mirror of
https://github.com/stablyai/orca.git
synced 2026-10-04 00:02:21 +00:00
Neil
d2dbe2c385
* docs(security): add the antivirus clearance path for future releases Every AV false positive here has been handled one vendor and one shipped version at a time. Document the programs that clear future releases instead -- signer and product enrollment rather than per-build sample submission -- and add a script that reports an RC's current detection state by hash, so a verdict is found before users meet it in an issue report. Hash lookup only by default; --upload transmits the artifact and stays manual. * fix(windows): replace the managed CLI launcher with a native one resources\bin\orca.exe was a csc-compiled MSIL assembly: a small, freshly compiled .NET image in a user-writable directory that mutates environment variables and proxies a child process. That is the shape .NET dropper heuristics are trained on, and every verdict against it named the family -- MSILHeracles from two vendors, Wacatac!ml from a third. Signing the file does not change its shape, so signing never cleared it. Rebuild it in Rust. Same resolution, same environment contract, same argv passthrough that keeps newline-bearing orchestration bodies intact (#8374), and the child still inherits our environment block rather than an explicit map, so a block carrying both PATH and Path survives (#12046). The PE now carries publisher, version, icon and an asInvoker manifest from build.rs. Refs #23383 * ci(windows): install the Rust toolchain before building the CLI launcher The hosted runners happen to ship cargo, but a real Windows dev box does not -- verified on our own Windows QA host, where cargo and rustc were both absent. Relying on the image means a future image change fails deep inside electron-builder's native hook instead of at an obvious step.
26 lines
692 B
TOML
26 lines
692 B
TOML
[package]
|
|
name = "orca-cli-launcher"
|
|
version = "0.0.0"
|
|
edition = "2021"
|
|
publish = false
|
|
|
|
# Why the bin is named `orca`: it ships as resources\bin\orca.exe, and the PE's
|
|
# OriginalFilename must match the file users actually invoke.
|
|
[[bin]]
|
|
name = "orca"
|
|
path = "src/main.rs"
|
|
|
|
[build-dependencies]
|
|
winresource = "0.1"
|
|
|
|
# Why: this is a launcher, not a program. Everything here trims the PE toward the
|
|
# shape of an ordinary small native utility -- no panic machinery, no debug
|
|
# sections, one codegen unit -- which is also what keeps it out of the
|
|
# heuristic bucket the previous managed build sat in.
|
|
[profile.release]
|
|
opt-level = "z"
|
|
lto = true
|
|
codegen-units = 1
|
|
panic = "abort"
|
|
strip = true
|