Install & Compatibility
Where this runs
tested against v1.2.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 25.9MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 2.7s · import 0.000s · 26MB
24MB installed
● package 24MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
cvdupdate
✓ This library is primarily used as a command-line tool, not typically imported programmatically.
Invoke using `cvd` command or `python -m cvdupdate`.
This quickstart demonstrates how to install `cvdupdate` and use its primary command to download ClamAV database files. It also includes optional commands to serve the databases locally for testing purposes and to customize the database storage location.
# Install cvdupdate (if not already installed)
pip install cvdupdate
# Run the update command to download ClamAV databases
cvd update
# (Optional) Serve the downloaded databases for testing (not production)
cvd serve
# (Optional) Configure database directory
cvd config set --dbdir /path/to/your/mirror
cvdupdate --version
Debug
Known issues
gotchaAs of v1.1.3, info-level and debug-level messages are directed to stdout instead of stderr. This change can impact existing scripts or logging configurations that differentiate between stdout and stderr.fixAdjust scripts or logging configurations to capture stdout for informational/debug messages. Consider redirecting stdout/stderr explicitly if needed.
affects: >=1.1.3
gotchaRunning `cvd clean all` followed by `cvd update` too frequently (e.g., repeatedly in quick succession) can result in the official ClamAV database servers temporarily refusing download requests due to rate-limiting. This can cause databases to enter a 'cool-down' period.fixAvoid excessively frequent updates. The tool is designed to only download new content when available, so frequent execution without new content is generally safe, but forced re-downloads (like after `cvd clean all`) should be spaced out.
affects: All versions
breakingIn version 1.2.0, `cvdupdate` migrated its internal logging dependency from `coloredlogs` (unmaintained) to `colorlog`. While this is primarily an internal change, users relying on specific behaviors or customizations of the `coloredlogs` dependency might observe subtle differences, particularly if they were using internal logging mechanisms of `cvdupdate`.fixReview any custom logging configurations or programmatic interactions that might have implicitly relied on the `coloredlogs` library's presence or behavior. The change is generally transparent for command-line usage.
affects: >=1.2.0
gotchaFor users upgrading from versions prior to 1.1.0 (specifically from 1.0.2), the configuration file (`config.json`) was automatically migrated and split into `config.json` and `state.json` upon running `cvd update`. This was done to separate database state from user configuration, allowing for easier management with configuration tools.fixBe aware of this change if you manage `cvdupdate`'s configuration files manually or with external configuration management tools. Ensure your tools account for the new `state.json` file.
affects: <1.1.0 to 1.1.0 upgrade path
gotchaIt is important to NOT use `cvdupdate` if you do not need to host a private database mirror. For direct updates on individual ClamAV clients, `freshclam` is significantly more efficient as it can update using small CDIFF patches. `cvdupdate`, conversely, downloads both the new daily CDIFF and the entire daily CVD.fixUtilize `freshclam` for direct client updates. Only use `cvdupdate` when setting up a centralized private mirror for multiple ClamAV clients.
affects: All versions
Upgrade
Version history
1.2.0latest on PyPI · released Oct 3, 2025
Audit
Dependencies
clickrequiredCommand-line interface toolkit.
colorlogrequiredColored logging output.
coloramarequiredCross-platform colored terminal text.
requestsrequiredHTTP client for downloading files.
dnspythonrequiredDNS query operations.
rangehttpserverrequiredInternal test HTTP server.
packagingrequiredVersion parsing and comparison.