Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Windows binary included in readpe with no source #210

Closed
davidpolverari opened this issue Jan 29, 2024 · 4 comments
Closed

Windows binary included in readpe with no source #210

davidpolverari opened this issue Jan 29, 2024 · 4 comments

Comments

@davidpolverari
Copy link
Contributor

Describe the bug
While I was packaging the latest readpe version for Debian, I realized the file support_files/samples/hh6d.golden.exe, which was added as a sample "hello world" binary for tests, comes with no corresponding source, nor a build system to generate it.

From the Debian standpoint, this is a violation of its free software guidelines. I could repackage upstream sources without the binary to comply with DFSG, but this would not be the best solution, as tests would not be run.

Besides, from a little bit of research, it seems that the binary comes from the pts-tinype repo. By perusing the files over there, I noticed there was no license in any of the files. This makes its inclusion even in readpe somewhat concerning from a legal standpoint.

To Reproduce
Please provide us with:

  • pev version 0.83 (7f3c136)
  • OS version: Debian GNU/Linux 12
@davidpolverari davidpolverari changed the title Windows binary included in reappe with no source Windows binary included in readpe with no source Jan 30, 2024
@GoGoOtaku
Copy link
Collaborator

Thank you for bringing this to my notice. I take this very seriously.

When I approved the merge request I already had a bad feeling but I had made sure to find out where the file was from and I thought I also checked the license.
Turns out I should have trusted myself more and rejected it.

I removed the file from the repository and it's history and remade the release.
(Turns out github really doesn't like recreating tar.gz files hence why I had to do it a couple times - sorry for the mail spam whoever follows this repository)
Now the release obviously is missing the test file but I rather have a release with broken tests than have this executable in here. I will create a small executable myself and add it and it's source code to the repository.

Once again: This is very serious and I really dropped the ball here. I'm sorry.

@davidpolverari
Copy link
Contributor Author

Don't worry. We all know how managing open source projects is not an easy task, and it is another one we put upon ourselves in addition to our day jobs and other responsibilities.

Sometimes those things happen to all of us. Most important is the way we handle it once we know. You're always doing a good job!

PS: I will try to package the new version on Debian as soon as I have time.

@jweyrich
Copy link
Contributor

@GoGoOtaku maybe host the test file somewhere and have the test script download it if it's not present locally? Not sure if that would be a good practice though.

@GoGoOtaku
Copy link
Collaborator

I just added a new executable that I build using MinGW. It's less than 50KB which is about what a larger source file can be.
See #212

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants