Accepting request 834369 from home:adkorte:branches:security

- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
    - Non-blocking database reloads are now the default behavior. Some
      systems that are more constrained on RAM may need to disable
      non-blocking reloads as it will temporarily consume two times as
      much memory. We added a new clamd config option
      ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)

OBS-URL: https://build.opensuse.org/request/show/834369
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=209

clamav-0.102.4.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:eebd426a68020ecad0d2084b8c763e6898ccfd5febcae833d719640bb3ff391b
-size 13234444

clamav-0.102.4.tar.gz.sig

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIcBAABAgAGBQJfD5GjAAoJEPE/nha8pb+tICwP/jLhv1LzuxcvHxxbjWK14+SQ
-rY9DazbS7yxnCR62Esy/kbiyjq/EWTLGmWH1U95T1dde+RfBI5dUpcNVvgx2gO+f
-tXn4Y9kdN/Zuu6QgD8aqgJ9+jwgdkaoh2a5DpBYM58dsjQuDfPMR61QWMUJBag36
-0g9XniENUiTS/a4Sff1U58tnHoj0VM9R6Zf7NktscomeQ7yy3g7ShPAttdcGVje6
-CECoeZFUO0C8YlgRqBC7O1d3xYusjUeudaYcVu0toeieRK8t2Imbl3XzYmb5T4sK
-ZY7ORRPE+z4mT3zaJ+zOrk6mZROUKjt1tgWG4TJEl/tDaQJrJnp8AJpfBtmn8EzP
-MAeHyeKF1wNH8cQJzQoZUgaz+mJvVCUWlzRNLaZqi65TZwmxRMF8EPFx5sBPbf/S
-bp1fS7NThOTBucjFoZmD6j09YTW1Qs/Zk17naPS61oOReZXdTaojeZoLa+l+JJk/
-Ds6D5TMu+qIAGGGhN70KYsHfH6EmnaDcoUQjUs1nAQ8p+1r7oHhaZFBuhWGZstak
-eoTO6jr7KjvwpkkQ+lSeOE+G/sNwZ2PktCVZ8y5S40U8JbWYr6TBBbGwbqSeNckc
-ZZkP5Uh/8E6Z9TfoeuXwbHcEG2XQtYjtuDG3JWwAOEk8RpEjqz7E0rjkG4DEHQma
-SuDZ2RZq4zwHaZEIA9ja
-=K+Ht
------END PGP SIGNATURE-----

clamav-0.103.0.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:32a9745277bfdda80e77ac9ca2f5990897418e9416880f3c31553ca673e80546
+size 13357078

clamav-0.103.0.tar.gz.sig

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIcBAABAgAGBQJfXhjDAAoJEPE/nha8pb+t6REP/3zOJuiijx9luneQ89YJbKa1
+F7FDGzmqm26B/jAeAZIrS8rRrpUHaKs9qI7vLgkX1gG5QJFrnDy1Lj26rJ82YZ08
+3HCkAScmxNqE7unI0Azyd034oYY/1+nWBipnrQe5oRVDuPF0EFxFrjqVSkXEJ264
+kZR/jXk+8ktLXKAjTw4B4Furmr8iWlRcrrDzISjZKIQtq7SkveiIbvhK98UcQKhK
+KF4XhuPfw+qkUZTz6ImJTK9rO705E1wgKthyqE06ZIt858RtXyshE3SVHjZKdxFi
+h1TxliYr5UxXVauJu7hjw5fwQFyE44QGK/PAFnOt7+aIE6ucQ3ErR6LAjz9xH3Xn
+MK1yRmXql72IhB8b+JG6c8VneljqAqBg36Hh5G+qv0Yk90bUWE8aSxQ4MIljB3aU
+OAl9+g6S+48W+v9z0cTzgS3FxHcFl18ulLEK4/ox8TJuq2XBKZZ8H5f2i59Ub2BJ
+PDYrlTTamj+s/axRqATyHeqdfZB+11idZiLl+WauVl75NEwefVwZAa+Lv6cF6Poz
+Wo28vPe2yyUu/RKUcMTNGD4KwUxC7oiY8vNEXje4tZop8QIzFQ6+F7VtlydA7eEj
+GWr4+S8BZoudAlA11AE5ipI9ghsGQIONf+mn+e6/liVYeDI3nZlg4SP+25+ZKmWk
+kDkn6ZmWUQaVScd5AFPy
+=bhFw
+-----END PGP SIGNATURE-----

clamav-conf.patch

@@ -31,7 +31,7 @@
  # Waiting for data from clamd will timeout after this time (seconds).
  # Value of 0 disables the timeout.
 @@ -61,7 +56,7 @@ Example
- # daemon (main thread).
+ # also owned by root to keep other users from tampering with it.
  #
  # Default: disabled
 -#PidFile /var/run/clamav-milter.pid
@@ -96,8 +96,8 @@
  # Enable verbose logging.
  # Default: no
 @@ -71,7 +67,7 @@ Example
- # This option allows you to save a process identifier of the listening
+ # It is recommended that the directory where this file is stored is
- # daemon (main thread).
+ # also owned by root to keep other users from tampering with it.
  # Default: disabled
 -#PidFile /var/run/clamd.pid
 +PidFile /run/clamav/clamd.pid
@@ -172,8 +172,8 @@
  # Enable log rotation. Always enabled when LogFileMaxSize is enabled.
  # Default: no
 @@ -48,12 +44,12 @@ Example
- 
+ # It is recommended that the directory where this file is stored is
- # This option allows you to save the process identifier of the daemon
+ # also owned by root to keep other users from tampering with it.
  # Default: disabled
 -#PidFile /var/run/freshclam.pid
 +PidFile /run/clamav/freshclam.pid

clamav-disable-timestamps.patch

@@ -82,4 +82,4 @@ Index: configure
 +_ACEOF
  
  
- VERSION="0.102.4"
+ VERSION="0.103.0"

clamav-str-h.patch

@@ -1,10 +0,0 @@
---- libclamav/others_common.c.orig
-+++ libclamav/others_common.c
-@@ -54,6 +54,7 @@
- #endif
- 
- #include "clamav.h"
-+#include "str.h"
- #include "others.h"
- #include "platform.h"
- #include "regex/regex.h"

clamav.changes

@@ -1,3 +1,18 @@
+-------------------------------------------------------------------
+Mon Sep 14 17:39:16 UTC 2020 - Arjen de Korte <suse+build@de-korte.org>
+
+- Update to 0.103.0
+  * clamd can now reload the signature database without blocking
+    scanning. This multi-threaded database reload improvement was made
+    possible thanks to a community effort.
+    - Non-blocking database reloads are now the default behavior. Some
+      systems that are more constrained on RAM may need to disable
+      non-blocking reloads as it will temporarily consume two times as
+      much memory. We added a new clamd config option
+      ConcurrentDatabaseReload, which may be set to no.
+  * Dropped clamav-str-h.patch (no longer needed)
+  * Fix clamav-milter.service (requires clamd.service to run)
+
 -------------------------------------------------------------------
 Thu Jul 16 20:02:03 UTC 2020 - Arjen de Korte <suse+build@de-korte.org>
 

clamav.spec

@@ -19,7 +19,7 @@
 %define clamav_check --enable-check
 %bcond_with clammspack
 Name:           clamav
-Version:        0.102.4
+Version:        0.103.0
 Release:        0
 Summary:        Antivirus Toolkit
 License:        GPL-2.0-only
@@ -37,14 +37,13 @@ Patch1:         clamav-conf.patch
 Patch4:         clamav-disable-timestamps.patch
 Patch5:         clamav-obsolete-config.patch
 Patch6:         clamav-disable-yara.patch
-Patch7:         clamav-str-h.patch
 BuildRequires:  autoconf
 BuildRequires:  automake
 BuildRequires:  bc
 BuildRequires:  check-devel
 BuildRequires:  gcc-c++
 BuildRequires:  libbz2-devel
-BuildRequires:  libcurl-devel
+BuildRequires:  libcurl-devel >= 7.45
 BuildRequires:  libjson-c-devel
 BuildRequires:  libopenssl-devel
 BuildRequires:  libtool
@@ -56,6 +55,7 @@ BuildRequires:  pwdutils
 BuildRequires:  sed
 BuildRequires:  sendmail-devel
 BuildRequires:  systemd-rpm-macros
+#BuildRequires:  valgrind
 BuildRequires:  zlib-devel
 BuildRequires:  pkgconfig(libsystemd)
 Requires(pre):  %_bindir/awk
@@ -125,7 +125,6 @@ that want to make use of libclamav.
 %patch4
 %patch5
 %patch6
-%patch7
 
 %build
 CFLAGS="-fstack-protector"
@@ -181,6 +180,7 @@ install -d -m 0755 %buildroot/%_unitdir
 install -m 0644 %SOURCE7 %buildroot/%_unitdir/clamd.service
 install -m 0644 %SOURCE8 %buildroot/%_unitdir/freshclam.service
 install -m 0644 %SOURCE9 %buildroot/%_unitdir/clamav-milter.service
+rm -f %buildroot/%_unitdir/clamav-clamonacc.service
 rm -f %buildroot/%_unitdir/clamav-daemon.service
 rm -f %buildroot/%_unitdir/clamav-daemon.socket
 rm -f %buildroot/%_unitdir/clamav-freshclam.service
@@ -194,7 +194,7 @@ done
 
 # regression tests
 %if !0%{?qemu_user_space_build:1}
-VALGRIND_GENSUP=1 make check
+make check VG=1
 %endif
 
 %post   -n libclamav9 -p /sbin/ldconfig

service.clamav-milter

@@ -1,7 +1,7 @@
 [Unit]
 Description=Clamav antivirus milter daemon 
-After=network.target freshclam.service
+After=network.target clamd.service
-Requires=freshclam.service
+Requires=clamd.service
 
 [Service]
 Type=forking