Skip to content

Add commands to upload bundles to virustotal

With each new release, some users are complaining that their Windows antivirus is detecting Tor Browser as a virus. A theory is that the antivirus is blocking programs that they have not seen before until they are a few days old.

To avoid this problem (or at least try to limit the duration of the problem), we could upload the Windows bundles to virustotal.com as soon as we have a build ready, so that the antivirus have seen them a few days/hours before the release.

In the past we had something as part of the testsuite uploading the bundles to virustotal, but it is currently broken and needs to be fixed. I think we could add some makefile commands to tor-browser-build.git such as make upload-unsigned-build-virustotal-release (with *-signed-* and *-alpha variants) to upload a build to virustotal (in addition to having it done by the testsuite, probably using the same script for both).

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information