VuXML

VuXML is the data format used to document security vulnerabilities in the FreeBSD Ports Collection.

Note: this process is tentative. Feel free to discuss and contribute. A reworded version of this section might fit into a PHB chapter.

• Don't panic!
  • Rushing with security advisories can bring more damage than delaying them.
  • Experience shows quite a few entries are added in a hurry, contain incomplete information and are unlikely to be corrected due to a “problem closed” kind of syndrome.
• Read up a bit.
  • A security advisory made by someone who doesn't understand the first thing about it is a security hole in itself.
• Search VuXML for 2-3 (the more the better) previous entries affecting the package in question.
  • Chances are the previous entries affected other packages as well and you need to include them in the new entry.
  • Firefox is a good example where every other entry lacks half of affected packages.
• Don't ignore recently deleted packages.
  • If a package has been deleted within a few months ago, we can't let down all the users who still have it installed and trust portaudit.
• Respect format
  • If paragraphs in the entire vuln.xml file are wrapped at column 80 (or less) and your terminal has 160 columns, it doesn't mean we should all switch to your standards.

• Make sure you have security/vuxml installed.
• Check out security/vuxml into a working dir and cd to it.
• % make newentry
• % make validate
• submit a diff for review or commit it right away if you running low on pointyhats

This section contains ideas for possible additions to the VuXML specification.

* Specify architecture for each vulnerability (suggested by sem@)