Open paperdave opened 1 month ago
can be properly added to anti-virus exclusion lists
why can’t we have CI push it up to them?
can be properly added to anti-virus exclusion lists
why can’t we have CI push it up to them?
Malwarebytes doesn't have any method for that, I think. So it's just two methods to resolve the problem that I can see, either signing the exe or putting the one version you'll use forever and ever on the forums (which isn't possible right now because the builds aren't reproducible)
dumpbin /all .\zig-out\bun_shim_impl.exe > out2.txt
That is a timestamp embedded in the file. ......... yeah unfortunate.
I know that the Zig compiler has tests that make sure that compiling itself is reproducible, so this has to be possible.
Then, once bun_shim_impl.exe has a static hash, we should add an assertion that the hash continues to stay the same.
After all of that is done, this binary will have a stable hash and can be properly added to anti-virus exclusion lists. It's been brought to my attention that this executable trips a Malwarebytes heuristic. We cannot possibly fix that if each build of Bun from CI changes this file.
For the rest of us, AV seems pretty friendly to this exe, as I have not seen anything flag it yet.