On 2 Aug 2007, at 14:24, Joerg Sonnenberger wrote:

> Index: check.mk
> ===================================================================
> RCS file: /home/joerg/repo/netbsd/pkgsrc/mk/flavor/pkg/check.mk,v
> retrieving revision 1.4
> diff -u -r1.4 check.mk
> --- check.mk	14 Jul 2007 17:17:46 -0000	1.4
> +++ check.mk	1 Aug 2007 11:44:03 -0000
> @@ -11,8 +11,7 @@
>  #
>  _flavor-check-vulnerable: .PHONY
>  	${_PKG_SILENT}${_PKG_DEBUG}					\
> -	_INFO_VER=`${PKG_INFO} -V`;					\
> -	if ${PKG_ADMIN} pmatch 'pkg_install<20070714' pkg_install-$$_INFO_VER; then \
> +	if ${PKG_ADMIN} pmatch 'pkg_install<20070714' pkg_install-${PKGTOOLS_VERSION}; then \
>  		vulnfile=${PKGVULNDIR:Q}/pkg-vulnerabilities;		\
>  		if ${TEST} ! -f "$$vulnfile"; then			\
>  			${PHASE_MSG} "Skipping vulnerability checks.";	\

I've been using separate PKGVULNDIR (/var/db/audit-packages) with 
PKGVULNDIR set in both mk.conf and audit-packages.conf.

Prior to patch the script was looking for /pkg-vulnerabilities and 
now looking for it in /usr/pkgsrc_distfiles.

David