Why does Windows Defender think my (github built) Zig binaries are trojanned?

[mellow laurel]

During development, I've been cross-compiling for Windows using a Mac zig build -Dtarget=x86_64-windows. I copy my .exe across a fileshare and run on Windows - no problems at all.

I've just setup github to build binaries but when I try to run them Windows Defender complains (even if I copy them via the fileshare as before).

I hope it's very unlikely that github's "goto-bus-stop/setup-zig@v1" is backdooring my binaries, so what is going on?

The Mac built cross compiled binary is exactly the same size. I do see differences in the binary where various build paths are embedded into it, but don't know how to check further.

Any ideas?

(The binaries are here: https://github.com/ringtailsoftware/commy/releases/tag/main)

[mellow laurel]

Switching to github action mlugg/setup-zig@v1 fixed it. But, it's still an interesting question.

Why does Windows Defender think my (github built) Zig binaries are trojanned?

[wide tendon]

This is dev 101 for machines with antivirus.
Go into your Defender settings and exclude your build folders (including caches) from being scanned. Windows 11 added "Developer mode" to make doing development less of a pain, so if you have it, use it.

[mellow laurel]

I am confused as to why my own builds work, as do the ones from @proven bloom ‘s GitHub action, but the older GitHub action trips the Windows Defender. How can I prove this is a false positive and not a cause for concern?

[wide tendon]

What's the diff between the two gihub actions .YML files? That might have some clues.

Is one of those files downloaded directly, versus from downloading a Github release .zip? It looks from the threat report that the one with an issue was downloaded directly from the web, which may be why it is considered suspicious.

[mellow laurel]

I tested them both coming in through a samba fileshare. It must be something in the action.

[crude wraith]

Perhaps it does actually backdoor it? Try comparing hashes of locally built and remotely built exe

[proven bloom]

I'm pretty damn confident that it's not backdooring the binary, lmao. That would be a very weird move, and also a lot of effort for someone who doesn't really use Zig and was very happy to have my Action replace hers as the recommended one.

Windows Defender trips on all sorts of things. Are you using the exact same Zig version with both Actions?

Also, if the binary is exactly the same size, then it would be exceedingly technically difficult for there to be a backdoor

I can try and diff the binaries later, Defender is probably just shitting itself for no reason

[obtuse vapor]

Always has been.

[mellow laurel]

I am also 99.9% certain Windows Defender is complaining about nothing. It's really just interesting as I was trying to get github to make working binaries I could point people at.
(I know I shouldn't be distributing unsigned binaries and that there are better ways)

Here are the two .exe files. They're different as they contain paths to the build environment, so I couldn't meaningfully diff them.

Also, I know basically nothing about Windows development.