v11.0.0 tarball ships 13 bundled apps as build working trees (.git/, tests/, build/artifacts/) — 102 MB of dev files, code-signed, incl. EICAR test data

Summary

The owncloud-complete-* release tarball ships 13 of its bundled apps as the working tree the app was built in, not as the app's release artifact. Each of those app directories contains .git/ (a shallow clone including the pack file), .github/, .gitignore, tests/, vendor-bin/ and build/artifacts/ — the last one holding a copy of the app's own, clean release tarball.

Verified on v11.0.0, owncloud-complete-20260730.tar.bz2 (sha256 747fcbb48a2df5d1ef61b87768a4e3484184469b876a76a8070e5c026f6396b3). Earlier lines are probably affected too; I only measured this one.

In numbers: 101.94 MB of 441.8 MB uncompressed content (23%) is development material, in 16 shipped .git repositories (13 apps plus three inside migrate_to_ocis's vendor/) and 22 nested app tarballs.

For contrast, other bundled apps in the same tarball are packaged correctly and contain zero such files: activity, admin_audit, password_policy, metrics, oauth2, twofactor_totp. So this looks like an inconsistency in the release job rather than a deliberate choice.

Why it matters

1. Anti-virus scans of the tarball, or of any image built from it, fail. files_antivirus 1.3.1 ships tests/acceptance/data/eicar.com, eicar_com.zip, eicarcom2.zip, and a nested build/artifacts/source/files_antivirus.tar.gz that contains them again. A ClamAV scan (1.4.6, recursive, limits disabled) of a container image built from this tarball reports 4 × Eicar-Test-Signature FOUND. For us this rejected a whole appliance image at a customer's AV gate. Thank you for repackaging 1.3.1 as 1.3.2 — that removed the development tree and fixed exactly this for one app; the underlying packaging problem remains for the other twelve.
2. The development files are code-signed, so an administrator cannot remove them. In announcementcenter/appinfo/signature.json, 181 of 355 hashes are .git/…, tests/… or build/… paths (files_primary_s3: 3653 of 7291). Deleting the cruft therefore breaks occ integrity:check-app, so the only clean options are to delete the entire app or to ship it as it is.
3. ~100 MB of dead weight in every deployment and every image layer.
4. Scanner noise and supply-chain surface. The nested build/artifacts/*.tar.gz contain second copies of vendored dependency trees, which image scanners (Trivy et al.) report separately from the installed copy. The shipped .git/ also carries the release engineer's clone metadata: .git/logs/HEAD holds their name and e-mail address, and .git/config the git@github.com:owncloud/<app>.git remote.

Likely cause

The release job appears to clone each app into apps/<app>/, build it there, and then package apps/<app>/ instead of the artifact it just produced. Two pieces of evidence from the shipped tree:

• apps/announcementcenter/.git/config contains fetch = +refs/tags/v1.3.1:refs/tags/v1.3.1 and there is a .git/shallow — i.e. a shallow tag clone made by an automated job.
• The clean artifact sits right there next to the cruft: apps/announcementcenter/build/artifacts/appstore/announcementcenter.tar.gz unpacks to 154 files with no .git/, tests/ or build/, while the shipped apps/announcementcenter/ directory has 406 files. Same for files_texteditor (332 clean files in the artifact vs 765 shipped).

Expected behaviour

Package the content of each app's appstore artifact — as already happens for activity, admin_audit, metrics, oauth2, password_policy, twofactor_totp — and sign that. Nothing under .git/, .github/, tests/, build/ or vendor-bin/ should be part of a release tarball, and no anti-virus test data.

How to reproduce

Listing only — note that extracting this archive writes EICAR test files to disk, which some endpoint protection will act on:

curl -sSLO https://github.com/owncloud/core/releases/download/v11.0.0/owncloud-complete-20260730.tar.bz2
tar -tjf owncloud-complete-20260730.tar.bz2 \
  | grep -E '^owncloud/apps/[^/]+/(\.git|\.github|tests|build|vendor-bin)/' \
  | cut -d/ -f3 | sort | uniq -c | sort -rn

Also in the same tarball

migrate_to_ocis 3.0.0 vendors three dependencies with their .git directories included: ramsey/uuid (3.23 MB pack file), brick/math (1.57 MB), ramsey/collection (0.40 MB).

Found while building the BayernBox appliance image from the v11.0.0 tarball; happy to provide the full per-file inventory if that helps.