fix: make incomplete ClamAV scans nonblocking #130

Merged

gitchegumi merged 1 commit from kiyi/clamav-advisory-failures into main

2026-10-18 18:49:47 -05:00

kiyi commented

2026-10-18 18:38:17 -05:00

Member

Base-images run 304 stopped image delivery because ClamAV hit MaxFileSize while inspecting the 195 MB Zarf binary, although the vulnerability scan and SBOM completed. This implements the owner’s explicit request to retain ClamAV but make incomplete scans nonblocking. ClamAV is still attempted; size/processing limits, timeouts, missing signatures and engine/export failures are recorded as advisory coverage gaps.

Actual malware detections remain blocking. A completed scan that finds malware fails the gate. Detections already reported before another scan error also remain blocking. Vulnerability, secret, IaC, SAST, other scanner-error and SBOM gates are unchanged. The existing timeout and resource protections stay in place; no workflow/job/status names or approved GO selectors change.

Full-image and application-layer failures retain status: incomplete, reused: false and malware_warnings with blocking: false. Job logs and the top of the report prominently say that malware coverage is incomplete and include the failure reason. Incomplete results never become clean reusable evidence. The downstream package-image gate accepts only matching explicit advisory records; missing, skipped or infected outcomes, other scanner errors and missing/invalid SBOMs still fail.

Validation: 51 local scanner/report/package-image tests pass, including completed malware detections, partial detections alongside scan failure, nonblocking MaxFileSize/timeouts, continued scans/SBOMs for later images, and rejection of missing core evidence. One real Trivy-converter integration test is skipped locally and remains required in hosted Library checks. All 16 scaffold cases, fatal/undefined-name lint, diff checks and the active Gitleaks hook pass.

After review, release/promote this library change and rerun base-images PR #56. Hosted checks remain pending; this PR does not claim a clean ClamAV scan of that image or publish/deploy it.

[Base-images run 304](https://git.gitchegumi.com/Homelab/base-images/actions/runs/304/jobs/7/attempt/1) stopped image delivery because ClamAV hit MaxFileSize while inspecting the 195 MB Zarf binary, although the vulnerability scan and SBOM completed. This implements the owner’s explicit request to retain ClamAV but make incomplete scans nonblocking. ClamAV is still attempted; size/processing limits, timeouts, missing signatures and engine/export failures are recorded as advisory coverage gaps. **Actual malware detections remain blocking.** A completed scan that finds malware fails the gate. Detections already reported before another scan error also remain blocking. Vulnerability, secret, IaC, SAST, other scanner-error and SBOM gates are unchanged. The existing timeout and resource protections stay in place; no workflow/job/status names or approved GO selectors change. Full-image and application-layer failures retain `status: incomplete`, `reused: false` and `malware_warnings` with `blocking: false`. Job logs and the top of the report prominently say that malware coverage is incomplete and include the failure reason. Incomplete results never become clean reusable evidence. The downstream package-image gate accepts only matching explicit advisory records; missing, skipped or infected outcomes, other scanner errors and missing/invalid SBOMs still fail. Validation: 51 local scanner/report/package-image tests pass, including completed malware detections, partial detections alongside scan failure, nonblocking MaxFileSize/timeouts, continued scans/SBOMs for later images, and rejection of missing core evidence. One real Trivy-converter integration test is skipped locally and remains required in hosted Library checks. All 16 scaffold cases, fatal/undefined-name lint, diff checks and the active Gitleaks hook pass. After review, release/promote this library change and rerun [base-images PR #56](https://git.gitchegumi.com/Homelab/base-images/pulls/56). Hosted checks remain pending; this PR does not claim a clean ClamAV scan of that image or publish/deploy it.

kiyi added 1 commit

2026-10-18 18:38:17 -05:00

fix: make incomplete ClamAV scans advisory

Workflow acceptance / acceptance (pull_request) Successful in 1m47s

Details

Repository security / security-1 (pull_request) Successful in 2m17s

Details

Library checks / tests (pull_request) Successful in 10m19s

Details

48a76c8aaf

portegumi approved these changes

2026-10-18 18:39:54 -05:00

portegumi left a comment

Reviewed exact head 48a76c8aaf. The scanner preserves reported ClamAV detections as mandatory blockers, records unsuccessful full-image/application-layer scans as non-reusable incomplete evidence with explicit non-blocking diagnostics, and continues SBOM generation; the package-image gate requires matching incomplete warnings plus passing non-malware gates and SBOM files. The changed tests cover partial detections, MaxFileSize/timeout/database failures, multi-image continuation, and rejection of missing core evidence. This is a library security-policy change, not a UDS deployment/routing/manifest change; no UDS gateway or bundle modification is implicated. Source review approved; Workflow acceptance, Repository security, and Library checks are pending at this head and remain required before merge or promotion. I did not independently execute local tests or verify a released consumer.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed exact head 48a76c8aaf0a718cd4609c0566a792e57a8b284b. The scanner preserves reported ClamAV detections as mandatory blockers, records unsuccessful full-image/application-layer scans as non-reusable incomplete evidence with explicit non-blocking diagnostics, and continues SBOM generation; the package-image gate requires matching incomplete warnings plus passing non-malware gates and SBOM files. The changed tests cover partial detections, MaxFileSize/timeout/database failures, multi-image continuation, and rejection of missing core evidence. This is a library security-policy change, not a UDS deployment/routing/manifest change; no UDS gateway or bundle modification is implicated. Source review approved; Workflow acceptance, Repository security, and Library checks are pending at this head and remain required before merge or promotion. I did not independently execute local tests or verify a released consumer. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.