Hi Callum, The CDN provides two types of files: ".cvd" and ".cdiff" files. In the future we will also be adding ".sign" files (e.g. ".cvd.sign" and ".cdiff.sign") as an improved way to verify authenticity and integrity of the ".cvd" and ".cdiff" files.
The "freshclam.dat" file you observe is created by Freshclam to store data about the update process, such as a uniquely generated client id, and a record of recent update failures. The ".cld" files you observe are the product of updating ".cvd" files using ".cdiff" patch files. They aren't downloaded directly. The first time you download the databases, you will only receive ".cvd" files (plus the ".dat" file created by Freshclam). Due to caching weirdness, which we've been unable to resolve, it is possible that the ".cvd" file you receive is not the latest version. In that case, Freshclam will immediately download the latest ".cdiff" patch file and replace the ".cvd" with a patched ".cld" equivalent. Generally, when you update an existing set of signature databases, the ".cvd" files that are updated are replaced with ".cld" files. In very rare occasions, we won't provide a ".cdiff" patch file because it is better to download an entirely new ".cvd". This is most commonly seen when we update the "main" database (which historically has been ~once a year, or less). When Freshclam can't download a ".cdiff" patch file to get the latest version, it downloads the whole ".cvd" file, instead. If you're not seeing "bytecode.cld" or "daily.cld" in your update, it could either be that you're downloading databases for the first time rather than updating existing "daily.cvd" / "daily.cld" and "bytecode.cvd" / "bytecode.cld". Or else that Freshclam was unable to download the latest ".cdiff" files to do the patch-based updated and so downloaded the entire ".cvd" file instead. In summary, ".cvd" and ".cld" are functionally equivalent. So long as you are able to receive the latest version of the daily, bytecode, and main databases in either form, you should be okay. Best, Val Val Snyder (she/they) ClamAV Development Talos Cisco Systems, Inc. ________________________________ From: clamav-users <clamav-users-boun...@lists.clamav.net> on behalf of Callum.Dommett100--- via clamav-users <clamav-users@lists.clamav.net> Sent: Thursday, June 5, 2025 8:03 AM To: clamav-users@lists.clamav.net <clamav-users@lists.clamav.net> Cc: callum.dommett...@mod.gov.uk <callum.dommett...@mod.gov.uk> Subject: [clamav-users] Daily ClamAV cld files To whom it may concern, Within our environment we update the antivirus using ClamAV. We are used to receiving 6 files from the freshclam.exe (bytecode.cdl, bytecode.cvd, daily.cld, daily.cvd, freshclam.dat, and main.cvd) The past couple of days we have missed the bytecode.cld and daily.cld. We've attempted to download manually but the site returns with a 404 error. I'm just wondering if this is a known issue or if there is a workaround to receive these files? Many thanks, Callum
_______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat
