>Number:         17186
>Category:       pkg
>Synopsis:       audit-packages ignores DISTDIR
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jun 07 01:13:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Martti Kuparinen
>Release:        NetBSD 1.6_BETA1
>Organization:
>Environment:
System: NetBSD dhcp118.verkstad.net 1.6_BETA1 NetBSD 1.6_BETA1 (KAYAK) #2: Wed May 29 13:47:35 CEST 2002 root@dhcp118.verkstad.net:/work/netbsd/src/sys/arch/i386/compile/KAYAK i386
Architecture: i386
Machine: i386
>Description:

I just noticed that security/audit-packages's download-vulnerability-list
saves the vulnerability list to /usr/pkgsrc/distfiles even though the user
might keep his distfiles somewhere else.

>How-To-Repeat:

# echo DISTDIR=/tmp/distfiles >> /etc/mk.conf
[install some package and see how the distfile is saved into /tmp/distfiles]
# download-vulnerability-list
[see how the vulnerability list is still stored in /usr/pkgsrc/distfiles]

>Fix:

Maybe some "grep DISTDIR /etc/mk.conf" kludge is needed to determine the
correct directory (not very elegant).
>Release-Note:
>Audit-Trail:
>Unformatted: