Checking for vulnerable packages before installing

[Iain Morgan <Iain.Morgan%nasa.gov@localhost>]

Hwllo,

I use a home-grown script to automate the building and installation of a
hundred or so packages and their dependencies. With the dependencies,
the installation ends up being over 1000 packages and frequently is
halted due to packages with some vulnerability or other.

Currently, I evaevaluate whether to add an IGNORE_URL line to the
pkg_install.conf as each vulnerability is encountered. But, this slows
down the build process since it often halts overnight. I know I could
set ALLOW_VULNERABLE_PACKAGES, but that is something I would rather not
do.

What I would like is a way to have pkgsrc check for vulnerabilities for
all packages (and their dependencies) without building them or halting,
so that I can evaluate the vulnerabilities in one go and then run the
build with less of a chance of it being interrupted. I'm not aware of
any make target that would accomplish this, but is such an approach
supported?

Thanks,

-- 
Iain Morgan