Re: download of source packages alarmed clamav

2013-06-26 Thread Joey Hess
Russ Allbery wrote: Given that the whole point of those files is to test clamav, I would hope that they would trigger clamav's detection. If not, that would be a bug in clamav, no? However, the point of the pymilter source package is not to test clamav, it's to distribute the source to

Re: download of source packages alarmed clamav

2013-06-26 Thread Russ Allbery
Joey Hess jo...@debian.org writes: So, the tarball could be fixed to rot-13 the virus files stored in it, and re-rotate them when the test suite is run. (If virus scanners perhaps try rot-13, then instead encrypt the viruses with a key included in the source package, but that's probably

Re: download of source packages alarmed clamav

2013-06-26 Thread Scott Kitterman
On Tuesday, June 25, 2013 11:06:26 PM Russ Allbery wrote: Joey Hess jo...@debian.org writes: So, the tarball could be fixed to rot-13 the virus files stored in it, and re-rotate them when the test suite is run. (If virus scanners perhaps try rot-13, then instead encrypt the viruses with a

Re: download of source packages alarmed clamav

2013-06-25 Thread Timo Juhani Lindfors
Harald Dunkel harald.dun...@aixigo.de writes: I doubt that sending a virus complies to the DFSG, so the question is whether these source packages have been compromised? The test/ directory in pymilter_0.9.3.orig.tar.gz contains some sample viruses on purpose. I can't comment on other source

Re: download of source packages alarmed clamav

2013-06-25 Thread Marius Gavrilescu
Forgot to list-reply. On Tue, Jun 25, 2013 at 08:47:56AM +0200, Harald Dunkel wrote: I doubt that sending a virus complies to the DFSG, so the question is whether these source packages have been compromised? That package contains a directory named test/ with emails with spam, viruses and

Re: download of source packages alarmed clamav

2013-06-25 Thread Marius Gavrilescu
On Tue, Jun 25, 2013 at 09:52:26AM +0200, Harald Dunkel wrote: Its not a warning. The download failed. Yes, I should have said failure. Anyway, the probable cause is the existence of emails with viruses as tests in the package. -- Marius Gavrilescu signature.asc Description: Digital signature

Re: download of source packages alarmed clamav

2013-06-25 Thread Harald Dunkel
On Tue, 25 Jun 2013 10:46:23 +0300 Marius Gavrilescu mar...@ieval.ro wrote: That package contains a directory named test/ with emails with spam, viruses and similar. This might have caused the clamav warning. Its not a warning. The download failed. Regards Harri -- To UNSUBSCRIBE,

Re: download of source packages alarmed clamav

2013-06-25 Thread Marius Gavrilescu
On Tue, Jun 25, 2013 at 10:19:46AM +0200, Harald Dunkel wrote: These are real-life viruses that should not be distributed using Debian's FTP server (IMHO). Even if they wre real, they would be real-life MS Windows viruses in emails in a debian package. For someone to get infected they would

Re: download of source packages alarmed clamav

2013-06-25 Thread Harald Dunkel
On Tue, 25 Jun 2013 10:54:53 +0300 Marius Gavrilescu mar...@ieval.ro wrote: On Tue, Jun 25, 2013 at 09:52:26AM +0200, Harald Dunkel wrote: Its not a warning. The download failed. Yes, I should have said failure. Anyway, the probable cause is the existence of emails with viruses as tests in

Re: download of source packages alarmed clamav

2013-06-25 Thread Scott Kitterman
Harald Dunkel harald.dun...@aixigo.de wrote: On Tue, 25 Jun 2013 10:54:53 +0300 Marius Gavrilescu mar...@ieval.ro wrote: On Tue, Jun 25, 2013 at 09:52:26AM +0200, Harald Dunkel wrote: Its not a warning. The download failed. Yes, I should have said failure. Anyway, the probable cause is

Re: download of source packages alarmed clamav

2013-06-25 Thread Scott Kitterman
Marius Gavrilescu mar...@ieval.ro wrote: On Tue, Jun 25, 2013 at 10:19:46AM +0200, Harald Dunkel wrote: These are real-life viruses that should not be distributed using Debian's FTP server (IMHO). Even if they wre real, they would be real-life MS Windows viruses in emails in a debian

Re: download of source packages alarmed clamav

2013-06-25 Thread Darac Marjal
On Tue, Jun 25, 2013 at 08:04:00AM -0400, Scott Kitterman wrote: Harald Dunkel harald.dun...@aixigo.de wrote: On Tue, 25 Jun 2013 10:54:53 +0300 Marius Gavrilescu mar...@ieval.ro wrote: On Tue, Jun 25, 2013 at 09:52:26AM +0200, Harald Dunkel wrote: Its not a warning. The download

Re: download of source packages alarmed clamav

2013-06-25 Thread Austin English
On Tue, Jun 25, 2013 at 5:05 AM, Scott Kitterman deb...@kitterman.com wrote: Marius Gavrilescu mar...@ieval.ro wrote: On Tue, Jun 25, 2013 at 10:19:46AM +0200, Harald Dunkel wrote: These are real-life viruses that should not be distributed using Debian's FTP server (IMHO). Even if they wre

Re: download of source packages alarmed clamav

2013-06-25 Thread Peter Samuelson
On Tue, Jun 25, 2013 at 08:04:00AM -0400, Scott Kitterman wrote: This comes up periodically. They aren't real. [Darac Marjal] It would appear they're real enough to trigger clamav's detection, which was the problem the OP was having. Yes. It is not really a fixable problem. The test

Re: download of source packages alarmed clamav

2013-06-25 Thread Russ Allbery
Darac Marjal mailingl...@darac.org.uk writes: On Tue, Jun 25, 2013 at 08:04:00AM -0400, Scott Kitterman wrote: These are real-life viruses that should not be distributed using Debian's FTP server (IMHO). This comes up periodically. They aren't real. It would appear they're real enough to

Re: download of source packages alarmed clamav

2013-06-25 Thread Jakub Wilk
* Scott Kitterman deb...@kitterman.com, 2013-06-25, 08:04: These are real-life viruses that should not be distributed using Debian's FTP server (IMHO). This comes up periodically. They aren't real. I hope so! Do we even have any real viruses that are DFSG-free? -- Jakub Wilk -- To

Re: download of source packages alarmed clamav

2013-06-25 Thread Chow Loong Jin
On Tue, Jun 25, 2013 at 11:04:40AM -0700, Austin English wrote: [...] FYI, some Windows viruses work under Wine (which can do whatever your normal user can do, unless you're using AppArmor or something similar to restrict it). That's not entirely true -- a Windows-based keylogger wouldn't