WolfStack v23.12.8

v23.12.8: skip non-local mounts in scans, live progress, prompt-free across all distros

Three real-world fixes that came out of running clamscan on a Proxmox
LXC host with S3FS mounted under /mnt:

1. Auto-skip non-local mountpoints. /proc/mounts is parsed at scan
   time and every mount whose fstype is network / FUSE / overlay /
   tmpfs / virtual is added to clamscan's --exclude-dir list. Local
   block filesystems (ext4/xfs/zfs/btrfs/vfat/ntfs/...) stay scanned.
   So /mnt/s3 (s3fs), NFS shares anywhere, sshfs/rclone-mount, Docker
   overlay layers are all skipped without the operator needing to
   configure anything. Static /mnt and /media excludes are kept as a
   belt-and-braces fallback.

2. Live scan progress. run_clamav_scan now spawns clamscan with piped
   stdout, reads every 'path: OK' / 'path: FOUND' line, counts files,
   and updates scan_state.progress_message every 100 files with the
   total count + current path. The Fleet/per-node Security card
   already polls scan state so the moving counter shows up
   immediately. Stuck scans become visible — counter freezes while
   the path stays displayed.

3. Subprocess can't hang on prompts, on every distro:

   • stdin = /dev/null on every spawn (Stdio::null) so any read()
     gets EOF
   • rkhunter --update / --propupd now pass --skip-keypress
     (alongside the existing --check)
   • Debian: DEBIAN_FRONTEND=noninteractive +
     DEBCONF_NONINTERACTIVE_SEEN, APT_LISTCHANGES_FRONTEND=none,
     NEEDRESTART_MODE=a, -o Dpkg::Options=force-conf{def,old} so it
     never asks about modified config files
   • RedHat: -y -q --setopt=install_weak_deps=False
   • Arch/CachyOS: --noconfirm --needed --noprogressbar
     (kills the CR-based progress bar that corrupted our line log)
   • openSUSE: --non-interactive --quiet --no-recommends

4 new unit tests cover the mount-path octal unescape, the
is_skippable_fstype classifier (network/FUSE/virtual vs
ext4/xfs/zfs/btrfs), and regex_escape. 14 antivirus tests total,
all green.

---

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

• wolfstack-x86_64 / wolfstack-aarch64 — static musl binaries (Linux x86_64 and ARM64 / Raspberry Pi 4+).
• wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
• SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.