On Thu, Nov 17, 2005 at 01:19:29AM +0100, Roland Illig wrote:
> The output from the check-vulnerable target is hidden completely because 
> after the assigment vul=`${MAKE} ${MAKEFLAGS} check-vulnerable`, which 
> returns FALSE, all further processing is inhibited. That includes the 
> ${ECHO} "$$vul".
> 
> The appended patch fixes that. Then the output looks like:
> 
> Updating pkgtools
> ===> Cleaning for pkg_install-20051114
> ===> Checking for vulnerabilities in pkg_install-20051114
> ===> *** The audit-packages package must be at least version 0.40
> ===> *** Please install pkgsrc/security/audit-packages package and run
> ===> *** '/home/bulk/pkg/sbin/download-vulnerability-list'.
> *** Error code 1

	I fixed two problems: audit-packages needs to be _1_.40, not 0.40, and
I changed it to not display the message about adjusting mk.conf when the
check-vulnerabile target output doesn't have any vulnid's in it.
	That causes the output to appear correctly on my machine, whether
w/ an old audit-packages, no audit-packages w+w/o pkg-vulnerabilities
or with a new audit-packages but a vulnerable package.
	I'm not sure what's went wrong when you ran it.  You should have
gotten _some_ kind of output.  Can you try with the latest bsd.pkg.mk?

eric