Documentation
¶
Overview ¶
Command virustotal submits release artifacts to VirusTotal via the public v3 API so every published binary has an antivirus scan on record.
Like cmd/packagecloud and cmd/cloudsmith, this is a small release-time tool driving a REST API directly. It is deliberately best-effort: submission is a nice-to-have record, not a release gate. VirusTotal frequently false-flags Go binaries, so this tool never inspects the verdict and never fails the release — it uploads, logs where each report will appear, and moves on. A missing API key or a per-file upload error is logged and skipped, not fatal.
Uploading a file is one of two flows depending on size:
- ≤32 MiB: POST the file as multipart/form-data to /api/v3/files.
- >32 MiB: GET a one-time upload URL from /api/v3/files/upload_url, then POST the file to that URL.
Both authenticate with the x-apikey header and return an analysis object. The permanent report lives at https://www.virustotal.com/gui/file/<sha256>.
Usage:
VT_APIKEY=... go run ./cmd/virustotal submit dist/*.tar.gz dist/*.zip dist/*.deb dist/*.rpm
Source Files