package clamav-0.105.1_4,1 fails to update signatures

[Stephen Welker]

On 12/1/2023 5:09 pm, Matthew Dillon wrote:
> You can lock a package via 'pkg lock ...' so it won't be overwritten.  
> That's the easiest solution.

So checking the dependancies:

$ pkg query "%dn %dv" clamav-0.105.1_4,1
libxml2 2.10.3
openssl 1.1.1q,1
libmilter 8.17.1
curl 7.86.0
pcre2 10.40
ncurses 6.3
json-c 0.16
unzoo 4.4_2
libmspack 0.10.1
arj 3.10.22_9
arc 5.21p

'pkg lock' will not allow me substitute a local version of curl for the 
package version.


> You can also maintain your own full custom repo using 'dsynth' (man 
> dsynth).  That's what we use to build the official repo.  There is a bit 
> of a learning curve and its nice to have a fast system and a modest 
> amount of memory and a lot of swap to really push the concurrency.  But 
> it can be run on small systems too with some care.  Some packages, like 
> chromium, require a ton of memory even with minimal concurrency though.  
>   Beyond that, its just time.... a well-endowed system (5900X, 7900X, 
> threadripper) can build the entire package set in a day or two.   A 
> smaller system might take a week.  A laptop might take even longer.
> 
> Its usually easier to use dsynth than to use make inside the dports 
> tree.  Options overrides are also separated out into their own directory.

Although, this may be a solution, a major problem is that current ClamAV 
0.105.1 package is mostly unusable for anyone (not to mention that the 
current version is ClamAV 1.0.0 LTS).

I could build ClamAV & curl+c-ares from source, for that matter any 
package that depends on curl would have to removed and built from source 
- the moment a package requires curl, it would reinstall the curl 
package because it is missing or incomplete.

In my case it is small number of packages: clamav & cmake.

I have created cmake (+ cmake-core, cmake-man, cmake-doc) from source in 
the past, it was a big task - hence the reason to use packages.

The more I look at it, building ClamAV from source may be the only way 
to get the latest version.

PS: curl is now at 7.87.0, released on 2022-12-21.

-- 
regards,
Stephen Welker.