Windows executable flagged by scanners

[binwiederhier]

[Curid]

Time for the yearly $500 Microsoft tax.

https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate

[binwiederhier]

Apparently it is common for Go binaries to be flagged by virus scanners, so common that they dedicated a FAQ item to it: https://go.dev/doc/faq#virus

There's also a 5 months young Reddit post about it: https://www.reddit.com/r/golang/comments/rism9x/why_does_windows_defender_still_flag_gobinaries/

The bottom line is: There's nothing you can do about it. I manually re-read the code of subscribe.go, and it's injecting the environment variables from the remote message, NOT the command. So those scanners are all wrong.

[binwiederhier]

The scoop project has asked for binaries to be built from a pipeline to prove that they match the source. I wanted to do that anyway in #36 so I'm doing that.

[binwiederhier]

I commented on ScoopInstaller/Main#3594 and I'm now awaiting their response. There is nothing really I can do about the executable being flagged by scanners. I'm going to close this ticket for now. If anyone has any great ideas let me know.