The situation of this bug is tricky... I used the opportunity of having ftpmaster and release team members around, as well as I discussed the situation with Marc on IRC.
As of now, the possible solutions seem to be: - leave things as is in the package. As a consequence, the package would need to be removed from lenny at some point - leave things as is and tag the bug as 'lenny'-ignore'. The rationale here is giving time for the maintainer to fix the problem "the right way" (for instance, get an answer from eicar.com about the Eicar test file license). The triggerred problem are failures in unattendend installs with no net acces...such as on autobuilders (taking into account the fact that clamav-getfiles has no reverse deps and that no package is build depending on it) - apply the proposed patch. The induced problem is that it would hide real problems when the user chooses to download the file and this fails - make the package display a warning when the download fails and then ignore the error - no Eicar file download and a big proeminent recommendation to use the update-eicar script (that would be provided as an example). - default the debconf answer to "No". The maintainer says that it however makes the package much less useful - move the package to contrib My own personal recommendation *as a compromise* would be to go the "lenny-ignore" way. This has the advantage of leaving time to the maintainer for solving the licenses issues without compromising the package functionality. The *very theoretical* problem induced by the possible failure on unattended installs with no network is mostly this: theory. The lenny-ignore tag should then bet requested to the release team, probably with the above rationale. The altenative I would propose if that's considered not possible is to include the eicar.com file in the package *now* as the probability of the file to be "non free" is fairly low as it is probably not even copyrightable. I don't pretend to have ${deity} word here....I really just think we should do our best to solve out this mess....in the hope that this contribution will help having things advance. Of course, the very same advice could be requested from the Tech CTTE team. --
signature.asc
Description: Digital signature