tea @63.1.0: won't build, needs update, and binary package flagged as malware

[grumpybozo (Bill Cole)]

Livecheck reports 63.3.1 is available. Binary installed from package repo triggers malware detections. See ​https://www.virustotal.com/gui/file/114b5c6106adcc581253cac07343157b9e6ff4a477d294df977190517b27ab7b?nocache=1

Source build emits this warning in config phase:

Executing:  cd "/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_editors_tea/tea/work/tea-qt-63.1.0" && /opt/local/libexec/qt5/bin/qmake PREFIX=/opt/local -spec macx-clang 
DEBUG: system:  cd "/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_editors_tea/tea/work/tea-qt-63.1.0" && /opt/local/libexec/qt5/bin/qmake PREFIX=/opt/local -spec macx-clang 
Info: creating stash file /opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_editors_tea/tea/work/tea-qt-63.1.0/.qmake.stash
Project MESSAGE: ASpell enabled
Project MESSAGE: hunspell enabled
Project WARNING: Qt has only been tested with version 13 of the platform SDK, you're using 14.
Project WARNING: This is an unsupported configuration. You may experience build issues, and by using
Project WARNING: the 14.5 SDK you are opting in to new features that Qt has not been prepared for.
Project WARNING: Please downgrade the SDK you use to build your app to version 13, or configure
Project WARNING: with CONFIG+=sdk_no_version_check when running qmake to silence this warning.
DEBUG: Executing portconfigure::configure_finish

It then goes on to fail:

ccache /Library/Developer/CommandLineTools/usr/bin/clang++ -c -pipe -stdlib=libc++ -I/opt/local/include -Os -std=gnu++11  -arch x86_64 -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk -mmacosx-version-min=14.0 -Wall -Wextra -fPIC -DVERSION_NUMBER=\"63.1.0\" -DASPELL_ENABLE -DHUNSPELL_ENABLE -DQT_NO_DEBUG -DQT_WIDGETS_LIB -DQT_GUI_LIB -DQT_CORE_LIB -I. -I/opt/local/include/hunspell -I/opt/local/libexec/qt5/lib/QtWidgets.framework/Headers -I/opt/local/libexec/qt5/lib/QtGui.framework/Headers -I/opt/local/libexec/qt5/lib/QtCore.framework/Headers -I. -I/Library/Developer/CommandLineTools/SDKs/MacOSX14.5.sdk/System/Library/Frameworks/OpenGL.framework/Headers -I/Library/Developer/CommandLineTools/SDKs/MacOSX14.5.sdk/System/Library/Frameworks/AGL.framework/Headers -I/opt/local/libexec/qt5/mkspecs/macx-clang -F/opt/local/libexec/qt5/lib -o gui_utils.o src/gui_utils.cpp
src/libretta_calc.cpp:1:10: fatal error: 'string' file not found
    1 | #include <string>
      |          ^~~~~~~~
src/textproc.cpp:37:10: fatal error: 'algorithm' file not found
   37 | #include <algorithm>
      |          ^~~~~~~~~~~
In file included from src/wavinfo.cpp:1:
In file included from /opt/local/libexec/qt5/lib/QtCore.framework/Headers/QFile:1:
In file included from /opt/local/libexec/qt5/lib/QtCore.framework/Headers/qfile.h:44:
In file included from /opt/local/libexec/qt5/lib/QtCore.framework/Headers/qfiledevice.h:43:
In file included from /opt/local/libexec/qt5/lib/QtCore.framework/Headers/qiodevice.h:43:
/opt/local/libexec/qt5/lib/QtCore.framework/Headers/qglobal.h:45:12: fatal error: 'type_traits' file not found
   45 | #  include <type_traits>
      |            ^~~~~~~~~~~~~
In file included from src/todo.cpp:1:
src/utils.h:9:10: fatal error: 'vector' file not found
    9 | #include <vector>
      |          ^~~~~~~~

[grumpybozo (Bill Cole)]

mail log of build attempt

[ryandesign (Ryan Carsten Schmidt)]

Replying to grumpybozo:

Livecheck reports 63.3.1 is available.

Yes. I did not update to 62.2.0 because of ​https://github.com/psemiletov/tea-qt/issues/64#issuecomment-1850406694. I did not investigate whether later versions fixed the problem that I believed existed.

Binary installed from package repo triggers malware detections. See ​https://www.virustotal.com/gui/file/114b5c6106adcc581253cac07343157b9e6ff4a477d294df977190517b27ab7b?nocache=1

This was also reported at ​https://lists.macports.org/pipermail/macports-users/2025-April/053535.html. If you have evidence that this is not a false positive, please explain.

Source build emits this warning in config phase:

Executing:  cd "/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_editors_tea/tea/work/tea-qt-63.1.0" && /opt/local/libexec/qt5/bin/qmake PREFIX=/opt/local -spec macx-clang 
DEBUG: system:  cd "/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_editors_tea/tea/work/tea-qt-63.1.0" && /opt/local/libexec/qt5/bin/qmake PREFIX=/opt/local -spec macx-clang 
Info: creating stash file /opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_editors_tea/tea/work/tea-qt-63.1.0/.qmake.stash
Project MESSAGE: ASpell enabled
Project MESSAGE: hunspell enabled
Project WARNING: Qt has only been tested with version 13 of the platform SDK, you're using 14.
Project WARNING: This is an unsupported configuration. You may experience build issues, and by using
Project WARNING: the 14.5 SDK you are opting in to new features that Qt has not been prepared for.
Project WARNING: Please downgrade the SDK you use to build your app to version 13, or configure
Project WARNING: with CONFIG+=sdk_no_version_check when running qmake to silence this warning.
DEBUG: Executing portconfigure::configure_finish

This does not sound like an issue specific to tea but rather general to Qt so I'll leave it to the maintainer of Qt to explain what we should do about this (e.g. should a qt portgroup be adding that sdk_no_version_check flag?)

It then goes on to fail:

ccache /Library/Developer/CommandLineTools/usr/bin/clang++ -c -pipe -stdlib=libc++ -I/opt/local/include -Os -std=gnu++11  -arch x86_64 -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk -mmacosx-version-min=14.0 -Wall -Wextra -fPIC -DVERSION_NUMBER=\"63.1.0\" -DASPELL_ENABLE -DHUNSPELL_ENABLE -DQT_NO_DEBUG -DQT_WIDGETS_LIB -DQT_GUI_LIB -DQT_CORE_LIB -I. -I/opt/local/include/hunspell -I/opt/local/libexec/qt5/lib/QtWidgets.framework/Headers -I/opt/local/libexec/qt5/lib/QtGui.framework/Headers -I/opt/local/libexec/qt5/lib/QtCore.framework/Headers -I. -I/Library/Developer/CommandLineTools/SDKs/MacOSX14.5.sdk/System/Library/Frameworks/OpenGL.framework/Headers -I/Library/Developer/CommandLineTools/SDKs/MacOSX14.5.sdk/System/Library/Frameworks/AGL.framework/Headers -I/opt/local/libexec/qt5/mkspecs/macx-clang -F/opt/local/libexec/qt5/lib -o gui_utils.o src/gui_utils.cpp
src/libretta_calc.cpp:1:10: fatal error: 'string' file not found
    1 | #include <string>
      |          ^~~~~~~~
src/textproc.cpp:37:10: fatal error: 'algorithm' file not found
   37 | #include <algorithm>
      |          ^~~~~~~~~~~
In file included from src/wavinfo.cpp:1:
In file included from /opt/local/libexec/qt5/lib/QtCore.framework/Headers/QFile:1:
In file included from /opt/local/libexec/qt5/lib/QtCore.framework/Headers/qfile.h:44:
In file included from /opt/local/libexec/qt5/lib/QtCore.framework/Headers/qfiledevice.h:43:
In file included from /opt/local/libexec/qt5/lib/QtCore.framework/Headers/qiodevice.h:43:
/opt/local/libexec/qt5/lib/QtCore.framework/Headers/qglobal.h:45:12: fatal error: 'type_traits' file not found
   45 | #  include <type_traits>
      |            ^~~~~~~~~~~~~
In file included from src/todo.cpp:1:
src/utils.h:9:10: fatal error: 'vector' file not found
    9 | #include <vector>
      |          ^~~~~~~~

See ProblemHotlist#clts16 for the fix for that.

[ryandesign (Ryan Carsten Schmidt)]

Replying to ryandesign:

Replying to grumpybozo:

Livecheck reports 63.3.1 is available.

Yes. I did not update to 62.2.0 because of ​https://github.com/psemiletov/tea-qt/issues/64#issuecomment-1850406694. I did not investigate whether later versions fixed the problem that I believed existed.

I see that somebody else updated the port to 63.1.0 without my input. (This is permitted, since the port is marked openmaintainer.)

[aeiouaeiouaeiouaeiouaeiouaeiou]

Replying to grumpybozo:

Binary installed from package repo triggers malware detections. See ​https://www.virustotal.com/gui/file/114b5c6106adcc581253cac07343157b9e6ff4a477d294df977190517b27ab7b?nocache=1

A similar thing once happened with Terragrunt: ​https://github.com/gruntwork-io/terragrunt/issues/2989

I also remembered that when Clang 12 just released, AVG and Avast often flagged all binaries created with it as false positives.