[clamav-users] [Clamav-devel] ClamAV(R) blog: ClamAV 0.102.0 Release Candidate is now available

[Franky Van Liedekerke]

Op Maandag, 30-09-2019 om 15:14 schreef J.R. via clamav-users:
> > While I applaud the re-use of existing components, requiring this
> > (minimum) version of libcurl will be a problem for redhat/centOS 7
> > users: everybody is still on RHEL7 (RHEL8 is "just" released and still
> > lacks support from many vendors).
> > In RHEL/Centos, clamav is only packaged in EPEL, and EPEL packages
> > will never include packages that the base OS also provides (in this
> > case libcurl + libssh2 as a dependancy). This would mean that 0.102
> > will never be available in RHEL7 (that is here until 2024).
> > So, maybe a solution could be to include libcurl in the clam distro
> > itself and build/use a static lib version of that (and not a shared
> > .so) in case the OS-version of libcurl is not sufficient? If not, EPEL
> > will never create an rpm for clamav 0.102, and that would leave a lot
> > of existing users "in the cold" and force them into using an "old"
> > version.
> 
> Franky,
> 
> As has been stated numerous times, the minimum requirement for curl is
> ONLY to build with the OPTIONAL argument for on-access scanning.
> 
> The ClamAV team is not responsible for 3rd party packages, if you want
> a static libcurl built you would need to contact the PACKAGE
> MAINTAINER. Which for RHEL appears to be a couple people.
> 
> Look at the changelog:
> https://centos.pkgs.org/7/epel-x86_64/clamav-0.101.4-1.el7.x86_64.rpm.html
> 
> Sure, it can be done.... for RHEL 6 they built a static version of
> zlib in the ClamAV package due to a bug with the OS version. But it is
> up to YOU to tell THEM... i.e. on Redhat's Bugzilla...  Alternatively
> now that you know exactly what feature is being used, instead of
> building a full static version with clamav, you could request that
> feature be backported into the existing curl package (as a different
> route to achieve the same end-goal)...
> 
> Additionally, you *can* install the latest Curl from a 3rd party repo:
> 
> https://mirror.city-fan.org/ftp/contrib/sysutils/Mirroring/
> 
> And if you want to add the repo to yum:
> 
> http://www.city-fan.org/ftp/contrib/yum-repo/
> 
> Ironic you are complaining about not getting a new version, when
> almost all packages in a RHEL distro are frozen versions (ex: curl)
> and merely receive backported bug fixes and features...
> 
> It's not hard to update curl, I already did it on my EL6 system. I
> haven't updated ClamAV yet, I'm waiting for the stable release.

I think you misunderstand me, I'm merely stating a fact here. Epel won't do anything about libcurl, and redhat won't just backport new features "because of". Even so, backport requests take a long time at redhat. Maybe the epel guys will include a static version of libcurl for clamav, I hope so.
I do know that this requirement is for clamonacc, that's just the feature I'm interested in.
Of course I know how to replace libcurl (I already did it and built clamav myself), but clamav packages would need to be done/provided/maintained by a recommended third-party (like epel) for the company I'm currently working at (maintaining own rpms is fine and I could even do it myself if clamav would provide/maintain a spec-file).

An extra thing is that the blog article states "This is only relevant if you are installing from source", so I hope that all this is just a non-issue (I'll need to rebuild myself later today again to verify).

Franky

F.