[MU 4.1.0 Beta Issue] Warning from Norton on launching 4.1 Beta

[SteveBlower]

Issue type

Other type of issue

Bug description

I followed the instructions to install MU 4.1.0 beta given in the announcement on Musescore.org - here https://musescore.org/en/node/351505 Downloading and installing MuseHub Beta from musehub.org and Musescore 4.1.0 beta from https://ftp.osuosl.org/pub/musescore-nightlies/windows/4x/testing/MuseScore-4.1.0.231731239-x86_64.msi

During the download Norton 365 reported no issues with the downloaded files.

After installing MuseHub 1.0.2.799 and launching it by selecting a copy of a MU3 file and using "Open With" Norton showed the warning in the screenshot below. The same warning is shown if I start Musescore from the desktop shortcut. If I understand the warning correctly, it is that MuseScore is trying to send data to s3.amazonaws.com.

Googling s3.amzonaws.com I see that it is a cloud file sharing service.

[Edited to remove incorrect assumptions -Note to self: Never assume!]

Steps to reproduce

1. On a machine that runs Norton 365, install MuseScore 4.1.0 beta
2. Launch
3. See warning message

Screenshots/Screen recordings

MuseScore Version

MuseScore version (64-bit): 4.1.0-231731239, revision: github-musescore-musescore-7d15ce0

Regression

Yes, this used to work in a previous version of MuseScore 4.x

Operating system

OS: Windows 10 Version 2009 or later, Arch.: x86_64,

Additional context

Identifying as a regression as no such warning was raised when running MU 4.0.2

[cbjeukendrup]

This has been fixed just after the beta build was created, in #18125.

[cbjeukendrup]

Hm, I think I spoke too soon. That fix was only for the "portable" version, not the MSI.

MuseScore uses that S3 server to load things like the playlist on the Learn page, and updated versions of the translations.

[bkunda]

@igorkorsukov do you think you could help us with this one please?

[igorkorsukov]

@cbjeukendrup Can you please tell me what is the status of this problem now?

[cbjeukendrup]

@igorkorsukov Actually there is not much more information than the description of this issue. Apparently, Norton thinks that some signature is invalid (and in combination with the fact that MuseScore connects to the internet, that triggers this warning apparently, but I don't know anything about Norton so I can't say more about that).
I commented because I thought that we had just fixed this, but then I realised that the fix was for the Portable build, while this issue is about the MSI build, where signing should already be working.

[igorkorsukov]

@cbjeukendrup Maybe it has something to do with the addition of SHA256?

[igorkorsukov]

In general, I think that the problem may be due to the fact that we updated the signature, but perhaps it has not become trusted yet, it takes some time and number of uses for it to become trusted. This is just a guess.

[cbjeukendrup]

I don't think it is related to the SHA256 thing, because that has not been merged to the 4.1 branch.

[igorkorsukov]

Then I have no idea at the moment, I think we need to write to Norton support and try to find out what is wrong.

[bkunda]

@igorkorsukov confirmed with @vpereverzev today that the approach should be:

• Someone on our team installs Norton 365 to test this on a) 4.1 beta, and b) 4.1 stable
  The hypothesis is that this shouldn't affect the stable build, but it would be good to verify in any case.

At any rate, addressing this could probably be done for either 4.2 or an earlier patch release.

[bkunda]

@SteveBlower can you please check whether this is still an issue with the latest release version (4.1.1)?
Many thanks!

[SteveBlower]

I am not getting the warning with 4.1.1.

However, I think I told Norton to ignore the warning at some stage. Then again, if I look at my Norton settings, I can't find any indication that musescore or musehub or s3.amzonaws.com or the remoteIP address in the warning are on a white list.

[cbjeukendrup]

In that case, I think we can close this issue. I haven't seen any other reports of it recently. And of course, we can always reopen it if the issue ever comes up again.
Thanks!