Re: Status of Python 3.11

On Tue, Aug 11, 2026, at 8:25 AM, Piotr Smyrak wrote:
> On Tue, 11 Aug 2026 07:20:38 -0400
> "Dan Langille" <[email protected]> wrote:
>
>> On Tue, Aug 11, 2026, at 6:17 AM, Dan Mahoney wrote:
>> > To Dan's L's point, though.  
>> 
>> [snip]
>> 
>> > And yeah, pkg-audit needs a knob that exempts specific
>> > CVEID's/vuxml entries/packages from its alert.  If you've looked at
>> > your system, read the tea leaves, asked other knowledgeable people,
>> > asked your favorite LLM, and asked your magic 8 ball and you say
>> > "okay, this is an imap and pop3 vuln, I am sure I'm not using those
>> > libs" OR "I have patched the code that consumes those functions" OR
>> >  "in fact I've deleted them post-install, let me go on with life",
>> > you should be able to.  
>> 
>> Please my post to freebsd-ports@ titled "modifying pkg-audit to
>> ignore specified vulns"
>> 
>> re:
>> https://lists.freebsd.org/archives/freebsd-ports/2026-August/009871.html
>> 
>> I have done a manual proof-of-concept and now it's just a simple
>> matter of coding.
>
> Dan,
>
> IIUC, you are building your own packages. I would like to propose a
> simpler approach that does not require any development whatsoever.
> You could either patch the local ports tree or just revert the
> commits that added these vulnerabilities to the XML file, and
> build the VuXML DB from such patched port, publish the XML artifact to
> be accessible from within Freshports network, and modify this setting in
> pkg.conf:
>
> #VULNXML_SITE = "http://vuxml.freebsd.org/freebsd/vuln.xml.xz"; 
>
> This way you just redirect the whole infrastructure to a custom
> advisory DB, still built and relying on a slightly adjusted project DB.
>
> As long as you don't push from this local git repo of ports, you can
> even commit the change. (I am assuming here, you use git to fetch the
> tree). 

That is a nice idea. Thank you.  That helps me, definitely.

The "tricky" part may be knowing there is a new VuXML to build and then distributing it.

I'm an outlier. Most people do not build their own.

-- 
  Dan Langille
  [email protected]