Memorandum : Building ClamAV® on Mac OS X 10.4 through macOS 11.0 Big Sur

Brew will be the foundation for most of the tools that are needed in this video series. Short and sweet we cover the one install and updateprocess that will. Thanks to brew, open source software like ClamAV can run on multiple platforms. Running ClamAV Normally, I would just run the application directly, in this case: clamav, but that does not exist.

Building ClamAV® on Mac OS X 10.4 through macOS 11.0 Big Sur

I'm running ClamXav Sentry as 'launch agent' with ClamAV antivirus scanning engine of my own custom build.
I've tested for building ClamAV (from version 0.90.x to version 0.103.x) on Mac OS X 10.4 through macOS 11.0 Big Sur.
I'm running the latest stable release ClamAV 0.103.0 on macOS 11.0 Big Sur now.
ClamAV 0.103.0 is available on the Download page of ClamavNet, and the release note is here!
When you want to build ClamAV-devel from the Git sources, autotools are now requied.
For further information, see the following section:
'How to install ClamAV®-devel from the Git sources on macOS'.

This memorandum contains as below:
・ Memorandum 1: Building ClamAV 0.103.x on OS X 10.10 Yosemite through macOS 11.0 Big Sur
・ Memorandum 2: Building ClamAV 0.99.x on OS X 10.10, 10.11, 10.12 and macOS 10.13 High Sierra
・ Memorandum 3: Building ClamAV 0.98.7 on OS X 10.10 Yosemite and 10.11 El Capitan
・ Memorandum 4: Building ClamAV on Mac OS X 10.4 (Intel)
・ Memorandum 5: Building ClamAV on Mac OS X 10.4 (PPC)
・ Memorandum 6: Building ClamAV on Mac OS X 10.6 through OS X 10.9 Mavericks
・ Memorandum 7: Running clamd and freshclam as daemon
・ Memorandum 8: Running ClamXav Sentry as 'launch agent' on Mac OS X 10.6 and later…
・ Memorandum 9: Update ClamXav's own Virus Database and running RunFreshclam as daemon
・ Memorandum 10: Running ClamXAV version 2.18.x with B.Y.O. ClamAV antivirus scanning engine
・ Links…

Memorandum 1: Building ClamAV 0.103.x on OS X 10.10 Yosemite through macOS 11.0 Big Sur

Building ClamAV 0.103.x on OS X 10.10 Yosemite through macOS 11.0 Big Sur

1. Requirements to build ClamAV 0.103.x is very much the same as building ClamAV 0.102.x.
2. Requirements to build ClamAV 0.102.x are almost the same as building ClamAV 0.101.x. and ClamAV 0.100.x.
The differences are as follows:
LLVM current version is 10.0.x, though ClamAV 1.02.x supports only LLVM =< 3.6.x.
The ClamAV team is not maintaining repackaged LLVM now, and they may drop the repackaged LLVM entirely
and deprecate support for system-installed LLVM in favor of the bytecode interpreter.
So LLVM Libraries are not necessarily required to build ClamAV 0.102.x, I think.
I am now configuring ClamAV 0.102.x to disable LLVM as follows:
Of course you can configure ClamAV 0.102.x to enable LLVM as before:
3. Requirements to build ClamAV 0.102.x and ClamAV 0.101.x are almost same as before.

The following are required as discussed in detail below.
・ PCRE Libraries
・ OpenSSL Libraries
・ LLVM Libraries (Only when enabling LLVM)

4. Differences

The default behavior for clam to link LLVM has been changed dynamically instead of statically.
Thus making ClamAV 0.100.x fails with an error:
To build ClamAV 0.100.x enabling the LLVM Just-In-Time compiler for executing bytecode signatures,
use this configuration:
or simply use this configuration to disable LLVM Just-In-Time compiler:

Memorandum 2: Building ClamAV 0.99.x on OS X 10.10, 10.11, 10.12 and 10.13 High Sierra

Building ClamAV 0.99.x on OS X 10.10, 10.11, 10.12 and 10.13 High Sierra

ClamAV 0.99.x contains major new features such as YARA rules, PCRE - Perl Compatible Regular Expressions and so on.
To support YARA and ClamAV logical signatures, the Perl Compatible Regular Expressions (PCRE) library is required.
If PCRE isn't installed on your system, you will get a warning message like this while running freshclam.
1. To ensure the PCRE library:
1) Install PCRE - Perl Compatible Regular Expressions.,

2) When compiling ClamAV 0.99.x, it fails with an error:

3) To avoid this failure, simply set CPPFLAGS:
4) And add this configuration option when configuring ClamAV: --with-pcre=/usr/local/pcre2.
2. To compile ClamAV 0.99.x on OS X 10.10 Yosemite or on OS X 10.11 El Capitan and macOS 10.12 Sierra,

in addition to the PCRE library;
1) LLVM Library is required on OS X 10.10 Yosemite.
2) LLVM Library and LibreSSL are required on OS X 10.11 El Capitan and macOS 10.12 Sierra.
Please readMemorandum 3 to learn more, and…
3) Install LLVM Library Binaries.
4) Install LibreSSL.

3. Configure ClamAV 0.99.x on OS X 10.10 Yosemite as follws:
4. Configure ClamAV 0.99.x on OS X 10.11 El Capitan and macOS 10.12 Sierra as follws:

Memorandum 3: Building ClamAV 0.98.7 on OS X 10.10 Yosemite and 10.11 El Capitan

Built-in LLVM of ClamAV 0.98.7 and 0.99.x are not compatible with GNU C++ on OS X 10.10 Yosemite and 10.11 El Capitan.
So ClamAV 0.98.7 and 0.99.x built on OS X 10.10 Yosemite or on OS X 10.11 El Capitan have major issues:
- Clamd crashes repeatedly throwing 'Segmentation Fault: 11'
- Clamscan also crashes and fails to scan…
- Freshclam fails to load new database logging:

These problems can be avoided by installing official LLVM.
Versions of LLVM beyond 3.6 seem not to be currently supported in ClamAV, so you should install LLVM 3.6.2.
1. Installing LLVM 3.6.2 Pre-built Binaries
2. To use LLVM installed into /usr/local as a system library instead of the ClamAV's built-in LLVM JIT,
add configuration option as following:
3. Configure ClamAV 0.98.7 on OS X 10.10.x Yosemite as follws:

Building ClamAV 0.98.7 on OS X 10.11 El Capitan

Apple introduded a new security feature SIP: System Integrity Protection (rootless) to OS X 10.11 El Capitan, so in /usr directory
OS X 10.11 El Capitan has the different file composition from OS X 10.10 Yosemite.
While configuring ClamAV 0.98.7 on OS X 10.11 El Capitan, configuration fails with an error:
1. To solve this configuration issue, install LibreSSL.
Setting search path:
You can confirm the installation:
2. But it's not still sufficient to succeed building.
Clamav windows

Building fails with an error: Brew

3. To succeed building ClamAV 0.98.7 on OS X 10.11 El Capitan, set CPPFLAGS:
4. Configure ClamAV 0.98.7 on OS X 10.11 El Capitan as follws:
5. Notes

Apple has opted to use LibreSSL while providing OpenSSL in OS X 10.11 El Capitan and macOS 10.12 Sierra.
In macOS 10.13 High Sierra, Apple seems to switch SSL libraries from OpenSSL 0.9.8zh to LibreSSL 2.2.7.
LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014.
And it is know to build and work on Mac OS X (tested with 10.8 and later).
So I have changed OpenSSL for LibreSSL to build ClamAV.
Now you can use LibreSSL 2.7.x (the latest stable release).
If you want to use OpenSSL as before, ClamAV 0.100.x is compatible with OpenSSL 1.1.1x,
so you can use OpenSSL 1.1.1x.

Setting search path:

If you use OpenSSL 1.1.1x to compile ClamAV 0.99.x, add more this configuration.

Memorandum 4 : Building ClamAV on Mac OS X 10.4 (Intel)

In last update, Clam AntiVirus developer team introduced JIT compiler to ClamAV® 0.96.
Apple gcc (version: 4.0.1 build: 5370) in Mac OS X 10.4 (aka Tiger) failed to build ClamAV 0.96.x and 0.98.x with JITcompiled in.
With a brief struggle I found a good solution that I will tell you here.
1) First, install LLVM (Low Level Virtual Machine) and LLVM-GCC 4.2 Front End.
2) Second, add this configuration option: --enable-llvm.
Then you can build ClamAV 0.96.x and 0.98.x with JIT compiled in and use new features included in anti-virus toolkit.

Install LLVM (Low Level Virtual Machine) and LLVM-GCC 4.2 Front End
1. Installing LLVM-GCC 4.2 Front End Binaries
2. Setting search path
3. Installing LLVM 2.3

Install MacPorts and the packages
1. Installing MacPorts

Go to their Installing MacPorts page, download the .dmg for your platform, and install it.
Ensure it's up to date by running:

2. Insta

Clamav Mac Brew