bigtech-sucks/packages/core/db/seed/0001-signal.sql

-- =====================================================================
-- Assessment 0001 — Signal Desktop, Linux x86_64
-- Assessed 2026-10-29 by CLU. Source commit 5dad34a (v8.36.0-alpha.1).
-- Evidence artifacts: Servetus vault
--   00-Artifacts/2026/10-Oct/29/clu-big-tech-report/
-- Narrative report: 04-Projects/big-tech-report/2026-10-29-signal-desktop-assessment.md
-- =====================================================================

INSERT OR REPLACE INTO vendor
  (id, name, legal_entity, entity_type, jurisdiction, business_model, founded, notes)
VALUES
  ('signal-foundation', 'Signal', 'Signal Technology Foundation / Signal Messenger LLC',
   'nonprofit', 'US', 'none', '2018',
   'US 501(c)(3), EIN 82-4506840. Operated by Signal Messenger LLC. No ad model, no data sale. US jurisdiction means US legal process reaches it, but there is almost nothing to reach.');

-- ------------------------------------------------------------------ dimension set v0.1
INSERT OR REPLACE INTO dimension (id, label, weight, anchor_10, anchor_0) VALUES
  ('telemetry_egress', 'Telemetry and egress', 25,
   'Published destination allowlist; cold idle produces zero unlisted packets, independently confirmed.',
   'Covert collection, or egress that cannot be enumerated.'),
  ('verifiability', 'Verifiability', 20,
   'Reproducible build verified on the scored platform.',
   'Closed source, or no way to prove the binary matches the source.'),
  ('server_retention', 'Server-side retention', 15,
   'Subpoena answer is two timestamps or an empty set.',
   'Content readable by the vendor.'),
  ('ownership_jurisdiction', 'Ownership, jurisdiction, business model', 12,
   'Nonprofit or cooperative, no ad model, strong process protections.',
   'State-controlled.'),
  ('local_data_exposure', 'Local data exposure', 10,
   'All artifacts encrypted at rest under a user-presence key.',
   'Everything plaintext on disk.'),
  ('dependency_surface', 'Dependency surface', 8,
   'Small audited dependency tree, signed and pinned update channel.',
   'Huge unaudited tree, unsigned updates.'),
  ('user_control_exit', 'User control and exit', 5,
   'Usable export, real deletion, no identity hostage-taking.',
   'No export, deletion that does not delete.'),
  ('incident_record', 'Incident record', 5,
   'Flaws found, disclosed honestly, fixed fast.',
   'Unblemished only because nobody is allowed to test it.');

-- ------------------------------------------------------------------ the product
INSERT OR REPLACE INTO product
  (id, vendor_id, name, category_id, platform, source_url, license, sovereign, boss, art_slot, monthly_cost, notes)
VALUES
  ('signal-desktop', 'signal-foundation', 'Signal Desktop', 'messaging', 'linux-x86_64',
   'https://github.com/signalapp/Signal-Desktop', 'AGPL-3.0', 0, 0, 'outlaw_signal', 0,
   'Linked-device client. Requires a phone to pair. Electron 45.0.0.');

-- ------------------------------------------------------------------ the assessment
INSERT OR REPLACE INTO assessment
  (id, product_id, version, source_commit, assessed_on, method_version,
   reproducible_build, weighted_total, grade, weakest_dimension, headline, not_tested)
VALUES
  ('A-2026-10-29-SIGNAL-DESKTOP', 'signal-desktop', '8.36.0-alpha.1',
   '5dad34ad5ea1a5b6229412e5c8ac0a696ff7532d', '2026-10-29', 'btr-0.1',
   1, 75.9, 'B', 'local_data_exposure',
   'The strongest transport on the internet, sitting behind the weakest desktop client we have scored.',
   'No live account was used. No packet capture was run (D1 to D4 not executed, this is a source audit only). Android and iOS clients not assessed. No attempt to verify the shipped .deb against a local rebuild.');

INSERT OR REPLACE INTO score (assessment_id, dimension_id, value, rationale) VALUES
  ('A-2026-10-29-SIGNAL-DESKTOP', 'telemetry_egress', 9,
   'Zero analytics packages across 224 dependencies. Crash reporter started with uploadToServer:false. Only signal.org, support.signal.org, updates*.signal.org and sfu.voip.signal.org appear in source. Docked one point for update checks on launch and the megaphone channel, neither of which is telemetry but both of which are vendor-initiated contact.'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'verifiability', 6,
   'Fully open source. Reproducible builds exist for Linux only, via Docker, and Signal labels them experimental and possibly non-functioning on public releases. macOS and Windows have none. Capped at 6 by the instrument rule.'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'server_retention', 10,
   'The published answer to a 2021 federal grand jury subpoena was registration date and last connection date. No messages, contacts, groups, profile or avatar exist server-side to hand over.'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'ownership_jurisdiction', 8,
   '501(c)(3) nonprofit, EIN 82-4506840, no advertising and no data sale, so the incentive to surveil is absent rather than merely restrained. Docked for US jurisdiction and for early Open Technology Fund grant funding.'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'local_data_exposure', 5,
   'Received attachments are stored unencrypted at ~/.config/Signal/attachments.noindex (CVE-2023-24069). The SQLCipher key lives in gnome-keyring, so anything running as the user can read db.sqlite. On this operator machine that means every agent process.'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'dependency_surface', 6,
   '224 dependencies, Electron 45.0.0 pinned. Electron has produced CVEs enabling persistent backdoors in exactly this class of app. Update channel is a signed apt repo, which is the good part.'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'user_control_exit', 7,
   'Registration still requires a phone number, though usernames and phone-number privacy now reduce the exposure. No practical encrypted export of message history in a portable format.'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'incident_record', 7,
   'Roughly 15 CVEs under the signal vendor entry. The 2023 local-storage flaws were acknowledged and fixed in 6.2.0. Signal is under continuous scrutiny, which is a better position than an untested clean record.');

-- ------------------------------------------------------------------ evidence (T1/T2 only)
INSERT INTO evidence (assessment_id, dimension_id, claim, tier, kind, artifact, sha256, observed_at) VALUES
  ('A-2026-10-29-SIGNAL-DESKTOP', 'local_data_exposure',
   'Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.',
   1, 'source', '00-Artifacts/2026/10-Oct/29/clu-big-tech-report/01-capture-sites.txt',
   NULL, '2026-10-29T13:13:56-05:00'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'telemetry_egress',
   'Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.',
   1, 'source', '00-Artifacts/2026/10-Oct/29/clu-big-tech-report/02-permissions.txt',
   '0a64f213f3c241c1211dec56c0018d9220651c2550a7cf44609d586e74369cf2', '2026-10-29T13:13:56-05:00'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'telemetry_egress',
   'Zero analytics, tracker or crash-upload dependencies across 224 packages.',
   1, 'source', '00-Artifacts/2026/10-Oct/29/clu-big-tech-report/05-dependencies.txt',
   NULL, '2026-10-29T13:13:56-05:00'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'telemetry_egress',
   'Only two audio capture call sites exist and both are reachable only from an explicit UI action.',
   1, 'source', '00-Artifacts/2026/10-Oct/29/clu-big-tech-report/03-call-path.txt',
   NULL, '2026-10-29T13:13:56-05:00'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'verifiability',
   'Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.',
   2, 'record', 'https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md',
   NULL, '2026-10-29T13:13:56-05:00'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'server_retention',
   'Grand jury subpoena response returned two timestamps and nothing else.',
   2, 'filing', 'https://signal.org/bigbrother/cd-california-grand-jury/',
   NULL, '2026-10-29T13:13:56-05:00'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'ownership_jurisdiction',
   'Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.',
   2, 'record', 'https://projects.propublica.org/nonprofits/organizations/824506840',
   NULL, '2026-10-29T13:13:56-05:00');

-- ------------------------------------------------------------------ findings
INSERT INTO finding (assessment_id, severity, title, detail, status, cve) VALUES
  ('A-2026-10-29-SIGNAL-DESKTOP', 'high',
   'Received attachments are stored unencrypted on disk',
   'Every image and file received is readable by any process running as the user. On a machine running agent software under the same account, this is the most likely real-world exposure.',
   'by_design', 'CVE-2023-24069'),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'medium',
   'No verified reproducible build for the Linux package',
   'The source is auditable; the shipped binary is not yet provably the same artifact. Until this closes, a source audit is evidence about the repository, not about the running process.',
   'open', NULL),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'medium',
   'Local database key is held in the OS keyring',
   'Any process running in the unlocked session can decrypt db.sqlite. There is no user-presence gate.',
   'accepted', NULL),
  ('A-2026-10-29-SIGNAL-DESKTOP', 'low',
   'Registration requires a phone number',
   'Mitigated by usernames and phone-number privacy, but the account root remains a phone number.',
   'accepted', NULL);

-- ------------------------------------------------------------------ off-ramp
INSERT OR REPLACE INTO offramp (product_id, replacement, nextcloud, notes) VALUES
  ('signal-desktop', 'Signal (keep it)', NULL,
   'Signal is not a thing to migrate off. It is the recommended landing place for SMS and WhatsApp, with the local-attachment caveat stated plainly.'),
  ('signal-desktop', 'Nextcloud Talk', 'Talk',
   'For household and business groups where the admin wants the contact graph to stay on ranch hardware.');