Module antivirus 

Checking a file before it opens: one question, three answers, one way per system (docs/client.md, “Antivirus”).

• Windows: the Antimalware Scan Interface (AMSI) hands the file to the antivirus Windows already runs, Microsoft Defender by default. Nothing to install.
• Linux and macOS: ClamAV, when the system has it (its packages, or Homebrew): its daemon when it runs (fast) and says when a file passes its limits, else its scanner with the system’s signatures, else with Sioul’s own signatures, which Sioul keeps current with the system’s freshclam. Nothing of ClamAV ships with Sioul.
• A file larger than the antivirus scans (ClamAV’s limits on a file’s size, on what an archive holds, on its depth; AMSI’s 4 GB) is “not scanned: too big”, never clean: ClamAV left alone finds such a file clean without reading it, so its scanner is asked to say so (--alert-exceeds-max), and its daemon is asked only when its own configuration says so (AlertExceedsMax yes).
• Without an antivirus, nothing is refused: the window says the file will not be checked, asks before opening or saving it, and says how to install one (install_hint).
• A phone has no antivirus another app can call, and no ClamAV: scan answers Unavailable there without trying, and Sioul’s window does not ask it (crates/sioul-app/src/attachments.rs).

Enums

Verdict

What the antivirus said.

Functions

clamav 🔒

clamav_verdict 🔒

What ClamAV’s exit code and output say: 0, nothing found; 1, a threat (<file>: Eicar-Test-Signature FOUND), or a limit passed, which it names Heuristics.Limits.Exceeded… when asked to say so: not scanned, too big; anything else, none: it could not scan.

daemon_alerts 🔒

Whether ClamAV’s daemon says when a file passes its limits: its configuration’s AlertExceedsMax yes. Without it, the daemon finds such a file clean without reading it, and there is no option to ask it otherwise for one scan: the scanner is asked instead.

daemon_config 🔒

The configuration ClamAV’s daemon and clamdscan read, where each system’s packages put it; none when there is none to read.

install_hint

How to install an antivirus here, in one line: the command for this system’s packages, in backticks (the window offers it to copy), or what to turn on, in your language.

installed 🔒

Whether one of ClamAV’s programs is installed: on the path, or where Homebrew puts it.

own_signatures 🔒

Where Sioul keeps its own ClamAV signatures (not on Windows, which has its own antivirus).

program 🔒

One of ClamAV’s programs, as the system has it: on its path, else where Homebrew puts it (a macOS application does not get the shell’s path).

refresh_signatures

Keeps Sioul’s own ClamAV signatures current, once a day, when the system has ClamAV’s programs but no signatures of its own. Returns whether it ran.

runs 🔒

The scanners to ask, in order, with their options: ClamAV’s daemon when it says when a file passes its limits (daemon_alerts), else none of it; its scanner with the system’s signatures, then with Sioul’s own (own), each asked to say so (--alert-exceeds-max).

scan

Checks a file.

system_signatures 🔒

Whether the system keeps ClamAV signatures Sioul’s scanner can read.