[users] clamav-db

[Kai Schaetzl]

Hi folks.

Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Kai

[Dag Wieers]

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files. On my system it seems to be fine though:

----
[root at moria ~]# ls -l /var/clamav/
total 64468
-rw-r--r--. 1 clamav clamav 88505 Nov 16 20:08 bytecode.cvd
-rw-r--r--. 1 clamav clamav 492544 Nov 17 11:41 daily.cld
-rw-r--r--. 1 clamav clamav 65422336 Nov 16 20:07 main.cld
-rw-------. 1 clamav clamav 104 Nov 17 11:41 mirrors.dat
[root at moria ~]# rpm -ql clamav-db
/etc/cron.daily/freshclam
/etc/logrotate.d/freshclam
/var/clamav
/var/clamav/daily.cvd
/var/clamav/main.cvd
/var/log/clamav
/var/log/clamav/freshclam.log
----

So we should fix the clamav packages (I am on it !), but fortunately it
doesn't have an impact on the users (except for the deadweight ;-)).

Thanks again !

[Dag Wieers]

Post by Dag Wieers

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files.

Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).

Do you know how a packager is supposed to do this ?

PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball. But I
still prefer to have a clamav-db package for offline installation/usage.

[Kai Schaetzl]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is.

Me, too :-) From what I gather the .cvd files are compressed versions of the
cld files. Apparently clamav unpacks them in memory before using. So, for
clamd using .cld is probably almost no advantage other than the startup of
the daemon is a bit faster, but for clamscan it might be quite noticable.
When you have both versions of say main.* in the clamav directory the daemon
will complain on startup and ask you to remove one of them. However, it
doesn't tell which is the preferred one. When these files were first
introduced (with 0.96 I think) I removed all my .cvd files going by the fact
that the .cld files had a newer timestamp and ran freshclam which fetched
all the .cld versions. So I deduced that .cld is the preferred format.

Post by Dag Wieers
Do you know how a packager is supposed to do this ?

I have no idea, I'm not a packager ;-) Possible solutions:
- provide a package with that dependency and one without it
- if install is an update then don't have that dependency (don't know if
that is possible)
- similar: if install finds a /var/clamav/main.cld file not older than 30
days don't have that dependency (again, I don't know if that is possible)

Post by Dag Wieers
PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball.

I think that makes sense. definitions grow old very soon and you have to
update regularly. Maybe on a system with no net access it's better to have
an old database than none, though.

But I

Post by Dag Wieers
still prefer to have a clamav-db package for offline installation/usage.

then maybe just remove the dependency and place a readme about the available
database package in a good place? Or read that out to console when a fresh
install happens?


Kai

[Kai Schaetzl]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is.

Me, too :-) From what I gather the .cvd files are compressed versions of the
cld files. Apparently clamav unpacks them in memory before using. So, for
clamd using .cld is probably almost no advantage other than the startup of
the daemon is a bit faster, but for clamscan it might be quite noticable.
When you have both versions of say main.* in the clamav directory the daemon
will complain on startup and ask you to remove one of them. However, it
doesn't tell which is the preferred one. When these files were first
introduced (with 0.96 I think) I removed all my .cvd files going by the fact
that the .cld files had a newer timestamp and ran freshclam which fetched
all the .cld versions. So I deduced that .cld is the preferred format.

Post by Dag Wieers
Do you know how a packager is supposed to do this ?

I have no idea, I'm not a packager ;-) Possible solutions:
- provide a package with that dependency and one without it
- if install is an update then don't have that dependency (don't know if
that is possible)
- similar: if install finds a /var/clamav/main.cld file not older than 30
days don't have that dependency (again, I don't know if that is possible)

Post by Dag Wieers
PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball.

I think that makes sense. definitions grow old very soon and you have to
update regularly. Maybe on a system with no net access it's better to have
an old database than none, though.

But I

Post by Dag Wieers
still prefer to have a clamav-db package for offline installation/usage.

then maybe just remove the dependency and place a readme about the available
database package in a good place? Or read that out to console when a fresh
install happens?


Kai

[Kai Schaetzl]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is.

Me, too :-) From what I gather the .cvd files are compressed versions of the
cld files. Apparently clamav unpacks them in memory before using. So, for
clamd using .cld is probably almost no advantage other than the startup of
the daemon is a bit faster, but for clamscan it might be quite noticable.
When you have both versions of say main.* in the clamav directory the daemon
will complain on startup and ask you to remove one of them. However, it
doesn't tell which is the preferred one. When these files were first
introduced (with 0.96 I think) I removed all my .cvd files going by the fact
that the .cld files had a newer timestamp and ran freshclam which fetched
all the .cld versions. So I deduced that .cld is the preferred format.

Post by Dag Wieers
Do you know how a packager is supposed to do this ?

I have no idea, I'm not a packager ;-) Possible solutions:
- provide a package with that dependency and one without it
- if install is an update then don't have that dependency (don't know if
that is possible)
- similar: if install finds a /var/clamav/main.cld file not older than 30
days don't have that dependency (again, I don't know if that is possible)

Post by Dag Wieers
PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball.

I think that makes sense. definitions grow old very soon and you have to
update regularly. Maybe on a system with no net access it's better to have
an old database than none, though.

But I

Post by Dag Wieers
still prefer to have a clamav-db package for offline installation/usage.

then maybe just remove the dependency and place a readme about the available
database package in a good place? Or read that out to console when a fresh
install happens?


Kai

[Kai Schaetzl]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is.

Me, too :-) From what I gather the .cvd files are compressed versions of the
cld files. Apparently clamav unpacks them in memory before using. So, for
clamd using .cld is probably almost no advantage other than the startup of
the daemon is a bit faster, but for clamscan it might be quite noticable.
When you have both versions of say main.* in the clamav directory the daemon
will complain on startup and ask you to remove one of them. However, it
doesn't tell which is the preferred one. When these files were first
introduced (with 0.96 I think) I removed all my .cvd files going by the fact
that the .cld files had a newer timestamp and ran freshclam which fetched
all the .cld versions. So I deduced that .cld is the preferred format.

Post by Dag Wieers
Do you know how a packager is supposed to do this ?

I have no idea, I'm not a packager ;-) Possible solutions:
- provide a package with that dependency and one without it
- if install is an update then don't have that dependency (don't know if
that is possible)
- similar: if install finds a /var/clamav/main.cld file not older than 30
days don't have that dependency (again, I don't know if that is possible)

Post by Dag Wieers
PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball.

I think that makes sense. definitions grow old very soon and you have to
update regularly. Maybe on a system with no net access it's better to have
an old database than none, though.

But I

Post by Dag Wieers
still prefer to have a clamav-db package for offline installation/usage.

then maybe just remove the dependency and place a readme about the available
database package in a good place? Or read that out to console when a fresh
install happens?


Kai

[Kai Schaetzl]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is.

Me, too :-) From what I gather the .cvd files are compressed versions of the
cld files. Apparently clamav unpacks them in memory before using. So, for
clamd using .cld is probably almost no advantage other than the startup of
the daemon is a bit faster, but for clamscan it might be quite noticable.
When you have both versions of say main.* in the clamav directory the daemon
will complain on startup and ask you to remove one of them. However, it
doesn't tell which is the preferred one. When these files were first
introduced (with 0.96 I think) I removed all my .cvd files going by the fact
that the .cld files had a newer timestamp and ran freshclam which fetched
all the .cld versions. So I deduced that .cld is the preferred format.

Post by Dag Wieers
Do you know how a packager is supposed to do this ?

I have no idea, I'm not a packager ;-) Possible solutions:
- provide a package with that dependency and one without it
- if install is an update then don't have that dependency (don't know if
that is possible)
- similar: if install finds a /var/clamav/main.cld file not older than 30
days don't have that dependency (again, I don't know if that is possible)

Post by Dag Wieers
PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball.

I think that makes sense. definitions grow old very soon and you have to
update regularly. Maybe on a system with no net access it's better to have
an old database than none, though.

But I

Post by Dag Wieers
still prefer to have a clamav-db package for offline installation/usage.

then maybe just remove the dependency and place a readme about the available
database package in a good place? Or read that out to console when a fresh
install happens?


Kai

[Dag Wieers]

Post by Dag Wieers

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files.

Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).

Do you know how a packager is supposed to do this ?

PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball. But I
still prefer to have a clamav-db package for offline installation/usage.

[Dag Wieers]

Post by Dag Wieers

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files.

Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).

Do you know how a packager is supposed to do this ?

PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball. But I
still prefer to have a clamav-db package for offline installation/usage.

[Dag Wieers]

Post by Dag Wieers

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files.

Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).

Do you know how a packager is supposed to do this ?

PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball. But I
still prefer to have a clamav-db package for offline installation/usage.

[Dag Wieers]

Post by Dag Wieers

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files.

Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).

Do you know how a packager is supposed to do this ?

PS On the internal clamav packaging list there have been discussions
regarding not including the virus database as part of the tarball. But I
still prefer to have a clamav-db package for offline installation/usage.

[Pavel Kankovsky]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).
Do you know how a packager is supposed to do this ?

Download the file manually and add it as a source file?

[Kai Schaetzl]

Hi folks.

Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Kai

[Dag Wieers]

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files. On my system it seems to be fine though:

----
[root at moria ~]# ls -l /var/clamav/
total 64468
-rw-r--r--. 1 clamav clamav 88505 Nov 16 20:08 bytecode.cvd
-rw-r--r--. 1 clamav clamav 492544 Nov 17 11:41 daily.cld
-rw-r--r--. 1 clamav clamav 65422336 Nov 16 20:07 main.cld
-rw-------. 1 clamav clamav 104 Nov 17 11:41 mirrors.dat
[root at moria ~]# rpm -ql clamav-db
/etc/cron.daily/freshclam
/etc/logrotate.d/freshclam
/var/clamav
/var/clamav/daily.cvd
/var/clamav/main.cvd
/var/log/clamav
/var/log/clamav/freshclam.log
----

So we should fix the clamav packages (I am on it !), but fortunately it
doesn't have an impact on the users (except for the deadweight ;-)).

Thanks again !

[Pavel Kankovsky]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).
Do you know how a packager is supposed to do this ?

Download the file manually and add it as a source file?

[Kai Schaetzl]

Hi folks.

Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Kai

[Dag Wieers]

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files. On my system it seems to be fine though:

----
[root at moria ~]# ls -l /var/clamav/
total 64468
-rw-r--r--. 1 clamav clamav 88505 Nov 16 20:08 bytecode.cvd
-rw-r--r--. 1 clamav clamav 492544 Nov 17 11:41 daily.cld
-rw-r--r--. 1 clamav clamav 65422336 Nov 16 20:07 main.cld
-rw-------. 1 clamav clamav 104 Nov 17 11:41 mirrors.dat
[root at moria ~]# rpm -ql clamav-db
/etc/cron.daily/freshclam
/etc/logrotate.d/freshclam
/var/clamav
/var/clamav/daily.cvd
/var/clamav/main.cvd
/var/log/clamav
/var/log/clamav/freshclam.log
----

So we should fix the clamav packages (I am on it !), but fortunately it
doesn't have an impact on the users (except for the deadweight ;-)).

Thanks again !

[Pavel Kankovsky]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).
Do you know how a packager is supposed to do this ?

Download the file manually and add it as a source file?

[Kai Schaetzl]

Hi folks.

Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Kai

[Dag Wieers]

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files. On my system it seems to be fine though:

----
[root at moria ~]# ls -l /var/clamav/
total 64468
-rw-r--r--. 1 clamav clamav 88505 Nov 16 20:08 bytecode.cvd
-rw-r--r--. 1 clamav clamav 492544 Nov 17 11:41 daily.cld
-rw-r--r--. 1 clamav clamav 65422336 Nov 16 20:07 main.cld
-rw-------. 1 clamav clamav 104 Nov 17 11:41 mirrors.dat
[root at moria ~]# rpm -ql clamav-db
/etc/cron.daily/freshclam
/etc/logrotate.d/freshclam
/var/clamav
/var/clamav/daily.cvd
/var/clamav/main.cvd
/var/log/clamav
/var/log/clamav/freshclam.log
----

So we should fix the clamav packages (I am on it !), but fortunately it
doesn't have an impact on the users (except for the deadweight ;-)).

Thanks again !

[Pavel Kankovsky]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).
Do you know how a packager is supposed to do this ?

Download the file manually and add it as a source file?

[Kai Schaetzl]

Hi folks.

Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Kai

[Dag Wieers]

Post by Kai Schaetzl
Just upgraded to clamav 0.96.4 and found clamav-db is still providing .cvd
files. AFAIK clamav has moved to .cld files for a while now. As I
understand the .cvd files are compressed and may still be fine for
starting a fresh install. It seems that clamav either ignores these files
or finds that they are older than the update and doesn't unpack them. No
harm is done. So, for an existing install with updates it's just dead
payload. I've seen reports (some months ago) about problems with mixing
both file types in an installation, though.
I've removed the files now after the upgrade. But I'm wondering if there
is a way to stop this unnecessary database "update" somehow thru the
packaging, so that there is no need to fetch database bytes that are not
used, anyway.

Thanks for the feedback, Kai. You are indeed correct that we should be
shipping .cld files. On my system it seems to be fine though:

----
[root at moria ~]# ls -l /var/clamav/
total 64468
-rw-r--r--. 1 clamav clamav 88505 Nov 16 20:08 bytecode.cvd
-rw-r--r--. 1 clamav clamav 492544 Nov 17 11:41 daily.cld
-rw-r--r--. 1 clamav clamav 65422336 Nov 16 20:07 main.cld
-rw-------. 1 clamav clamav 104 Nov 17 11:41 mirrors.dat
[root at moria ~]# rpm -ql clamav-db
/etc/cron.daily/freshclam
/etc/logrotate.d/freshclam
/var/clamav
/var/clamav/daily.cvd
/var/clamav/main.cvd
/var/log/clamav
/var/log/clamav/freshclam.log
----

So we should fix the clamav packages (I am on it !), but fortunately it
doesn't have an impact on the users (except for the deadweight ;-)).

Thanks again !

[Pavel Kankovsky]

Post by Dag Wieers
Looking at the SPEC file, I see the ClamAV project still shipping (and
installing) the .cvd files. So somehow I wonder what the purposes of this
is. I cannot update the .cvd files or import .cld files from the
build-process as the build-process is not allowed to access
network-resources (for security reasons).
Do you know how a packager is supposed to do this ?

Download the file manually and add it as a source file?