{"id":6338,"library":"cvdupdate","title":"ClamAV Private Database Mirror Updater Tool","description":"cvdupdate is a command-line tool designed to facilitate the creation and maintenance of private mirrors for ClamAV antivirus databases. It efficiently downloads the latest ClamAV signature databases (CVDs) and associated patch files (CDIFFs), replacing the older `clamdownloader.pl` script. The library is actively maintained, with its current version being 1.2.0, and receives regular updates to support new ClamAV features and address bug fixes.","status":"active","version":"1.2.0","language":"en","source_language":"en","source_url":"https://github.com/Cisco-Talos/cvdupdate","tags":["ClamAV","antivirus","mirror","update","security","CLI","database"],"install":[{"cmd":"pip install cvdupdate","lang":"bash","label":"Install via pip"}],"dependencies":[{"reason":"Command-line interface toolkit.","package":"click","optional":false},{"reason":"Colored logging output.","package":"colorlog","optional":false},{"reason":"Cross-platform colored terminal text.","package":"colorama","optional":false},{"reason":"HTTP client for downloading files.","package":"requests","optional":false},{"reason":"DNS query operations.","package":"dnspython","optional":false},{"reason":"Internal test HTTP server.","package":"rangehttpserver","optional":false},{"reason":"Version parsing and comparison.","package":"packaging","optional":false}],"imports":[{"note":"Invoke using `cvd` command or `python -m cvdupdate`.","symbol":"cvdupdate","correct":"This library is primarily used as a command-line tool, not typically imported programmatically."}],"quickstart":{"code":"# Install cvdupdate (if not already installed)\npip install cvdupdate\n\n# Run the update command to download ClamAV databases\ncvd update\n\n# (Optional) Serve the downloaded databases for testing (not production)\ncvd serve\n\n# (Optional) Configure database directory\ncvd config set --dbdir /path/to/your/mirror","lang":"bash","description":"This quickstart demonstrates how to install `cvdupdate` and use its primary command to download ClamAV database files. It also includes optional commands to serve the databases locally for testing purposes and to customize the database storage location."},"warnings":[{"fix":"Adjust scripts or logging configurations to capture stdout for informational/debug messages. Consider redirecting stdout/stderr explicitly if needed.","message":"As of v1.1.3, info-level and debug-level messages are directed to stdout instead of stderr. This change can impact existing scripts or logging configurations that differentiate between stdout and stderr.","severity":"gotcha","affected_versions":">=1.1.3"},{"fix":"Avoid excessively frequent updates. The tool is designed to only download new content when available, so frequent execution without new content is generally safe, but forced re-downloads (like after `cvd clean all`) should be spaced out.","message":"Running `cvd clean all` followed by `cvd update` too frequently (e.g., repeatedly in quick succession) can result in the official ClamAV database servers temporarily refusing download requests due to rate-limiting. This can cause databases to enter a 'cool-down' period.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Review any custom logging configurations or programmatic interactions that might have implicitly relied on the `coloredlogs` library's presence or behavior. The change is generally transparent for command-line usage.","message":"In version 1.2.0, `cvdupdate` migrated its internal logging dependency from `coloredlogs` (unmaintained) to `colorlog`. While this is primarily an internal change, users relying on specific behaviors or customizations of the `coloredlogs` dependency might observe subtle differences, particularly if they were using internal logging mechanisms of `cvdupdate`.","severity":"breaking","affected_versions":">=1.2.0"},{"fix":"Be aware of this change if you manage `cvdupdate`'s configuration files manually or with external configuration management tools. Ensure your tools account for the new `state.json` file.","message":"For users upgrading from versions prior to 1.1.0 (specifically from 1.0.2), the configuration file (`config.json`) was automatically migrated and split into `config.json` and `state.json` upon running `cvd update`. This was done to separate database state from user configuration, allowing for easier management with configuration tools.","severity":"gotcha","affected_versions":"<1.1.0 to 1.1.0 upgrade path"},{"fix":"Utilize `freshclam` for direct client updates. Only use `cvdupdate` when setting up a centralized private mirror for multiple ClamAV clients.","message":"It is important to NOT use `cvdupdate` if you do not need to host a private database mirror. For direct updates on individual ClamAV clients, `freshclam` is significantly more efficient as it can update using small CDIFF patches. `cvdupdate`, conversely, downloads both the new daily CDIFF and the entire daily CVD.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"last_verified":"2026-04-15T00:00:00.000Z","next_check":"2026-07-14T00:00:00.000Z"}