> > So maybe the ClamAV definitions should be treated similarly? In
> > a separate package which gets updated on a regular interval to pull in
> > the latest data?
> >
>
> That would be the best solution here, yes. Could someone please file an RFE
> against clamav?
Done:
https://bugzilla.redhat.com/show_bug.cgi?id=1477777