PKG-AUDIT(8)

💅 PKG-AUDIT(8) — the system manager's manual, but make it cute

okay bestie, welcome to pkg-audit(8), a page from the System Manager's Manual. this is the one that tells you whether the stuff on your machine has known security holes in it. grab a snack, we're doing vulnerability lore. 🍓

---

✨ NAME ✨

pkg audit — audit installed packages against known vulnerabilities 🕵️‍♀️

---

🦋 SYNOPSIS 🦋

pkg audit [-Fqr] [-f filename] [-R[format]] [pkg-name]

pkg audit [--{fetch,quiet,recursive}] [--file filename] [--raw[=format]]
    [pkg-name]

---

🌸 DESCRIPTION 🌸

so pkg audit literally goes through your installed packages and checks them for known vulnerabilities, then generates reports that reference the security advisories. its intended audience is system administrators and individual users — so yes, that's you, you're the target audience, slay. 👑

the way it works is it uses a database maintained by port committers and the FreeBSD security team to check if security advisories exist for any of your installed packages. and here's the iconc part: a current ports tree (or any local copy of the ports tree) is not required for operation. nope, not needed, don't worry about it. ✨

the URL that's used to fetch that database can be overridden via the VULNXML_SITE config variable. peep pkg.conf(5) if you want the full tea. 🫖

💀 if you have a vulnerable package installed, you are advised to update or deinstall it immediately. like, right now. not later. immediately. i'm so serious.

and if you supply a pkg-name? it audits only that package. one little guy, checked all by itself. 🎀

---

💅 OPTIONS 💅

here's everything pkg audit supports, no skips:

• -d directory, --directory directory — audits packages found in the specified directory instead of the installed package database. like, "look over there instead" energy.
• -F, --fetch — fetches the database before checking. get the fresh data first, obviously. 🔥
• -f filename, --file filename — uses filename as the local copy of the vulnerability database. and if you use this in combination with -F, it downloads the vulnerability database to the named filename before auditing installed ports against it. combo move. 🧚
• -q, --quiet — be "quiet". prints only the requested information without displaying many hints. minimal, lowkey, no extra chatter. 🤫
• -R[format], --raw[=format] — presents the output in one of these formats:
  • json
  • json-compact
  • ucl
  • yaml

and in case format is not provided, it defaults to ucl. noted. 📝

• -r, --recursive — prints packages that depend on vulnerable packages and are thus potentially vulnerable as well. the drama spreads downstream, bestie. 😭

---

🌈 ENVIRONMENT 🌈

these environment variables affect how pkg audit runs. peep pkg.conf(5) for a further description, iykyk.

• PKG_DBDIR
• VULNXML_SITE

---

🎀 FILES 🎀

see pkg.conf(5). that's the whole vibe. ✨

---

⭐ SEE ALSO ⭐

a whole friend group, fr fr: pkg_create(3), pkg_printf(3), pkg_repo_create(3), pkg_repos(3), pkg-keywords(5), pkg-lua-script(5), pkg-repository(5), pkg-script(5), pkg-triggers(5), pkg.conf(5), pkg(8), pkg-add(8), pkg-alias(8), pkg-annotate(8), pkg-autoremove(8), pkg-check(8), pkg-clean(8), pkg-config(8), pkg-create(8), pkg-delete(8), pkg-fetch(8), pkg-help(8), pkg-info(8), pkg-install(8), pkg-key(8), pkg-lock(8), pkg-plugins(8), pkg-query(8), pkg-register(8), pkg-repo(8), pkg-repositories(8), pkg-rquery(8), pkg-search(8), pkg-set(8), pkg-shell(8), pkg-shlib(8), pkg-ssh(8), pkg-stats(8), pkg-triggers(8), pkg-unregister(8), pkg-update(8), pkg-updating(8), pkg-upgrade(8), pkg-version(8), pkg-which(8)

---

okay that's the page!! 💖 this edition came from Debian, dated March 1, 2022 — so go audit your packages, fix the vulnerable ones, and hydrate. mwah. 🫶✨