Signatures

exav reads ClamAV’s signature formats, so the ecosystem’s signatures work, but it ships no real database of its own (only a built-in EICAR test signature). You supply the signatures.

Why exav doesn’t ship signatures

The ClamAV signature database (main.cvd, daily.cvd) is GPL-licensed. exav is MIT-licensed, so it does not bundle or redistribute it.

• Reading the CVD format is interoperability, not redistribution.
• You run Cisco’s own updater on your machine and point exav at the directory. The GPL governs distribution, not use.
• exav does not re-implement freshclam’s update protocol: no DNS TXT version probing, no .cdiff patching, no verification of the CVD’s digital signature (dsig). cvdupdate (Apache-2.0) and freshclam are the supported way to fetch the official database, and they spare Cisco’s CDN. exav’s own --auto-update only fetches from a mirror you run.

Get the official signatures

Either updater works; keep whichever you already run, on the same schedule.

# Option A: cvdupdate (Cisco's Python updater; the command it installs is `cvd`)
pipx install cvdupdate
cvd update
exav -d ~/.cvdupdate/database /data

# Option B: freshclam (ships with ClamAV)
freshclam
exav -d /var/lib/clamav /data

-d (--database) or --sig-dir loads a directory recursively (hidden .-prefixed sub-directories are skipped), so a nested layout is picked up in full.

Formats exav loads

From .cvd/.cld containers or loose files in the directory:

Extension	Signature type
.ndb	body signatures: hex with wildcards
.db	legacy Name=HEX literal signatures (no wildcards)
.ldb	logical signatures (boolean expressions over subsignatures)
.hdb / .hsb	whole-file MD5 / SHA hashes
.mdb / .msb	PE section hashes
.fdb	exav’s own fuzzy hashes, see below
.cdb	container-metadata signatures
.imp	PE import hashes (imphash)
.idb	PE icon signatures
.ftm	file-type magic, used when content typing is inconclusive
.crb	Authenticode certificate block list
.cbc	bytecode programs, run in a sandboxed interpreter
.fp / .sfp	allowlists by file hash
.ign / .ign2	ignore lists by signature name
.pdb / .wdb / .gdb	phishing databases
.pwdb	passwords for encrypted archives
.yar / .yara	YARA rules
.ndu, .ldu, .hdu, .hsu, .mdu, .msu	PUA variants of the above, loaded with --detect pua
.cvd / .cld	ClamAV containers of the above: a .cvd is a signed, gzip-compressed tar; a .cld is the uncompressed form freshclam keeps after applying .cdiff patches

See Supported formats for the file types each signature applies to and the containers exav opens, and the comparison for how completely each signature format is covered. A signature exav cannot load is skipped and counted: -v prints the total as Unsupported sigs skipped in the scan summary.

exav’s .fdb format

.fdb is not a ClamAV format. Each line is one of:

imphash:<md5 of the PE import table>:<name>
tlsh:<TLSH digest>:<name>[:<max distance>]

The distance defaults to 100. imphash lines match PE files by default; tlsh lines match only with --detect exav-heuristics.

Unofficial and third-party feeds

Community YARA rulesets, commercial vendor feeds and add-on signature sets load the same way: put the files, or a nested directory of them, in the signature directory.

• Prefer permissively licensed sets if you intend to redistribute them.
• Feeds distributed through updater tools that lay signatures out in nested directories load unchanged.
• A database is recognised by its extension, not its contents. Anything else in the directory is passed over without being read, which lets .cdiff, .sign, .info and updater state live there safely; a signature file saved under another name is skipped the same way, so rename it.

Built-in updater (--auto-update)

--auto-update fetches the URLs you supply on a schedule, with a conditional request that transfers nothing when a file has not changed, and hot-reloads the result. It is not a freshclam replacement: no DNS version probing, no .cdiff patches. Point it at a mirror you run, or at a .exavdb you built.

# A cvdupdate directory served over HTTPS. The trailing slash makes the URL a
# mirror base, fetched as main.cvd, daily.cvd and bytecode.cvd.
exav --auto-update --sig-sources https://mirror.internal/clamav/ \
  --listen /run/exav/exav.sock

--sig-sources (or EXAV_SIG_SOURCES) also takes exact file URLs, a file listing sources, or a freshclam.conf: exav reads its source directives and warns about the rest. exav does not refuse a stock freshclam.conf, which names Cisco’s database.clamav.net; use it only with one that names your own mirror. --auto-update works with any --listen address, and alone for a one-shot scan that should fetch first; with no --listen and no paths it is only an updater. See the Docker guide, the CLI reference and Configuration.

The updater needs the http-update feature. The Docker image has it; the release binaries and a plain cargo install exav do not (see Installation). It runs on Unix only.

Each source is saved under the signature directory (-d when given, else --sig-dir) as env/<host>/<url path>/<name>-<hash>.<ext>, keeping the extension its URL ends in, so the URL has to name the file it serves: https://mirror/daily.cvd works, while https://feeds/get.php?db=daily ends in .php, which the loader does not route. exav warns about such a source at startup.

Caution

The built-in updater does no signature verification, so point it only at a mirror you trust, over HTTPS. For verified updates, use freshclam or cvdupdate and let exav hot-reload the directory.

Next

• Prebuilt database: compile signatures once for a fast start.
• YARA rules: the native YARA engine.