search

gildas-lormeau / single-file-companion-lite

SingleFile Companion Lite
GNU Affero General Public License v3.0
80 stars 7 forks source link

Strange binary file in repository #14

Open spaceman7777 opened 3 months ago

spaceman7777 commented 3 months ago

Hi, I was taking a look through your projects (great job! :D), and I noticed that in single-file-companion-lite, there are some very large binary files (99.6MB), for which no source code is provided.

These files are not present in the regular single-file-companion.

I tried decompiling it to determine what was going on, and they had a bunch of references to various Rust libraries.

Anyway, this is kind of concerning from a security standpoint. But also, it doesn't comply with the AGPL 3 license that this project is licensed under, unless there is a public project somewhere that this corresponds to.

Let me know if you know what this file is, to allay my fears (hopefully lol). Screenshot of file in repo: Screenshot_20240725_001506

gildas-lormeau commented 3 months ago

It's the binary code compiled with Deno. I agree these files should not be in the repository though.

mara004 commented 3 months ago

It's the binary code compiled with Deno. I agree these files should not be in the repository though.

Is the only source file the small index.js ? Why then are the binaries so big (~100 MiB) ? Do they bundle Deno or something?

(Update:) FWIW, if I run deno compile --allow-read --allow-write --target x86_64-unknown-linux-gnu --output ./src/linux/singlefile_companion_lite ./src/index.js locally on git main, I get an ~80 MiB file, not ~100.

Is there any way to reproduce the current builds? I suppose merely reverting to the build commit will not be sufficient?

gildas-lormeau commented 3 months ago

The builds should be reproducible by using the correct version of Deno. The problem is that I do not remember what version it was. Looking at the dates and the code in a hexadecimal editor, it seems it was the version v1.30.2. The files were larger because the Deno runtime size has been optimized meanwhile.