[AndrewSav]

Description

Fixes #93

• What is the current behavior (you can also link to an open issue here) ?

  The image ships clamav-unofficial-sigs 7.2.5. Among the faults listed in the 8.0.0 release notes, these apply to this image's default configuration:

  • urlhaus never updates: its work directory is never created, and the cleanup pass removes urlhaus.ndb straight after installing it.
  • The Yara-Rules project is enabled by default, though upstream no longer maintains it and, per the 8.0.0 notes, several of its rules fail to load or crash current ClamAV releases. One of its files, email/bank_rule.yar, is gone upstream, so every update that fetches it fails to download it.
  • The MalwarePatrol free product code is the old 8.
  • 7.2.5 checks GitHub for a newer release every 12 hours and reports one as an ALERT. Upstream master is now 8.0.0, so every such check reports it.

• What is the new behavior (if this is a feature change) ?

  The image ships 8.0.0. Its master.conf (config version 97 → 100) disables Yara-Rules by default, removes bank_rule.yar, and moves four maldoc rules with known ClamAV problems to DISABLED. It also sets the MalwarePatrol free product code to 32. The new ditekshen and twinclams sources are disabled by default.

  master.conf belongs to the image, and users configure through user.conf, which still overrides it. An existing user.conf that sets yararulesproject_enabled="yes", as the README example did, keeps Yara-Rules on. 8.0.0 then writes a deprecation WARNING to its own log file on each run. Warnings are not printed when there is no terminal, so the warning stays out of the container log.

  URLhaus is turned off, in the image's os.conf (urlhaus_enabled="no"). 8.0.0 fixes the urlhaus bugs above, but abuse.ch now serves the URLhaus ClamAV signatures only with an Auth-Key, and 8.0.0 has no setting for one, so every download fails (see the testing notes below). The comment beside the setting says to turn it back on once upstream supports an Auth-Key.

What else changed

• os.conf: besides turning URLhaus off, the header comment now matches upstream's os.debian.conf. Upstream's os.debian.conf now sets clamd_reload_opt="clamdscan --reload". Since Clamav unofficial sigs cron #94 the image already reloads that way, once clamd has finished starting. 8.0.0 adds a socket fallback when the reload fails, but it only triggers when the reload command prints ERROR, the same check as 7.2.5. So the image keeps its own reload script.
• README: the example user.conf no longer enables the Yara-Rules project, and its commented MalwarePatrol product code is 32.
• What the image relies on is unchanged in 8.0.0: the cron file --install-cron writes, apart from the random minute now being 0–59 instead of 1–59; the --install-logrotate output; the pid file path; when output is printed without a terminal (only ERROR and ALERT lines); and the exit status the cron job passes on, which is non-zero only when the script stops early (configuration, lock, missing tools), since it still ends with exit $?.

Type of change

• Bug fix (non-breaking change which fixes an issue)

Status

• Ready

Todo List

• Implementation
• Tests
• Documentation

How has this been tested ?

The full bats suite, one suite at a time and not as root: git submodule update --init --recursive, make build, then make default, make reverse TEST_DNS=9.9.9.9, make ldap, make ldap2 TEST_DNS=9.9.9.9, make sieve, make ecdsa, make traefik_acmev1, make traefik_acmev2, make traefik_v3.

• default — 136 tests
• reverse — 81 tests
• ldap — 66 tests
• ldap2 — 30 tests
• sieve — 2 tests
• ecdsa — 4 tests
• traefik_acmev1 — 11 tests
• traefik_acmev2 — 12 tests
• traefik_v3 — 9 tests

351 tests, 0 failures, the same counts as master. No tests were added: the cron-job tests from #94 run the updater the way cron does, as its cron user and with no terminal. On 8.0.0 they still pass: clamav can read the copy of a user.conf that only its owner can read, the job runs cleanly and exits 0, the cron user can reload clamd, the reload waits for clamd to start, the job stays quiet while another update runs, stderr and stdout go to mail.err and mail.warning, and the job fails when the update fails.

A container started with the default suite's settings was also checked by hand, after the startup update and one run of the cron job, started the way cron starts it:

• The startup update logged no ERROR or ALERT, and clamd reloaded after it (Database correctly reloaded, 3,689,078 signatures at start, 3,834,220 after).
• The cron job exited 0 and logged No updates detected. Nothing from clamav-unofficial-sigs reached the container log, and there is no /var/log/mail.err.
• Nothing fetched from the Yara-Rules project (dbs-yara is empty). The three .yara files in /var/lib/clamav are Sanesecurity's two and Linux Malware Detect's rfxn.yara.

That check ran with URLhaus still on, and showed why it is now off. On 2026-10-21 https://urlhaus.abuse.ch/downloads/urlhaus.ndb answers 410 Gone, and the URLhaus API page now says its ClamAV signature download needs an abuse.ch login and Auth-Key. 8.0.0 downloads from urlhaus_url without one and has no setting for a key. The same check on 2026-10-17 did install urlhaus.ndb (6.2 MB), which 7.2.5 never managed, so 8.0.0's urlhaus fixes work but now have nothing to fetch. Each update recorded the failure as a WARNING in the script's own log (warnings are not printed without a terminal).

• With URLhaus turned off in os.conf, the startup update makes no URLhaus request. Its log only says Removing disabled urlhaus Database files, so an installed urlhaus.ndb is removed rather than left to go stale, and it has no WARNING or ERROR lines. The default suite still passes, 136 tests.

[ksylvan]

LGTM