Hello,
My snap “ingetrazo” (revision 1, version 0.3.8) was flagged as potentially malicious and made private. I already sent an appeal to help@snapcraft.io on September 1st; I’m posting here as well since false positives are usually resolved faster on the forum. I believe this is a false positive and every claim below is publicly verifiable:
-
IngeTrazo is free software (GPL-3.0-or-later). Full source code: GitHub - ingelibre/ingetrazo: Modelador 3D libre estilo SketchUp para ingeniería civil. Linux-first, PySide6, integración IFC con IngePresupuestos. · GitHub — a 3D modeling application (Qt/PySide6) for architecture and civil engineering.
-
The exact snap you reviewed was built in public GitHub Actions CI, not on a private machine. Build run: snap: the listing says what it is — a SketchUp alternative, native .skp · ingelibre/ingetrazo@6ce3748 · GitHub (job “Snap (x86_64)”). The recipe is in the repository:
packaging/snap/snapcraft.yaml.inand thesnapjob in.github/workflows/release.yml. The same commit ships as AppImage, tarball, Flatpak and a Windows installer on the GitHub release (v0.3.8), all built by the same public pipeline. -
What likely tripped the scanner:
- The application is frozen with PyInstaller; its bootloader is a well-known antivirus false-positive family.
- The snap bundles
vendor/libredwg/bin/dwg2dxf, the DWG-to-DXF converter from GNU LibreDWG (GPL), used for opening AutoCAD DWG drawings. Its provenance and rebuild instructions are documented in the repo (vendor/libredwg/SOURCES.md).
-
The snap requests only standard auto-connecting interfaces (opengl, x11, wayland, desktop, home, network, removable-media) under strict confinement, and contains no telemetry, no cryptocurrency code, no obfuscation.
I am happy to rebuild the snap any way you prefer (for example from source with the python plugin), to provide checksums matching the CI artifacts, or anything else that helps the review. Could you please re-review revision 1 and restore the snap?
Thank you for your time,
Marco Sumari