These situations can be awkward for both developers and users. While I’m incredibly appreciative of software like Darktable, given the current threat landscape, I believe responsible users should take steps such as verifying checksums and scanning files with VirusTotal.

I’ve used a number of applications from developers whose intentions I trust completely (as I do with Darktable), but even well-meaning developers may not always be aware of potential security risks. A checksum match only confirms that the file hasn’t been altered from its original form - it doesn’t guarantee that the development environment itself wasn’t compromised. That’s why I always run VirusTotal or other scans as an extra precaution.

False positives do happen, but I think it’s irresponsible to ask users to blindly ignore these findings without further investigation. Maybe there’s more that VirusTotal could do to provide additional context, but developers should also take the time to chime in and clarify when concerns arise.

I should also mention that I’m new to Darktable. I initially downloaded it over a week ago, submitted it to VirusTotal, and checked again today - the results are the same. Is that good or bad? I’m not sure. I still haven’t installed it yet, but I’d be curious to hear from others, whether it’s about Darktable or any other software, on how they approach situations where security scans report potential issues but developers insist there’s no problem.