Re: [exim] Exim and Sophos command line AV wrong exit codes?

On 07/11/2020 16:52, Jeremy Harris via Exim-users wrote:
> On 07/11/2020 16:16, Mike Tubby via Exim-users wrote:
>> Sophos manual for savscan says it returns:
>>
>>         0      If no errors are encountered and no threats are detected.
>>         1      If you interrupt savscan (usually by pressing CRTL+C)
>> or kill the process.
>>         2      If some error preventing further execution is
>> encountered.
>>         3      If threats or virus fragments are detected.
>
> The thing being run via "cmdline" has to return success, meaning a
> value of zero.  Either wrap your savscan in a shellscript to do
> the right thing, or use the "sophie" interface.

Actually, I think I have found two problems:

1. that the return codes from savscan are << 8 which is a PITA but can
be fixed with a wrapper

2. the return value 512 (really 2) is tripping on a password encrypted
ZIP file for which there is no right thing to do:

        a) accept it because we can't decrypt it [might still have a
virus]; or

        b) reject it because we can't decrypt it [might not have a
virus but might be confidential customer data]

    appears to be a loose-loose ;-(

Mike