libhogweed-6.dll and libgstcodecparsers-1.0-0.dll tagged as malware

[gustavmgr]

Hello there

I really want to use Xpra at work and we're pretty crazy about security so everything gets scanned. Apparently we're picking up something in these files:
" libhogweed-6.dll and libgstcodecparsers-1.0-0.dll have been flagged as a possible trojan by the Vir.IT eXplorer AV engine"

Does this look like something you recognise?

[totaam]

These two DLLs come directly from MSYS2 without being modified in any way, so the chance that they are malicious is vanishingly small.
False positives with virus scanners is something that happens regularly: #3639 (comment)

I suggest that you just remove these two files, xpra should work OK without it, AFAICT this will only remove the ability to:

• use AES encryption as libhogweed is used by the cryptography package
• use some audio codecs: gst-plugins-bad-libs

Or you could just use a different / better AV scanner, or report this as a false positive so they can fix it.
My guess is that if you don't report it, someone else will, as MSYS2 is used by a large number of open-source projects.

[gustavmgr]

Fantastic - I needed to know the origin so appreciate that very much