 @@ -1,14 +1,14 @@
-<!-- $NetBSD: fixes.xml,v 1.162 2021/07/06 16:57:09 schmonz Exp $ -->
+<!-- $NetBSD: fixes.xml,v 1.163 2021/08/22 16:27:50 wiz Exp $ -->
 <chapter id="fixes"> <?dbhtml filename="fixes.html"?>
 <title>Making your package work</title>
 <sect1 id="general-operation">
   <title>General operation</title>
   <para>One appealing feature of pkgsrc is that it runs on many
   different platforms. As a result, it is important to ensure,
   where possible, that packages in pkgsrc are portable. This
   chapter mentions some particular details you should pay
   attention to while working on pkgsrc.</para>
 @@ -557,41 +557,76 @@ CONFLICTS=      libXaw3d-[0-9]*
     installed, the <varname>PKG_PRESERVE</varname> definition should
     be set in the package Makefile. This will be carried into any
     binary package that is made from this pkgsrc entry. A
     <quote>preserved</quote> package will
     not be deleted using &man.pkg.delete.1; unless the
     <quote>-f</quote> option is used.</para>
   </sect2>
   <sect2 id="security-handling">
     <title>Handling packages with security problems</title>
     <para>When a vulnerability is found, this should be noted in
-    <filename>localsrc/security/advisories/pkg-vulnerabilities</filename>,
+    <filename>localsrc/security/advisories/pkg-vulnerabilities</filename>.
-    and after committing that file, ask pkgsrc-security@NetBSD.org to
+    Entries in that file consist of three parts:</para>
     <itemizedlist>
       <listitem><para>package version pattern</para></listitem>
       <listitem><para>type of vulnerability (please cut'n'paste an existing one where possible)</para></listitem>
       <listitem><para>URL providing additional information about the issue</para></listitem>
     </itemizedlist>
     <para>For the package version pattern please always use `&lt;' to
     mark an upper bound (not `&lt;='!). This will avoid possible
     problems due unrelated <varname>PKGREVISION</varname> bumps not
     related to security fixes. Lower bounds can be added too, using
     '&gt;' or '&gt;='. For example,
     <quote><literal>foo&gt;'=1&lt;1.2</literal></quote> would mark
     versions 1.0 (included) to 1.2 (excluded) of
     <quote><literal>foo</literal></quote> as affected by the security
     issue.</para>
     <para>Entries should always be added at the bottom of the file.</para>
     <para>When fixing packages, please modify the upper bound of the
     corresponding entry. To continue the previous example, if a fix
     was backported to version 1.1nb2, change the previous pattern to
     <quote><literal>foo&gt;'=1&lt;1.1nb2</literal></quote>.</para>
     <para>To locally test a package version pattern against a
     <varname>PKGNAME</varname> you can use the <command>pkg_admin
     pmatch</command> command.</para>
     <para>The URL should be as permanent as possible and provide as
     much information about the issue as possible.  CVE entries are
     preferred.</para>
     <para>After committing that file, ask pkgsrc-security@NetBSD.org to
     update the file on ftp.NetBSD.org.</para>
     <para>After fixing the vulnerability by a patch, its
     <varname>PKGREVISION</varname> should be increased (this is of
     course not necessary if the problem is fixed by using a newer
     release of the software), and the pattern in the
     pkg-vulnerabilities file must be updated.</para>
     <para>Also, if the fix should be applied to the stable pkgsrc
     branch, be sure to submit a pullup request!</para>
     <para>Binary packages already on ftp.NetBSD.org will be handled
     semi-automatically by a weekly cron job.</para>
     <para>In case a security issue is disputed, please contact
     pkgsrc-security@NetBSD.org.</para>
   </sect2>
   <sect2 id="bumping-pkgrevision">
     <title>How to handle incrementing versions when fixing an existing package</title>
     <para>When making fixes to an existing package it can be useful
     to change the version number in <varname>PKGNAME</varname>. To
     avoid conflicting with future versions by the original author, a
     <quote>nb1</quote>, <quote>nb2</quote>, ... suffix can be used
     on package versions by setting <varname>PKGREVISION=1</varname>
     (2, ...). The <quote>nb</quote> is treated like a
     <quote>.</quote> by the package tools. e.g.</para>