====== VuXML ======
%%VuXML%% is the data format used to document security vulnerabilities in the %%FreeBSD%% Ports Collection.
===== Adding entries =====
Note: this process is tentative. Feel free to discuss and contribute. A reworded version of this section might fit into a PHB [[http://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html|chapter]].
==== Theory ====
  * Don't panic!
    * Rushing with security advisories can bring more damage than delaying them.
    * Experience shows quite a few entries are added in a hurry, contain incomplete information and are unlikely to be corrected due to a "problem closed" kind of syndrome.
  * Read up a bit.
    * A security advisory made by someone who doesn't understand the first thing about it is a security hole in itself.
  * Search %%VuXML%% for 2-3 (the more the better) previous entries affecting the package in question.
    * Chances are the previous entries affected other packages as well and you need to include them in the new entry.
    * Firefox is a good example where every other entry lacks half of affected packages.
  * Don't ignore recently deleted packages.
    * If a package has been deleted within a few months ago, we can't let down all the users who still have it installed and trust portaudit.
  * Respect format
    * If paragraphs in the entire vuln.xml file are wrapped at column 80 (or less) and your terminal has 160 columns, it doesn't mean we should all switch to your standards.
==== Practice ====
  * Make sure you have security/vuxml installed.
  * Check out security/vuxml into a working dir and cd to it.
  * % make newentry
  * % make validate
  * submit a diff for review or commit it right away if you running low on pointyhats

===== Next VuXML version =====

This section contains ideas for possible additions to the %%VuXML%% specification.

* Specify architecture for each vulnerability (suggested by sem@)

----

{{tag>Ports Stale}}