ImageMagick source download gets flagged as malware

[gandaro]

ImageMagick version

7.1.2-8

Operating system

Other (enter below)

Operating system, version and so on

--

Description

The (autogenerated) source file (.tar.gz) for ImageMagick release 7.1.2-8 is flagged as malicious in Firefox by Google's Safe Browsing. The release page on GitHub for ImageMagick gets flagged as malicious as well.

Steps to Reproduce

Open release page, download source file.

Images

--

[urban-warrior]

We are aware that the autogenerated source file (.tar.gz) for ImageMagick version 7.1.2-8 has been flagged as potentially malicious by Google. Unfortunately, we do not have control over Google's internal malware detection systems or their decisions regarding flagged content.

We want to reassure our users and contributors that ImageMagick follows strict security and quality protocols before each release:

• Extensive Testing: Each release must pass thousands of unit tests to ensure functionality and stability.
• Secure Build Environment: All binaries are compiled within GitHub’s secure infrastructure, reducing the risk of tampering or contamination.
• Continuous Fuzzing: ImageMagick is continuously fuzz-tested via OSS-Fuzz, a project designed to uncover vulnerabilities in open-source software.
• Security Reporting: We encourage responsible disclosure of any security vulnerabilities through our GitHub Security Advisory page.
• Verified Downloads: All ImageMagick downloads include a message digest and a GPG signature to verify authenticity and integrity.

We remain committed to transparency and security. If you have concerns or encounter issues, reach out through our GitHub channels. We appreciate the community’s continued support and vigilance.