Joerg Sonnenberger <joerg@britannica.bec.de> writes:

>> 2) audit-packages writes to standard error.  It used to write to
>> standard output (as I think it should), and it's documented to write to
>> standard output.  I suspect this is just a bug.
>
> What is it writing to standard error?

All the lines about which packages have vulnerabilities.  It wrote
nothing to standard output.

sudo /usr/obj/gdt-current/destdir/i386/usr/sbin/audit-packages  >A 2>B

A is empty

B contains a line that some package has some vulnerability

(same happened without sudo, and with pkg_install from pkgsrc; but I
just updated and am in the middle of a base system rebuild, so this is
the code in -current)