On 02/04/2010 12:21 PM, [email protected] wrote: > Hi, > > I have to download manually the daily.cvd file from the ClamAV internet > website > in order to update a server that is not connected to the Internet. > But due to security reasons, I'd like to check the md5 sum of this file. It > seems that no md5 hash are available. > The sigtool command seems to be safe but the workstation where I must download > the file is a Windows PC without this command. > > I'm looking for any good ideas ;-) ! >
The CVD includes the md5, and a digital signature of it. libclamav checks the md5 and digital signature of the cvd when loading it. You can use clamscan --debug, and you should see something like this for main.cvd: LibClamAV debug: MD5(.tar.gz) = 4e3fb7ff64c71cd4b79147ac30a382d3 LibClamAV debug: cli_versig: Decoded signature: 4e3fb7ff64c71cd4b79147ac30a382d3 LibClamAV debug: cli_versig: Digital signature is correct. That needs ClamAV 0.95 (which embeds libtommath), or a ClamAV <0.95 built with libgmp support. Best regards, --Edwin _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
