search

cnlohr / rv003usb

CH32V003 RISC-V Pure Software USB Controller
MIT License
461 stars 47 forks source link

Linked GCC10 Toolchain is flagged as Virus/potentially dangerous #67

Open cad435 opened 3 days ago

cad435 commented 3 days ago

When trying to download the prebuild GCC10 Toolchain for RISCV from the provided link:

https://gnutoolchains.com/risc-v/

Virustotal freaks out a bit: https://www.virustotal.com/gui/file/9fdb75f4c67a6975f362ae61116c65bef5ba1e841e2f22a3b14d2da9df0e07fa

Is it safe to use?

cnlohr commented 1 day ago

I have not seen this! We will discuss on my Discord. Thank you for reporting it.

cad435 commented 1 day ago

You're welcome! Thank you for looking in

I just want to add that it actually is very easy to make a Ubuntu WSL, install the required packages and compile the bootloader this way. (Never done this before, defintely will use it more often in the future)

for me, with (I'd say) beginner Linux skills definately less effort than installing a toolchain on windows...

cnlohr commented 1 day ago

It is unacceptable for users to install WSL to use this tool. WSL requires >100MB of space, which is out of the question for supporting embedded development for a platform... not to mention additional services will need to run.

The link above is a single installer that includes all needed components, so the complete installation steps are:

  1. Use the GCC installer from the above link.
  2. Get a copy of ch32v003fun.
  3. Run "make" in the example of your choice from command-line.

Anything more complicated than that is not going to be tolerable to our audience.

-- on the reporting end --

So far, one other user is reporting that there is no issue. We are continuing to investigate.

Charles

cad435 commented 1 day ago

Hmm, yeah I definately can see that points in regards to WSL...

cnlohr commented 1 day ago

It appears that this might be a false alarm. It is possible that the install methodology of this GCC compiler toolchain is similar to an attack vector of muddywater. But, still looking. I've reached out to sysprogs to discuss with them.