Monday, July 30, 2018

If you use ClamAV’s Git repository, you may have noticed that we’ve recently changed our Git workflow.

It’s a big departure from what we had been doing, and we believe it will be a major improvement. Our new workflow took inspiration from the popular and well-known GitFlow model, and it shares some of its features. However, to better suit our needs, we’ve made a number of modifications and simplifications to the original GitFlow paradigm. Here’s a rundown of some of the most important changes:

  1. New commits will go into dev/0.101 instead of master.  The default branch will now be dev/0.101.
    • When unit tests, system tests, and regression tests on dev/0.101 are up to snuff, we will cherry-pick the commits over to master. This way, master will always be stable. 
  2. When we’re ready to release, we will create a release branch (rel/0.101) from master and tag the release (0.101.0). 
  3. A new dev branch will be created for the next feature release (dev/0.102) and will be set as the default branch. 
  4. Any urgent security or bug-fix patches will be applied both to the new dev branch (dev/0.102) and to the previous dev branch (dev/0.101).  
    • After successful testing on dev/0.100, the patch(es) will be cherry-picked to rel/0.101 and tagged for the patch version release (0.101.1). 
    • Meanwhile, the same urgent patch(es) will undergo normal testing in the current dev branch (dev/0.102). Security related patches will remain private until the patch version release is published.
  5. The goal going forward is for master to always be stable, so we can publish releases as frequently as needed.  With this workflow and versioning scheme, it will also be easy to create patch releases. 

As a disclaimer:  We’re just getting started with the new Git workflow, which means that master isn’t proven stable yet. Also, we have some major automation improvements to make to our system and regression-testing processes that will make this workflow highly effective. The automation improvements are still in the works, and are probably a couple months out. Until then, any testing done before we cherry-pick changes to master will be mostly manual.

The takeaway from this is that these are the important branches in the ClamAV Git repository:
  • dev/0.101 — The latest unstable code in development.
  • master — The latest tested stable code.
  • rel/0.100 — The latest released version, which is also posted on
  • dev/0.100 — The previous development branch, used to test hotfixes prior to a patch release. 
For any further questions or discussion please head on over to our ClamAV-devel mailing list

Thank you.

Monday, July 9, 2018

ClamAV 0.100.1 is a hotfix release to patch a set of vulnerabilities.
  • Fixes for the following CVE's:
  • Fixes for a few additional bugs:
    • Buffer over-read in unRAR code due to missing max value checks in table initialization. Reported by Rui Reis.
    • Libmspack heap buffer over-read in CHM parser. Reported by Hanno Böck.
    • PDF parser bugs reported by Alex Gaynor.
      • Buffer length checks when reading integers from non-NULL terminated strings.
      • Buffer length tracking when reading strings from dictionary objects.
  • HTTPS support for clamsubmit.
  • Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only. Patch provided by Guilherme Benkenstein.
Thank you to the following ClamAV community members for your code submissions and bug reports!
  • aCaB
  • Alex Gaynor
  • Guilherme Benkenstein
  • Hanno Böck
  • Rui Reis
  • Laurent Delosieres, Secunia Research at Flexera