search

libgdx / gdx-liftoff

A modern setup tool for libGDX Gradle projects
Apache License 2.0
541 stars 50 forks source link

Virus protection find malware on 1.13.0.0 #207

Open cbejl opened 2 days ago

cbejl commented 2 days ago

Windows Defender and Chrome Browser find malware in jar.

That trouble only with 1.13.0.0, the problem is not observed on the other version.

Virus Total

I fully trust you and I am sure that this is a bug that can be solved or that users can be notified about. It would also be nice to attach checksums to releases, because initially I had thoughts about a virus replacing files on my PC.

Virus Total Windows Defender Google Chrome

HenryGX commented 2 days ago

i have the same issues image

crykn commented 2 days ago

This may be related to LWJGL/lwjgl3#1005.

GuidoNicolini commented 2 days ago

imagen

Same problem here .[Windows Defender]

tommyettinger commented 1 day ago

I'll see if downgrading LWJGL3 to the 3.3.3 release (which didn't flag antivirus programs) is even possible. If it isn't, we'd probably need to wait for Microsoft to figure out this isn't a virus (though the detection is most likely LWJGL3 3.3.4, and we of course use LWJGL3 heavily), or wait for LWJGL3 to push a new version that doesn't detect as malware. If it is a detection on Liftoff itself, I don't even know who we would contact to get this figured out...

tommyettinger commented 1 day ago

OK, I downgraded libGDX to 1.12.1 (which isn't a bad idea right now if you target GWT, Android, or really desktop too given the AV issues with 1.13.0...). This seems to essentially solve the VirusTotal issues it had; only Fortinet claims it might be a "PossibleThreat", and no other AV programs think it is a problem.

Here's a build of the latest gdx-liftoff that's had LibGDX downgraded to 1.12.1, while keeping the dependency on NFD (for file dialogs) at 3.3.4 . VirusTotal seems almost totally fine with this one.

gdx-liftoff-1.13.0.1-SNAPSHOT.jar.zip