help with IGNORE_URL

["Steven M. Bellovin" <smb%cs.columbia.edu@localhost>]

I'm trying to use IGNORE_URL to let me build pidgin.  (The advisory
applies to icq; I don't use icq, so I'll take my chances.)

I've created an entry

        IGNORE_URL=http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1889

in /etc/pkg_install.conf; when I check it via

        # pkg_admin config-var IGNORE_URL
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1889
        some-other-advisory

I get what seems to be the right answer.  Nevertheless, when I try to
build it the system complains about the vulnerability:

# make
=> Bootstrap dependency digest>=20010302: found digest-20080510
===> Checking for vulnerabilities in pidgin-2.5.7
Package pidgin-2.5.7 has a denial-of-service vulnerability, see 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1889
ERROR: Define ALLOW_VULNERABLE_PACKAGES in mk.conf or IGNORE_URL in 
pkg_install.conf(5) if this package is absolutely essential.
*** Error code 1

What am I doing wrong?  (This is i386-current from yesterday,
pkg_install 20090610, pkgsrc HEAD.)


                --Steve Bellovin, http://www.cs.columbia.edu/~smb