Dear sirs,
Can I buy and use virus DB of ClamAV in my commercial product? (scan engine is written by myself).
If I want to use DB of ClamAV under GPL, what are conditions I must follow? (public my source code for example,...?)
Thanks for help.

Tuan Vu

May be off-topic, but :
Would you consider join ClamWin team and help improve existing scaner, rather than developing other separate product ?
:)

I don't think you have to buy the Clam database. There are some open source people who are contributing to it, so it is still open source. Clam AV (not ClamWin) is now owned by Sourcefire, a commercial company. Right now Clam and its source code are still available for free, and they are charging for a commercial level of support by Clam. Anyone using the Clam AV source code has to make his code available to open source. Both Sourcefire and Clam have open source roots, and Sourcefire has announced its intention to keep Clam open source. Anything is possible, however, and that could eventually change as the program gets more competitive with commercial AVs and the competition among AVs gets tougher.

If you use the database only, it is freely available. However, if you change/improve the database, you should make it available to open source. The same is true for changes/improvements in the code, which is still available to open source due to the goodness of heart of Sourcefire.

Regards,

Thanks for your replies.
@ GuitarBob: I will use DB only. In the future, I think my profile development team will also contribute new virus def to the ClamAV's DB

Hi,

This is not a legal advise and you should consult a qualified lawyer for a professional advise on this matter.

I can tell you however what I know - ClamAV virus database is GPL licensed and therefore you cannot use it in a non-GPL product (using the database is considered as "derivative works") without a permission from a copyright owner (Sourcefire). So your product needs to use GPL icense as well.

Alch

Alch, there is at least one (maybe more) commercial product using the Clam DB. Spyware Terminator is freeware, but I haven't seen any open source code made available from them even though I'm pretty sure they are using the Clam DB and engine. And you might be able to label "derivative work" to what they've done by integrating it with their antispyware.

Regards,

Bob,
there is a significant difference in using a virus database in a non-GPL scanner and making a product compatible with ClamAV command line tools. The former is likely to be a "derivative work" because the AV product is built around the database. Spyware terminator, however is not likely to infringe GPL because their use of ClamAV is not "derivative" - they just utilize ClamAV for some optional software functionality.

I am not a lawyer but it does make sense to me.

Cheers,
Alch

Thanks, Alch. I have a feeling this may become more important as the AV industry gets more competitive. Microsoft's free AV should take some customers away from the commercial stuff, and the barrier to entry should make it tough for new AV products. Clam's signature database is functional and growing, and that's an asset!

Regards,