Please make the program less suspicious

[BenoitHiller]

Seeing a hidden bin folder after extracting the zip expecting a bat script plus data set off so many alarm bells.

If you aren't actually trying to do something suspicious you will probably want to take some steps to convince people that this isn't malware. As anyone who would download this as is and just run it trusting you has probably already installed a bunch of malware and should keep an eye out for people logging into their bank accounts.

For starters there is no legitimate reason to ship that folder hidden.

Secondly I highly recommend making it much more clear where all of the included software comes from.

If, for example, you have a folder called 7z2600-extra which contains the exact contents of the official 7z2600-extra.7z archive, then because someone can easily check the checksums of every file in that archive they have a much better reason to believe you haven't just disguised malware as 7z.

Though better than saving all of the dependencies into the repo you could just write a script to go download them from official sites and extract them where you want them, only packaging them into the release (or even better downloading them when the user runs the program, but I'm trying to present the simplest options first).

For anyone else wondering if this is malicious

If someone else is looking at these issues because they are wondering what is going on (and are deeply concerned that of the 2 issues one of them is about getting flagged by antivirus), I've been able to verify that the vast majority of the random crap packaged into this is legit. I've attached a sha256 checksum file with annotations on where the binaries come which can verify most of the binaries in the 1.1.1 release.

The only thing I haven't found yet is the curl.exe and libcurl.dll. They are curl 7.70.0 (i386-pc-win32), but don't quite match any version I've found.

You can verify the checksum file decache-1.1.1-bins.sha256.txt with the following command inside the folder where you extract the corresponding zip:

sha256sum -c decache-1.1.1-bins.sha256.txt

[SindexMon]

Thank you for the breakdown. I'll try to incorporate all these points as I am, ultimately, an extreme amateur operating out of desperation. I do not hold any knowledge on lower-level programming languages, building applications, or software norms. I'm not sure why this repo has gained so many stars yet so little issues like this one.

The /bin folder was hidden as I was terrified that someone would accidentally alter it and kill their chances; I was somehow under the impression that this was common practice. A number of people have told me that nobody does this, and it is a terrible idea.

The curl release was retrieved from this repo - https://github.com/NewYaroslav/curl-7.70.0-win32-mingw/ - I will note this in the README as soon as I have access to a computer. I was under the impression that I had already, but it seems that the only disclaimer is for FFmpeg. I also apologize for the unconventional nature of said README.

[BenoitHiller]

No worries. Your choices were reasonable and you don't need to apologize for what you know or don't know.

I tried to provide suggestions based on a guess at skill level matching about what you said. Packaging and documenting software are both subtle complicated tasks that experienced developers often stumble over. There aren't necessarily great conventions for either. You just steadily improve things over time as you solve problems and your understanding grows.

As for the bin folder choice I suspected as much, that seemed the most likely legitimate reason for doing something like that. In case someone else hasn't already mentioned it, the way people usually address that concern is by shipping all of the associated files bundled up into an executable (you can cram whatever you want into an exe for example. It doesn't have to be just code). That way if someone opens it up they know they are effectively "voiding the warranty" and should assume they broke everything.

Though I do agree that you probably don't need to do anything like that, I just wanted to provide the info in case you were curious. People do already usually assume that touching the files that come with software will break it.

Similarly don't worry too much about all the suggestions I posted originally. Besides un-hiding bin just having links to the exact places you got software you are including, along with the version numbers, is more than sufficient to address my original concern.

My suggestions about how to structure things or about writing scripts to package things were just a few examples of steps towards a more ideal solution that would hopefully be easy to do (or that AI might be able to do for you if asked). I note this because I know when I give those kinds of suggestions to people starting out they tend to see them as a list of problems to be fixed, when they are merely examples of the many possible improvements to explore.

Note that the experienced developer answer to "how do you package something like this properly" is "oh god, is rewriting it in a language with dependency management on the table?" That is a terrible answer and would be absurdly overkill(and probably cause more problems than it solves) unless you had a lot more issues than you do now.

[SindexMon]

Haha yeah. Sorry if I sounded a little over-apologetic - it was quite late.

I once again appreciate all of your points, and will ship with the immediate concerns resolved in the next release. It's a gradual journey for sure!