> > So maybe the ClamAV definitions should be treated similarly? In
> > a separate package which gets updated on a regular interval to pull in
> > the latest data?
> >
>
> That would be the best solution here, yes. Could someone please file an RFE
> against clamav?
Done:

    https://bugzilla.redhat.com/show_bug.cgi?id=1477777


The clamav maintainer doesn't seem to have the time needed to provide a regularly updated clamav-data package. So today I tried to update the rpmgrill task with running freshclam before running rpmgrill, using clamav.upjs.sk mirror. That mirror is very fast when I try it (as opposed to the default mirror). However, when running it in our infra, I hit "WARNING: Mirror 158.197.16.70 is not synchronized." errors with clamav.upjs.sk mirror [1] and extremely long times with the default mirror (my patience ran out after 5 minutes).

So, sorry, I give up. Unless we can convince someone to maintain a regularly updated clamav-data package, or provide a reliable and fast clamav mirror (that is willing to be hit very often from our infra), I'm afraid we can't offer an updated clamav database for our tests.

[1] https://paste.fedoraproject.org/paste/hqewIGsDK8XFn9O6B0bPPQ/raw