fix: remove cumulative ClamAV scan-size cap #129

Merged

gitchegumi merged 1 commit from kiyi/clamav-remove-scan-size-cap into main

2026-10-18 16:45:15 -05:00

kiyi commented

2026-10-18 16:39:17 -05:00

Member

The 195 MB Zarf binary in base-images run 302 exceeded ClamAV’s cumulative 16 GiB processing allowance, preventing a complete image scan. Following the owner’s explicit request, set --max-scansize=0 for clamscan and MaxScanSize 0 for clamd. This removes only the aggregate expansion/repeated-scan cap.

Explicitly retain the existing two-minute per-input engine timeout with --max-scantime=120000 / MaxScanTime 120000. Preserve the per-file cap, image file/total/export bounds, recursion/file-count defaults, bounded batches, two workers, four-item queue, symlink protections, private socket and cleanup. The 180-minute overall job timeout stays unchanged. Malware detections, timeouts, remaining limit failures, scanner errors and incomplete image scans still block; no approved GO selectors or workflow/job/status names change. Diagnostics use configured_limit_bytes: 0 for the disabled cap.

Validation: 41 focused scanner/report regressions pass in WSL; one real Trivy-converter integration test is skipped locally and remains required in hosted Library checks. The existing scaffold check passes all 16 mocked cases. Fatal/undefined-name lint, diff checks and the active Gitleaks hook pass.

Hosted CI and a real candidate image scan remain required. After review, release and promote this library change, then rerun base-images PR #56. This PR prepares the change; no release, scan dispatch or image publication has been performed.

The 195 MB Zarf binary in [base-images run 302](https://git.gitchegumi.com/Homelab/base-images/actions/runs/302/jobs/7/attempt/1) exceeded ClamAV’s cumulative 16 GiB processing allowance, preventing a complete image scan. Following the owner’s explicit request, set `--max-scansize=0` for clamscan and `MaxScanSize 0` for clamd. This removes only the aggregate expansion/repeated-scan cap. Explicitly retain the existing two-minute per-input engine timeout with `--max-scantime=120000` / `MaxScanTime 120000`. Preserve the per-file cap, image file/total/export bounds, recursion/file-count defaults, bounded batches, two workers, four-item queue, symlink protections, private socket and cleanup. The 180-minute overall job timeout stays unchanged. Malware detections, timeouts, remaining limit failures, scanner errors and incomplete image scans still block; no approved GO selectors or workflow/job/status names change. Diagnostics use `configured_limit_bytes: 0` for the disabled cap. Validation: 41 focused scanner/report regressions pass in WSL; one real Trivy-converter integration test is skipped locally and remains required in hosted Library checks. The existing scaffold check passes all 16 mocked cases. Fatal/undefined-name lint, diff checks and the active Gitleaks hook pass. Hosted CI and a real candidate image scan remain required. After review, release and promote this library change, then rerun [base-images PR #56](https://git.gitchegumi.com/Homelab/base-images/pulls/56). This PR prepares the change; no release, scan dispatch or image publication has been performed.

kiyi added 1 commit

2026-10-18 16:39:17 -05:00

fix: remove cumulative ClamAV scan size cap

Workflow acceptance / acceptance (pull_request) Successful in 1m24s

Details

Repository security / security-1 (pull_request) Successful in 3m54s

Details

Library checks / tests (pull_request) Successful in 4m31s

Details

ff8e30bb14

portegumi approved these changes

2026-10-18 16:40:51 -05:00

portegumi left a comment

Reviewed exact head ff8e30bb14. The standalone clamscan and per-image clamd paths both set the cumulative MaxScanSize to 0 while explicitly keeping MaxScanTime at 120000 ms and MaxFileSize at 2000M; batching, image export/total limits, two-worker/four-queue bounds, symlink restrictions and fail-closed limit/error handling remain in the inspected source. Focused tests assert both scanner configurations and retained rejection behavior. This is a malware-scanner library change, not a UDS deployment, admission, policy, or route change. Source review approved; Library checks, workflow acceptance and repository-security checks remain pending, and a real image candidate scan/release are separate acceptance gates. No merge authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed exact head ff8e30bb14b13d3d5c7784318f18ff326ddc4e74. The standalone clamscan and per-image clamd paths both set the cumulative MaxScanSize to 0 while explicitly keeping MaxScanTime at 120000 ms and MaxFileSize at 2000M; batching, image export/total limits, two-worker/four-queue bounds, symlink restrictions and fail-closed limit/error handling remain in the inspected source. Focused tests assert both scanner configurations and retained rejection behavior. This is a malware-scanner library change, not a UDS deployment, admission, policy, or route change. Source review approved; Library checks, workflow acceptance and repository-security checks remain pending, and a real image candidate scan/release are separate acceptance gates. No merge authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.