From: "Paul Smedley" <ecs-isp@2rosenthals.com>
Content-Type: multipart/alternative;
 boundary="------------06t4C3xhutCsoV70qDhWJLWd"
Message-ID: <0abb173f-92ec-4f56-a3d3-a5f142db20a6@smedley.id.au>
Date: Fri, 13 Oct 2023 09:25:25 +1030
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [eCS-ISP] ClamAV
To: eCS ISP Mailing List <ecs-isp@2rosenthals.com>
References: <list-8103999@2rosenthals.com>
Content-Language: en-AU
In-Reply-To: <list-8103999@2rosenthals.com>

This is a multi-part message in MIME format.
--------------06t4C3xhutCsoV70qDhWJLWd
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hi Steven,

On 12/10/23 06:37, Steven Levine wrote:
> In<list-8103121@2rosenthals.com>, on 10/11/23
>     at 06:45 PM, "Paul Smedley"<ecs-isp@2rosenthals.com>  said:
>
> There was no announcement - afair - I built it just for Max  and it
> (apparently) worked  until clamav decided to stop generating updates
> for  it.
> Perhaps you pointed Massimo to it in a PM?  IAC, once Massimo posted the
> zip file it was easy to pull a copy.  I already had a copy of 0.102.0
> pulled using the content of the exceptq report you posted.

I  honestly don't remember any more :)

>> I have no comments on clamscan from 0.102 -  given it can't refresh
>> virus signatures  - I don't see the point of wasting any brain cycles on
>> it.
> Can't or won't.  I'm not that familar with ClamAV.

Both I think - at some point they claim to stop  supporting older 
version - perhaps there are differences  in the binary formats of the 
signatures?

> FWIW, I spent some time with ClamAV here to see for myself how it fails.
>
> clamscan 0.103.6 using the 0.102.0 signatures seems to run without errors
> here.  Isn't it supposed to complain that the signatures are out of date
> or is that just freshclam?
I would have expected it to at least *warn* that the signatures are out 
of date.
> Freshclam 0.103.6 fails with an SSL issue here.  What .pem file is
> freshclam looking for when it complains about:
>
>    * error setting certificate verify locations:  CAfile:
> /etc/ssl/cacert.pem CApath: none
>
> If I create cacert.pem and make it read-only, the error changes to:
>
>    ERROR: Download failed (77) ERROR:  Message: Problem with the SSL CA
> cert (path? access rights?)

This will probably go away once I rebuild clamav 0.103.6 with rpm openssl.

Build is running now.

Cheers,

Paul

--------------06t4C3xhutCsoV70qDhWJLWd
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Hi Steven,<br>
    </p>
    <div class="moz-cite-prefix">On 12/10/23 06:37, Steven Levine wrote:<br>
    </div>
    <blockquote type="cite" cite="mid:list-8103999@2rosenthals.com">
      <pre class="moz-quote-pre" wrap="">In <a class="moz-txt-link-rfc2396E" href="mailto:list-8103121@2rosenthals.com">&lt;list-8103121@2rosenthals.com&gt;</a>, on 10/11/23
   at 06:45 PM, "Paul Smedley" <a class="moz-txt-link-rfc2396E" href="mailto:ecs-isp@2rosenthals.com">&lt;ecs-isp@2rosenthals.com&gt;</a> said:

There was no announcement - afair - I built it just for Max  and it 
(apparently) worked  until clamav decided to stop generating updates 
for  it.
</pre>
      <pre class="moz-quote-pre" wrap="">
Perhaps you pointed Massimo to it in a PM?  IAC, once Massimo posted the
zip file it was easy to pull a copy.  I already had a copy of 0.102.0
pulled using the content of the exceptq report you posted.
</pre>
    </blockquote>
    <p>I  honestly don't remember any more :)</p>
    <p><span style="white-space: pre-wrap">
</span></p>
    <blockquote type="cite" cite="mid:list-8103999@2rosenthals.com">
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">I have no comments on clamscan from 0.102 -  given it can't refresh 
virus signatures  - I don't see the point of wasting any brain cycles on
it.
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">
Can't or won't.  I'm not that familar with ClamAV.</pre>
    </blockquote>
    <p>Both I think - at some point they claim to stop  supporting older
      version - perhaps there are differences  in the binary formats of
      the signatures?</p>
    <p><span style="white-space: pre-wrap">
</span></p>
    <blockquote type="cite" cite="mid:list-8103999@2rosenthals.com">
      <pre class="moz-quote-pre" wrap="">FWIW, I spent some time with ClamAV here to see for myself how it fails.

clamscan 0.103.6 using the 0.102.0 signatures seems to run without errors
here.  Isn't it supposed to complain that the signatures are out of date
or is that just freshclam?</pre>
    </blockquote>
    I would have expected it to at least *warn* that the signatures are
    out of date.<span style="white-space: pre-wrap">
</span>
    <blockquote type="cite" cite="mid:list-8103999@2rosenthals.com">
      <pre class="moz-quote-pre" wrap="">
Freshclam 0.103.6 fails with an SSL issue here.  What .pem file is
freshclam looking for when it complains about:

  * error setting certificate verify locations:  CAfile:
/etc/ssl/cacert.pem CApath: none

If I create cacert.pem and make it read-only, the error changes to:

  ERROR: Download failed (77) ERROR:  Message: Problem with the SSL CA
cert (path? access rights?)
</pre>
    </blockquote>
    <p>This will probably go away once I rebuild clamav 0.103.6 with rpm
      openssl.</p>
    <p>Build is running now.</p>
    <p>Cheers,</p>
    <p>Paul<br>
    </p>
  </body>
</html>

--------------06t4C3xhutCsoV70qDhWJLWd--