Scan uploaded crates for viruses

[erickt]

We should scan uploaded crates for viruses. Simplest option would be to use clamscan from clamav. There's also virus scanning services like https://www.virustotal.com/ too. Possibly some products we can buy to do the scanning.

[vignesh-sankaran]

Think we'd want the antivirus to be libre if we set this up, and ideally works independently of an external service. Clamav sounds like it could fit the bill, though we'd need to figure out how to get clamscan to run against a new upload since I'm not sure how to get the daemon to run from Rust code. Thoughts @carols10cents?

[zsims]

FWIW I have written simple/safe Rust wrapper around libclamav (the library, not the daemon): https://crates.io/crates/clamav

[smokytheangel0]

I can imagine that a build during publishing while costly is fairly straight forward for crates with no non-rust dependencies, I think if a Cargo.toml had a key for prebuild steps whose values could be run in bash that would allow an easier path to automating ffi builds, and hopefully this would align with the package manager of whichever distro crates.io is run on. So I would reccomend, if resources are available for the extra work, a badge for binary crates with rust only deps that pass the clamav at first, and adding an issue to cargo about the non rust deps key (which doesnt need to be platform agnostic, as it would be intended for compatiblity with crates.io, windows deps would be impossible to include in this manner) which would then be used to fully build/configure binary crates with non rust dependencies and run clamav over them. This would be really big, but, if resources and teams allow, I dont see it as being unfeasible for binary crates. I am not sure if clamav is compatible with library code, but this may also be just as 'simple'.

[Turbo87]

we discussed this issue in the weekly team meeting today and we don't see a way forward with this is the near future given the currently available resources. we would definitely like to have something like this in general, but since this seems unlikely to be resolved soon we will go ahead and close this issue for now. if anyone wants to work on this feel free though :)