[clamav-users] Freshclam updates problem

[Paul Kosinski]

On Wed, 14 Jul 2021 23:55:06 +0000
"Micah Snyder \(micasnyd\) via clamav-users" <clamav-users at lists.clamav.net> wrote:

> Hi Paul, all:
> 
> We're triaging this issue now, also reported by a user on Discord.
> 
> We issue a zero-byte CDIFF database patch file whenever we want Freshclam to download a whole CVD instead of doing the incremental/patch update. 
> Today we published a zero-byte patch file for both daily and main, as we've migrated about half of the daily signatures over to the main database.
> 
> Unfortunately it appears we have a bug in 0.102 and 0.103 where Freshclam will complain loudly about the zero-byte CDIFF patch file. I suspect we didn't notice it before because, despite the error message, Freshclam will still do the right thing (at least in 0.102). 
> 
> But it seems 0.103 has a second bug where it will patiently wait until it's at least 2 versions behind before it downloads the whole CVD database. This behavior is supposed to happen when a private mirror doesn't have the latest patch file yet, but wasn't supposed to happen for a zero-byte patch file. So we clearly have 2 bugs to fix ASAP.
> 
> The good news is, I believe that if we publish 1 more version of daily.cvd and main.cvd, we will see the 0.103 Freshclam clients all download the new daily & main and they'll be good again. I will work with our signature publishing team here to get an update for daily & main out as soon as we're able.
> 
> I'm sorry about the bug everyone. Thank you for your patience!
> 
> I will write again a soon as I have an update.
> 
> -Micah


More details on the new 'main' misbehavior. Don't know if it is helpful.

I'm running 0.103.3 on all 3 of my ClamAV installations. On one of the systems (where I have very detailed logging of freshclam), main was still at 59 (today at 7:43 AM EDT), and freshclam correctly downloaded daily 26231 over 26230. 

Later on, from the same system, main was allegedly (DNS TXT) supposed to be at 60, and daily was supposed to be at 26232, but *both* failed to download at least 7 times (15:43 EDT through 21:43).

This may, of course, be essentially the same problem I had with Cloudflare's BOS (Anycast) POP a couple of years ago, which made me give up putting any more work into setting up my own mirror.