freedomofpress / dangerzone

Take potentially dangerous PDFs, office documents, or images and convert them to safe PDFs
https://dangerzone.rocks/
GNU Affero General Public License v3.0
3.37k stars 153 forks source link

Do not teleport compiled Python code when running dz.ConvertDev on Qubes #723

Closed apyrgio closed 3 months ago

apyrgio commented 4 months ago

Our dz.ConvertDev Qubes policy, which runs in a disposable qube, expects a Python zipfile. This zipfile is created in the dev qube where the ./dev_scripts/dangerzone* command runs, and it contains the Python compiled files for the dangerzone.conversion module.

The problem here is that the disposable qube and the main qube may have different Python versions. This can happen if e.g., the dev qube is based on Fedora 38 (Python 3.11), and the disposable qube is based on Fedora 39 (Python 3.12).