ClamAV Signature Retirement Announcement

--===============4919099683494297709==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_DM6PR11MB47376A062047A22F27BB6BF6B2D7ADM6PR11MB4737namp_"

--_000_DM6PR11MB47376A062047A22F27BB6BF6B2D7ADM6PR11MB4737namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

ClamAV was first introduced in 2002; since then, the signature set has grow=
n without bound, delivering as many detections as possible to the community=
. Due to continually increasing database sizes and user adoption, we are fa=
ced with significantly increasing costs of distributing the signature set t=
o the community.
To address the issue, Cisco Talos has been working to evaluate the efficacy=
 and relevance of older signatures. Signatures which no longer provide valu=
e to the community, based on today=92s security landscape, will be retired.
We are making this announcement as an advisory that our first pass of this =
retirement effort will affect a significant drop in database size for both =
the daily.cvd and main.cvd.
Our goal is to ensure that detection content is targeted to currently activ=
e threats and campaigns. We will judge this based on signature matches seen=
 in our, and our partners, data feeds over an extended period of time. We w=
ill continue to evaluate detection prevalence for retired signatures and wi=
ll restore any signatures to the active signature set as needed to protect =
the community. Going forwards, we will continue to curate the signature set=
 to match the security landscape. This may result in further reductions in =
the total number of signatures included in the signature set alongside the =
normal growth that comes from new added coverage.

These are the impacts on signature database sizes you can expect from the f=
irst pass:
File Name
September 2025
December 2025 after retirement of signatures
main.cvd
163 MB
~80 MB
daily.cvd
62 MB
~22 MB

In addition to the reduction in size of the signature set, we will also beg=
in to remove container images from Docker Hub. We are doing this to remove =
container images which may contain vulnerabilities either in ClamAV or in t=
he base image, and to reduce the burden on Docker Hub itself, which present=
ly hosts over 300 GiB of ClamAV container images.
When complete, we will only provide container images on Docker Hub for the =
supported versions of ClamAV. At this time, these will include:
Release
Tags
1.5
1.5, 1.5.1, latest, stable
1.4 LTS
1.4, 1.4.3
1.0 LTS
1.0, 1.0.9

We recommend that ClamAV container image users select a feature release tag=
 rather than a specific minor release tag in order to stay up to date with =
security and bug fixes.

ClamAV Signature Retirement Open Source FAQ:

What if bad actors begin to reuse old malware and old exploits?
Our team is committed to reintroducing any signature based on the activity =
of bad actors in a timely fashion.

Can open-source users access the signatures that have been retired from mai=
n.cvd?
We intend to make the retired signatures available at a later date for rese=
archers and corner cases

Is this an ongoing process?
Cisco Talos will continue to curate the signature set and may retire signat=
ures as they lose relevance to today=92s security landscape.
How will open source Users benefit from these changes?
Smaller file downloads come with inherent advantages, but unbound growth is=
 not sustainable and we already have outgrown resource needs for scanning o=
n some server configurations. We anticipate a noticeable RAM usage reductio=
n for the ClamAV engine, possibly by as much as 25%.

When will users see a change in file sizes?
Signature retirement and the file size reduction will begin on December 16t=
h , 2025.
Users will notice that the main.cvd and daily.cvd will be roughly 50% small=
er than they have seen prior to that date.


If you have any questions please ask here or join our ClamAV discord:
https://discord.gg/K5jjC9Td

Thanks.

--_000_DM6PR11MB47376A062047A22F27BB6BF6B2D7ADM6PR11MB4737namp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
ClamAV was first introduced in 2002; since then, the signature set has grow=
n without bound, delivering as many detections as possible to the community=
. Due to continually increasing database sizes and user adoption, we are fa=
ced with significantly increasing
 costs of distributing the signature set to the community.</div>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
To address the issue, Cisco Talos has been working to evaluate the efficacy=
 and relevance of older signatures. Signatures which no longer provide valu=
e to the community, based on today=92s security landscape, will be retired.=
</div>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
We are making this announcement as an advisory that our first pass of this =
retirement effort will affect a significant drop in database size for both =
the daily.cvd and main.cvd.</div>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
Our goal is to ensure that detection content is targeted to currently activ=
e threats and campaigns. We will judge this based on signature matches seen=
 in our, and our partners, data feeds over an extended period of time. We w=
ill continue to evaluate detection
 prevalence for retired signatures and will restore any signatures to the a=
ctive signature set as needed to protect the community. Going forwards, we =
will continue to curate the signature set to match the security landscape. =
This may result in further reductions
 in the total number of signatures included in the signature set alongside =
the normal growth that comes from new added coverage.</div>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
<br>
These are the impacts on signature database sizes you can expect from the f=
irst pass:</div>
<table style=3D"direction: ltr; text-align: left; color: rgb(68, 68, 68); b=
ox-sizing: border-box; border-collapse: collapse; border-spacing: 0px;" cel=
lpadding=3D"0" cellspacing=3D"0">
<tbody>
<tr>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.7pt; height: 42.35pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
File Name</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.7pt; height: 42.35pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
September 2025&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.8pt; height: 42.35pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
December 2025 after retirement of signatures</div>
</td>
</tr>
<tr>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.7pt; height: 14.1pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
main.cvd</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.7pt; height: 14.1pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
163 MB</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.8pt; height: 14.1pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
~80 MB</div>
</td>
</tr>
<tr>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.7pt; height: 14.1pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
daily.cvd</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.7pt; height: 14.1pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
62 MB</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 147.8pt; height: 14.1pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
~22 MB</div>
</td>
</tr>
</tbody>
</table>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
&nbsp;</div>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
In addition to the reduction in size of the signature set, we will also beg=
in to remove container images from Docker Hub. We are doing this to remove =
container images which may contain vulnerabilities either in ClamAV or in t=
he base image, and to reduce the
 burden on Docker Hub itself, which presently hosts over 300&nbsp;GiB of Cl=
amAV container images.</div>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
When complete, we will only provide container images on Docker Hub for the =
supported versions of ClamAV. At this time, these will include:</div>
<table style=3D"direction: ltr; text-align: left; color: rgb(68, 68, 68); b=
ox-sizing: border-box; border-collapse: collapse; border-spacing: 0px;" cel=
lpadding=3D"0" cellspacing=3D"0">
<tbody>
<tr>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 3.25in; height: 15pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
Release</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 3.25in; height: 15pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
Tags</div>
</td>
</tr>
<tr>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 3.25in; height: 15pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
1.5</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 3.25in; height: 15pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
1.5, 1.5.1, latest, stable</div>
</td>
</tr>
<tr>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 3.25in; height: 15pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
1.4 LTS</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 3.25in; height: 15pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
1.4, 1.4.3</div>
</td>
</tr>
<tr>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 3.25in; height: 15pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
1.0 LTS</div>
</td>
<td style=3D"direction: ltr; text-align: left; padding: 0in; vertical-align=
: top; width: 3.25in; height: 15pt;">
<div style=3D"direction: ltr; text-align: left; line-height: normal; margin=
-top: 1em; margin-bottom: 0in; font-family: Aptos, Aptos_EmbeddedFont, Apto=
s_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rg=
b(0, 0, 0);">
1.0, 1.0.9</div>
</td>
</tr>
</tbody>
</table>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
&nbsp;</div>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
We recommend that ClamAV container image users select a feature release tag=
 rather than a specific minor release tag
<a name=3D"x__Int_V7pQPgA5">in order to</a>&nbsp;stay up to date with secur=
ity and bug fixes.</div>
<div style=3D"direction: ltr; text-align: left; text-indent: 0px; margin-to=
p: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_M=
SFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0=
, 0, 0);">
<br>
ClamAV Signature Retirement Open Source FAQ:<br>
<br>
What if bad actors begin to reuse old malware and old exploits?<br>
Our team is committed to reintroducing any signature based on the activity =
of bad actors in a timely fashion.<br>
<br>
Can open-source users access the signatures that have been retired from mai=
n.cvd?<br>
We intend to make the retired signatures available at a later date for rese=
archers and corner cases<br>
<br>
Is this an ongoing process?<br>
Cisco Talos will continue to curate the signature set and may retire signat=
ures as they lose relevance to today=92s security landscape.</div>
<div style=3D"direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos=
_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=
(0, 0, 0);">
How will open source Users benefit from these changes?<br>
Smaller file downloads come with inherent advantages, but unbound growth is=
 not sustainable and we already have outgrown resource needs for scanning o=
n some server configurations. We anticipate a noticeable RAM usage reductio=
n for the ClamAV engine, possibly
 by as much as 25%.<br>
<br>
When will users see a change in file sizes?<br>
Signature retirement and the file size reduction will begin on December 16t=
h&nbsp;, 2025.<br>
Users will notice that the main.cvd and daily.cvd will be roughly 50% small=
er than they have seen prior to that date.</div>
<div style=3D"direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos=
_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=
(0, 0, 0);">
<br>
<br>
If you have any questions please ask here or join our ClamAV discord:</div>
<div style=3D"direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos=
_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=
(0, 0, 0);">
<a data-auth=3D"NotApplicable" class=3D"OWAAutoLink" id=3D"OWAfb4855bd-2567=
-a00c-68c8-8711c492042b" href=3D"https://discord.gg/K5jjC9Td">https://disco=
rd.gg/K5jjC9Td</a><br>
<br>
Thanks.</div>
</body>
</html>

--_000_DM6PR11MB47376A062047A22F27BB6BF6B2D7ADM6PR11MB4737namp_--

--===============4919099683494297709==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________

clamav-announce mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-announce

http://www.clamav.net/contact.html#ml

--===============4919099683494297709==--