search

mikecole / chocolatey-packages

A template to use when setting up to create packages both manual and automatic
Apache License 2.0
8 stars 21 forks source link

Problem with imgburn package #129

Open gep13 opened 3 years ago

gep13 commented 3 years ago

@mikecole we received a report about one of your packages:

I downloaded the file using Chocolatey. Right after installing MBAM AV engine reported Adware Fusin.Core. Virustoral.com reports 67 AV engine hits.

Is this something that you can help with? Given the high number of detections for the file, we may need to look to remove this package from the repository if there is nothing that can be done.

I did notice the pinned comment from Rob here: https://chocolatey.org/packages/imgburn/2.5.8.20170708#comment-3780419867 but I wanted to check to see if things had changed.

mikecole commented 3 years ago

Not that I am aware of. This has always been a problem package. I would vote for removal.

On Fri, Oct 9, 2020 at 1:18 AM Gary Ewan Park notifications@github.com wrote:

@mikecole https://github.com/mikecole we received a report about one of your packages:

I downloaded the file using Chocolatey. Right after installing MBAM AV engine reported Adware Fusin.Core. Virustoral.com reports 67 AV engine hits.

Is this something that you can help with? Given the high number of detections for the file, we may need to look to remove this package from the repository if there is nothing that can be done.

I did notice the pinned comment from Rob here: https://chocolatey.org/packages/imgburn/2.5.8.20170708#comment-3780419867 but I wanted to check to see if things had changed.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/mikecole/chocolatey-packages/issues/129, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAI4X26XW3DVS5QS75HCBGTSJ2TMVANCNFSM4SJVB3OA .

pauby commented 3 years ago

Can we look to use mirrors for this as suggested in the comment @gep13 linked to?

mikecole commented 3 years ago

There is a MajorGeeks mirror, but it appears they use sessions/expiring download URLs. Is there a recommended way of handling this other than scripting a call to their intermediate URL to get the expiring URL?

On Mon, Oct 12, 2020 at 3:11 AM Paul Broadwith notifications@github.com wrote:

Can we look to use mirrors for this as suggested in the comment @gep13 https://github.com/gep13 linked to?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/mikecole/chocolatey-packages/issues/129#issuecomment-706956709, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAI4X265WUJMGWJKUXZFZMLSKK2ZRANCNFSM4SJVB3OA .

pauby commented 3 years ago

@admiringworm may be able to help here as he has some experience using headers in requests for downloads.

AdmiringWorm commented 3 years ago

@pauby @mikecole I don't think just using headers in the request would help in the case of using Major Geeks as a mirror.

From the looks of it, it must be scripted inside the package to get the session URL during the installation.

pauby commented 3 years ago

@AdmiringWorm Are there are any packages, that you're aware of, that does this?

AdmiringWorm commented 3 years ago

None that comes to mind, unfortunately.

Maybe @mkevenaar, @RedBaron2 or @chtof are aware of a any.

RedBaron2 commented 3 years ago

@mikecole The software has not had an update since 2013, and as many people mentioned in the imgburn/majorgeeks forum/disqus. Most new systems don't come with CD/DVD drives for even using the software.

@pauby I'm not a legal expert. The use of MajorGeeks as a mirror could create a usage conflict with Chocolatey (the company). We would not want to have another issue like the FossHub issue from 3 years ago.

pauby commented 3 years ago

@RedBaron2 Can you elaborate on all of that as I'm unsure of it?

AdmiringWorm commented 3 years ago

@pauby I assume he is referring to: https://github.com/chocolatey/package-validator/wiki/ScriptsDoNotDownloadFromFossHub

mikecole commented 3 years ago

@gep13 I'd like to request that we remove this package from choco. Due to its long history with malware, its limited usefulness today, and the unclear path forward, I just don't think it's feasible to maintain it.

TheCakeIsNaOH commented 3 years ago

I've taken a closer look at this, and it actually seems to be alright now.

The currently newest approved version is 2.5.8.20170708. That has a checksum starting with D7DEA28, and has a high virustotal count of of 40/69 (currently)

The version currently under moderation is 2.5.8.20210426. That has a checksum starting with 49AA061, and a low virus count of 2/67 (currently).

The binary with 49AA061 also what majorgeeks offers for download, and they are offering clean version, without open candy.

Thus, it appears like the author's site is now offering the version of the binary previously only available at majorgeeks.

Therefore, my suggestion is to go ahead and approve version 2.5.8.20210426, and then unlist all older version of the package.

jkirk commented 1 month ago

Any progress on this? 2.5.8.20210426 downloads the file directly from imgburn.com, see: https://github.com/mikecole/chocolatey-packages/commit/1d5641d997b0be4f93a11f2a31e5beb4a73d28df

Virus Total shows a score of 0:

The only problem I see is that the verification tests failed: https://gist.github.com/choco-bot/c48938534358fcb879da695814dc6ecb

Can we help to fix this?

Thx for maintaining ImgBurn! ❤️

mikecole commented 1 month ago

I just re-listed it. I am unable to trigger a re-run on the virus scanner or verification tests, so we'd need somebody like @TheCakeIsNaOH to reconcile that part of it. Thanks!

pauby commented 1 month ago

@mikecole Package Verifier / Package Scanner don't need to be re-run.

mikecole commented 1 month ago

@pauby I was trying to reset this message:

image
pauby commented 1 month ago

To do that, we need to exempt the package, run the services and then potentially (if it passes) approve it again.

My suggestion would be to leave this as is unless there is a reason not to do so.

mikecole commented 1 month ago

@pauby My only concern with that is the warning IMO makes the package seem dangerous to the end user, when it perhaps isn't.