')"

10
deploy/docker/docker-compose.yml
View File

@@ -1,4 +1,4 @@
# SooSeF Docker Compose — Three-Tier Deployment
# FieldWitness Docker Compose — Three-Tier Deployment
#
# Tier 2 (Org Server): Full web UI + attestation + federation
# Tier 3 (Federation Relay): Lightweight attestation API only
@@ -10,7 +10,7 @@
services:
# === Tier 2: Organizational Server ===
# Full SooSeF instance with web UI, stego, attestation, federation.
# Full FieldWitness instance with web UI, stego, attestation, federation.
# Deploy on a mini PC in the newsroom or a trusted VPS.
server:
build:
@@ -23,8 +23,8 @@ services:
volumes:
- server-data:/data
environment:
- SOOSEF_DATA_DIR=/data
- VERISOO_GOSSIP_INTERVAL=60
- FIELDWITNESS_DATA_DIR=/data
- FIELDWITNESS_GOSSIP_INTERVAL=60
restart: unless-stopped
# === Tier 3: Federation Relay ===
@@ -41,7 +41,7 @@ services:
volumes:
- relay-data:/data
environment:
- SOOSEF_DATA_DIR=/data
- FIELDWITNESS_DATA_DIR=/data
restart: unless-stopped
volumes:

8
deploy/kubernetes/README.md
View File

@@ -1,4 +1,4 @@
# SooSeF Kubernetes Deployment
# FieldWitness Kubernetes Deployment
## Architecture
@@ -29,8 +29,8 @@
```bash
# Build images
docker build -t soosef-server --target server -f deploy/docker/Dockerfile .
docker build -t soosef-relay --target relay -f deploy/docker/Dockerfile .
docker build -t fieldwitness-server --target server -f deploy/docker/Dockerfile .
docker build -t fieldwitness-relay --target relay -f deploy/docker/Dockerfile .
# Deploy to Kubernetes
kubectl apply -f deploy/kubernetes/namespace.yaml
@@ -41,7 +41,7 @@ kubectl apply -f deploy/kubernetes/relay-deployment.yaml
## Notes
- **Single writer**: Both deployments use `replicas: 1` with `Recreate` strategy.
SooSeF uses SQLite and append-only binary logs that require single-writer access.
FieldWitness uses SQLite and append-only binary logs that require single-writer access.
Do not scale horizontally.
- **PVCs**: Both deployments require persistent volumes. The server needs 10Gi,
the relay needs 5Gi. Adjust based on expected attestation volume.

4
deploy/kubernetes/namespace.yaml
View File

@@ -1,6 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: soosef
name: fieldwitness
labels:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness

24
deploy/kubernetes/relay-deployment.yaml
View File

@@ -1,13 +1,13 @@
# SooSeF Federation Relay — Lightweight attestation sync relay.
# FieldWitness Federation Relay — Lightweight attestation sync relay.
# Deploy on a VPS in a favorable jurisdiction for geographic redundancy.
# Stores only attestation records — zero knowledge of encryption keys.
apiVersion: apps/v1
kind: Deployment
metadata:
name: soosef-relay
namespace: soosef
name: fieldwitness-relay
namespace: fieldwitness
labels:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness
app.kubernetes.io/component: relay
spec:
replicas: 1
@@ -15,12 +15,12 @@ spec:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness
app.kubernetes.io/component: relay
template:
metadata:
labels:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness
app.kubernetes.io/component: relay
spec:
securityContext:
@@ -29,12 +29,12 @@ spec:
fsGroup: 1000
containers:
- name: relay
image: soosef-relay:latest
image: fieldwitness-relay:latest
ports:
- containerPort: 8000
name: federation
env:
- name: SOOSEF_DATA_DIR
- name: FIELDWITNESS_DATA_DIR
value: /data
volumeMounts:
- name: data
@@ -61,7 +61,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: relay-data
namespace: soosef
namespace: fieldwitness
spec:
accessModes:
- ReadWriteOnce
@@ -72,11 +72,11 @@ spec:
apiVersion: v1
kind: Service
metadata:
name: soosef-relay
namespace: soosef
name: fieldwitness-relay
namespace: fieldwitness
spec:
selector:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness
app.kubernetes.io/component: relay
ports:
- name: federation

32
deploy/kubernetes/server-deployment.yaml
View File

@@ -1,12 +1,12 @@
# SooSeF Org Server — Full deployment with persistent storage.
# FieldWitness Org Server — Full deployment with persistent storage.
# For newsroom or trusted infrastructure deployment.
apiVersion: apps/v1
kind: Deployment
metadata:
name: soosef-server
namespace: soosef
name: fieldwitness-server
namespace: fieldwitness
labels:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness
app.kubernetes.io/component: server
spec:
replicas: 1 # Single writer — do not scale horizontally
@@ -14,12 +14,12 @@ spec:
type: Recreate # Not RollingUpdate — SQLite + append-only logs need single writer
selector:
matchLabels:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness
app.kubernetes.io/component: server
template:
metadata:
labels:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness
app.kubernetes.io/component: server
spec:
securityContext:
@@ -27,17 +27,17 @@ spec:
runAsGroup: 1000
fsGroup: 1000
containers:
- name: soosef
image: soosef-server:latest
- name: fieldwitness
image: fieldwitness-server:latest
ports:
- containerPort: 5000
name: web
- containerPort: 8000
name: federation
env:
- name: SOOSEF_DATA_DIR
- name: FIELDWITNESS_DATA_DIR
value: /data
- name: VERISOO_GOSSIP_INTERVAL
- name: FIELDWITNESS_GOSSIP_INTERVAL
value: "60"
volumeMounts:
- name: data
@@ -64,13 +64,13 @@ spec:
volumes:
- name: data
persistentVolumeClaim:
claimName: soosef-data
claimName: fieldwitness-data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: soosef-data
namespace: soosef
name: fieldwitness-data
namespace: fieldwitness
spec:
accessModes:
- ReadWriteOnce
@@ -81,11 +81,11 @@ spec:
apiVersion: v1
kind: Service
metadata:
name: soosef-server
namespace: soosef
name: fieldwitness-server
namespace: fieldwitness
spec:
selector:
app.kubernetes.io/name: soosef
app.kubernetes.io/name: fieldwitness
app.kubernetes.io/component: server
ports:
- name: web

8
deploy/live-usb/build.sh
View File

@@ -1,5 +1,5 @@
#!/usr/bin/env bash
# Build a bootable Debian Live USB image with SooSeF pre-installed.
# Build a bootable Debian Live USB image with FieldWitness pre-installed.
#
# Prerequisites:
# apt install live-build
@@ -12,10 +12,10 @@
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SOOSEF_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
FIELDWITNESS_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
echo "=== SooSeF Live USB Image Builder ==="
echo "Source: $SOOSEF_ROOT"
echo "=== FieldWitness Live USB Image Builder ==="
echo "Source: $FIELDWITNESS_ROOT"
echo
cd "$SCRIPT_DIR"

26
deploy/live-usb/config/hooks/live/0100-install-soosef.hook.chroot
View File

@@ -1,26 +1,26 @@
#!/bin/bash
# Install SooSeF and all dependencies into the live image.
# Install FieldWitness and all dependencies into the live image.
# This runs inside the chroot during image build.
set -euo pipefail
echo "=== Installing SooSeF ==="
echo "=== Installing FieldWitness ==="
# Create soosef user
useradd -m -s /bin/bash -G sudo soosef
echo "soosef:soosef" | chpasswd
# Create fieldwitness user
useradd -m -s /bin/bash -G sudo fieldwitness
echo "fieldwitness:fieldwitness" | chpasswd
# Create virtual environment
python3 -m venv /opt/soosef-env
source /opt/soosef-env/bin/activate
python3 -m venv /opt/fieldwitness-env
source /opt/fieldwitness-env/bin/activate
# Install soosef with all extras (pre-built wheels from PyPI)
pip install --no-cache-dir "soosef[web,cli,attest,stego-dct,stego-audio,fieldkit]"
# Install fieldwitness with all extras (pre-built wheels from PyPI)
pip install --no-cache-dir "fieldwitness[web,cli,attest,stego-dct,stego-audio,fieldkit]"
# Verify installation
python3 -c "import soosef; print(f'SooSeF {soosef.__version__} installed')"
python3 -c "from soosef.stegasoo import encode; print('stegasoo OK')"
python3 -c "from soosef.verisoo import Attestation; print('verisoo OK')"
python3 -c "import fieldwitness; print(f'FieldWitness {fieldwitness.__version__} installed')"
python3 -c "from fieldwitness.stego import encode; print('stego OK')"
python3 -c "from fieldwitness.attest import Attestation; print('attest OK')"
deactivate
echo "=== SooSeF installation complete ==="
echo "=== FieldWitness installation complete ==="

12
deploy/live-usb/config/hooks/live/0200-harden.hook.chroot
View File

@@ -6,17 +6,17 @@ echo "=== Applying security hardening ==="
# Disable core dumps (Python doesn't zero memory — core dumps leak keys)
echo "* hard core 0" >> /etc/security/limits.conf
echo "fs.suid_dumpable = 0" >> /etc/sysctl.d/99-soosef.conf
echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.d/99-soosef.conf
echo "fs.suid_dumpable = 0" >> /etc/sysctl.d/99-fieldwitness.conf
echo "kernel.core_pattern=|/bin/false" >> /etc/sysctl.d/99-fieldwitness.conf
# Disable swap (keys persist in swap pages)
systemctl mask swap.target || true
echo "vm.swappiness = 0" >> /etc/sysctl.d/99-soosef.conf
echo "vm.swappiness = 0" >> /etc/sysctl.d/99-fieldwitness.conf
# Enable UFW with deny-all + allow web UI
ufw default deny incoming
ufw default allow outgoing
ufw allow 5000/tcp comment "SooSeF Web UI"
ufw allow 5000/tcp comment "FieldWitness Web UI"
ufw allow 22/tcp comment "SSH"
ufw --force enable || true
@@ -25,14 +25,14 @@ systemctl disable bluetooth.service 2>/dev/null || true
systemctl disable avahi-daemon.service 2>/dev/null || true
systemctl disable cups.service 2>/dev/null || true
# Enable SooSeF service
# Enable FieldWitness service
systemctl enable soosef.service
# Auto-login to openbox (so the browser opens without login prompt)
mkdir -p /etc/lightdm/lightdm.conf.d
cat > /etc/lightdm/lightdm.conf.d/50-autologin.conf << 'EOF'
[Seat:*]
autologin-user=soosef
autologin-user=fieldwitness
autologin-user-timeout=0
EOF

18
deploy/live-usb/config/includes.chroot/etc/systemd/system/soosef.service
View File

@@ -1,17 +1,17 @@
[Unit]
Description=SooSeF Security Fieldkit
Description=FieldWitness
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=soosef
Group=soosef
WorkingDirectory=/home/soosef
Environment=PATH=/opt/soosef-env/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Environment=SOOSEF_DATA_DIR=/home/soosef/.soosef
ExecStartPre=/opt/soosef-env/bin/soosef init --no-identity --no-channel
ExecStart=/opt/soosef-env/bin/soosef serve --host 0.0.0.0 --no-https
User=fieldwitness
Group=fieldwitness
WorkingDirectory=/home/fieldwitness
Environment=PATH=/opt/fieldwitness-env/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Environment=FIELDWITNESS_DATA_DIR=/home/fieldwitness/.fwmetadata
ExecStartPre=/opt/fieldwitness-env/bin/fieldwitness init --no-identity --no-channel
ExecStart=/opt/fieldwitness-env/bin/fieldwitness serve --host 0.0.0.0 --no-https
Restart=on-failure
RestartSec=5
@@ -19,7 +19,7 @@ RestartSec=5
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/soosef/.soosef
ReadWritePaths=/home/fieldwitness/.fwmetadata
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes

4
deploy/live-usb/config/includes.chroot/etc/xdg/openbox/autostart
View File

@@ -1,4 +1,4 @@
# SooSeF Live USB — auto-open web UI in Firefox
# Wait for the SooSeF server to start, then open the browser
# FieldWitness Live USB — auto-open web UI in Firefox
# Wait for the FieldWitness server to start, then open the browser
sleep 5
firefox-esr --kiosk http://127.0.0.1:5000 &

2
deploy/live-usb/config/package-lists/soosef.list.chroot
View File

@@ -12,7 +12,7 @@ libssl-dev
gfortran
libopenblas-dev
## SooSeF runtime dependencies
## FieldWitness runtime dependencies
gpsd
gpsd-clients
cryptsetup