carlos / platform Public

| Finding | Disposition | Reason | |---|---|---| | 9 | Closed for the specified 100 MiB configuration | The recorded real-engine results address the reported truncation. Source inspection supports them: ClamAV accounts for the enclosing archive before checking the extracted member’s size, and checks limits before consulting the clean cache. See scanners.c:3918 and others.c:1081. | | 7, remaining part | Explicitly deferred, not fixed | §11 acknowledges that increasing limits does not retry unchanged skipped objects. That matches internal/objstore/clamav.go:249–258. This is an identified follow-up outside the initial rollout, not a new finding. |

Reviewed 51985b0d. No files changed or live scans performed.

1. P2 — §§3.2, 6.3, 8: A failed self-test does not prevent the scanner passing the rollout’s readiness checks.

Step 6 starts clamd before step 7 runs the self-test. Exiting the bootstrap script non-zero does not stop that already-running service; cloud-init’s user-data stage does not block boot. See cloud-init’s final-stage documentation.

The subsequent checks cannot distinguish this state from success: internal/objstore/clamav.go:108 obtains provenance using only VERSION; internal/console/apisystem.go:85 uses that for status; enable checks only that a scanner is wired at line 133.

Consequently, an engine that returns OK for an over-limit fixture can fail its self-test yet remain reachable, report fresh signatures, and pass Tito’s prescribed status/enable proof. Withholding the script’s final version line does not close this path.

Fix: Require successful bootstrap and self-test completion on each scanner instance before §6 wiring, including Tito. Make self-test failure stop the scanner and prevent it restarting into service without a successful test.

1. P2 — §§3.2–3.4: Fixed-size fixtures reject valid non-default limits.

§3.3 permits max_scan_bytes = 33554432 with the default 25 MiB stream limit. But §3.4 requires the ZIP containing one 60 MiB member to return OK. With both engine limits at 32 MiB, its extraction instead encounters the limit: libclamav/unzip.c:209–227 trims the member, and libclamav/others.c:1081–1086 reports the exhausted aggregate budget.

A correctly configured scanner therefore fails the mandatory self-test for an explicitly permitted module input. The recorded expectations apply to the 100 MiB default, not the full variable contract.

Fix: Derive fixture sizes and expected outcomes from the configured limits, keeping compressed streams below stream_max_bytes; alternatively, restrict this release to the tested limits.

Verdict: accept with fixes.