Re: pkgsrc binary packages security with pkgin

[Leonardo Taccari <leot%NetBSD.org@localhost>]

Ottavio Caruso writes:
> [...]
> I believe there's an internal pkgsrc security mailing list to which 
> users have no access (I could be wrong), so I don't really know how this 
> auditing really works.
>
> One can always "pkg_admin fetch-pkg-vulnerabilities && pkg_admin audit".
> [...]

pkgsrc-security@ is a team, usually there isn't much traffic on it and
the most possible private information that happens is on an internal RT
ticket system to track tickets that then ends up in pkg-vulnerabilities
file.

However, this is mostly unrelated to signing binary packages (we manually
sign the pkg-vulnerabilities file but that's unrelated).