| 1 | | Finding | Disposition | Reason | |
| 2 | |---|---|---| |
| 3 | | 9 | **Closed for the specified 100 MiB configuration** | The recorded real-engine results address the reported truncation. Source inspection supports them: ClamAV accounts for the enclosing archive before checking the extracted member’s size, and checks limits before consulting the clean cache. See [`scanners.c:3918`](https://github.com/Cisco-Talos/clamav/blob/clamav-1.4.3/libclamav/scanners.c#L3918) and [`others.c:1081`](https://github.com/Cisco-Talos/clamav/blob/clamav-1.4.3/libclamav/others.c#L1081-L1126). | |
| 4 | | 7, remaining part | **Explicitly deferred, not fixed** | §11 acknowledges that increasing limits does not retry unchanged `skipped` objects. That matches `internal/objstore/clamav.go:249–258`. This is an identified follow-up outside the initial rollout, not a new finding. | |
| 5 | |
| 6 | Reviewed `51985b0d`. No files changed or live scans performed. |
| 7 | |
| 8 | 10. **P2 — §§3.2, 6.3, 8: A failed self-test does not prevent the scanner passing the rollout’s readiness checks.** |
| 9 | |
| 10 | Step 6 starts clamd before step 7 runs the self-test. Exiting the bootstrap script non-zero does not stop that already-running service; cloud-init’s user-data stage does not block boot. See [cloud-init’s final-stage documentation](https://docs.cloud-init.io/en/latest/explanation/boot.html#final). |
| 11 | |
| 12 | The subsequent checks cannot distinguish this state from success: [`internal/objstore/clamav.go:108`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/scanner-host/internal/objstore/clamav.go:108) obtains provenance using only `VERSION`; [`internal/console/apisystem.go:85`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/scanner-host/internal/console/apisystem.go:85) uses that for status; enable checks only that a scanner is wired at line 133. |
| 13 | |
| 14 | Consequently, an engine that returns `OK` for an over-limit fixture can fail its self-test yet remain reachable, report fresh signatures, and pass Tito’s prescribed `status`/`enable` proof. Withholding the script’s final version line does not close this path. |
| 15 | |
| 16 | **Fix:** Require successful bootstrap and self-test completion on each scanner instance before §6 wiring, including Tito. Make self-test failure stop the scanner and prevent it restarting into service without a successful test. |
| 17 | |
| 18 | 11. **P2 — §§3.2–3.4: Fixed-size fixtures reject valid non-default limits.** |
| 19 | |
| 20 | §3.3 permits `max_scan_bytes = 33554432` with the default 25 MiB stream limit. But §3.4 requires the ZIP containing one 60 MiB member to return `OK`. With both engine limits at 32 MiB, its extraction instead encounters the limit: [`libclamav/unzip.c:209–227`](https://github.com/Cisco-Talos/clamav/blob/clamav-1.4.3/libclamav/unzip.c#L209-L227) trims the member, and [`libclamav/others.c:1081–1086`](https://github.com/Cisco-Talos/clamav/blob/clamav-1.4.3/libclamav/others.c#L1081-L1086) reports the exhausted aggregate budget. |
| 21 | |
| 22 | A correctly configured scanner therefore fails the mandatory self-test for an explicitly permitted module input. The recorded expectations apply to the 100 MiB default, not the full variable contract. |
| 23 | |
| 24 | **Fix:** Derive fixture sizes and expected outcomes from the configured limits, keeping compressed streams below `stream_max_bytes`; alternatively, restrict this release to the tested limits. |
| 25 | |
| 26 | **Verdict: accept with fixes.** |
amadan