Dear porters and port users,
I've added a new port security/portaudit-db that complements
security/portaudit for users
that have a current ports tree and want to generate the portaudit
database themselves,
possibly distributing it over their local network. This will save you
the traffic downloading
information that is already on your local machine and avoid the lag that
is currently
associated with the mirroring process.
Basically you just need to install security/portaudit-db and do
`packaudit' every time after
your ports tree has been updated. Try `portaudit -d', it should show the
current date
afterwards.
This port also features a MOVED style file (database/portaudit.txt)
where UUIDs for vulnerabilities
can be allocated before they are researched thoroughly and moved to the
VuXML database. When you fix
a vulnerability in one of your ports, please add at least an entry to
this file, so that this fact
doesn't go unnoticed. Of course a full VuXML entry is preferred.
I take this announcement as an opportunity to make a plea to all port
maintainers:
* please stick with *one* PKGNAMESUFFIX (possibly using a combined one
like -sasl-client)
* please *do not* change the structure of the packages version number
according to included components.
Lets take for example port `myport' with has optional components c1 and
c2. This *should not*
result in the following package names:
port-v
port-suf1-v+v1
port-suf2-v+v2
port-suf1-suf2-v+v1+v2
because I need 2^(number of components) entries to catch all possible
combinations, for example the
recent vulnerability in www/apache13-modssl would need 32 entries in the
vulnerability database,
which seems a little high. A net effect is that many combinations are
not recognized, and users remain
unprotected even though they assume the opposite. If you need to record
the included components, please
do this in the pkg-message, which is displayed with pkg_info -D.
Again:
* a port should *not* change its version numbering based on included
components
* restrain yourself to *one* suffix in the package name (and use a dash
to seperate it from the main ports name)
Thanks
-Oliver
