under IRIX. Other OS regen the catman page.
This addresses PR pkg/23452.
Since just depending on textproc/groff would pull in a large number of
packages (such as perl, ghostscript, tiff etc.), and since this is a very
important package that should NOT depend on all this gunk, Jeremy C. Reed
suggested this solution.
Ok agc.
By popular demand, add a -v switch to audit-packages(8) which enables the
check for a package vulnerabilities file being unchanged for over 7 days.
To enable the check, -v must be specified on the command line:
% audit-packages
% audit-packages -v
*** WARNING - /usr/distfiles/pkg-vulnerabilities more than a week old, continuing...
%
Difference from previous version (1.26):
+ if the vulnerability list is older than a week, just display a warning
message - don't consider this a fatal error.
+ get rid of unnecessary awk invocation in audit-packages, use shell
construction instead, pointed out by enami tsugutomo. Cuts system and
user execution times for audit-packages in half.
+ add (4-clause) licences to audit-packages and download-vulnerability-list
+ check integrity of pkg-vulnerabilities file in audit-packages by using
the same construct as in download-vulnerability-list
+ CSE in error checking in audit-packages
+ properly terminate a case expression in download-vulnerability-list
Simplify quoting syntax in the awk command, so that gawk-3.1.3 (as found in
NetBSD-current) doesn't have a problem with a malformed escape sequence.
With thanks to Johnny Lam for testing with an older version of gawk.
Changes from previous version:
+ rely on an embedded sha1 digest to tell whether the vulnerabilities
file has been damaged in transit or received successfully, rather than
trusting that the file will not grow smaller
+ use the new filename "pkg-vulnerabilities"
+ use definitions from defs.${OPSYS}.mk in the download-vulnerability-list
script
+ at installation time, don't rely on "ln -sf" to DTRT - explicitly call
"rm -f" before attempting the symbolc link
With thanks to seb@ for testing.
Instead of using the number of bytes to determine whether or not the
file has shrunk, use the number of lines. This will allow for
spelling corrections, login name of committers being shorter than
others, etc. This is a temporary measure until a better distribution
mechanism is used. Suggested by David Brownlee.
The directory ${PKGVULNDIR)} holding the 'vulnerabilities' file
which default value is determined at configure time can now be
overridden at runtime from the environment.
As a side effect the strings substituted at configure time in
files/{audit-packages,download-vulnerability-list} are now of the
form '@VAR@' and not '${VAR}'.
Fix a problem which occurs if the vulnerability list does not already exist.
This fixes PR 12763 from Brian de Alwis (bsd@cs.ubc.ca), albeit in a
slightly different manner. (I also added a check for the existence of
the new vulnerabilities file, in case it was not downloaded for some
reason).
Incorporates the following changes from Anne Bennett
(anne@alcor.concordia.ca) in PR 12538:
(1) Running download-vulnerability-list as it stands from cron will
spam the sysadmin with ftp output. Easy to fix: redirect output
to /dev/null as per the example in pkg/MESSAGE. Problem: now
we lose some error messages as well. Patch: make sure error
complaints in that script are spouted to STDERR, not STDOUT.
(3) Minor readability issue: set the source location for the
vulnerability list in a variable at the top of the script.
(4) PR 12457 reported that audit-packages complained spuriously
when the vulnerability list had not been updated in over a
week, and suggested touching it as a solution. This loses
the information of when the file was really last updated.
I'd prefer to always "mv" the new file into place, and use
mtime instead of ctime in the file freshness test.
I did this part of the PR differently, as I was worried about
incomplete vulnerability lists being downloaded, and overwriting an
existing vulnerability list:
(2) ftp failure in download-vulnerability-list is not being detected
properly by the current "${FETCH_CMD} .. || (complain; exit 1)"
test. Patch: test for a non-zero vulnerability file instead.
Don't forget to remove any zero-length droppings, if any.
We know that the vulnerability list size will increase, and not
decrease, so test the size of the newly-downloaded file. If the new
file is smaller than the existing file, then a bad transfer has taken
place - log this fact, and remove the new list.
