On Tue, Aug 1, 2017 at 11:18 AM, Petr Pisar <ppisar@redhat.com> wrote:
I received this test failure
<https://taskotron.fedoraproject.org/artifacts/all/ad295f84-7690-11e7-a988-5254008e42f6/task_output/rpmgrill.json>:

{
         "module" : "VirusCheck",
         "order" : 2,
         "results" : [
            {
               "arch" : "src",
               "code" : "ClamAV",
               "context" : {
                  "path" : "/libwbxml-0.11.5.tar.bz2"
               },
               "diag" : "ClamAV <b>Win.Trojan.Ramnit-5550</b> subtest triggered (ClamAV 0.99.2/21723/Mon Jun 13 13:53:00 2016)",
               "subpackage" : "libwbxml"
            }
         ],
         "run_time" : 9,
         "status" : "completed"
      },

I checked it locally in Fedora 27 with the same result. The tarball contains
win32/expat/libexpat.dll that triggers the antivirus.

But look at the clamav database version (21723/Mon Jun 13 13:53:00 2016). It's
more than a year old. After updating the database (you need to install
clamav-update package and wait for a cronjob or run /usr/bin/freshclam as root
manually), the hit went away. It's a false positive caused by Tasktron not
updating the virus database.

Please update the virus database regularly.

-- Petr

Hi Petr,

thanks for the report. In the task, we just install rpmgrill and run it. If rpmgrill reports outdated clamav results, it seems that's something that should be fixed in rpmgrill itself (it could depend on clamav-update and update the virus db before running the virus check). Can you please report a bug against rpmgrill and post the link here? (We could do it ourselves before running rpmgrill, but it seems cleaner to me if rpmgrill itself performs this, because that's the tool responsible for running the virus check - we're just a wrapper around it that schedules in on every koji build. Furthermore, having it in rpmgrill will fix this for all users of rpmgrill, regardless of execution). Thanks a lot.

Kamil