[Security]: Add comprehensive security scanning to Nuitka build jobs #76
Labels
No labels
Kind/Bug
Kind/Feature
Priority/High
Priority/Medium
Reviewed/Confirmed
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
ai-collab/bulk-image-organizer#76
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Add automated security scanning steps to Nuitka standalone build pipeline for both the Windows executable (.exe / .dist folder) and the Linux AppImage.
Provide users with safety assurance, catch real issues early, document scan results, and reduce AV false-positive complaints.
Impact
Nuitka binaries are frequently flagged by Windows Defender and other AVs due to their compiled structure. These scans will give us (and users) confidence and help with false-positive submissions.
Steps to reproduce
No response
Suggested mitigation
After the Nuitka compilation step (and before artifact upload), add the following checks:
ClamAV scan (fast, local, cross-platform)
VirusTotal scan (comprehensive – 70+ engines)
Static analysis
Nice-to-have / follow-ups
Acceptance criteria
Implemented on branch
0.1.42/issue-76-build-security-scanning(queued for PR tomain, not yet opened).Both release jobs (
linux-appimage.yml,windows-release.yml) now scan the freshly built artifact after the Nuitka build and before publishing it as a Forgejo release asset:scripts/security-scan-artifact.py).checksec/readelf/fileon Linux; an Authenticode signature check + PE section/entropy dump (viapefile) on Windows.scripts/virustotal-scan.py) is optional infrastructure — it skips quietly when noVT_API_KEYsecret is configured, and never fails the build on a network error or a detection, only links the multi-engine report.Each step's summary (including the artifact's SHA256) is written to the job's
GITHUB_STEP_SUMMARY. Documented in README under a new "Security scanning" section, with unit tests covering both scripts' logic (ClamAV missing/clean/detected/error, summary formatting, VT upload/poll/skip-on-no-key/network-failure-is-non-fatal).A couple of notes for whoever has admin access to the Forgejo instance:
VT_API_KEYsecret (otherwise it just skips with a log line — nothing breaks).choco install clamavstep actually succeeds on the realwindows-fullrunner image from here (no Windows CI access in this environment) — worth watching the first run of this workflow to confirm, since a failed ClamAV install will fail the whole release build by design (per the issue's "fail the build on any positive detection" — a missing scanner shouldn't let an artifact ship unscanned either).This is CI/workflow-only — no
src//resources/changes, so no app version bump. Closing — implemented and tested at the script-logic level; first real CI run will confirm the runner-environment integration.Reopened as a reminder to the admin to have the compiled application reviewed for personal data then add a VirusTotal VT_API_KEY secret. https://www.virustotal.com/gui/home/upload
Acknowledged — this reopen is a reminder for whoever has Forgejo admin access, not a code task, so I'm not changing anything here. For the record: to enable the VirusTotal step, add a
VT_API_KEYrepo/org secret (the workflow already skips it quietly when absent). The "review the compiled application for personal data before uploading" step is a manual call for a human to make before that secret is added — leaving this open until an admin has done both.Closing — shipped in PR #123 (part of the stacked 11-PR chain bringing the full feature backlog into
main). ClamAV scan (build-failing), informational static analysis (checksec/readelf/file on Linux, Authenticode + PE section/entropy dump on Windows), and optional VirusTotal upload are now wired into both release jobs after the Nuitka build, before artifact publish. Documented in README under "Security scanning".