On Tue, Aug 11, 2026, at 8:25 AM, Piotr Smyrak wrote: > On Tue, 11 Aug 2026 07:20:38 -0400 > "Dan Langille" <[email protected]> wrote: > >> On Tue, Aug 11, 2026, at 6:17 AM, Dan Mahoney wrote: >> > To Dan's L's point, though. >> >> [snip] >> >> > And yeah, pkg-audit needs a knob that exempts specific >> > CVEID's/vuxml entries/packages from its alert. If you've looked at >> > your system, read the tea leaves, asked other knowledgeable people, >> > asked your favorite LLM, and asked your magic 8 ball and you say >> > "okay, this is an imap and pop3 vuln, I am sure I'm not using those >> > libs" OR "I have patched the code that consumes those functions" OR >> > "in fact I've deleted them post-install, let me go on with life", >> > you should be able to. >> >> Please my post to freebsd-ports@ titled "modifying pkg-audit to >> ignore specified vulns" >> >> re: >> https://lists.freebsd.org/archives/freebsd-ports/2026-August/009871.html >> >> I have done a manual proof-of-concept and now it's just a simple >> matter of coding. > > Dan, > > IIUC, you are building your own packages. I would like to propose a > simpler approach that does not require any development whatsoever. > You could either patch the local ports tree or just revert the > commits that added these vulnerabilities to the XML file, and > build the VuXML DB from such patched port, publish the XML artifact to > be accessible from within Freshports network, and modify this setting in > pkg.conf: > > #VULNXML_SITE = "http://vuxml.freebsd.org/freebsd/vuln.xml.xz";; > > This way you just redirect the whole infrastructure to a custom > advisory DB, still built and relying on a slightly adjusted project DB. > > As long as you don't push from this local git repo of ports, you can > even commit the change. (I am assuming here, you use git to fetch the > tree).
That is a nice idea. Thank you. That helps me, definitely. The "tricky" part may be knowing there is a new VuXML to build and then distributing it. I'm an outlier. Most people do not build their own. -- Dan Langille [email protected]
