 @@ -1315,30 +1315,30 @@ and you can still use binary packages fr
     will remove jpeg and all the packages that used it; this allows
     upgrading the jpeg package.</p>
 </div>
 <div class="sect2">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="using.pkg_info"></a>5.1.4. Getting information about installed packages</h3></div></div></div>
 <p>The <span class="command"><strong>pkg_info</strong></span> shows information about
     installed packages or binary package files.</p>
 </div>
 <div class="sect2">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="vulnerabilities"></a>5.1.5. Checking for security vulnerabilities in installed packages</h3></div></div></div>
 <p>
-      The NetBSD Security-Officer and Packages Groups maintain a list of
+      The pkgsrc Security Team and Packages Groups maintain a list of
       known security vulnerabilities to packages which are (or have been)
       included in pkgsrc.  The list is available from the NetBSD
-      FTP site at <a class="ulink" href="http://ftp.NetBSD.org/pub/pkgsrc/distfiles/vulnerabilities" target="_top">http://ftp.NetBSD.org/pub/pkgsrc/distfiles/vulnerabilities</a>.
+      FTP site at <a class="ulink" href="http://ftp.netbsd.org/pub/NetBSD/packages/vulns/pkg-vulnerabilities" target="_top">http://ftp.netbsd.org/pub/NetBSD/packages/vulns/pkg-vulnerabilities</a>.
     </p>
 <p>
       Through <span class="command"><strong>pkg_admin fetch-pkg-vulnerabilities</strong></span>,
       this list can be downloaded
       automatically, and a security audit of all packages installed on a system
       can take place.
     </p>
 <p>
       There are two components to auditing.  The first
       step, <span class="command"><strong>pkg_admin fetch-pkg-vulnerabilities</strong></span>,
       is for downloading
       the list of vulnerabilities from the NetBSD FTP site.  The second
       step, <span class="command"><strong>pkg_admin audit</strong></span>, checks to see if any of your
 @@ -9014,27 +9014,27 @@ place.
 </li>
 </ol></div>
 </div>
 </div>
 <div class="chapter">
 <div class="titlepage"><div><div><h2 class="title">
 <a name="devfaq"></a>Chapter 24. Frequently Asked Questions</h2></div></div></div>
 <p>This section contains the answers to questions that may
 	arise when you are writing a package. If you don't find your
 	question answered here, first have a look in the other chapters,
 	and if you still don't have the answer, ask on the
 	<code class="literal">pkgsrc-users</code> mailing list.</p>
 <div class="qandaset">
-<a name="idm79147248"></a><dl>
+<a name="idm74766032"></a><dl>
 <dt>24.1. <a href="#devfaq.makeflags">What is the difference between
 	MAKEFLAGS, .MAKEFLAGS and
 	MAKE_FLAGS?</a>
 </dt>
 <dt>24.2. <a href="#devfaq.make">What is the difference between
 	MAKE, GMAKE and
 	MAKE_PROGRAM?</a>
 </dt>
 <dt>24.3. <a href="#devfaq.cc">What is the difference between
 	CC, PKG_CC and
 	PKGSRC_COMPILER?</a>
 </dt>
 <dt>24.4. <a href="#devfaq.bl3flags">What is the difference between
 @@ -9059,157 +9059,157 @@ place.
 </dt>
 <dt>24.9. <a href="#devfaq.too-much-time">I have a little time to kill.  What shall I
 do?</a>
 </dt>
 </dl>
 <table border="0" style="width: 100%;">
 <colgroup>
 <col align="left" width="1%">
 <col>
 </colgroup>
 <tbody>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.makeflags"></a><a name="idm79146864"></a><p><b>24.1.</b></p>
+<a name="devfaq.makeflags"></a><a name="idm74773840"></a><p><b>24.1.</b></p>
 </td>
 <td align="left" valign="top"><p>What is the difference between
 	<code class="varname">MAKEFLAGS</code>, <code class="varname">.MAKEFLAGS</code> and
 	<code class="varname">MAKE_FLAGS</code>?</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><p><code class="varname">MAKEFLAGS</code> are the flags passed
 	to the pkgsrc-internal invocations of <a class="citerefentry" href="http://netbsd.gw.com/cgi-bin/man-cgi?make+1.i386+NetBSD-8.1"><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a>, while
 	<code class="varname">MAKE_FLAGS</code> are the flags that are passed to
 	the <code class="varname">MAKE_PROGRAM</code> when building the
 	package. [FIXME: What is .MAKEFLAGS for?]</p></td>
 </tr>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.make"></a><a name="idm79142768"></a><p><b>24.2.</b></p>
+<a name="devfaq.make"></a><a name="idm74790352"></a><p><b>24.2.</b></p>
 </td>
 <td align="left" valign="top"><p>What is the difference between
 	<code class="varname">MAKE</code>, <code class="varname">GMAKE</code> and
 	<code class="varname">MAKE_PROGRAM</code>?</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><p><code class="varname">MAKE</code> is the path to the
 	<a class="citerefentry" href="http://netbsd.gw.com/cgi-bin/man-cgi?make+1.i386+NetBSD-8.1"><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> program that is used in the pkgsrc
 	infrastructure. <code class="varname">GMAKE</code> is the path to GNU
 	Make, but you need to say <code class="varname">USE_TOOLS+=gmake</code> to
 	use that. <code class="varname">MAKE_PROGRAM</code> is the path to the
 	Make program that is used for building the
 	package.</p></td>
 </tr>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.cc"></a><a name="idm79138416"></a><p><b>24.3.</b></p>
+<a name="devfaq.cc"></a><a name="idm74794192"></a><p><b>24.3.</b></p>
 </td>
 <td align="left" valign="top"><p>What is the difference between
 	<code class="varname">CC</code>, <code class="varname">PKG_CC</code> and
 	<code class="varname">PKGSRC_COMPILER</code>?</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><p><code class="varname">CC</code> is the path to the real C
 	compiler, which can be configured by the pkgsrc user.
 	<code class="varname">PKG_CC</code> is the path to the compiler wrapper.
 	<code class="varname">PKGSRC_COMPILER</code> is <span class="emphasis"><em>not</em></span> a
 	path to a compiler, but the type of compiler that should be
 	used. See <code class="filename">mk/compiler.mk</code> for more
 	information about the latter variable.</p></td>
 </tr>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.bl3flags"></a><a name="idm79134192"></a><p><b>24.4.</b></p>
+<a name="devfaq.bl3flags"></a><a name="idm74798288"></a><p><b>24.4.</b></p>
 </td>
 <td align="left" valign="top"><p>What is the difference between
 	<code class="varname">BUILDLINK_LDFLAGS</code>,
 	<code class="varname">BUILDLINK_LDADD</code> and
 	<code class="varname">BUILDLINK_LIBS</code>?</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><p>[FIXME]</p></td>
 </tr>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.bl3prefix"></a><a name="idm79132016"></a><p><b>24.5.</b></p>
+<a name="devfaq.bl3prefix"></a><a name="idm74796112"></a><p><b>24.5.</b></p>
 </td>
 <td align="left" valign="top"><p>Why does <span class="command"><strong>make show-var
 	VARNAME=BUILDLINK_PREFIX.<em class="replaceable"><code>foo</code></em></strong></span>
 	say it's empty?</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><p>For optimization reasons, some variables are only
 	available in the <span class="quote">&#8220;<span class="quote">wrapper</span>&#8221;</span> phase and later. To
 	<span class="quote">&#8220;<span class="quote">simulate</span>&#8221;</span> the wrapper phase, append
 	<span class="command"><strong>PKG_PHASE=wrapper</strong></span> to the above
 	command.</p></td>
 </tr>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.master_sites"></a><a name="idm79128944"></a><p><b>24.6.</b></p>
+<a name="devfaq.master_sites"></a><a name="idm74801232"></a><p><b>24.6.</b></p>
 </td>
 <td align="left" valign="top"><p>What does
 	<code class="code">${MASTER_SITE_SOURCEFORGE:=package/}</code> mean? I
 	don't understand the <code class="code">:=</code> inside
 	it.</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><p>The <code class="code">:=</code> is not really an
 	assignment operator, although it looks like it.
 	Instead, it is a degenerate form of
 	<code class="code">${LIST:<em class="replaceable"><code>old_string</code></em>=<em class="replaceable"><code>new_string</code></em>}</code>,
 	which is documented in the <a class="citerefentry" href="http://netbsd.gw.com/cgi-bin/man-cgi?make+1.i386+NetBSD-8.1"><span class="citerefentry"><span class="refentrytitle">make</span>(1)</span></a> man page and which is
 	commonly used in the form <code class="code">${SRCS:.c=.o}</code>. In the
 	case of <code class="varname">MASTER_SITE_*</code>,
 	<em class="replaceable"><code>old_string</code></em> is the empty string and
 	<em class="replaceable"><code>new_string</code></em> is
 	<code class="code">package/</code>. That's where the
 	<code class="code">:</code> and the <code class="code">=</code> fall
 	together.</p></td>
 </tr>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.mailinglists"></a><a name="idm79122032"></a><p><b>24.7.</b></p>
+<a name="devfaq.mailinglists"></a><a name="idm74831312"></a><p><b>24.7.</b></p>
 </td>
 <td align="left" valign="top"><p>Which mailing lists are there for package
 	developers?</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top"><div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><a class="ulink" href="http://www.NetBSD.org/mailinglists/index.html#tech-pkg" target="_top">tech-pkg</a></span></dt>
 <dd><p>This is a list for technical discussions related
 	to pkgsrc development, e.g. soliciting feedback for changes to
 	pkgsrc infrastructure, proposed new features, questions related
 	to porting pkgsrc to a new platform, advice for maintaining a
 	package, patches that affect many packages, help requests moved
 	from pkgsrc-users when an infrastructure bug is found,
 	etc.</p></dd>
 <dt><span class="term"><a class="ulink" href="http://www.NetBSD.org/mailinglists/index.html#pkgsrc-bugs" target="_top">pkgsrc-bugs</a></span></dt>
 <dd><p>All bug reports in category "pkg" sent with
 	<a class="citerefentry" href="http://netbsd.gw.com/cgi-bin/man-cgi?send-pr+1.i386+NetBSD-8.1"><span class="citerefentry"><span class="refentrytitle">send-pr</span>(1)</span></a> appear here. Please do not report your bugs here
 	directly; use one of the other mailing
 	lists.</p></dd>
 </dl></div></td>
 </tr>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.documentation"></a><a name="idm79110000"></a><p><b>24.8.</b></p>
+<a name="devfaq.documentation"></a><a name="idm74827600"></a><p><b>24.8.</b></p>
 </td>
 <td align="left" valign="top"><p>Where is the pkgsrc
 	documentation?</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top">
 <p>There are many places where you can find
 	documentation about pkgsrc:</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem"><p>The pkgsrc guide (this document) is a collection
 	of chapters that explain large parts of pkgsrc, but some
 	chapters tend to be outdated. Which ones they are is hard to
 @@ -9237,27 +9237,27 @@ do?
 	documented</span>&#8221;</span>, that is the documentation exists only in the
 	mind of the developer who wrote the code. To get this
 	information, use the <span class="command"><strong>cvs annotate</strong></span> command
 	to see who has written it and ask on the
 	<code class="literal">tech-pkg</code> mailing list, so that others can
 	find your questions later (see above). To be sure that the
 	developer in charge reads the mail, you may CC him or
 	her.</p></li>
 </ul></div>
 </td>
 </tr>
 <tr class="question">
 <td align="left" valign="top">
-<a name="devfaq.too-much-time"></a><a name="idm79103472"></a><p><b>24.9.</b></p>
+<a name="devfaq.too-much-time"></a><a name="idm74837584"></a><p><b>24.9.</b></p>
 </td>
 <td align="left" valign="top"><p>I have a little time to kill.  What shall I
 do?</p></td>
 </tr>
 <tr class="answer">
 <td align="left" valign="top"></td>
 <td align="left" valign="top">
 <p>This is not really an FAQ yet, but here's the answer
 anyway.</p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem"><p>Run <span class="command"><strong>pkg_chk -N</strong></span> (from the
     <a href="https://cdn.NetBSD.org/pub/pkgsrc/current/pkgsrc/pkgtools/pkg_chk/README.html" target="_top"><code class="filename">pkgtools/pkg_chk</code></a> package).  It
     will tell you about newer versions of installed packages that are

 @@ -1128,30 +1128,30 @@ package in question and then removes the
 # pkg_delete -r jpeg
 will remove jpeg and all the packages that used it; this allows upgrading the
 jpeg package.
 .1.4. Getting information about installed packages
 The pkg_info shows information about installed packages or binary package
 files.
 .1.5. Checking for security vulnerabilities in installed packages
-The NetBSD Security-Officer and Packages Groups maintain a list of known
+The pkgsrc Security Team and Packages Groups maintain a list of known security
-security vulnerabilities to packages which are (or have been) included in
+vulnerabilities to packages which are (or have been) included in pkgsrc. The
-pkgsrc. The list is available from the NetBSD FTP site at http://ftp.NetBSD.org
+list is available from the NetBSD FTP site at http://ftp.netbsd.org/pub/NetBSD/
-/pub/pkgsrc/distfiles/vulnerabilities.
+packages/vulns/pkg-vulnerabilities.
 Through pkg_admin fetch-pkg-vulnerabilities, this list can be downloaded
 automatically, and a security audit of all packages installed on a system can
 take place.
 There are two components to auditing. The first step, pkg_admin
 fetch-pkg-vulnerabilities, is for downloading the list of vulnerabilities from
 the NetBSD FTP site. The second step, pkg_admin audit, checks to see if any of
 your installed packages are vulnerable. If a package is vulnerable, you will
 see output similar to the following:
 Package samba-2.0.9 has a local-root-shell vulnerability, see
     http://www.samba.org/samba/whatsnew/macroexploit.html