UNCLASSIFIED - NO CUI

ClamAV Scans Failing due to Definition Filetype Mismatch

Current Behavior

ClamAV scans are failing due to the provided definition file types not matching those expected by clamav-run.sh

Live Example

See the failing pipeline at https://repo1.dso.mil/dsop/opensource/grafana/grafana-loki/-/jobs/4251831

Expected Behavior

ClamAV scan should use the provided definitions and proceed.

Possible Solution

FreshClam checks the ClamAV virus database directory (indicated by the DatabaseDirectory value in the freshclam.conf that FreshClam uses) for existing instances of main.cvd, daily.cvd, or bytecode.cvd. For main and daily, if the CVD can’t be found it also looks for main.cld and daily.cld. These CLD files are uncompressed and unsigned versions of the CVD that have had CDIFFs applied.

clamav-run.sh currently fails the job if bytecode.cvd, main.cvd, and daily.cvd are not present.

As of this writing the current definitions.tar.gz includes bytecode.cvd, main.cvd, and daily .cld which is causing the pipelines to fail.