On Mon, 30 Sep 2019 at 02:41, Cyril Ferlicot D. <cyril.ferlicot@gmail.com> wrote:
Le 29/09/2019 �� 16:35, Brainstorms a ��crit��:
> Hi Cyril,
>
> I downloaded it and tried it on Win7 Pro 64bit (running in Virtualbox), and
> was able to open as expected.
>
> However, looking in the zip file itself, I noticed about two dozen
> "*_Zone.Identifier" files that I was not expecting to see.�� They likely
> should not be there; they have something to do with IT security inspections
> on downloaded files, and I delete them as a matter of course whenever I see
> them (as part of a download).�� I'm not sure why the Pharo build process
> would have these.
>
> I tried launching Pharo from this zip file before and after I removed these
> files...�� It worked in both cases; no corruption reported.�� However, since
> your error dialog was reporting one of these 'zone' files, I would trying
> removing them and see if that helps.
>

Thanks!

With your comment I succeeded to launch my image. What I needed to do
was to open the zip file without extracting it, delete all the
.Identifier files and extract it once done.

I wonder how the vm zip files end up with those files in them.

Looking inside...��http://files.pharo.org/vm/pharo-spur64/win/stable-20190916.zip
I see filename "FT2Plugin.dll:Zone.Identifier"
The colon in the filename is a clue that it was originally an Alternate Data Stream attached to the root file
https://www.2brightsparks.com/resources/articles/NTFS-Alternate-Data-Stream-ADS.pdf��
That ZoneIdentifier ADS wont show in a��

Opening "FT2Plugin.dll_Zone.Identifier" in Notepad shows it contains...
�� �� ��[ZoneTransfer]
�� �� ��ZoneId=3

...which seems like its been tagged by a Windows system function into an untrusted "Internet Zone"
http://woshub.com/how-windows-determines-that-the-file-has-been-downloaded-from-the-internet/����

So it seems not-malicious, since�� I'd guess an attacker would be putting it in a "Trusted Zone"

Looking in directory...��http://files.pharo.org/vm/pharo-spur64/win/��
for the following at recent consecutive files, the ones marked "Y" have the ADS����
��
N�� ��2019-09-13 22:18�� �� 8.1 MB�� �� pharo-win-x86_64-201909131927-218e97a.zip
N�� ��2019-09-15 00:16�� �� 8.1 MB�� �� pharo-win-x86_64-201909142122-f5de9a4.zip
Y�� ��2019-09-20 11:57�� �� 6.8 MB�� �� stable-20190916.zip
Y�� ��2019-09-20 11:57�� �� 6.8 MB�� �� pharo-win-x86_64-201909161029-19f5d00.zip
N�� ��2019-09-21 21:50�� ��8.1 MB�� �� pharo-win-x86_64-201909211859-521c75a.zip
N�� ��2019-09-25 19:12�� ��8.1 MB�� �� pharo-win-x86_64-201909251551-3023fbc.zip

So it seems to be a blip related around the moment that the "stable" zip was created.����
I note that the�� 2019-09-20 zips�� include the following additional files the surrounding zips don't have.
SurfacePlugin.dll
SqueakSSL.dll
libfontconfig-1.dll
libexpat-1.dll
libbz2
FTPlugin.dll�� ��

Highly speculative, but one scenario could be that "pharo-win-x86_64-201909161029-19f5d00.zip"��
was downloaded to someone's machine to add those files and it got tagged by Windows.����
They then got included when " pharo-win-x86_64-201909161029-19f5d00.zip " was rezipped and also copied to "stable-20190916.zip" ??
It would be good to understand what happened here.

A solution might be to exclude ADS when "stable-20190916.zip" is created.

btw, The `dir` command is not aware of ADS.�� This can be used to investigate...
https://docs.microsoft.com/en-us/sysinternals/downloads/streams��

cheers -ben
��