Skip to content

Conversation

@alexis-opolka
Copy link
Collaborator

@alexis-opolka alexis-opolka commented Mar 16, 2025

This PR aims to fix the security reports raised by Windows Defender and VirusTotal.

https://www.virustotal.com/gui/file/a4672b879ef32f9254c575dd548ea787bafe0827da1c6f93a65411a75a7121b2/detection

I am waiting to check a packaged version from an automated release on my fork but it seems the issue was from crossterm 0.28.0 which has been yanked (see here) from the creates registry in favor of 0.28.1(see here)

Fixes #869

Signed-off-by: alexis-opolka <[email protected]>
@alexis-opolka
Copy link
Collaborator Author

The packaged version built with the CI/CD is still flagged on VirusTotal: https://www.virustotal.com/gui/file/430acdb902527a1b060b512bfbf70bf16ec99fb5f7606771812b6bfc36512507?nocache=1

It seems that Windows Defender doesn't flag the executable as a trojan anymore.

@alexis-opolka
Copy link
Collaborator Author

alexis-opolka commented Mar 16, 2025

After multiple tests, it seems that what causes thoses issues is the scripts/dot script which in turn calls the scripts/rust/release script inside the dotfiles repository.

The scan below is of the file that has been built locally with cross and then put into a .zip, it's not flagged by any security provider: www.virustotal.com/gui/file/a86f9ee032c4856dd2087a87d187cdd86ef8a4279a6ec25634649b07d3b2e000/detection

@alexis-opolka
Copy link
Collaborator Author

@denisidoro, what do you want to do? Those are your scripts.

@denisidoro
Copy link
Owner

I think the issue is the use of upx: https://github.com/denisidoro/dotfiles/blob/master/scripts/rust/release#L71

We can disable it for Windows

@alexis-opolka
Copy link
Collaborator Author

alexis-opolka commented Mar 19, 2025

@denisidoro Do you want me to make a PR on the dotfiles repository or do you want to do it yourself?

Signed-off-by: alexis-opolka <[email protected]>
@alexis-opolka
Copy link
Collaborator Author

alexis-opolka commented Apr 8, 2025

This PR is deprecated in favor of #971.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security concern about Windows binary (v2.23.0)

2 participants