Build 2577 for main with status FAILURE - open ./testdata/garble_macho_executable: Operation did not complete successfully because the file contains a virus or potentially unwanted software.

[elasticmachine]

💔 Build Failed

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2024-04-19T15:02:21.381+0000

• Duration: 176 min 26 sec

Test stats 🧪

Test	Results
Failed	0
Passed	55692
Skipped	4988
Total	60680

Steps errors

Expand to view the steps failures

auditbeat-windows-11-windows-11 - mage build unitTest

• Took 4 min 8 sec . View more details here
• Description: mage build unitTest

x-pack/packetbeat-windows-10-windows-10 - mage build unitTest

• Took 0 min 14 sec . View more details here
• Description: mage build unitTest

x-pack/packetbeat-windows-10-windows-10 - mage build unitTest

• Took 1 min 53 sec . View more details here
• Description: mage build unitTest

x-pack/packetbeat-windows-10-windows-10 - mage build unitTest

• Took 0 min 11 sec . View more details here
• Description: mage build unitTest

x-pack/packetbeat-windows-10-system-windows-10 - mage systemTest

• Took 0 min 15 sec . View more details here
• Description: mage systemTest

x-pack/packetbeat-windows-10-system-windows-10 - mage systemTest

• Took 1 min 58 sec . View more details here
• Description: mage systemTest

x-pack/packetbeat-windows-10-system-windows-10 - mage systemTest

• Took 0 min 12 sec . View more details here
• Description: mage systemTest

Error signal

• Took 0 min 0 sec . View more details here
• Description: Error "hudson.AbortException: script returned exit code 1"

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[scottgeary]

When cloning the repo, my local virus scanner is also detecting that the pre-compiled binary garble_macho_executable is matching a known virus.

Offending shasum detected: https://www.virustotal.com/gui/file/776afb2460e1bc4d7caf471b8db038da78cb47d416aa7e45d175c054114b714a

The file hasn't changed since it was introduced in 1fb2484 #28802

The readme for these test binaries suggests they were built using either Go or Garble in-advance. Garble specifically designed to obfuscate code, and likely why it's being flagged.

As a user of this repo, I have to trust these binaries were indeed compiled from the example hello world source. If I compile myself, it's unlikely my output would be exactly the same to prove this.

Perhaps compiling these on-demand, during testing, would increase the trust that they don't include anything malicious. Otherwise it's quite difficult to fully say it's a false-positive.