1.0.0 malformed database cannot update with freshclam

[chrcoluk]

Summary, was running fine on 0.105.
Updated to 1.0.0
Clamav fails to start daily.cld malformed database.
Freshclam fails to update 'signature doesnt match'

Unable to find manual download links for the database files.

Checking configuration files in /usr/local/etc

Config file: clamd.conf

LogFile = "/var/log/clamav/clamd.log"
LogFileMaxSize = "512000"
LogTime = "yes"
LogClean = "yes"
LogVerbose = "yes"
ExtendedDetectionInfo = "yes"
PidFile = "/var/run/clamav/clamd.pid"
TemporaryDirectory = "/var/tmp"
LocalSocket = "/var/run/clamav/clamd"
TCPSocket = "3310"
TCPAddr = "127.0.0.1", "::1"
StreamMaxLength = "52428800"
MaxThreads = "20"
CommandReadTimeout = "15"
IdleTimeout = "60"
ExcludePath = "^/proc/", "^/sys/"
SelfCheck = "3600"
User = "clamav"
DetectPUA = "yes"
ExcludePUA = "PUA.Win.Packer", "PUA.Win.Trojan.Packed", "PUA.Win.Trojan.Molebox", "PUA.Win.Packer.Upx", "PUA.Doc.Packed"
HeuristicScanPrecedence = "yes"
MaxScanTime = "30000"
MaxScanSize = "157286400"
MaxRecursion = "40"
MaxEmbeddedPE = "104857600"
MaxHTMLNormalize = "52428800"
MaxHTMLNoTags = "5242880"
MaxScriptNormalize = "52428800"
MaxZipTypeRcg = "52428800"

Config file: freshclam.conf

LogTime = "yes"
LogVerbose = "yes"
PidFile = "/var/run/clamav/freshclam.pid"
UpdateLogFile = "/var/log/clamav/freshclam.log"
DatabaseMirror = "database.clamav.net"
MaxAttempts = "1"
*** SafeBrowsing is DEPRECATED ***

clamav-milter.conf not found

Software settings

Version: 0.105.1
WARNING: Version mismatch: libclamav=0.105.1, clamconf=1.0.0
Optional features supported: MEMPOOL AUTOIT_EA06 BZIP2 LIBXML2 PCRE2 ICONV JSON RAR

Database information

Database directory: /var/db/clamav
[3rd Party] javascript.ndb: 9686 sigs
[3rd Party] twinclams.ldb: 1892 sigs
daily.cld: version 26792, sigs: 2018388, built on Wed Jan 25 08:49:26 2023
[3rd Party] securiteinfopdf.hdb: 2575 sigs
[3rd Party] securiteinfo.hdb: 30275 sigs
[3rd Party] urlhaus.ndb: 3136 sigs
bytecode.cld: version 333, sigs: 92, built on Mon Mar 8 15:21:51 2021
[3rd Party] securiteinfoascii.hdb: 29542 sigs
[3rd Party] securiteinfohtml.hdb: 19230 sigs
[3rd Party] securiteinfo.ign2: 130 sigs
main.cld: version 62, sigs: 6647427, built on Thu Sep 16 13:32:42 2021
Total number of signatures: 8762373

Platform information

uname: FreeBSD 12.3-STABLE FreeBSD 12.3-STABLE #1 stable/12-n100-e8fcdf9de-dirty: Mon Apr 1 amd64
OS: FreeBSD, ARCH: amd64, CPU: amd64
zlib version: 1.2.12 (1.2.12), compile flags: a9
platform id: 0x0323a0a00800000000040201

Build information

Clang: FreeBSD Clang 13.0.0 (git@github.com:llvm/llvm-project.git llvmorg-13.0.0-0-gd7b669b3a303) (4.2.1)
sizeof(void*) = 8
Engine flevel: 160, dconf: 160

[chrcoluk]

I noticed the mixed version warning, recompiling clamav from the ports tree removed that warning, however still have malformed database and couldnt update from freshclam with same error, now after that have the good old cloudflare rate limit, a pretty harsh 24h cooldown so no more testing until tommorow.

I downgraded back to 0.105 and these apparently malformed databases are now working again, their hash values match other machines.

[micahsnyder]

Do you have the full output from freshclam when this happened?

If you can reproduce this issue, can you try using freshclam --verbose? It it may show more detail about what is going wrong.

Without more information, I am unsure how to help. I am unable to reproduce this issue.

[chrcoluk]

I did run with verbose and debug and it honestly didnt say anything useful, but I will upgrade again later so I can give you the full output, it was mostly headers for the http request and a very short vague error about signature not matching (without saying why).

[wj0nes]

Perhaps this is related to your problem:
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=268069