dotnet / dotnet/arcade

Microsoft.DotNet.SignTool.Tests/Resources/MsiSetup.msi and MsiApplication.exe are flagged as malicious software by antiviral scanners

Open
#13,843 17 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
729
Forks
397
Avg merge
3d 15m
Merged PRs (30d)
149

Description

- [X] This issue is causing unreasonable pain

arcade/src/Microsoft.DotNet.SignTool.Tests/Resources/MsiSetup.msi
https://github.com/dotnet/arcade/blob/main/src/Microsoft.DotNet.SignTool.Tests/Resources/MsiSetup.msi
is being flagged as malicious by multiple antiviruses

arcade/src/Microsoft.DotNet.SignTool.Tests/Resources/MsiApplication.exe
https://github.com/dotnet/arcade/blob/main/src/Microsoft.DotNet.SignTool.Tests/Resources/MsiApplication.exe
which is inside that msi is being flagged by much more scanners as malicious

To test that you can just submit that to virustotal and notice that it is being flagged as malicious.

While we do understand that it is most likely false positive, will be nice to fix it, otherwise scanners pick up source files provided for dotnet as containing malicious software.
Since arcade sources, at least those two files, are being packed into source tarball to build SDK, scanning dotnet sources provided with the compiled SDK will generate a failed scan ( viruses reported ).
While binaries themselves were committed back in 2020, looks like they were submitted for scanning around March 2023, so we expect more and more people will be getting those "your have a virus" reports over time.

### Release Note Category
- [ ] Feature changes/additions
- [X] Bug fixes
- [ ] Internal Infrastructure Improvements
### Release Note Description

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.