Web-based Code Assurance and Transparency (WEBCAT)

[!CAUTION] This is experimental software and currently released as an alpha. It might slow down or interfere with web pages, and it might not yet provide the intended security guarantees.

The extension is available to end-users on the Mozilla Add-ons website (AMO):

• Get the extension
• User guide

To get started as website owner, developer, contributor, or researcher see the following resources:

• Project Website
• Documentation
• Research

To report issues, please use the bug tracker of this repository.

WEBCAT is a framework that provides blocking code signing, as well as integrity and transparency checks for browser-based applications. In doing so, it primarily leverages existing technologies and community infrastructure, including Sigsum, Sigstore and CometBFT. The browser extension has no external runtime dependencies, and all cryptographic operations are performed using only the Web Crypto API. Runtime policy enforcement in the enrolled domains is handled by the browser's Content Security Policy (CSP).

The project has been originally written as a master's thesis for the Master Computer Security at the Vrije Universiteit Amsterdam and the University of Amsterdam, sponsored by the Freedom of the Press Foundation. The full dissertation is available on ePrint. It has since evolved to address censorship risks, centralization, and single points of failure concerns.

WEBCAT is:

1. An enrollment consensus system
2. A set of specifications
3. A Firefox (MV2) extension
4. A CLI for developers and hosters
5. Some dependencies, such as sigsum-ts, cometbft-ts and sigstore-browser.

See The long and winding road to safe browser-based cryptography, Introducing WEBCAT and Towards auditable web application runtimes for additional context.

Overview

Click here for a PNG version.

Acknowledgements

Thanks to smaury of Shielder and to antisnatchor of Persistent Security for their security-related insights. Thanks to Giorgio Maone of the Tor Project for the development-related support. We are also working with, and taking inspiration from, the WAICT working group.