On Fri, 29 Apr 2011 15:22:16 +0200 lukn <lukn...@gmail.com> wrote: > Dear Clamav-List > > I'm trying to build an md5-sigs from HTML-files. My procedure is as > follows: > > mkdir /tmp/clamsig > cd /tmp/clamsig > sigtool --html-normalise=/data/foo.html > mv nocomment.html foo.html > sigtool --md5 foo.html >> /tmp/htmlfiles.hdb > > Then I verified the file using > clamscan --database=/tmp/htmlfiles.hdb --leave-temps --debug /data/foo.html > But the signature did not match. > > I investigated the leftover tempfiles from clamscan and it seems that > sigtool and clamscan normalize differently. sigtool apparently converts > & (ampersand) even in URLs to & where clamscan leaves ampersands > intact. This can produce different files and therefore different md5 > hashes. > > I am not absolutely sure, but I think this is new since clamav 0.97. My > procedure worked in previous versions of clamav. > Can anybody confirm this? Is this indended behaviour? If so, what's the > recommended way of creating md5 signatures from HTML-files? > > My current version of clamav is 0.97 from Debian repositories: > clamscan --version > ClamAV 0.97/13022/Fri Apr 29 08:03:10 2011
Please open a bug report at bugs.clamav.net and attach the HTML file if possible. -- oo ..... Tomasz Kojm <tk...@clamav.net> (\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg \..........._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Fri Apr 29 16:44:24 CEST 2011 _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
