[Pkg-clamav-devel] Bug#624380: Bug#624380: Bug#624380: clamav-base: Please package huge example files seperately or move them to clamav-docs

[Stephen Gran]

This one time, at band camp, Axel Beckert said:
> Hi Stephen,
> 
> Stephen Gran wrote:
> > > With the exception of the example configuration file, those files are
> > > probably not needed by the vast majority of the clamav users, yet all of
> > > them have to waste those 26 MB of disk space and download time when
> > > installing e.g. freshclam which has a hard dependency.
> > 
> > We've been around this before, unfortunately.  The problem is that we
> > can't require a network connection for users installing the software,
> > and without these files, the dependencies can end up installing
> > non-functional software.  I'm afraid I don't see any way out of this
> > one.
> 
> Hmm, I then see the following three problems (or just don't understand
> the reasoning for it):

Reading the postinst for clamav-base is a good place to start if you're
not sure what is going on.

> A) Why are files necessary to get a working software installed in
>    /usr/share/_doc_/$package/_examples_? IMHO that's a totally
>    inappropriate location for them.

They are copied into place for use if they are not there.  This is a
compromise with clamav-data, as the maintainer of that package wanted to
ship them in place and didn't want a file clash.  This also ensures that
we don't overwrite a potentially newer downloaded version of the
signatures with what we ship in the package, eg, on a security upgrade.

> B) What is the package clamav-data then for? It has btw. also a size
>    of 26 MB. Coincidence?

This is one of two possible dependencies for clamav.  The other is
freshclam, which needs to provide the files by the time it's postinst
finishes.  If a user chooses to run freshclam as a daemon (the default
answer), the download is not guaranteed to finish by the time
freshclam's postinst exits.

> C) clamav doesn't depend on clamav-base, it just recommends it. Just
>    clamav-freshclam does depend on it, which, according to your
>    arguments, does not need those files as the sole purpose of package
>    is to fetch signature updates via the internet.

clamav will install, but not do very much, in the absence of signatures.
clamav-daemon and clamav-milter will not start in the absence of
signatures.  This is what is being addressed with this arrangement.
Yes, we could ship the signatures with clamav-freshclam, but this means
26MB*<number of arches> in the archive instead of just 26MB.

The current arrangement is a compromise, and possibly not the best one.
If you have a suggestion that satisfies the following, I'd be happy to
work with you on it:
a) an installation of clamav-daemon or clamav-milter will always result
   in signatures being in place for use by the time their postinst runs.
   This means that the relationship to a package containing signatures
   is expressed in Dependencies in the packaging system.
b) installation of signatures must be satisfiable in the archive.
   Network download of the signatures after install cannot be assumed.
c) Putting the signatures into an arch any package instead of an arch
   all package is probably a no-go, as it's an extra 260MB in the
   archive for no real gain.

Cheers,
-- 
 -----------------------------------------------------------------
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran at debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |
 -----------------------------------------------------------------