Which repository "should" I install clamav from?

AlucardZero · 07-24-2007, 11:42 AM

I'm running a mail server that uses clamav to scan for viruses. It's been complaining for at least a week that my installation is outdated, so I've been waiting for the new version to make it into the repositories. I have it installed from volatile (which has a pin priority of 990 in /etc/apt/preferences). But I looked today, and unstable is at version 0.91.1-1, while volatile is at 0.90.3-1~volatile1 (and testing is at 0.90.1-3.1lenny3).

I'm running a very slightly mixed system, Etch with a dash of Lenny, with a dash of volatile. I was under the impression that I should be running clamav from volatile; is that right?

JimBass · 07-24-2007, 10:56 PM

Not necessarily. Personally I wouldn't mix installations on a production server, but that choice is yours.

Clamav will always complain when it is not the newest version. You either need to be comfortable enough with installing from source to upgrade as soon as it released, or install it from unstable. I don't know what the volatile repository is, but it isn't a mainline Debian thing. The only 3 "official" versions are stable (Etch), testing (Lenny) and unstable (Sid). There is also experimental, but that is only for those very much into bug hunting. In any case, volatile is either somebodies home brew somewhere in between unstable and testing, or something else not quite approved.

Personally, I would revert to the Etch version of clamav. It will still complain about not being the newest, but the Etch update team will have it in essence back ported into the Etch package. That basically allows you to ignore the warnings, as the Etch guys will handle everything for you.

Peace,
JimBass

farslayer · 07-25-2007, 08:36 AM

I would use Volatile for ClamAV, at least on a Debian Stable system.. the normal repositories will not be updated as frequently as volatile will..

http://lists.clamav.net/lurker/messa...41a2e9.it.html

AlucardZero · 07-25-2007, 09:37 AM

JimBass, http://www.debian.org/volatile/

farslayer, thanks, though I'm still wondering what's taking so long for this new version to get into volatile, and if the delay is normal.

farslayer · 07-25-2007, 11:35 AM

Because if you are running a production server you utilize the STABLE versions from Debian.
Volatile allows you to get the Signature updates faster than waiting for them to his the Debian repositories..

Code:

mail:~# apt-cache policy clamav
clamav:
  Installed: 0.90.2-1~volatile1
  Candidate: 0.90.3-1~volatile1
  Version table:
     0.90.3-1~volatile1 0
        500 http://volatile.debian.net stable/volatile/main Packages
 *** 0.90.2-1~volatile1 0
        100 /var/lib/dpkg/status
     0.90.1-3etch4 0
        500 http://security.debian.org etch/updates/main Packages
     0.90.1-2 0
        500 http://ftp.uwsg.indiana.edu etch/main Packages

You are comparing stable versions to Unstable versions. Even though a package is in the Volatile repository doesn't mean it's going to be pulling a version from the Unstable branch. yes the stable will always lag in version number but you can be pretty sure it's not going to crash on you..

I never did understand the need for unnecessarily mixing systems between different versions.

JimBass · 07-25-2007, 11:52 PM

Well, I learned something new. Cool, thanks guys.

Peace,
JimBass