Is cc65 infected by a trojan?

[Johan Kårlin]

I am getting started with cc65/ca65. I found it on GitHub. There are two releases but they only contain source code. But I found a download link leading to sourceforge.net and I downloaded what I understand is the latest version. I tried compiling a simple c program then suddenly WIndows Defender blocks cc65 and reports this below. I must say I am somewhat puzzled over this. I am not exactly the first one using cc65 in this community and I haven't seen any discussions about the compiler being infected by any virus. Does anyone know where can I download an uninfected version?

 

[desertfish]

May I suggest you check the hashes of the file you downloaded against what sourceforge claims?

 

[StephenHorn]

You might also consider grabbing the latest snapshot generated on Github at https://github.com/cc65/cc65/actions/workflows/snapshot-on-push-master.yml

At present, that is specifically the following links:

• 
  (Win32) https://github.com/cc65/cc65/suites/9531935857/artifacts/453016092
  


• 
  (Win64) https://github.com/cc65/cc65/suites/9531935857/artifacts/453016093
  

You can't get much safer (virus-wise) than that without literally building the source code yourself.

[neutrino]

Could be that the maintainers computer is infected. Another harder path of remedy is to use Unix.

 

[Johan Kårlin]

On 12/1/2022 at 10:24 PM, desertfish said:

May I suggest you check the hashes of the file you downloaded against what sourceforge claims?



 

You certainly may, I am a bit lost concerning this. The checksums are the same but that doesn't mean more than that I really downloaded the compressed file I found on the website? I mean some of the files in the compressed folder can be infected and the checksums are calculated on that basis?

[Ender]

Probably a bogus virus report.  They pick up on false positives all the time.  Lots of people use cc65, people that are smart with computers.  I'm pretty sure if it had a virus someone would have noticed. Not to mention, it's open source.  The only way I can see it having a virus was if your computer was already infected and it injected itself into cc65 after you downloaded it, but you probably would have noticed before now if that was the case.

[Johan Kårlin]

On 12/1/2022 at 10:40 PM, StephenHorn said:

You might also consider grabbing the latest snapshot generated on Github at https://github.com/cc65/cc65/actions/workflows/snapshot-on-push-master.yml

Great, I downloaded the latest snapshot. It works just fine. Windows Defender has nothing to say. I even scanned the files manually. What is confusing is that when I now manually scan my originally downloaded cc65 files nothing is found. 

[Johan Kårlin]

On 12/2/2022 at 8:36 AM, Ender said:

Probably a bogus virus report.  They pick up on false positives all the time.  

Ok, that makes sense. But it really makes a simple computer enthusiast like me uncertain. It's not easy to know which warnings to take seriously ...

[StephenHorn]

On 12/2/2022 at 2:00 AM, Johan Kårlin said:

Ok, that makes sense. But it really makes a simple computer enthusiast like me uncertain. It's not easy to know which warnings to take seriously ...

I agree that it's probably a false positive, but I can appreciate your unease. Sourceforge has been around a long time, and it hasn't always maintained the greatest reputation with the software packages it hosts, and honestly I'm not too keen about using it these days just as a matter of personal preference. And in the case of cc65, this is reinforced by the fact that CI builds are available on Github, leaving me to wonder who's uploading new builds to Sourceforge, or why they even bother when Github provides a pretty nice method of hosting release builds as-is, with references to the exact git commit that they were generated from.

I just don't understand why the cc65 folks need or even want Sourceforge anymore. But I'm not them, and I'm sure they have their own preferences and biases just as I have mine. ¯\_(ツ)_/¯

[Johan Kårlin]

On 12/2/2022 at 9:21 AM, StephenHorn said:

I just don't understand why the cc65 folks need or even want Sourceforge anymore. But I'm not them, and I'm sure they have their own preferences and biases just as I have mine. ¯\_(ツ)_/¯

I am asking myself the exact same question. When coming from the ouside like me, GitHub looks like s serious place for both amateurs and professionals, Sourceforge looks outdated and not serious with all its ads and what I find a messy layout. But that’s only what I think. Overall I am very grateful for all people who have contributed to this impressing and well developed tool. ?