I am developing a Multi-Release PKGSRC Guide for HPC and scientific computing environments.
https://github.com/georgalis/pub/blob/main/boot/pkgsrc_guide.mdThe guide aims to simplify the software approval process by using a two-step strategy:
First, obtain approval for pkgsrc as a software packaging framework
Then, seek approval for individual software packages built with pkgsrc
A key advantage of pkgsrc is its ability to maintain multiple LOCALBASE release cycles simultaneously---you can keep a stable, qualified set of software versions while also installing newer versions in separate LOCALBASE directories.
If anyone has experience representing pkgsrc as a software, for approvals, I am interested in your resources and experience. Please reach out to me directly or through this list.
As a side note, I may have identified a security bug, although I configured
ALLOW_VULNERABLE_PACKAGES= NO
in my $LOCALBASE/etc/mk.conf immediately after bootstrap, then ran
pkg_admin fetch-pkg-vulnerabilities -u
prior to package builds, and pkgin installs.
Several vulnerable packages were installed,
as indicated by "pkg_admin audit"
My bootstrap and package build procedure is as described in the guide, and executed on Darwin/macOS. Is this a bug or have I done something wrong?
Thanks,
George
--
George Georgalis, (415) 894-2710,
http://www.galis.org/