Fix: ClamAV fails to complete scan (#6022) #6039

dsotirho-ucsc · 2024-03-13T17:43:04Z

Connected issues: #6022

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or this PR does not require reindexing}
This PR is labeled reindex:dev _{or does not require reindexing dev}
This PR is labeled reindex:anvildev _{or does not require reindexing anvildev}
This PR is labeled reindex:anvilprod _{or does not require reindexing anvilprod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
Ran make image_manifests.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify image_manifests.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (operator tasks)

Added checklist items for additional operator tasks _{or this PR does not require additional tasks}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the prod branch has no temporary hotfixes for any connected issues}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after requesting changes)

Uncheck the Author (before every review) checklists.

Peer reviewer (after approval)

PR is not a draft
Ticket is in Review requested column
Requested review from system administrator
PR is assigned to only the system administrator

System administrator (after requesting changes)

Uncheck the before every review checklists. Update the N reviews label.

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review _{or this PR is a promotion or a backport}
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved ticket to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvilprod.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

¹ When pushing the merge commit is skipped due to the PR being
labelled no sandbox, the next build triggered by a PR whose merge commit is
pushed determines this checklist item.

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial and reindex:prod labels to the next promotion PR _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial and reindex:prod labels from the description of this PR to that of the next promotion PR _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

codecov · 2024-03-13T18:04:23Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.33%. Comparing base (8bda13f) to head (6d6ec09).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #6039   +/-   ##
========================================
  Coverage    85.33%   85.33%           
========================================
  Files          154      154           
  Lines        19969    19969           
========================================
  Hits         17040    17040           
  Misses        2929     2929

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

coveralls · 2024-03-13T18:04:52Z

coverage: 85.35%. remained the same
when pulling 6d6ec09 on issues/dsotirho-ucsc/6022-downgrade-clamav
into 8bda13f on develop.

dsotirho-ucsc · 2024-03-13T19:26:00Z

6039-IT_2024-03-13.txt

achave11-ucsc

From the issue,

"Assignee to file partial PR that downgrades ClamAV. Ticket will then go to parked column until upstream fixes the segmentation fault."

PR lacks indications of partiality.

achave11-ucsc

Approved ✅

hannes-ucsc

It's not clear from the description or comments in the GH issue what the problem is. One of my comments is alluding to a segmentation fault but there is no actual error message mentioned in the issue that would corroborate that. Without this information it would be hard to file an upstream issue or look for an existing issue. It would also be good to know what file(s) cause ClamAV to crash.

hannes-ucsc · 2024-03-15T23:13:14Z

environment.py

@@ -284,7 +284,9 @@ def env() -> Mapping[str, Optional[str]]:
            # Updating any of the four images below additionally requires
            # redeploying the `gitlab` TF component.
            'clamav': {
-                'ref': 'docker.io/clamav/clamav:1.3.0-41'
+                # FIXME: https://github.com/DataBiosphere/azul/issues/6022
+                #        Keep CalmAV at 1.2.1 until 1.3.x failure is resolved


Suggested change

# Keep CalmAV at 1.2.1 until 1.3.x failure is resolved

# Keep ClamAV at 1.2.1 until 1.3.x failure is resolved

image_manifests.json

dsotirho-ucsc · 2024-03-19T07:57:55Z

It's not clear from the description or comments in the GH issue what the problem is. One of my comments is alluding to a segmentation fault but there is no actual error message mentioned in the issue that would corroborate that. Without this information it would be hard to file an upstream issue or look for an existing issue. It would also be good to know what file(s) cause ClamAV to crash.

Added verbose logs and reproduction to the ticket and linked to the comment in the ticket's description.

hannes-ucsc

PR labels are wrong. See checklist.

environment.py

hannes-ucsc · 2024-03-21T01:50:53Z

Security design review

dsotirho-ucsc added the deploy:shared [process] PR requires deploying `shared` component label Mar 13, 2024

github-actions bot added the orange [process] Done by the Azul team label Mar 13, 2024

dsotirho-ucsc requested a review from achave11-ucsc March 13, 2024 19:28

dsotirho-ucsc assigned achave11-ucsc Mar 13, 2024

achave11-ucsc requested changes Mar 14, 2024

View reviewed changes

dsotirho-ucsc added the partial [process] PR is does not completely resolve associated ticket label Mar 14, 2024

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6022-downgrade-clamav branch from 54725e0 to 2d2eefc Compare March 14, 2024 16:51

achave11-ucsc removed their assignment Mar 14, 2024

dsotirho-ucsc requested a review from achave11-ucsc March 14, 2024 17:13

dsotirho-ucsc assigned achave11-ucsc Mar 14, 2024

achave11-ucsc previously approved these changes Mar 14, 2024

View reviewed changes

achave11-ucsc marked this pull request as ready for review March 14, 2024 17:32

achave11-ucsc requested a review from hannes-ucsc as a code owner March 14, 2024 17:32

achave11-ucsc assigned hannes-ucsc and unassigned achave11-ucsc Mar 14, 2024

hannes-ucsc requested changes Mar 15, 2024

View reviewed changes

hannes-ucsc removed their assignment Mar 15, 2024

hannes-ucsc added the 1 review [process] Lead requested changes once label Mar 15, 2024

dsotirho-ucsc dismissed achave11-ucsc’s stale review via 2283409 March 18, 2024 17:38

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6022-downgrade-clamav branch from 2d2eefc to 2283409 Compare March 18, 2024 17:38

dsotirho-ucsc requested a review from hannes-ucsc March 19, 2024 15:21

dsotirho-ucsc assigned hannes-ucsc Mar 19, 2024

hannes-ucsc approved these changes Mar 20, 2024

View reviewed changes

hannes-ucsc added 2 reviews [process] Lead requested changes twice and removed 1 review [process] Lead requested changes once labels Mar 20, 2024

hannes-ucsc requested changes Mar 20, 2024

View reviewed changes

environment.py Show resolved Hide resolved

hannes-ucsc removed their assignment Mar 20, 2024

dsotirho-ucsc added the deploy:gitlab [process] PR requires deploying `gitlab` component label Mar 20, 2024

dsotirho-ucsc requested a review from hannes-ucsc March 20, 2024 18:05

dsotirho-ucsc assigned hannes-ucsc Mar 20, 2024

hannes-ucsc approved these changes Mar 21, 2024

View reviewed changes

hannes-ucsc assigned achave11-ucsc and unassigned hannes-ucsc Mar 21, 2024

[p] Fix: ClamAV fails to complete scan (#6022)

6d6ec09

achave11-ucsc force-pushed the issues/dsotirho-ucsc/6022-downgrade-clamav branch from 2283409 to 6d6ec09 Compare March 25, 2024 23:30

achave11-ucsc assigned hannes-ucsc and unassigned achave11-ucsc Mar 26, 2024

hannes-ucsc assigned achave11-ucsc and unassigned hannes-ucsc Mar 26, 2024

achave11-ucsc added the sandbox [process] Resolution is being verified in sandbox deployment label Mar 26, 2024

achave11-ucsc merged commit d86aa6d into develop Mar 26, 2024
12 checks passed

achave11-ucsc deleted the issues/dsotirho-ucsc/6022-downgrade-clamav branch March 26, 2024 20:44

achave11-ucsc removed their assignment Mar 27, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: ClamAV fails to complete scan (#6022) #6039

Fix: ClamAV fails to complete scan (#6022) #6039

dsotirho-ucsc commented Mar 13, 2024 •

edited by achave11-ucsc

Loading

codecov bot commented Mar 13, 2024 •

edited

Loading

coveralls commented Mar 13, 2024 •

edited

Loading

dsotirho-ucsc commented Mar 13, 2024

achave11-ucsc left a comment

achave11-ucsc left a comment

hannes-ucsc left a comment

hannes-ucsc Mar 15, 2024

dsotirho-ucsc commented Mar 19, 2024

hannes-ucsc left a comment

hannes-ucsc commented Mar 21, 2024

	# Keep CalmAV at 1.2.1 until 1.3.x failure is resolved
	# Keep ClamAV at 1.2.1 until 1.3.x failure is resolved

Fix: ClamAV fails to complete scan (#6022) #6039

Fix: ClamAV fails to complete scan (#6022) #6039

Conversation

dsotirho-ucsc commented Mar 13, 2024 • edited by achave11-ucsc Loading

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (operator tasks)

Author (hotfixes)

Author (before every review)

Peer reviewer (after requesting changes)

Peer reviewer (after approval)

System administrator (after requesting changes)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

codecov bot commented Mar 13, 2024 • edited Loading

Codecov Report

coveralls commented Mar 13, 2024 • edited Loading

dsotirho-ucsc commented Mar 13, 2024

achave11-ucsc left a comment

Choose a reason for hiding this comment

achave11-ucsc left a comment

Choose a reason for hiding this comment

hannes-ucsc left a comment

Choose a reason for hiding this comment

hannes-ucsc Mar 15, 2024

Choose a reason for hiding this comment

dsotirho-ucsc commented Mar 19, 2024

hannes-ucsc left a comment

Choose a reason for hiding this comment

hannes-ucsc commented Mar 21, 2024

Security design review

dsotirho-ucsc commented Mar 13, 2024 •

edited by achave11-ucsc

Loading

codecov bot commented Mar 13, 2024 •

edited

Loading

coveralls commented Mar 13, 2024 •

edited

Loading