ClamAV reports `@esbuild/linux-s390x` contains an encrypted rar about esbuild

[evanw]

Your anti-virus has discovered the Go standard library. This is harmless. Please see esbuild's FAQ about anti-virus false positives: https://esbuild.github.io/faq/#anti-virus-software

I'm closing this issue as this is not a problem with esbuild. It's up to anti-virus vendors to fix their false positives. It's not up to esbuild to work around faulty anti-virus software.

[candrews]

I'm closing this issue as this is not a problem with esbuild.

Thank you very much for the information you've provided!

It's up to anti-virus vendors to fix their false positives. It's not up to esbuild to work around faulty anti-virus software.

Absolutely. That's why I'm working with ClamAV to address this false positive. And the information you provided is very helpful achieving that goal 👍

[micahsnyder]

It seems worthwhile to mention that ClamAV is not incorrectly detecting the Go standard library as malware. ClamAV is correctly detecting an embedded RAR archive and @candrews is using settings to make the scan alert if it finds an archive that appears to be encrypted. This is not a default setting.

It's possible we can find a way to ignore the "alert if encrypted" option for RAR's found in Go EXE's,... Maybe? I don't have any better ideas off-hand.