Plugin StompTuner v0.5.0

[kmturley]

Adds StompTuner, a multi-format strobe tuner built with the DISTRHO Plugin Framework, from https://github.com/brummer10/StompTuner.

Sourced from the awesome-linux-clap-list.

[github-actions]

VirusTotal Report:

• brummer10/stomptuner/0.5.0/StompTuner-v0.5-linux-arm64.tar.xz
• brummer10/stomptuner/0.5.0/StompTuner-v0.5-linux-armhf.tar.xz
• brummer10/stomptuner/0.5.0/StompTuner-v0.5-linux-i686.tar.xz
• brummer10/stomptuner/0.5.0/StompTuner-v0.5-linux-x86_64.tar.xz
• brummer10/stomptuner/0.5.0/StompTuner-v0.5-macos-intel.dmg
• brummer10/stomptuner/0.5.0/StompTuner-v0.5-macos-universal.dmg
• brummer10/stomptuner/0.5.0/StompTuner-v0.5-win32.zip
• brummer10/stomptuner/0.5.0/StompTuner-v0.5-win64.zip

[github-actions]

Destination urls:
Registry: https://open-audio-stack.github.io/open-audio-stack-registry/plugins/brummer10/stomptuner
Site: https://studiorack.github.io/studiorack-site/plugins/brummer10/stomptuner

[github-actions]

Plugin author notification:

@brummer10 — your plugin has been submitted to the Open Audio Stack registry. Please review this PR and let us know if the metadata (name, description, tags, files) is correct. To see a full list of all currently added plugins, click here.

[kmturley]

VirusTotal has flagged these binaries:

https://www.virustotal.com/gui/file/1970cff26fef7ee4b7efc8501b0287f36bedaf70e4c50c0bab216ce4d9f81e06?nocache=1
https://www.virustotal.com/gui/file/37a0e12daf47a4dc5dd20e799666acf7091b4016ae64e0d03f6a33d9a78caf3f?nocache=1

[brummer10]

VirusTotal has flagged these binaries:

See here for more information:
brummer10/ToneTwistPlugs#4

[kmturley]

More details here:
https://www.virustotal.com/gui/file/1970cff26fef7ee4b7efc8501b0287f36bedaf70e4c50c0bab216ce4d9f81e06/behavior

AI recommendation:

To get an open-source, low-level Windows audio application like this cleared of false positives, the developer has to address two main fronts: proving identity to automated engines (reputation) and handling known architectural triggers more gently.

Here is a practical roadmap the developer could take to significantly reduce the flag count on future releases:

---

1. Digital Code Signing (The Most Effective Fix)

The single biggest reason this binary is sitting at 24/66 detections is a lack of reputation. Without a digital signature, security engines look at complex low-level behaviors and default to a "guilty until proven innocent" stance.

• Sign the Executable and DLLs: Signing stomptuner.exe, stomptuner-vst.dll, and the .lv2/.vst3 components with a valid digital certificate establishes a cryptographic identity.
• Look into Community-Friendly Options: Traditional Extended Validation (EV) code-signing certificates can be incredibly expensive for independent open-source developers. However, projects like SignPath offer free code-signing certificates specifically for open-source projects via GitHub Actions. Signing the binaries ensures Windows SmartScreen and automated sandboxes instantly grant the app a higher trust threshold.

---

2. Refactor "Malware-Like" Audio Logic

Because real-time audio requires high-precision timing and dynamic library management, it naturally mimics malware signatures. Minor changes in the codebase can break these behavioral heuristics:

Avoid Dynamic Unarchiving/Dropping

The sandboxes flagged the binary for dropping multiple DLL components (stomptuner.clap, stomptuner-vst.dll, etc.) directly into a temporary directory (AppData\Local\Temp\...) and executing them from there.

• The Fix: Instead of using a wrapper executable that extracts and places binaries in temporary space at runtime, the developer should use a standard, well-known installer framework (like Inno Setup or NSIS). Installers copy files to standard directories (like Program Files or Common Files VST folders) during setup, which sandboxes treat as legitimate administrative placement rather than an active Trojan dropping a payload.

Abstract High-Precision Timing Loops

The behavior tags caught long-sleeps and heavy loops utilizing GetTickCount and Sleep. Automated security systems assume the binary is trying to stall execution to time out the sandbox analyzer.

• The Fix: Switch away from raw Win32 API timing blocks like Sleep() inside the main threads to standard C++ library abstractions (std::this_thread::sleep_for) or use event-driven audio thread callbacks provided by the audio framework (e.g., JUCE or JACK) to handle timing implicitly.

Fix the Process Spawning Context

The Crowdsourced Sigma Rules flagged a critical technique: Rundll32 Spawned Via Explorer.EXE. This happens when a user clicks the executable, and it immediately spins up rundll32.exe to hook into its own sub-DLL components.

• The Fix: Instead of using rundll32.exe to launch or test plugin entry points dynamically, the primary executable should handle the internal DLL loading explicitly via native LoadLibrary or LoadLibraryEx API calls. Spawning system utilities like rundll32.exe from a user-initiated process is a massive red flag for automated Endpoint Detection and Response (EDR) systems.

---

3. Establish Early Trust Proactively

• Submit False Positive Reports: Major vendors like Microsoft (Defender), BitDefender, and Kaspersky have dedicated developer portals where you can upload a clean zip file and mark it as an open-source false positive. Once whitelisted by the heavy hitters, the automated detection rate on VirusTotal will plummet.
• Integrate VirusTotal in CI/CD: The developer can integrate a VirusTotal GitHub Action into their release workflow. This allows them to scan nightlies or release candidates automatically, catching a spike in false positives before pushing the binary to the public [StompTuner GitHub Releases page](https://github.com/brummer10/StompTuner).