feat(malwaremanager): remove the ClamAV scanner

[AlonLiwsky]

Summary

ClamAV is the only in-tree implementation of the MalwareScanner interface, and it is obsolete.
Its alerts never reach the hash-signature matcher — that path handles rule R6000 only — and the
dashboard's "Malware Name" field reads a signature name that only the hash path fills, so a
ClamAV alert renders it empty today. This removes the scanner, the sidecar image and the claims
about it, and keeps the interface.

BREAKING CHANGE: the node-agent no longer ships a malware scanner. malwareDetectionEnabled
still starts the malware manager, but with no scanner registered it cannot produce an alert, so
it logs a warning saying exactly that.

Ticket

None — this repository has no ticket link. Tracked internally as part of the file-hash detection
GA work.

Changes

• Delete pkg/malwaremanager/v1/clamav — the scanner.
• Delete clamav/ — the sidecar image: Dockerfile, Makefile, the init script and the
  database-filter script.
• Drop the CLAMAV_SOCKET wiring in CreateMalwareManager, and warn when the manager starts
  with no scanner registered.
• Drop the ClamAV surface of the CI test chart under tests/chart.
• Drop the ClamAV claims in README.md, docs/CONFIGURATION.md and the demo walkthrough, and
  the demo screenshot the removed section used.
• go mod tidy drops github.com/dutchcoders/go-clamd.

Kept on purpose: MalwareScanner, MalwareResult, MalwareManagerClient and
pkg/malwaremanager/v1/types. They are the extension point for an out-of-tree scanner, and
downstream exporters build on MalwareResult.

The matching chart change removes the sidecar from kubescape/helm-charts. The two are
independent and can merge in either order: this agent ignores an absent CLAMAV_SOCKET, and a
running sidecar with no client is inert.

Testing

go build ./... and go vet ./... for GOOS=linux → pass. The test suite does not run on
macOS — the dependency tree is Linux-only — so CI is the gate for the tests. helm template on
tests/chart with capabilities.malwareDetection=enable → renders, no ClamAV.

AI-skills: armosec-shared-rules:agent-dispatch-policy

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[matthyx]

Reviewed. The removal itself is clean (interface, MalwareResult, and MalwareManagerClient are correctly kept as the extension point; chart/docs/demo cleanup is consistent), but there's one real blocker: CI is red on Test_10_MalwareDetectionTest, and it will stay red permanently since this PR removes the only scanner that test's assertion depends on — see the inline comment for detail and the fix needed. Also note this PR is still a Draft. Not approving until the failing test is addressed and CI is green.

[matthyx]

Blocker: component-tests (Test_10_MalwareDetectionTest) is red on this PR (https://github.com/kubescape/node-agent/actions/runs/32974296987/job/98196942880). That test deploys quay.io/petr_ruzicka/malware-cryptominer-container:2.0.2 and asserts a malware alert with malware_name == "Multios.Coinminer.Miner-6781728-2.UNOFFICIAL" — a ClamAV signature name (tests/component_test.go). With malwareScanners now permanently empty (no in-tree scanner ever gets appended here), that alert can never be produced, so this test fails deterministically on every future run, not just this one.

Since the PR intentionally removes the only scanner that could satisfy this test, the test itself needs to go too — please delete Test_10_MalwareDetectionTest (and its entry in .github/workflows/component-tests.yaml) as part of this change, or gate it clearly, so CI reflects the new "no in-tree scanner" reality instead of staying red.

Minor/non-blocking nit: since malwareScanners is now always empty at this point (nothing appends to it), if len(malwareScanners) == 0 { ... } is dead code — could just be an unconditional logger.L().Warning(...). Not blocking, just flagging in case a future scanner registration is added here later and this branch is expected to become conditional again.