fix: expand the bounded ClamAV budget for init binaries #128

Merged

gitchegumi merged 1 commit from kiyi/clamav-expanded-limit-diagnostics into main

2026-10-18 15:53:10 -05:00

kiyi commented

2026-10-18 15:41:03 -05:00

Member

Base-images run 300 used promoted workflows v1.46.4 and correctly rejected the incomplete Zarf-agent malware scan. The 195,354,784-byte stripped Zarf binary still exceeds MaxScanSize at 4096M. Its retained image decision has zero unmitigated findings, the existing exact GO exception, a completed SBOM and one blocking ClamAV error.

Raise the finite expanded-content accounting budget to 16384M in both clamscan and clamd. ClamAV counts recursive content and repeated scans under different detected types separately from raw file size (upstream explanation). Keep MaxFileSize 2000M, time/recursion/file-count limits, two workers, bounded staging and image export/total limits unchanged. Incomplete scans continue to fail; there is no skip, exception or automatic retry. Report configured_limit_bytes for MaxScanSize failures and show the allowance at image-engine startup without publishing raw scanner logs.

Validation: 41 focused scanner/report regressions pass; the real pinned Trivy converter test is skipped locally and remains required in Library checks. The existing scaffold check passes 16 mocked success/finding/error/version cases. Fatal/undefined-name lint, diff checks and the active Gitleaks hook pass. Workflow/job/status names and the owner-approved GO selectors are unchanged.

This proposes more headroom; it does not establish that 16 GiB is sufficient. After review and release/promotion, the actual base-images PR #56 candidate must complete with clean ClamAV evidence and zero blocking findings, malware warnings and scanner errors before approval/publication. The acceptance gap from the outstanding review remains open.

[Base-images run 300](https://git.gitchegumi.com/Homelab/base-images/actions/runs/300/jobs/7/attempt/1) used promoted workflows v1.46.4 and correctly rejected the incomplete Zarf-agent malware scan. The 195,354,784-byte stripped Zarf binary still exceeds MaxScanSize at 4096M. Its retained image decision has zero unmitigated findings, the existing exact GO exception, a completed SBOM and one blocking ClamAV error. Raise the finite expanded-content accounting budget to 16384M in both clamscan and clamd. ClamAV counts recursive content and repeated scans under different detected types separately from raw file size ([upstream explanation](https://github.com/Cisco-Talos/clamav-large-archive-scanner#readme)). Keep MaxFileSize 2000M, time/recursion/file-count limits, two workers, bounded staging and image export/total limits unchanged. Incomplete scans continue to fail; there is no skip, exception or automatic retry. Report configured_limit_bytes for MaxScanSize failures and show the allowance at image-engine startup without publishing raw scanner logs. Validation: 41 focused scanner/report regressions pass; the real pinned Trivy converter test is skipped locally and remains required in Library checks. The existing scaffold check passes 16 mocked success/finding/error/version cases. Fatal/undefined-name lint, diff checks and the active Gitleaks hook pass. Workflow/job/status names and the owner-approved GO selectors are unchanged. This proposes more headroom; it does not establish that 16 GiB is sufficient. After review and release/promotion, the actual [base-images PR #56](https://git.gitchegumi.com/Homelab/base-images/pulls/56) candidate must complete with clean ClamAV evidence and zero blocking findings, malware warnings and scanner errors before approval/publication. The acceptance gap from [the outstanding review](https://git.gitchegumi.com/Homelab/base-images/pulls/56#issuecomment-7358) remains open.

kiyi added 1 commit

2026-10-18 15:41:03 -05:00

fix: allow bounded expanded scans of large init binaries

Workflow acceptance / acceptance (pull_request) Successful in 1m44s

Details

Repository security / security-1 (pull_request) Successful in 2m43s

Details

Library checks / tests (pull_request) Successful in 7m37s

Details

d8f48f7678

portegumi approved these changes

2026-10-18 15:42:58 -05:00

portegumi left a comment

Reviewed the exact-head malware scanner, its changed focused tests, and security documentation. Both standalone clamscan and per-image clamd use the same finite 16384M expanded-content limit while MaxFileSize remains 2000M, staging/export limits and the two-worker daemon remain bounded, and limit/error outcomes still fail closed. MaxScanSize diagnostics report the configured byte allowance without exposing raw scanner logs. This is source approval only: 16 GiB is not proven sufficient for the Zarf candidate. Workflow acceptance, Repository security, and Library checks were pending at review time; their required results and a subsequent clean real base-images candidate scan remain separate acceptance gates. This change does not cross a UDS deployment, policy or routing boundary. Forgejo's changed-files API omitted patch hunks; review used authenticated exact-head contents of all four changed files.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.