Hisashi T Fujinaka wrote:
...
I'm unclear on the whole thing. On my -current system, audit-packages
does nothing. Well, it does something but doesn't indicate anything.
What am I supposed to be doing to check my packages on -current?
Have a look at the MESSAGE from pkgsrc/pkgtools/pkg_install and see if
that answers any of your questions. I'd point you to other sources on
www.netbsd.org but I've just realised they are not fully up to date :<
I'll get on to updating them ASAP, but basically you:
* Run download-vulnerability-list from cron to get the updated list of
vulnerable packages (a.k.a pkg-vulnerabilities)
* Run audit-packages from cron to scan for installed vulnerable packages
Also, if you install a package, and the pkgsrc infrastructure detects
you have the pkg-vulnerabilities file, it will warn you if the package
you are trying to install has any known security issues.
I'm also sane and run "stable" versions of netbsd on several
"production" servers rather than -current. What do I use instead of
audit-packages?
As I mentioned in my initial email all the functionality in
security/audit-packages is now in pkg_install. Just make sure you have
a recent pkg_install package (i.e. post 20070714) and you will have all
the tools at your disposal.
Apparently something changed and I missed the notification, or perhaps
it was all decided on netbsd-core and the regular folks have no idea
what's going on. (Yes, this is yet another ignored complaint about
netbsd-core's opacity.)
The only real change that's gone on here is that security/audit-packages
has been replaced by tools in pkgtools/pkg_install. With that
replacement has come extra functionality and improved performance. So
basically is a case of "same job, different tools". Nothing has been
hidden here and there are multiple emails to public lists and
announcements that detail this [1]. Also, all the tools have associated
man pages.
regards,
adrian.
[1]
http://mail-index.netbsd.org/tech-userlevel/2007/02/22/0003.html
http://mail-index.netbsd.org/tech-pkg/2007/05/25/0001.html
http://mail-index.netbsd.org/tech-pkg/2007/10/15/0008.html