For a network with no way out

The OBSCURA Field Kit

Every tool on this site, as one archive you run on your own machine or your own network, with no connection to anything. Nothing it serves can reach another host, and you can check every file in it without taking our word for any of it.

What it is

The public site already keeps what you open in your browser. What it cannot do is run where there is no internet at all: an evidence room, a disconnected network, a laptop at a scene. It is served from obscuraos.com, and the heavier tools fetch their libraries through it the first time they run.

The Field Kit removes both. It is a single archive holding every page, every script and every library the tools load, the PDF engine, the OCR engine and its languages, the spreadsheet and document readers, with a small server to hand them to a browser. Unpack it, check it, run one command, and open it.

Network: Every page is served with a Content-Security-Policy whose connect-src is 'self'. A page can talk to the machine serving it, and the browser refuses everything else.
Code from text: No 'unsafe-eval'. Every tool is driven under that policy before each kit is built, libraries included.
Server: Node or Python, standard library only, nothing to install. GET and HEAD only, nothing written, no log you do not ask for. An nginx configuration with the same headers is included.
Integrity: A SHA-256 for every file, in the format sha256sum reads, and an Ed25519 signature over that list.
Reproducible: The same commit builds the same bytes. Rebuild it with no key and the manifest matches the signed release exactly.
Inventory: A CycloneDX software bill of materials: every third-party library, its version, where it came from, and the hash of the file that shipped.

Check it before you run it

The checks use tools you already have. Our own script does the same checks in one command, and also fails on a file that has been added, which sha256sum does not look for.

sha256sum --check --strict --quiet MANIFEST.sha256

openssl pkeyutl -verify -pubin -inkey fieldkit-signing.pub.pem -rawin \
  -in MANIFEST.sha256 -sigfile MANIFEST.sha256.sig

node verify.mjs --key fieldkit-signing.pub.pem

Fetch the public key from this site, not from inside the kit. A key that travels with the files proves nothing about them.

The key is at /.well-known/fieldkit-signing.pub.pem. Its fingerprint, the SHA-256 of the key in DER form, is SHA256:cYBEalCKAaLHx6sJq7ffW6A0XNG3ExdWLfRaEQcoH5Q. Check it with openssl pkey -pubin -in fieldkit-signing.pub.pem -outform DER | openssl dgst -sha256 -binary | base64, which prints the same string with an = on the end.

Run it

node serve/serve.mjs          # or: python3 serve/serve.py
# then open http://127.0.0.1:8080/

For other machines, serve it over HTTPS with a certificate from your own authority. A browser only gives a page WebCrypto and offline storage on https or on localhost, and the tools that encrypt, hash or sign need them. Once a browser has opened the kit it keeps a copy, and the workspace opens from it when the server is off.

What is different from the public site

The breach check is left out. PWNCHECK asks an internet service. Its page in the kit says so and points to SHADOWKEY, which rates a password with no network.
VAULT uses no STUN server, so two browsers sending a file must be on the same network. WebRTC is the one kind of connection a page policy cannot govern, so the kit removes the only outside address it would use.
Location and the microphone are allowed for the kit’s own address, so a scene tool can stamp where it is. Each is still the browser’s own prompt.
Nothing is sent back to us. No analytics, no update check. The kit does not know it exists.
The kit lists anything it lacks. If a library or model could not be included in a build, fieldkit.json and the README name it and the tool it affects.

What it is not

Everything on the page for police, fire and defence still holds. It is not accredited, it has no authority to operate, and it is not a system of record. What the kit changes is the answer to the question that page could not answer: yes, it runs on your own network, and here is how to check what you are running.

Getting a copy

Kits are sent on request while the first ones go to people using them for real work. Say what the network is and roughly who will use it, and you will get the archive, its SHA-256, and the source for your reviewers if they want to rebuild it themselves. It costs nothing, the same as everything else here.

Ask for the Field Kit Read the threat model Security