clamav: checksum mismatch

[bunk3m (Bunk3m)]

I tried to install clamav today but it errors with following issue listed:

sudo port install clamav
--->  Computing dependencies for clamav
--->  Fetching archive for clamav
--->  Attempting to fetch clamav-0.104.2_0.darwin_17.x86_64.tbz2 from http://packages.macports.org/clamav
--->  Attempting to fetch clamav-0.104.2_0.darwin_17.x86_64.tbz2 from http://ywg.ca.packages.macports.org/mirror/macports/packages/clamav
--->  Attempting to fetch clamav-0.104.2_0.darwin_17.x86_64.tbz2 from http://mse.uk.packages.macports.org/clamav
--->  Fetching distfiles for clamav
--->  Attempting to fetch clamav-0.104.2.tar.gz from http://distfiles.macports.org/clamav
--->  Verifying checksums for clamav
Error: Checksum (rmd160) mismatch for clamav-0.104.2.tar.gz
Error: Checksum (sha256) mismatch for clamav-0.104.2.tar.gz
Error: Checksum (size) mismatch for clamav-0.104.2.tar.gz
***
The non-matching file appears to be HTML. See this page for possible reasons
for the checksum mismatch:
<https://trac.macports.org/wiki/MisbehavingServers>
***
The file has been moved to: /opt/local/var/macports/distfiles/clamav/clamav-0.104.2.tar.gz.html
Error: Failed to checksum clamav: Unable to verify file checksums
Error: See /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_sysutils_clamav/clamav/main.log for details.
Error: Follow https://guide.macports.org/#project.tickets if you believe there is a bug.
Error: Processing of port clamav failed

My concern with the error message is that the files could have been compromised or the checksums not updated.

[bunk3m (Bunk3m)]

I read the misbehaving servers page but it doesn't apply.

[ryandesign (Ryan Carsten Schmidt)]

Replying to bunk3m:

I read the misbehaving servers page but it doesn't apply.

I'll bet it does. What does /opt/local/var/macports/distfiles/clamav/clamav-0.104.2.tar.gz.html contain?

[danielluke (Daniel J. Luke)]

This doesn't appear to be a problem with the clamav port or with macports' distfiles mrirors (ie, curl ​https://distfiles.macports.org/clamav/clamav-0.104.2.tar.gz works just fine). I'm going to close this, but feel free to reopen if you have more information about the problem (especially an answer to Ryan's question above).

[bunk3m (Bunk3m)]

Hi. Sorry for the delay in responding. Just to test, I tried to install it on another Mac at home. I get the same error.

@Ryan - the file in /opt/local/var/macports/distfiles/clamav/ is an html page with contents that says "Virus or bad content detected. Heuristics.Phishing.Email.SSL-Spoof"

So it didn't download anything and so the errors on md5sum etc check.

The error looks like it might be a problem with my server not allowing the download. Since I've fiddled with clamav before, I know that there are virus samples to test the build package. It's quite possible that those virus samples cause my server to block the download.

I downloaded the file with curl. Once I import the gpg key from the clamav.net site, I can verify the download is OK.

Thanks for the help. I'll have to look into this and see if I can whitelist something to allow Macports to download.