Installation

exav runs on Linux, macOS and Windows and ships as a single binary. The Linux release builds are static (musl); the macOS and Windows builds link the system libraries. On Windows there is no prefork worker pool, no per-job limits (--max-scan-secs, --max-process-bytes) and no --auto-update, which are Unix only.

Prebuilt binaries

Each release on GitHub carries binaries for {x86_64,aarch64}-unknown-linux-musl (static, any distro), {x86_64,aarch64}-apple-darwin and x86_64-pc-windows-msvc, and the WASI module exav-wasm-<tag>-wasm32-wasip1.wasm (see the WASM sandbox guide). Each archive has a .sha256 checksum beside it. For example, on 64-bit Linux:

tag=v0.0.2 target=x86_64-unknown-linux-musl
curl -fsSLO https://github.com/sylvinus/exav/releases/download/$tag/exav-$tag-$target.tar.gz
tar xzf exav-$tag-$target.tar.gz
sudo install -m755 exav /usr/local/bin/exav
exav --version

They are the default build, without HTTP support: to fetch signatures with --auto-update or scan URLs, build with --features http below.

Every archive carries the LICENSE and the NOTICE of what the binary links. The same releases carry the other tools in archives of their own, each installed as its page says: exav-unpack, exav-grep, exav-pe-emu and exav-imagehash.

From crates.io

Building needs Rust 1.92 or newer (rustc --version; rustup update to upgrade).

cargo install exav

That installs the exav binary with the default pure-Rust build, which handles every supported archive format. For a build with HTTP support (URL scanning and signature updates over HTTP(S)):

cargo install exav --features http

See Feature flags for all build options.

Build from source

1. Install a Rust toolchain (1.92 or newer) via rustup.

2. Clone and build:

   git clone https://github.com/sylvinus/exav
   cd exav
   cargo build --release -p exav      # -> target/release/exav
   ./target/release/exav --help

3. Put the binary somewhere on your PATH:

   sudo install -m755 target/release/exav /usr/local/bin/exav

To add HTTP(S) support (URL scanning and signature auto-update):

cargo build --release -p exav --features http

For a smaller binary without YARA, DLP, the phishing heuristic or ICAP:

cargo build --release -p exav --no-default-features --features all-formats,decrypt

See Feature flags for the full list of build-time options.

Debian / Ubuntu package

Build a .deb locally with cargo-deb:

cargo install cargo-deb
cargo build --release -p exav
cargo deb -p exav --no-build      # the binary, and the systemd unit exav.service
sudo apt install ./target/debian/exav_*.deb

The unit runs as the clamav user and reads /var/lib/clamav, as clamav-daemon does; the package creates neither, so install it on a machine that has ClamAV’s (see Migrating from ClamAV).

Container

The published image is a wire-level replacement for the ClamAV Docker image: the same clamd port 3310 and protocol. It fetches signatures itself from a source you name, such as a cvdupdate mirror of Cisco’s database:

docker run -d -p 3310:3310 -v exav-db:/var/lib/exav \
  -e EXAV_SIG_SOURCES=https://clamav-mirror.internal/ ghcr.io/sylvinus/exav

Without a source it waits for another container to fill the volume. See the Docker guide for signature population, environment variables, and the dual-container updater pattern.

WASM sandbox module

To run the scanner sandboxed (for untrusted signatures), take the release’s .wasm or build the wasm32-wasip1 module:

rustup target add wasm32-wasip1
cargo build --release --target wasm32-wasip1 -p exav-core --features wasi-bin

The output is target/wasm32-wasip1/release/exav-wasm.wasm. See the WASM sandbox guide for how to run it under wasmtime.

Next

exav ships no signature database of its own, so the next step is to get signatures and run a first scan.