[csw-maintainers] ClamAV - to include the (obsolete) signatures or not?

[Peter Bonivart]

On Sat, Dec 13, 2008 at 11:55 AM, James Lee <james at opencsw.org> wrote:
> "DatabaseMirror db.local.clamav.net" should resolve to a suitable site,
> prove this by running "nslookup db.local.clamav.net" and it will
> show a list of places local to yourself.

The mirror is not a showstopper, that's correct, but the proxy
settings may be in many (most?) environments. Trying to find those in
wgetrc, pkg-get.conf or other files doesn't feel right. As far as I
know freshclam doesn't pick up proxy settings from the environment, it
wants it configured in freshclam.conf. It's also quite common not to
have internet access at all but to set up a freshclam proxy to connect
to.

> It's possible to add to crontab with postinstall (a new challenge to
> cswclassutils?) but maybe freshclam in daemon mode is better anyway,
> (variable time, control run level, control its stop and start).

The crontab idea is really cool! I have added that to the wiki page
for cswclassutils as a possible future addition.

http://wiki.opencsw.org/cswclassutils

It would be simple to provide a start script for freshclam in the
package and let cswclassutils set it up. Maybe I should do that
anyway?

However, it doesn't change the fact that a Clam package without the
db's does not work out of the tin as someone said to me. It doesn't
even handle it gracefully according to me. If you check your version
you get an incomplete message returned which may not make you
suspicious of anything wrong. If you try to scan it will complain
about missing signatures but break with more weird info and none about
how to fix it (run freshclam in most cases).

Maybe it's not worth the trouble to save 15 MB of download with todays
connections, web caches and local distribution and so on?

I'm all for splitting packages to reduce bloat, especially now when
it's real easy in GAR v2, but in this case it probably will cause
problems for some users.

-- 
/peter