Frankenphp for windows was flagged as malware

[mark1502]

What happened?

I tried to download the windows version of frankenphp (latest) and my antivirus flagged it as containing malware, so I thought I should make you aware of this. Is it really infected with malware or can I install it? Here is a screenshot with malware info:

Build Type

Custom (tell us more in the description)

Worker Mode

Yes

Operating System

Windows

CPU Architecture

x86_64

PHP configuration

phpinfo() output

php 8.4

Relevant log output

Relevant log output

[henderkes]

"Anti"virus software really detects anything not used by a million people as malware these days. There's a reason why I have it disabled on most of my devices.

We should move to statically linking watcher-c and properly signing the FrankenPHP binary, but that'd be @dunglas responsibility. Possibly the phpf already has a certificate backed by a real CA? Technically there are free signing services around, in reality I've found the requirements and maintenance to outweigh the benefit of saving money.

[dunglas]

I don't know anything about windows binary signing. Do you have any link explaining how to do that?

[henderkes]

SignTool itself is available on Windows by default, you can use it to sign binaries with an organisation signature or for extended validation (where I believe they do some checks on the organisation applying, such as how long they've been in business, how trustworthy they are, etc.). The benefit of EV signed binaries is that they immediately get SmartScreen reputation. Sellers are all the big CA's you'd imagine, DigiCert, SSL.com, Sectigo, and so on.

Just took a peek and it seems like php binaries aren't signed at all. Given that the PHP Foundation was only brought into life a few years ago and the releases are done by windows folks, that makes sense. The whole situation is honestly a disaster and at times feels like a pure money grab, just like ssl certificates used to be before Let's Encrypt made free ones widely available a decade ago.