feat: Add ClamAV container with automatic config wiring for PHP 8.4 and 8.5

[chris-snyder-totara]

Description

Adding ClamAV support to docker-dev so that we can test antivirus on Totara file uploads.

Testing Instructions

1. Check out this pull request

2. Get the images

The clamav container is the stock upstream image, so it is simply pulled. The PHP images are ours though, and they now contain clamdscan:

tbuild php-8.4

After the patch is released, an ordinary upgrade just needs a pull instead:

tpull

3. Start it, from your site directory

tup clamav

Signatures are baked into the image, so there is no large download. Wait for the healthcheck to go green — expect (healthy), usually under a minute:

docker ps --filter name=totara_clamav --format '{{.Names}} {{.Status}}'

4. Confirm the plumbing

texec php sh -c 'ls -l /run/clamav/clamd.sock; clamdscan --ping 1'

Expect a socket listing and PONG. If clamdscan is missing here, your PHP image is stale — redo step 1.

5. Confirm Totara enabled the plugin

Run from your site's server/ directory:

texec php php -r 'define("CLI_SCRIPT",true); require "config.php"; echo "antivirus active: ", var_export(\core\antivirus\manager::get_antivirus("clamav")->is_configured(), true), "\n";'

Expect antivirus active: true.

6. Confirm it actually blocks a virus

This writes the EICAR test file (the industry-standard harmless AV test string, not real malware) and runs it through Totara's own scan path:

texec php php -r 'define("CLI_SCRIPT",true); require "config.php"; $f=sys_get_temp_dir()."/eicar.txt"; file_put_contents($f, base64_decode("WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCo=")); try { \core\antivirus\manager::scan_file($f,"eicar.txt",true); echo "FAIL: virus not detected\n"; } catch (\core\antivirus\scanner_exception $e) { echo "PASS: virus detected and blocked\n"; } @unlink($f);'

Expect PASS: virus detected and blocked.
Then repeat through the UI: save that EICAR string as a .txt file on your host and upload it via any file picker. The upload should be rejected with a virus warning. This is the step that proves real web uploads are covered, since those land in the container's /tmp rather than the shared dataroot.

7. Confirm it stays out of the way when off

tdown clamav

Reload a page and re-run step 4 — expect false, and uploads to behave exactly as before. Also worth spot-checking a PHP 8.3 site while clamav is running: it should also report false, since the socket is only mounted on 8.4/8.5.

Known behaviours, not bugs

• tdown clamav leaves the container as Exited (137). The upstream image does not forward SIGTERM to clamd, so docker kills it. Harmless — and because it also means clamd never removes its socket file, config-after.php probes for a live listener rather than trusting the file to be gone.
• The antivirus settings in Site administration are greyed out. They are forced from config-after.php by design.

Checklist

• Does what the author says it will do
• Testing instructions are provided
• Commit messages make sense and follow the conventional commit standard
• No identified security issues
• No identified maintenance issues
• Any third-party libraries/dependencies use the MIT or Apache 2.0 license
• Changes made are backwards compatible and will not break existing setups
• Changes to scripts in the bin/ directory run correctly on both MacOS and WSL
• Changes to containers can be built locally sucessfully (e.g. via tbuild container && tup container)
• Containers/images are compatible with both AMD64 (Windows) and ARM64 (MacOS)
• Changes made to config.php are compatible with our oldest supported Totara version, our newest Totara version, and Moodle

[chris-snyder-totara]

Rebased on master.