did someone get a pkg file created using fleetctl package as malware ? Probably a false positive but this could cause problems in some deployment.

Yes I've seen similar -- there's no information available from Google or Ikarus as to why they detect it as a problem.

Maybe they don't like our launchd config?

Thanks for answering. I'll try to figure out something

I discovered that it's the Orbit binary itself that triggers Ikarus AV. A newly built Orbit binary does not trigger (no false positives). I then thought it might be because the Orbit binary we currently ship is built with 1.16.2 which has a CVE related to the ReverseProxy code (which we use, but only in the

--insecure

option). I tried building with 1.16.8 which has a fix for that CVE and I still get a false positive. So I'm pretty confident there's nothing wrong with Orbit and the false positive is due to Ikarus and the Go 1.16 builds. When we publish the new release with Go 1.17 things should be resolved.

Great! thanks !