Clash Download Failure: Virus Alert On Linux-arm64

Hey guys, it looks like there's a nasty bug going around! Users are reporting that downloading clash-linux-arm64.tar.gz is failing. Worse yet, it's triggering virus alerts, specifically a Trojan:Script/Sabsik.FL.A!ml detection by Chrome and Windows Security Center. This is a serious issue that needs some attention, so let's dive into the details and figure out what's going on. This issue affects users on the Istoreos platform using OpenWrt 21.02, running on Linux-arm64.

The Problem: Virus Detected During Download

So, the main issue is pretty straightforward: When you try to download the latest kernel version (alpha-gbeb1f27) of the clash-linux-arm64.tar.gz file, both Chrome and Windows Security are flagging it as malicious. The download link in question is https://raw.githubusercontent.com/vernesong/OpenClash/core/master/meta/clash-linux-arm64.tar.gz. This means that even if you're trying to get the latest updates, your security software is blocking you, and potentially deleting the file automatically. This is a real bummer because it prevents users from getting the latest features and security fixes for OpenClash. Nobody wants their system to be potentially compromised, so this is a high-priority issue. I know it can be frustrating when you encounter problems like this, but don't worry, we'll try to get to the bottom of this. We need to find out why these false positives are occurring and, more importantly, how to fix them.

This isn't just a minor inconvenience; it's a significant roadblock for anyone trying to use OpenClash on their arm64 Linux devices. This issue can prevent users from updating to the latest kernel versions, which often include important bug fixes and performance improvements. Also, it can break the functionality of any programs that depend on this file. We need to identify the root cause of the virus detection to ensure the safety and reliability of OpenClash for all users. We also need to see if the maintainers have provided any suggested temporary solutions for this problem. If it is a false positive and there is no virus, the maintainers will need to provide steps to avoid this situation.

It is important to understand what the user has already done to determine the problem. They have followed several verification steps to ensure the issue is not with the user's setup or outdated versions. It's great that they checked the Issue Tracker to see if the problem was already reported. This is a good way to save some time, because if the issue had already been reported, the user wouldn't have to spend a lot of time trying to report it again. They also confirmed that they're using the latest Dev version of OpenClash, which suggests that the problem persists even with the most recent updates. The user is aware that OpenClash is independent of other related projects like Core, Dashboard, and Subconverter. So, the source of the problem is likely within OpenClash itself, making it easier to track down the issue. They confirmed that the issue is specific to OpenClash and not a general problem with their system. They also mentioned they're willing to help develop and solve the issue, which shows a commitment to the OpenClash community. Lastly, the user confirmed this is not a request for a meaningless update or fix. Instead, this is a report of a legitimate problem.

Technical Details and Context

The issue was found on Istoreos, running OpenWrt 21.02. This means the affected users are on a specific operating system and OpenWrt version. This information is critical, as it allows developers to focus their debugging efforts on the specific environment where the bug is happening. The bug is happening on the Linux-arm64 platform. This means that users with arm64 architecture devices are most affected. This will affect users using devices such as NAS devices or routers. The user is using OpenClash version 0.47.024. This information helps in tracking down specific version-related issues. The user has provided the link to the problematic file which helps in verifying the problem. It also includes the exact link https://raw.githubusercontent.com/vernesong/OpenClash/core/master/meta/clash-linux-arm64.tar.gz which can be used to reproduce the problem. The user has specified that they were not able to reproduce the problem.

Troubleshooting and Potential Solutions

Okay, so what can we do to tackle this? First off, we need to determine if this is a false positive. It's possible that the security software is incorrectly identifying the file as a threat. If this is the case, the OpenClash developers might need to contact the security software vendors (like Google and Microsoft) to have the file whitelisted. This can be a pain, but it's often necessary to ensure that legitimate software isn't blocked. If the file is malicious, then we need to know how it happened, if the code was infected by a virus. Or, if someone deliberately uploaded a corrupted version of the file. And, if that's the case, then the file needs to be removed from the repository, and a clean version needs to be uploaded. The original uploader should also check their system for malware. And, we also need to see if the user could download the software from other sources to see if the problem persists. If the problem only exists for a specific source, then the developers can focus on fixing that source specifically.

If it's a false positive, users might be able to temporarily disable their antivirus software or add an exception for the file to allow the download and installation. But be extremely cautious when doing this, as it could expose your system to real threats if the file is, in fact, malicious. It's always best to err on the side of caution. And, of course, make sure you're getting your downloads from a trusted source. Ensure that you have the correct file name, version number, and that the site where you're downloading it from is reputable. Consider checking the file's hash (like SHA-256) to verify its integrity. If the hash matches the one provided by the developers, you can be more confident that the file is safe.

Steps to Reproduce and Gathering Information

To reproduce this, you would ideally: go to the download location, and attempt to download the clash-linux-arm64.tar.gz file. The user has already provided the direct link, so this part should be easy. Then, observe how your security software reacts. Does it immediately flag the file? Does it quarantine or delete it? If you can reproduce the issue, you should try to gather more information, such as the exact error messages from your antivirus software, or the logs from OpenClash. You can provide these logs by pasting them in the proper area within the Github issue, using the log formatting in the Github issue. The original poster didn't include OpenClash logs or a specific config, which is fine, as the issue seems to be directly related to the download itself. However, providing this information could help with diagnosing the problem.

Conclusion and Next Steps

So, in summary, we're dealing with a frustrating situation where the download of clash-linux-arm64.tar.gz is being blocked due to virus detection. We need to clarify whether this is a false positive or a legitimate threat. If it is a false positive, it's crucial to report the issue to the antivirus vendors, and see what the users can do to download the file. If it is a malicious file, then we need to identify how it became infected and remove it from the download location. For now, users should be cautious and verify the integrity of any downloaded files. This is a call to action for the developers to investigate this issue, verify the file's safety, and take the necessary steps to resolve this, whether it's by contacting security vendors, cleaning up the file, or providing further guidance to users.

Remember to stay safe, keep your software updated, and always be wary of unexpected security alerts!