v11.0.0 tarball ships 13 bundled apps as build working trees (.git/, tests/, build/artifacts/) — 102 MB of dev files, code-signed, incl. EICAR test data
Summary
The owncloud-complete-* release tarball ships 13 of its bundled apps as the working tree the app was built in, not as the app's release artifact. Each of those app directories contains .git/ (a shallow clone including the pack file), .github/, .gitignore, tests/, vendor-bin/ and build/artifacts/ — the last one holding a copy of the app's own, clean release tarball.
Verified on v11.0.0, owncloud-complete-20260730.tar.bz2 (sha256 747fcbb48a2df5d1ef61b87768a4e3484184469b876a76a8070e5c026f6396b3). Earlier lines are probably affected too; I only measured this one.
In numbers: 101.94 MB of 441.8 MB uncompressed content (23%) is development material, in 16 shipped .git repositories (13 apps plus three inside migrate_to_ocis's vendor/) and 22 nested app tarballs.
| app | files shipped | of which dev-tree | dev-tree size |
|---|---|---|---|
| files_primary_s3 1.7.1 | 10949 | 5504 | 52.11 MB |
| firewall 2.11.1 | 1616 | 867 | 6.33 MB |
| files_pdfviewer 1.1.1 | 1146 | 595 | 24.59 MB |
| files_texteditor 2.7.1 | 765 | 413 | 10.69 MB |
| files_antivirus 1.3.1 | 611 | 354 | 1.33 MB |
| windows_network_drive 2.5.1 | 449 | 290 | 1.48 MB |
| notifications 0.7.1 | 403 | 244 | 0.79 MB |
| announcementcenter 1.3.1 | 406 | 228 | 0.52 MB |
| brute_force_protection 1.4.1 | 383 | 225 | 2.52 MB |
| workflow 0.7.1 | 320 | 209 | 0.71 MB |
| files_external_ftp 0.3.1 | 347 | 195 | 0.23 MB |
| theme-enterprise 2.4.1 | 159 | 98 | 0.53 MB |
| systemtags_management 0.5.1 | 125 | 85 | 0.12 MB |
For contrast, other bundled apps in the same tarball are packaged correctly and contain zero such files: activity, admin_audit, password_policy, metrics, oauth2, twofactor_totp. So this looks like an inconsistency in the release job rather than a deliberate choice.
Why it matters
- Anti-virus scans of the tarball, or of any image built from it, fail.
files_antivirus1.3.1 shipstests/acceptance/data/eicar.com,eicar_com.zip,eicarcom2.zip, and a nestedbuild/artifacts/source/files_antivirus.tar.gzthat contains them again. A ClamAV scan (1.4.6, recursive, limits disabled) of a container image built from this tarball reports 4 ×Eicar-Test-Signature FOUND. For us this rejected a whole appliance image at a customer's AV gate. Thank you for repackaging 1.3.1 as 1.3.2 — that removed the development tree and fixed exactly this for one app; the underlying packaging problem remains for the other twelve. - The development files are code-signed, so an administrator cannot remove them. In
announcementcenter/appinfo/signature.json, 181 of 355 hashes are.git/…,tests/…orbuild/…paths (files_primary_s3: 3653 of 7291). Deleting the cruft therefore breaksocc integrity:check-app, so the only clean options are to delete the entire app or to ship it as it is. - ~100 MB of dead weight in every deployment and every image layer.
- Scanner noise and supply-chain surface. The nested
build/artifacts/*.tar.gzcontain second copies of vendored dependency trees, which image scanners (Trivy et al.) report separately from the installed copy. The shipped.git/also carries the release engineer's clone metadata:.git/logs/HEADholds their name and e-mail address, and.git/configthe[email protected]:owncloud/<app>.gitremote.
Likely cause
The release job appears to clone each app into apps/<app>/, build it there, and then package apps/<app>/ instead of the artifact it just produced. Two pieces of evidence from the shipped tree:
apps/announcementcenter/.git/configcontainsfetch = +refs/tags/v1.3.1:refs/tags/v1.3.1and there is a.git/shallow— i.e. a shallow tag clone made by an automated job.- The clean artifact sits right there next to the cruft:
apps/announcementcenter/build/artifacts/appstore/announcementcenter.tar.gzunpacks to 154 files with no.git/,tests/orbuild/, while the shippedapps/announcementcenter/directory has 406 files. Same forfiles_texteditor(332 clean files in the artifact vs 765 shipped).
Expected behaviour
Package the content of each app's appstore artifact — as already happens for activity, admin_audit, metrics, oauth2, password_policy, twofactor_totp — and sign that. Nothing under .git/, .github/, tests/, build/ or vendor-bin/ should be part of a release tarball, and no anti-virus test data.
How to reproduce
Listing only — note that extracting this archive writes EICAR test files to disk, which some endpoint protection will act on:
curl -sSLO https://github.com/owncloud/core/releases/download/v11.0.0/owncloud-complete-20260730.tar.bz2
tar -tjf owncloud-complete-20260730.tar.bz2 \
| grep -E '^owncloud/apps/[^/]+/(\.git|\.github|tests|build|vendor-bin)/' \
| cut -d/ -f3 | sort | uniq -c | sort -rnAlso in the same tarball
migrate_to_ocis 3.0.0 vendors three dependencies with their .git directories included: ramsey/uuid (3.23 MB pack file), brick/math (1.57 MB), ramsey/collection (0.40 MB).
Found while building the BayernBox appliance image from the v11.0.0 tarball; happy to provide the full per-file inventory if that helps.
Source: owncloud/core