This is an old revision of the document!
VuXML
VuXML is the data format used to document security vulnerabilities in the FreeBSD Ports Collection.
Adding entries
Note: this process is tentative. Feel free to discuss and contribute. A reworded version of this section might fit into a PHB [http://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html chapter].
Theory
- Don't panic!
- Rushing with security advisories can bring more damage than delaying them.
- Experience shows quite a few entries are added in a hurry, contain incomplete information and are unlikely to be corrected due to a “problem closed” kind of syndrome.
- Read up a bit.
- A security advisory made by someone who doesn't understand the first thing about it is a security hole in itself.
- Search VuXML for 2-3 (the more the better) previous entries affecting the package in question.
- Chances are the previous entries affected other packages as well and you need to include them in the new entry.
- Firefox is a good example where every other entry lacks half of affected packages.
Practice
- Make sure you have security/vuxml installed.
- Check out security/vuxml into a working dir and cd to it.
- % sh files/newentry.sh vuln.xml
- % vim vuln.xml
- % sh files/validate.sh vuln.xml
- submit a diff for review or commit it right away if you running low on pointyhats
Next VuXML version
This section contains ideas for possible additions to the VuXML specification.
* Specify architecture for each vulnerability (suggested by sem@)