diff options
| author | erh <erh@pkgsrc.org> | 2005-11-16 20:59:22 +0000 |
|---|---|---|
| committer | erh <erh@pkgsrc.org> | 2005-11-16 20:59:22 +0000 |
| commit | e2097e6bcdaccda79beb2ee845f3afcc302b4565 (patch) | |
| tree | e79d295786cae513adb8bb1aacbbf8c36a42690f /mk/defaults | |
| parent | ace0d0453ee78a7c5e3b9eaa6c6784f6544f0a52 (diff) | |
| download | pkgsrc-e2097e6bcdaccda79beb2ee845f3afcc302b4565.tar.gz | |
Improve the handling of allowed vulnerabilities. Instead of the single
ALLOW_VULNERABLE_PACKAGES settings that applies to all packages, there can
now be per-package lists of allowed vulnerability ids:
ALLOW_VULNERABILITIES.<pkgname>=<space separated list of vulnids>
To avoid duplication of code, audit-packages is now used to do these checks.
It can be skipped altogether by setting:
SKIP_AUDIT_PACKAGES=yes
Diffstat (limited to 'mk/defaults')
| -rw-r--r-- | mk/defaults/mk.conf | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/mk/defaults/mk.conf b/mk/defaults/mk.conf index 1f02dfc9bf3..772abbed489 100644 --- a/mk/defaults/mk.conf +++ b/mk/defaults/mk.conf @@ -1,4 +1,4 @@ -# $NetBSD: mk.conf,v 1.91 2005/11/15 12:54:36 tonio Exp $ +# $NetBSD: mk.conf,v 1.92 2005/11/16 20:59:23 erh Exp $ # # This file provides default values for variables that may be overridden @@ -14,12 +14,20 @@ # NOTE TO PEOPLE EDITING THIS FILE - USE LEADING SPACES, NOT LEADING TABS. # ************************************************************************ -#ALLOW_VULNERABLE_PACKAGES= -# allow the user to build packages which are known to be vulnerable to -# security exploits -# Possible: defined, not defined +#ALLOW_VULNERABILITIES.<pkgname>= +# List of vulnerability ids to ignore when performing audit-packages +# check when building a package. +# Possible: one or more vulnerabilities ids, +# or the word "yes" to allow all. (not recommended) # Default: not defined +SKIP_AUDIT_PACKAGES=no +# Completely skip running audit-packages to check for vulnerable packages. +# Specifying individual vulnerabilities with +# ALLOW_VULNERABILITIES.<pkgname>=<vulnid> is preferred to using this. +# Possible: yes, no +# Default: no + MANINSTALL?= maninstall catinstall # Specify manpage installation types. # Possible: maninstall, catinstall, both types or empty |