On Mon, Sep 20, 2004 at 10:22:33PM -0700, Jon Buller wrote:
> devel/tla has a slightly odd package numbering scheme, and it
> seems to be interacting badly with audit-packages...
> 
> pkg-vulnerabilities has the following entry:
> 
>      tla<1.2.1pre1	remote-code-execution	http://.....

The pkg-vulnerabilities entry has the wrong version string in it - as
far as I know, "pre" isn't one of the recognised magic strings that
are used for version numbers.

To quote from pkg_info(1):

     Package wildcards use fnmatch(3).  In addition, csh(1) style {,} alter-
     nates have been implemented.  Package version numbers can also be matched
     in a relational manner using the >=, <=, >, and < operators.  For exam-
     ple, pkg_info -e 'name>=1.3' will match versions 1.3 and later of the
     name package.  The collating sequence of the various package version num-
     bers is unusual, but strives to be consistent.  The magic string
     ``alpha'' equates to alpha version and sorts before a beta version.  The
     magic string ``beta'' equates to beta version and sorts before a release
     candidate.  The magic string ``rc'' equates to release candidate and
     sorts before a release.  For example, name-1.3rc3 will sort before
     name-1.3 and after name-1.2.9.  Similarly name-1.3alpha2 will sort before
     name-1.3beta1 and they both sort before name-1.3rc1.  In addition, alpha-
     betic characters sort in the same place as their numeric counterparts, so
     that name-1.2e has the same sorting value as name-1.2.5 The magic string
     ``pl'' equates to a patch level and has the same value as a dot in the
     dewey-decimal ordering schemes.

and from src/usr.sbin/pkg_install/lib/str.c:

static const test_t     modifiers[] = {
        {       "alpha",        5,      Alpha   },
        {       "beta",         4,      Beta    },
        {       "rc",           2,      RC      },
        {       "pl",           2,      Dot     },
        {       "_",            1,      Dot     },
        {       ".",            1,      Dot     },
        {       NULL,           0,      0       }
};

Regards,
Alistair