github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-12 02:24:21 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

gitea source code zip detected as virus/malware #178

New Issue
Closed
opened 2025-11-02 03:12:26 -06:00 by GiteaMirror · 12 comments
GiteaMirror commented 2025-11-02 03:12:26 -06:00
Owner
Copy Link

Originally created by @Harish1n1ly on GitHub (Dec 29, 2016).

Description

Chrome automatically removes the file gitea-1.0.0.zip after download with error Virus detected
File URL: https://github.com/go-gitea/gitea/archive/v1.0.0.zip
Chrome Version: 57.0.2950.4 (Official Build) dev (64-bit)

Windows Defender also reports this as malware: screenshot

Originally created by @Harish1n1ly on GitHub (Dec 29, 2016). - Gitea version: **1.0.0 (6aacf4d)** ## Description Chrome automatically removes the file gitea-1.0.0.zip after download with error **Virus detected** **File URL:** https://github.com/go-gitea/gitea/archive/v1.0.0.zip **Chrome Version:** 57.0.2950.4 (Official Build) dev (64-bit) Windows Defender also reports this as malware: [screenshot](https://cloud.githubusercontent.com/assets/8962050/21538506/d30232d8-cdc3-11e6-8475-4c619b009c8c.jpg)
GiteaMirror added the topic/deployment label 2025-11-02 03:12:26 -06:00
GiteaMirror commented 2025-11-02 03:12:27 -06:00
Author
Owner
Copy Link

@thibaultmeyer commented on GitHub (Dec 29, 2016):

@Harish1n1ly Could you submit file to VirusTotal and paste the report link ?

@thibaultmeyer commented on GitHub (Dec 29, 2016): @Harish1n1ly Could you submit file to [VirusTotal](https://www.virustotal.com) and paste the report link ?
GiteaMirror commented 2025-11-02 03:12:27 -06:00
Author
Owner
Copy Link

@denji commented on GitHub (Dec 29, 2016):

https://github.com/go-gitea/gitea/blob/v1.0.0/public/js/index.js (VirusTotal)

https://github.com/go-gitea/gitea/archive/v1.0.0.zip

@denji commented on GitHub (Dec 29, 2016): https://github.com/go-gitea/gitea/blob/v1.0.0/public/js/index.js ([VirusTotal](https://www.virustotal.com/en/url/8697f916197ace339f5989db40be06ad8fa95e5658d1bc248779759d3d69cac9/analysis/1483000185/)) #### `https://github.com/go-gitea/gitea/archive/v1.0.0.zip` * https://virusscan.jotti.org/en-US/filescanjob/qjtao23xc2 * https://www.virustotal.com/en/url/46063cb91041153d7ee5ef8ed5d7d57eebd7c209408127c5d4da684270e6203e/analysis/1482999884/
GiteaMirror commented 2025-11-02 03:12:27 -06:00
Author
Owner
Copy Link

@thibaultmeyer commented on GitHub (Dec 29, 2016):

You don't have scan archive file but the URL (not the same thing for VirusTotal)

index.js
https://www.virustotal.com/fr/file/51e5f87b23e57b9bdd7c122143a55237a4ffb8c712753d0deff5b91e2e635a49/analysis/1483000531/

File is clean, is just a false positive due to the Zip compression algorithm

@thibaultmeyer commented on GitHub (Dec 29, 2016): You don't have scan archive file but the URL (not the same thing for VirusTotal) **index.js** https://www.virustotal.com/fr/file/51e5f87b23e57b9bdd7c122143a55237a4ffb8c712753d0deff5b91e2e635a49/analysis/1483000531/ File is clean, is just a false positive due to the Zip compression algorithm
GiteaMirror commented 2025-11-02 03:12:27 -06:00
Author
Owner
Copy Link

@Harish1n1ly commented on GitHub (Dec 29, 2016):

Extracted the zip in a Linux machine and copied index.js to Windows, Immediately removed as malware by Windows Defender. It is not related to compression.

Strangely, Defender does not report when any change is made to the file before copying. Just added an empty line, it does not have any problem.
Looks like false positive, but this may affect downloads by Windows/Chrome users.

@Harish1n1ly commented on GitHub (Dec 29, 2016): Extracted the zip in a Linux machine and copied index.js to Windows, Immediately removed as malware by Windows Defender. It is not related to compression. Strangely, Defender does not report when any change is made to the file before copying. Just added an empty line, it does not have any problem. Looks like false positive, but this may affect downloads by Windows/Chrome users.
GiteaMirror commented 2025-11-02 03:12:27 -06:00
Author
Owner
Copy Link

@thibaultmeyer commented on GitHub (Dec 29, 2016):

Only Windows users with Windows Defender. I dont have this issue on my Win 10 with Avast Pro.

Maybe you can submit a PR to add an empty line to this file and explain it will fix false positive detection with Windows Defender

@thibaultmeyer commented on GitHub (Dec 29, 2016): Only Windows users with Windows Defender. I dont have this issue on my Win 10 with Avast Pro. Maybe you can submit a PR to add an empty line to this file and explain it will fix false positive detection with Windows Defender
GiteaMirror commented 2025-11-02 03:12:27 -06:00
Author
Owner
Copy Link

@tboerger commented on GitHub (Dec 29, 2016):

And since we have not really changed the index.js it must also apply for Gogs. Beside that I suggest to use our prebuilt binaries from https://dl.gitea.io which embeds the public folder into the binary.

@tboerger commented on GitHub (Dec 29, 2016): And since we have not really changed the index.js it must also apply for Gogs. Beside that I suggest to use our prebuilt binaries from https://dl.gitea.io which embeds the public folder into the binary.
GiteaMirror commented 2025-11-02 03:12:28 -06:00
Author
Owner
Copy Link

@tboerger commented on GitHub (Dec 29, 2016):

So what do we want to do here? How can we solve that false-positive?

@tboerger commented on GitHub (Dec 29, 2016): So what do we want to do here? How can we solve that false-positive?
GiteaMirror commented 2025-11-02 03:12:28 -06:00
Author
Owner
Copy Link

@thibaultmeyer commented on GitHub (Dec 29, 2016):

Maybe is possible to use the virustotal API for each file pushed to dl.gitea.io ? it could avoid this kind of ticket in the future.

@thibaultmeyer commented on GitHub (Dec 29, 2016): Maybe is possible to use the virustotal API for each file pushed to dl.gitea.io ? it could avoid this kind of ticket in the future.
GiteaMirror commented 2025-11-02 03:12:28 -06:00
Author
Owner
Copy Link

@Harish1n1ly commented on GitHub (Dec 29, 2016):

@tboerger : Gogs zip downloads just fine. Gitea 1.0 prebuild binaries are not working for me.

The problem seems to be resolved with latest index.js though. I just tried the following,

wget https://raw.githubusercontent.com/go-gitea/gitea/master/public/js/index.js
wget https://raw.githubusercontent.com/go-gitea/gitea/release/v1.0/public/js/index.js

Defender only reports problem with second file and removes it.

update: The binaries are working fine. I thought they were installers.

@Harish1n1ly commented on GitHub (Dec 29, 2016): @tboerger : Gogs zip downloads just fine. ~~Gitea 1.0 prebuild binaries are not working for me.~~ The problem seems to be resolved with latest index.js though. I just tried the following, > wget https://raw.githubusercontent.com/go-gitea/gitea/master/public/js/index.js > wget https://raw.githubusercontent.com/go-gitea/gitea/release/v1.0/public/js/index.js Defender only reports problem with second file and removes it. **update:** The binaries are working fine. I thought they were installers.
GiteaMirror commented 2025-11-02 03:12:28 -06:00
Author
Owner
Copy Link

@lesderid commented on GitHub (Jan 2, 2017):

I believe this is the right place to report false positives (for Windows Defender):
https://www.microsoft.com/en-us/security/portal/submission/submit.aspx

@lesderid commented on GitHub (Jan 2, 2017): I believe this is the right place to report false positives (for Windows Defender): https://www.microsoft.com/en-us/security/portal/submission/submit.aspx
GiteaMirror commented 2025-11-02 03:12:28 -06:00
Author
Owner
Copy Link

@Bwko commented on GitHub (Jan 22, 2017):

I've contacted the Microsoft defender team and they cant find anything suspicious.
So I think this is a false positive.

@Bwko commented on GitHub (Jan 22, 2017): I've contacted the Microsoft defender team and they cant find anything suspicious. So I think this is a false positive.
GiteaMirror commented 2025-11-02 03:12:29 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Feb 5, 2017):

So let's close this one. Please feel free to reopen it.

@lunny commented on GitHub (Feb 5, 2017): So let's close this one. Please feel free to reopen it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label topic/deployment
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#178
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?