% Author: Jan Schaumann <jschauma@netmeister.org>
% $Id: pkgsrc.tex,v 1.2 2006/02/09 13:59:13 jschauma Exp $

\documentclass[xga]{xdvislides}
\usepackage{graphics}
\usepackage{graphicx}
\usepackage{colordvi}
\usepackage{color}
\usepackage{ulem}
\normalem

\begin{document}
\setfontphv

%%% Headers and footers
\lhead{\slidetitle}				% default:\lhead{\slidetitle}
\chead{pkgsrc - The NetBSD Packages Collection}% default:\chead{\relax}
\rhead{Slide \thepage}
\lfoot{\Gray{Jan Schaumann}}		% default:\lfoot{\slideauthor}
\cfoot{\relax}
\rfoot{\Gray{\today}}

\vspace*{\fill}
\begin{center}
	\Hugesize
		-- pkgsrc -- \\
		\addvspace{.25in}
		The NetBSD Packages Collection \\ [1em]
	\hspace*{5mm}\blueline\\ [1em]
	\Normalsize
		{\em Jan Schaumann}\\
		\verb+jschauma@NetBSD.org+ \\
		\addvspace{.125in}
		\small
		\verb+136D 027F DC29 8402 7B42  47D6 7C5B 64AF AF22 6A4C+ \\
		\Normalsize
\end{center}
%\markright{}
\vspace*{\fill}

\subsection{Topics covered}
\begin{itemize}
	\item Concept of Software Package Management
	\item Features of pkgsrc
	\item Using pkgsrc
		\begin{itemize}
			\item Using binary packages
			\item Building packages from source
			\item Updating packages
			\item Deploying large numbers of binary packages
		\end{itemize}
	\item A look ahead
\end{itemize}

\subsection{General Concepts: File System Hierarchy}

Basic distinction between {\em shareable} and {\em unshareable} files.
\\

Shareable content:
\begin{itemize}
	\item essential components that remain the same across multiple hosts
	\item often possible to mount read-only
	\item may overlap with {\em local} data
\end{itemize}
\addvspace{.5in}

Unshareable content:
\begin{itemize}
	\item data that needs to be individual to each host
	\item data that changes often
	\item may overlap with {\em local} data
\end{itemize}

\subsection{General Concepts: File System Hierarchy}
Examples:
\\

\begin{center}
\begin{tabular}{| l | l | l |}
	\hline
	& shareable content & unshareable content \\
	\hline
	static   & & \\
	         & & \\
	\hline
	variable & & \\
	         & & \\
	\hline
\end{tabular}
\end{center}


\subsection{General Concepts: File System Hierarchy}
Examples:
\\

\begin{center}
\begin{tabular}{| l | l | l |}
	\hline
	& shareable content & unshareable content \\
	\hline
	static   & \verb+/usr+ & \\
	         & \verb+/opt+ & \\
	\hline
	variable & & \\
	         & & \\
	\hline
\end{tabular}
\end{center}

\subsection{General Concepts: File System Hierarchy}
Examples:
\\

\begin{center}
\begin{tabular}{| l | l | l |}
	\hline
	& shareable content & unshareable content \\
	\hline
	static   & \verb+/usr+ & \verb+/etc+ \\
	         & \verb+/opt+ & \verb+/boot+ \\
	\hline
	variable & & \\
	         & & \\
	\hline
\end{tabular}
\end{center}

\subsection{General Concepts: File System Hierarchy}
Examples:
\\

\begin{center}
\begin{tabular}{| l | l | l |}
	\hline
	& shareable content & unshareable content \\
	\hline
	static   & \verb+/usr+ & \verb+/etc+ \\
	         & \verb+/opt+ & \verb+/boot+ \\
	\hline
	variable & \verb+/var/mail+ & \\
	         & \verb+/var/spool/news+ & \\
	\hline
\end{tabular}
\end{center}

\subsection{General Concepts: File System Hierarchy}
Examples:
\\

\begin{center}
\begin{tabular}{| l | l | l |}
	\hline
	& shareable content & unshareable content \\
	\hline
	static   & \verb+/usr+ & \verb+/etc+ \\
	         & \verb+/opt+ & \verb+/boot+ \\
	\hline
	variable & \verb+/var/mail+ & \verb+/var/run+ \\
	         & \verb+/var/spool/news+ & \verb+/var/lock+ \\
	\hline
\end{tabular}
\end{center}

\subsection{General Concepts: System Software vs. Third Party Software}
Consider:
\begin{itemize}
	\item OS upgrades vs. software upgrades
	\item configuration files get mixed up
	\item duplicates or conflicting versions in the base system vs. the
		add-ons
	\item startup scripts, d{\ae}mons
	\item location of third party software
	\item proprietary third party software
\end{itemize}

\subsection{General Concepts: Why use a Package Management System?}
Sure, you {\em could} install everything by hand.  But ...
\begin{itemize}
	\item thousands of applications and libraries are available
	\item binaries are not available for all platforms
	\item compilation from source is not always trivial
		\begin{itemize}
			\item ``90\% of everything is crud''
			\item platform and compiler issues may arise
			\item different ways of satisfying dependencies / optional
				features
		\end{itemize}
	\item how to maintain a database of installed applications?
	\item dependencies among applications and libraries grow
		rather complex
\end{itemize}

\subsection{General Concepts: Complexity of Dependencies}
An example: Let's install some software to produce nice slides! \\

\vspace*{\fill}
\begin{center}
	\includegraphics[scale=1.0]{figs/xdvipresent.1.ps}
\end{center}

\subsection{General Concepts: Complexity of Dependencies}
An example: Let's install some software to produce nice slides! \\

\vspace*{\fill}
\begin{center}
	\includegraphics[scale=1.0]{figs/xdvipresent.2.ps}
\end{center}

\subsection{General Concepts: Complexity of Dependencies}
An example: Let's install some software to produce nice slides! \\

\vspace*{\fill}
\begin{center}
	\includegraphics[scale=0.8]{figs/xdvipresent.3.ps}
\end{center}



\subsection{General Concepts: Package Management}
Important aspects of package management:
\begin{itemize}
	\item available for virtually all OS
	\item may include building from source as well as binary package
		management
	\item easily determine what is installed
	\item keep track of {\em where} things are installed
	\item make {\em consistent} use of the package manager
	\item consider providing separate {\em ``depots''} or {\em ``views''} for
		different purposes
	\item teach users to use the tools
\end{itemize}

\subsection{Enter pkgsrc...}
\begin{verbatim}
$ wtf pkgsrc
Gee...  I don't know what pkgsrc means...
$
\end{verbatim}
\vspace*{\fill}
\begin{flushright}
	\includegraphics[scale=0.6]{figs/pkg-daemon.eps}
\end{flushright}

\subsection{Enter pkgsrc...}
\begin{verbatim}
$ wtf pkgsrc
Gee...  I don't know what pkgsrc means...
$
\end{verbatim}
\addvspace{1in}
\begin{quote}
	``The NetBSD Packages Collection (pkgsrc) is a framework for building
third-party software on NetBSD and other UNIX-like systems, currently
containing nearly 5300 packages. It is used to enable freely available
software to be configured and built easily on supported platforms.''
\end{quote}
\vspace*{\fill}
\begin{flushright}
	\includegraphics[scale=0.6]{figs/pkg-daemon.eps}
\end{flushright}



\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
\end{itemize}

\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
\end{itemize}


\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
\end{itemize}


\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
\end{itemize}


\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
	\item FreeBSD (2002)
\end{itemize}


\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
	\item FreeBSD (2002)
	\item OpenBSD (2002)
\end{itemize}


\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
	\item FreeBSD (2002)
	\item OpenBSD (2002)
	\item IRIX (2002)
\end{itemize}


\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
	\item FreeBSD (2002)
	\item OpenBSD (2002)
	\item IRIX (2002)
	\item BSD/OS (2003)
\end{itemize}

\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
	\item FreeBSD (2002)
	\item OpenBSD (2002)
	\item IRIX (2002)
	\item BSD/OS (2003)
	\item AIX (2003)
\end{itemize}


\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
	\item FreeBSD (2002)
	\item OpenBSD (2002)
	\item IRIX (2002)
	\item BSD/OS (2003)
	\item AIX (2003)
	\item Interix -- Microsoft Windows Services for Unix (2004)
\end{itemize}

\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
	\item FreeBSD (2002)
	\item OpenBSD (2002)
	\item IRIX (2002)
	\item BSD/OS (2003)
	\item AIX (2003)
	\item Interix -- Microsoft Windows Services for Unix (2004)
	\item DragonFlyBSD (2004)
\end{itemize}

\subsection{Platforms supported by pkgsrc}

\begin{itemize}
	\item NetBSD (1997)
	\item Solaris -- first non-NetBSD platform supported, aka ``Zoularis'' (1999)
	\item Linux (1999)
	\item Darwin / Mac OS X (2001)
	\item FreeBSD (2002)
	\item OpenBSD (2002)
	\item IRIX (2002)
	\item BSD/OS (2003)
	\item AIX (2003)
	\item Interix -- Microsoft Windows Services for Unix (2004)
	\item DragonFlyBSD (2004)
	\item OSF/1 (2004)
\end{itemize}

\subsection{pkgsrc Terminology}
{\em ``pkgsrc''} -- the NetBSD Packages Collection (ie the package management
system)
\\

{\em ``port''} -- In NetBSD terminology, {\em ``port''} refers to a different
architecture;  FreeBSD and OpenBSD refer to what we call a {\em ``package''}
with the word {\em ``port''}.
\\

{\em ``package''} -- A set of files and building instructions that describe
what's necessary to build a certain piece of software using pkgsrc.
Packages are traditionally stored under \verb+/usr/pkgsrc+.
\\

{\em ``binary package''} --  A set of binaries built with pkgsrc from a
distfile and stuffed together in a single \verb+.tgz+ file so it can be
installed on machines of the same machine architecture without the need to
recompile.
\\

{\em ``distfile''} -- The file(s) that are provided by the author of the piece
of software to distribute his or her work. All the changes necessary to build
on NetBSD are reflected in the corresponding {\em package}.  Distfiles are
usually fetched into /usr/pkgsrc/distfiles.

\subsection{Features of pkgsrc}
Some of the more obvious features:
\begin{itemize}
	\item fetching of {\em distfiles}
	\item dependency checking
	\item installation of the {\em package} and all dependencies
	\item maintenance of package database, including checksums of all files
	\item upgrade procedures:
		\begin{itemize}
			\item automatically upgrade all installed packages
			\item automatically upgrade a single package and all dependents
			\item upgrade a package in place (careful!)
		\end{itemize}
	\item all of the above applies equally to {\em binary packages} as well as
		building from source
\end{itemize}

\subsection{Features of pkgsrc}
Some more subtle features:
\begin{itemize}
	\item integrity checking via recorded checksum
	\item automatic patching of sources where necessary
	\item verification of acceptable licenses
	\item central configuration file to control pkgsrc behavior
		(\verb+/etc/mk.conf+ -- lots of knobs! See
		\verb+pkgsrc/mk/defaults/mk.conf+)
	\item checking of installed packages against known vulnerabilities
	\item pkgsrc release engineering -- \verb+HEAD+ and quarterly stable
		branches
\end{itemize}

\subsection{Using pkgsrc: Getting Started}
There are three ways to get pkgsrc:
\begin{itemize}
	\item via {\em sup}: \verb+release=pkgsrc+
	\item via {\em cvs}: \verb+cvs -d anoncvs@anoncvs.nebsd.org:/cvsroot co -P pkgsrc+
	\item via {\em ftp}: \verb+ftp://ftp.NetBSD.org/pub/NetBSD/NetBSD-current/tar_files/pkgsrc.tar.gz+
\end{itemize}
\addvspace{.5in}
On non-NetBSD platforms, you also need the necessary tools:
\begin{itemize}
	\item via binary bootstrap kits available from
		\verb+ftp://ftp.NetBSD.org/pub/NetBSD/packages/bootstrap-pkgsrc/+
	\item via pkgsrc itself:
		\begin{verbatim}
# cd /usr/pkgsrc/bootstrap
# more README
# ./bootstrap
		\end{verbatim}
\end{itemize}

\subsection{Using pkgsrc: Using binary packages}
Using \verb+pkg_add(1)+:\\

Precompiled packages are stored on ftp.NetBSD.org and its mirrors in the
directory \verb+/pub/NetBSD/packages+.
\\

Installation is as easy as \\
\verb+# pkg_add \\+
\verb+ftp://ftp.NetBSD.org/pub/NetBSD/packages/+\`\space\verb+uname -r+\`\space\verb+/+\`\space\verb+uname -p+\`\space\verb+/All/package.tgz+ \\

Influenced by (among others):
\begin{itemize}
	\item \verb+LOCALBASE+ -- place where all packages are installed; defaults
		to \verb+/usr/pkg+
	\item \verb+PKG_DBDIR+ -- place where information about all packages is
		stored; defaults to \verb+/var/db/pkg+
	\item \verb+PKG_PATH+ -- list of directories in which to look for binary
		packages; defaults to \verb+/usr/pkgsrc/packages/All.+
\end{itemize}

\subsection{Using pkgsrc: Building packages from source}
Package components:
\begin{itemize}
	\item \verb+Makefile+ -- instructions on how to download and build the software
	\item \verb+distinfo+ -- checksum of the {\em distfiles}
	\item \verb+patches/*+ -- any patches necessary to make the software build
	\item \verb+DESCR+ -- a description of the package
	\item \verb+PLIST+ -- the list of files that are installed
	\item a number of other optional files
\end{itemize}

\subsection{Using pkgsrc: Building packages from source}
A simple package: {\em net/tor} \\
\small
\begin{verbatim}
DISTNAME=           tor-0.0.9.3
CATEGORIES=         net security
MASTER_SITES=       http://tor.eff.org/dist/

MAINTAINER=         jschauma@NetBSD.org
HOMEPAGE=           http://tor.eff.org
COMMENT=            Anonymizing overlay network for TCP

.include "../../mk/bsd.prefs.mk"

.if !empty(PKGSRC_COMPILER:Mmipspro)
CFLAGS+=            -c99
.endif

do-install:
    ${INSTALL_PROGRAM} ${WRKSRC}/src/or/tor ${PREFIX}/bin/tor
    ${INSTALL_SCRIPT} ${WRKSRC}/contrib/torify ${PREFIX}/bin/torify
    ${INSTALL_MAN} ${WRKSRC}/doc/tor.1 ${PREFIX}/man/man1/tor.1
    ${INSTALL_MAN} ${WRKSRC}/contrib/torify.1 ${PREFIX}/man/man1/torify.1

.include "../../security/openssl/buildlink3.mk"
.include "../../mk/bsd.pkg.mk"
\end{verbatim}
\Normalsize

\subsection{Using pkgsrc: Building packages from source}
\begin{verbatim}
# cd /usr/pkgsrc/net/tor
# make install
\end{verbatim}

Easy!  But what exactly happens here?

\subsection{Using pkgsrc: Building packages from source}
\begin{verbatim}
# cd /usr/pkgsrc/net/tor
# make install
\end{verbatim}

Easy!  But what exactly happens here? \\

\verb+make+ performs the following steps:
\begin{enumerate}
	\item fetch {\em distfile}
	\item make sure checksum matches
	\item install dependencies (repeating these steps for each)
	\item extract {\em distfile}
	\item apply any patches (if necessary)
	\item configure software
	\item build software
	\item install software
\end{enumerate}

\subsection{Using pkgsrc: Creating binary packages}
\begin{verbatim}
# cd /usr/pkgsrc/net/tor
# make package
\end{verbatim}

Easy!  But what exactly happens here? \\

\subsection{Using pkgsrc: Creating binary packages}
\begin{verbatim}
# cd /usr/pkgsrc/net/tor
# make package
\end{verbatim}

Easy!  But what exactly happens here? \\

Not all that complicated:
\begin{itemize}
	\item \verb+make install+
	\item create binary package by including all the files and the
		meta-information in a tarball
\end{itemize}

Meta-information includes:
\begin{itemize}
	\item build information, such as \verb+OPSYS+, \verb+OS_VERSION+,
		\verb+CFLAGS+, etc.
	\item a one-line comment
	\item contents of the package, including checksums of all files; list of
		dependencies
	\item a description of the package
\end{itemize}

\subsection{Using pkgsrc: Updating packages}
Holy Grail: During the upgrade process -- which doesn't affect the running
system -- all dependents are upgraded as well ({\em iff} necessary). \\

In reality, this can get hairy! \\

Possibilities in pkgsrc:
\begin{itemize}
	\item delete package, rebuild and reinstall
	\item replace package without rebuilding dependencies
	\item delete package, remembering all dependents, then rebuild them all
\end{itemize}

\subsection{Using pkgsrc: Updating packages}
Delete package, rebuild and reinstall: \\

\verb+# make deinstall clean install+ \\
or \\
\verb+# pkg_delete <pkg-old> && pkg_add <pkg-new>+ \\

\begin{itemize}
	\item most simple approach
	\item works well for {\em leaf} packages
	\item well, works {\bf only} for {\em leaf} packages
\end{itemize}

\subsection{Using pkgsrc: Updating packages}
Replace package without rebuilding dependencies: \\

\verb+# make replace+ \\
or \\
\verb+# pkg_add -u <pkg>+ \\

\begin{itemize}
	\item register all dependents
	\item (force) delete existing package
	\item install new package
	\item register / update all dependents \\
	\item Problem: dependents may not work (correctly) with new version
\end{itemize}

\subsection{Using pkgsrc: Updating packages}
Delete package, remembering all dependents, then rebuild them all: \\

\verb+# make update+ \\

Note that this is the {\em only} way to guarantee that all packages will work
with each other! \\

Problems:
\begin{itemize}
	\item during rebuild process, the system is in unstable condition
	\item what if rebuild of one of the packages fails?
	\item highly ``destructive'' for upgrades of essential packages (such as
		libpng) \\
\end{itemize}

Solution: use a sandbox/chroot or another machine to build binary packages.

\subsection{Using pkgsrc: Updating packages}
Delete package, remembering all dependents, then rebuild them all. \\

Using binary packages: \\
\verb+# pkg_info > /tmp/before+  \\
\verb+# pkg_delete -r <pkg>+ \\
\verb+# pkg_info > /tmp/after+ \\
\verb+# diff /tmp/before /tmp/after+ \\
\verb+# pkg_add <each> <deleted> <pkg>+ \\

But this requires you to have binary packages available! \\
How do we do that?

\subsection{Using pkgsrc: Updating packages}
Delete package, remembering all dependents, then rebuild them all. \\

Using binary packages: \\
\verb+# pkg_info > /tmp/before+  \\
\verb+# pkg_delete -r <pkg>+ \\
\verb+# pkg_info > /tmp/after+ \\
\verb+# diff /tmp/before /tmp/after+ \\
\verb+# pkg_add <each> <deleted> <pkg>+ \\

But this requires you to have binary packages available! \\
How do we do that?

\begin{itemize}
	\item download all required packages from ftp.NetBSD.org
	\item (regularly) bulk-build {\bf all} packages yourself
	\item (regularly) build only the packages you actually need yourself
\end{itemize}

\subsection{Using pkgsrc: bulk-building all packages}
See \verb+/usr/pkgsrc/mk/bulk/*+ \\

\begin{itemize}
	\item create \verb+build.conf+ and point \verb+$BULK_BUILD_CONF+ to it
	\item \verb+# cd /usr/pkgsrc+
	\item \verb+# sh mk/bulk/build+
	\item read a good book
\end{itemize}
\addvspace{.5in}
{\bf Warning: During the bulk build, {\em all packages will be removed!}}

\subsection{Using pkgsrc: bulk-building all packages}
What you need: \\

\begin{itemize}
	\item lots of RAM and CPU power
	\item \verb+~+ 10 GB diskspace for {\em distfiles}
	\item \verb+~+ 8 GB diskspace for all resulting binary packages
	\item \verb+~+ 5 GB diskspace to extract and build everything
\end{itemize}
\addvspace{.5in}
If you do not have a constant internet connection, then you can fetch all
required distfiles at once: \\
\verb+# cd /usr/pkgsrc+ \\
\verb+# make fetch-list | sh+

\subsection{Using pkgsrc: bulk-building all packages}
The bulk builds consist of three steps:
\begin{enumerate}
	\item pre-build: \\
		The script updates your pkgsrc tree via (anon)cvs, then cleans out
		any broken distfiles, and removes all packages installed.
	\item the bulk build: \\
		This is basically \verb+make bulk-package+ with an optimized order in
		which packages will be built.  Packages that don't require other packages
		will be built first, and packages with many dependencies will be built later.
	\item post-build: \\
		Generates a report that's placed in the directory specified in the
		build.conf file named broken.html, a short version of that report will
		also be mailed to the build's admin.
\end{enumerate}
\addvspace{.5in}
Instructions on how to do this in a sandbox are available online.

\subsection{Using pkgsrc: bulk-building select packages}
Using \verb+pkg_comp(1)+:
\begin{itemize}
	\item automatically sets up and operates inside a chroot
	\item allows easy built of packages for other system versions
	\item specify which packages to build by setting \verb+BUILD_PACKAGES+
\end{itemize}
\addvspace{.5in}
Using \verb+pkg_chk(1)+:
\begin{itemize}
	\item automatically updates packages to latest pkgsrc version
	\item easily build sets of packages for different hosts
\end{itemize}

\subsection{Using pkgsrc: Security Audits}
\verb+security/audit-packages+ -- show vulnerabilities in installed packages
\\

\verb+pkg-vulnerabilities+, maintained by NetBSD Packages Team: \\
\small
\\
\begin{verbatim}

# package                       type of exploit          URL
[...]
mysql-client-4.1.[0-8]{,nb*}    local-file-write         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0004
ethereal<0.10.9                 remote-code-execution    http://www.ethereal.com/news/item_20050120_01.html
koffice<1.3.5nb4                remote-code-execution    http://www.kde.org/info/security/advisory-20050120-1.txt
squid<2.5.7nb6                  buffer-overrun           http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0094
unarj<2.65nb1                   local-file-write         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1027
suse_libtiff<9.1nb1             remote-code-execution    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1308
suse_x11<9.1nb1                 remote-code-execution    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0914
suse_gtk2<9.1nb3                denial-of-service        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788
webmin<1.160                    local-file-write         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0559
sun-jre14<2.6                   remote-code-execution    http://sunsolve.sun.com/search/document.do?assetkey=1-26-57708-1
sun-jdk14<2.6                   remote-code-execution    http://sunsolve.sun.com/search/document.do?assetkey=1-26-57708-1
sun-jre13<1.0.13                remote-code-execution    http://sunsolve.sun.com/search/document.do?assetkey=1-26-57708-1
sun-jdk13<1.0.13                remote-code-execution    http://sunsolve.sun.com/search/document.do?assetkey=1-26-57708-1
evolution14<1.4.6nb3            remote-code-execution    http://www.gentoo.org/security/en/glsa/glsa-200501-35.xml
evolution<2.0.3nb1              remote-code-execution    http://www.gentoo.org/security/en/glsa/glsa-200501-35.xml
enscript<1.6.5                  remote-code-execution    http://www.securityfocus.org/advisories/7879
bind-9.3.0                      denial-of-service        http://www.kb.cert.org/vuls/id/938617
p5-DBI<1.46nb2                  local-file-write         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0077
f2c<20001205nb8                 local-file-write         http://www.debian.org/security/2005/dsa-661
[...]
\end{verbatim}
\Normalsize

\subsection{Using pkgsrc: Other nifty tools}
Useful packages:
\begin{itemize}
	\item \verb+pkgtools/pkgdepgraph+ -- visual representation of installed
		packages
	\item \verb+pkgtools/pkgfind+ -- find packages by package name in pkgsrc
	\item \verb+pkgtools/pkglint+ -- check a
		pkgsrc entry for correctness (\verb+pkglint(1)+);  check for and remove
		out-of-date distfiles and binary packages (\verb+lintpkgsrc(1)+)
	\item \verb+pkgtools/pkg_tarup+ --  create a binary package from an
		already-installed package.
\end{itemize}
Useful variables:
\begin{itemize}
	\item \verb+IGNORE_RECOMMENDED=YES+
	\item \verb+DEPENDS_TARGET=package+
	\item \verb+MASTER_SITE_OVERRIDE=ftp://your.mirror/pub/NetBSD/packages/distfiles/+
\end{itemize}
Useful targets:
\begin{itemize}
	\item \verb+make show-all-depends-dirs+
	\item \verb+make show-var VARNAME=<VAR>+
\end{itemize}

\subsection{pkgsrc -- what's next?}
Areas in which work is being done / ideas that have been suggested:
\begin{itemize}
	\item using and bulk-building as non-root
	\item automated PLIST handling
	\item cross-building packages for slower architectures
	\item \verb+pkg_select+ -- a curses based pkgsrc browser / manager
	\item integration with \verb+sysinst+/\verb+sushi(8)+
	\item parallelizing bulk-builds
	\item extend \verb+audit-packages+ to include a \verb+pkg_ids+
\end{itemize}

\subsection{How you can help}
\begin{itemize}
	\item join \verb+tech-pkg@NetBSD.org+
	\item join {\em pkgsrc-wip} on SourceForge
	\item create new packages
	\item update existing packages
	\item look at PR database and submit patches
	\item port pkgsrc to other operating systems
	\item \verb+/usr/pkgsrc/doc/TODO+
\end{itemize}

\subsection{References}
\verb+http://www.pkgsrc.org/+ \\
\verb+http://www.NetBSD.org/+ \\
\verb+http://www.NetBSD.org/Documentation/pkgsrc/+ \\
\verb+http://pkgsrc-wip.sourceforge.net/+ \\
\verb+http://www.NetBSD.org/Gnats/category/pkg.html+ \\
\\

\verb+pkg_add(1)+, \verb+pkg_info(1), +\verb+pkg_delete(1)+, \verb+packages(7)+

\end{document}