[Pkg-clamav-devel] Bug#1143939: clamav: I prepared package 1.4.6+dfsg-1 for #1143939

[Edmund Lodewijks]

Hello all,

clamav 1.4.5+dfsg-3 is flagged for autoremoval from testing on 2026-09-21
because of this bug, and it takes seven reverse dependencies with it:
c-icap-modules, clamassassin, clamsmtp, clamtk, cyrus-imapd, e2guardian and
libclamunrar. I was working on the cyrus-imapd patch, and thought I'd 
also see if a contribution to clamav would be welcome.

Since I am not familiar with the git-dpm workflow, I just built it the 
way I know, as a plain source package (I am still new to packaging for 
Debian).

Upstream 1.4.6 (2026-08-07) fixes all five CVEs. Since the packaging 
branch had no 1.4.6 work yet, I have prepared 1.4.6+dfsg-1. I do not 
have upload rights, so I uploaded it to mentors.

   Source package: https://mentors.debian.net/package/clamav/

I have kept the diff to the minimum a security update needs, but also 
included commit 97a37bb2 from Salsa (d/ci: Disable blhc).

A debdiff is attached to this email.

Build:		I built this with sbuild in unstable.
Tests:		The upstream testsuite passes (6/6 test suites, plus the Rust 
unit tests).
Lintian:		Compared to 1.4.5+dfsg-3, lintian reports two new tags:
			`no-nmu-in-changelog` and `source-nmu-has-incorrect-version-number`.
			Both are due to my name being in the changelog, but I am not a
			Maintainer or Uploader.

Some points that I think are noteworthy:

* All four patches in debian/patches/series still apply to 1.4.6; none have
   been merged upstream. Only 0004-unit_tests-Don-t-set-TMP.patch needed a
   refresh (3-line offset).

* No ABI break. LIBCLAMAV_CURRENT:REVISION:AGE is 12:3:0 in both 1.4.5 and
   1.4.6. The SONAME stays libclamav.so.12.

* Your guard in override_dh_auto_configure did its job and stopped my first
   build: CL_FLEVEL went 215 -> 216 in 1.4.6. I followed the same treatment
   as 478677ef ("d: Update symbols") for the 1.4.5 bump -- the four 1.4.5
   minvers in debian/libclamav12.symbols (CLAMAV_PRIVATE, cl_retflevel@
   CLAMAV_PUBLIC, FRESHCLAM_PRIVATE, FRESHCLAM_PUBLIC) go to 1.4.6, and the
   CL_FLEVEL literal in debian/rules goes to 216. Please do sanity-check
   that, as I was trying to copy what has been done before.

* CVE-2025-8088 is not relevant to Debian: it is Windows-only. The security
   tracker marks it NOT-FOR-US. I have not mentioned it in the changelog.

* I did not do anything with git-dpm, and therefore didn't touch 
d/.git-dpm (it still has the 1.4.5 import).

* debian/rules runs debconf-updatepo in the `clean` target, so a plain 
"dpkg-buildpackage -S" rewrites all twenty debian/po/*.po files. When I 
did a diff between the newly built package and 1.4.5+dfsg-3, I saw all 
these new .po files, which surprised me. Looking at that 1.4.5+dfsg-3 
source package in the
archive, it still has POT-Creation-Date 2021-02-21, so I reckon these 
don't usually get updated by the clamav team. Therefore, I rebuilt with 
`-nc` and restored the .po files, so that the change is minimal. I just 
wanted to write this out.

If it is easier for you to just do the 1.4.6 import yourselves and ignore my
package entirely, that is completely fine. Please let me know, and I 
will remove it from mentors.

I hope that the changelog is written correctly. I presumed that the 
clamav-team will upload the package, if they so desire. If they drop it, 
fine. If someone else uploads it as an NMU, then the changelog will be 
changed accordingly I'm sure.

Kind regards,

     Edmund


-- 
Edmund Lodewijks <edmund at proteamail.com>
TZ: UTC+2 / GMT+2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: clamav-debian-only.diff
Type: text/x-patch
Size: 3831 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-clamav-devel/attachments/20260817/6446c7d6/attachment.bin>