From owner-freebsd-ports  Thu Jul 18 23:20:20 2002
Delivered-To: freebsd-ports@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1C2FE37B401
	for <freebsd-ports@hub.freebsd.org>; Thu, 18 Jul 2002 23:20:04 -0700 (PDT)
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B4BEA43E6A
	for <freebsd-ports@hub.freebsd.org>; Thu, 18 Jul 2002 23:20:02 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g6J6K2JU063065
	for <freebsd-ports@freefall.freebsd.org>; Thu, 18 Jul 2002 23:20:02 -0700 (PDT)
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g6J6K2Fs063064;
	Thu, 18 Jul 2002 23:20:02 -0700 (PDT)
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2243937B400
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 18 Jul 2002 23:17:06 -0700 (PDT)
Received: from www.freebsd.org (www.FreeBSD.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id DD72543E31
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 18 Jul 2002 23:17:05 -0700 (PDT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.12.4/8.12.4) with ESMTP id g6J6H5OT085335
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 18 Jul 2002 23:17:05 -0700 (PDT)
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.12.4/8.12.4/Submit) id g6J6H5Ut085334;
	Thu, 18 Jul 2002 23:17:05 -0700 (PDT)
Message-Id: <200207190617.g6J6H5Ut085334@www.freebsd.org>
Date: Thu, 18 Jul 2002 23:17:05 -0700 (PDT)
From: Caitlen <aeonflux@trioptimum.com>
To: freebsd-gnats-submit@FreeBSD.org
X-Send-Pr-Version: www-1.0
Subject: ports/40757: by cvsupfile defaults
Sender: owner-freebsd-ports@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-ports.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-ports>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-ports>
X-Loop: FreeBSD.org


>Number:         40757
>Category:       ports
>Synopsis:       by cvsupfile defaults
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-ports
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jul 18 23:20:02 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Caitlen
>Release:        4.6
>Organization:
none
>Environment:
4.6p3 release
>Description:
The cvsupit port has a special user friendly application that builds a cvsupfile for you.  This file is flawed by default and does NOT include src-crypto or src-secure, meaning that openssl and openssh do NOT get updated when you run make world, and thus remain the older (READ: Vulnerable) versions of the software.
>How-To-Repeat:
install cvsupit and look at the file created in /etc/cvsupfile
notice how src-secure and src-crypto are NOT included.
>Fix:
Change the defaults to read src-all, instead of individually listing every category except the REALLY important ones like security and crypto :)

the port should also create an empty /usr/sup/refuse and tell the user of it's existence.  So the users know they can add "russian", or whatever other ports from the collection they dont want to it.  By default this isn't explained.
>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message