Re: pkg-vulnerabilities file now in pkgsrc

[Thomas Klausner <wiz%NetBSD.org@localhost>]

On Fri, Sep 29, 2023 at 08:35:30AM -0600, Brook Milligan wrote:
> Just to be clear, the pkgsrc file will be the master version (except for signing)?  That is, the only pathway for new vulnerabilities into the signed version is through a commit to the pkgsrc file?  Is the process documented?

Exactly, and yes, in the pkgsrc guide (that's not new, I just updated the path):

http://netbsd.org/docs/pkgsrc/fixes.html#security-handling

 Thomas