Note that Ubuntu's most recent Long-Term-Support release (8.04) has Clamav version
"0.94.dfsg.2-1ubuntu0.3~hardy4". The next Ubuntu LTS release is due in April -- probably late April.
Similarly, the current stable Debian release has Clamav version "0.94.dfsg.2-1lenny2", though the
lenny-volatile repository has "0.95.1+dfsg-1~volatile1", and current Debian testing (and unstable)
has version "0.95.2+dfsg-4+b1". The next Debian stable is also likely to be out next spring, but
that's less firm than Ubuntu.
It will be interesting to see what happens when ClamAV on Ubuntu LTS servers gets disabled two
weeks before a new Ubuntu LTS release is available.
Posted Oct 6, 2009 17:01 UTC (Tue) by proski (subscriber, #104)
[Link]
Perhaps Ubuntu could provide a fixed version that's immune to the disabling update.
ClamAV 0.94.x and Ubuntu / Debian
Posted Oct 6, 2009 17:23 UTC (Tue) by foom (subscriber, #14868)
[Link]
....and then what? You still wouldn't have working updated rules.
And what good is a virus checker without updated rules?
ClamAV 0.94.x and Ubuntu / Debian
Posted Oct 6, 2009 18:26 UTC (Tue) by proski (subscriber, #104)
[Link]
It's a fact of life that some programs are not compatible with long time support releases. Antivirus software is a perfect example, as it has to deal with an evolving adversary.
ClamAV 0.94.x and Ubuntu / Debian
Posted Oct 8, 2009 13:47 UTC (Thu) by epa (subscriber, #39769)
[Link]
I think there might be some misunderstanding of what 'long term support' means. It does not mean 'an unchanging lump of code fixed for all time with only grudging security updates'. It means that your vendor undertakes to maintain the software and make whatever changes may be needed to keep it working effectively, while avoiding changes that will stop it working. (These two requirements do conflict a little, since any change at all has the chance of breaking something.)
In this case, the only meaningful way of providing long term support for an antivirus product is to keep it updated with the latest code and the latest virus definitions. To keep it frozen at an old (and therefore ineffective) version is not support at all.
ClamAV 0.94.x and Ubuntu / Debian
Posted Oct 6, 2009 18:38 UTC (Tue) by nybble41 (subscriber, #55106)
[Link]
Rather, to get the updated rules you'd have to download the full CVDs rather than incremental updates, increasing the load on their servers.
ClamAV 0.94.x and Ubuntu / Debian
Posted Oct 6, 2009 17:43 UTC (Tue) by jspaleta (subscriber, #50639)
[Link]
0.95.2 is already in backports for dapper, hardy and intrepid. So concerned individuals can enable backports and grab the 0.95.x release. And if I'm reading the wiki page correctly the plan appears to transition these from backports into security or updates.
So the remaining question here is.. how are people going to be notified that they need to enable backports and pull the 0.95 release? When 0.94 gets disabled are admins going to get a local log notification and will they know what to do about it? Hopefully Ubuntu can push these packages out of backports and into security or updates before the deadline so admins won't have to figure it out on their own.
-jef
ClamAV 0.94.x and Ubuntu / Debian
Posted Oct 7, 2009 19:09 UTC (Wed) by orev (subscriber, #50902)
[Link]
This is pretty much irrelevant since anyone using an LTS version wouldn't immediately drop their old version and install the new one. The timing of it doesn't matter, since it would be many months for most people running critical servers.
ClamAV 0.94.x and Ubuntu / Debian
Posted Oct 7, 2009 19:19 UTC (Wed) by rfunk (subscriber, #4054)
[Link]
That makes it more relevant, not less. Those people running LTS and waiting
to upgrade the system will have ClamAV broken for "many months" rather than
two weeks (unless the solutions mentioned by others above come into play).
ClamAV 0.94.x and Ubuntu / Debian
Posted Oct 12, 2009 2:21 UTC (Mon) by pabs (subscriber, #43278)
[Link]
Debian has now issued an EOL statement encouraging stable/oldstable users to switch to the version in debian-volatile: