Install Portaudit On OpenBSD

[TheNoob]

Hello all,

On freebsd, I use portaudit to check my ports vulnerabilities.
On OpenBSD ,I saw there is a VUXML for OpenBSD too (http://www.vuxml.org/openbsd/index.html)
But vxquery or portaudit are not in ports and no packages are available.
Could you tell me if portaudit works on OpenBSD and can I install it on OpenBSD ?

Best Regards

[ocicat]

Originally Posted by TheNoob

On freebsd, I use portaudit to check my ports vulnerabilities.
On OpenBSD ,I saw there is a VUXML for OpenBSD too (http://www.vuxml.org/openbsd/index.html)

The latest entries on that page come from 2006, so I would be wary of how conscientiously this application is being maintained.

As for portaudit, there aren't even any references found in the ports@ mailing list.

Your questions are valid, however Mark Espie has put a lot of work into improving the infrastructure of OpenBSD's ports/package system, so I would be hesitant about making any generalized assumptions about similarities with FreeBSD's ports system.

With respect to security concerns over third-party applications, I would say that keeping OpenBSD up-to-date is a good first step in making your goal.

[TheNoob]

Thanks ocicat for your answer

[ocicat]

A question you should ask is how effective is the portaudit application? Given the number of applications, & the differing rates at which they may have issues (plus resolutions), can a tool tracking all of this information be timely, reliable, & effective?

Although it is merely conjecture on my part, but I suspect the answer to this question is why such an application does not exist in the OpenBSD environment.

[jggimi]

There was an attempt to do something similar in 2005.

A tool called "pkg_check" was developed, and a VuXML database for OpenBSD was begun.

The tool was never added to the ports tree, and the database at www.vuxml.org/openbsd has not been updated since January 2006.

I have not determined the reason the project was abandoned. One could always e-mail the developers and ask, I suppose, but it is moot; such a tool is neither available nor useable with this OS.