This is an archive of past FreeBSD releases; it's part of the FreeBSD Documentation Archive.
Invariably there will come a time when a particular port will contain a security vulnerability, will be radically broken and needs many hours of tender loving care, or is generally obsoleted, but for one reason or another should remain in the tree (and get fixed, right?). To designate a port as broken, there are three make variables that can be used in a port's Makefile. The value of the following make variables will be the reason that is given back to users for why the port was marked as broken. Please use the correct make variable as each make variable conveys radically different meanings to both users, and to automated systems that parse Makefiles.
BROKEN is reserved for ports that do not work and should not be installed by users. This will prevent users from installing the port, however, ports marked as BROKEN will still be built by the Bento cluster. Do mark ports as BROKEN if you want users to not install this port, but you still want to have it built by Bento.
FORBIDDEN is used for ports that do contain a security vulnerability or induce grave concern regarding the security of a FreeBSD system with a given port installed (ex: a reputably insecure program or a program that provides easily exploitable services). Ports should be marked as FORBIDDEN as soon as a particular piece of software has a vulnerability and there is no released upgrade. Ideally ports should be upgraded as soon as possible when a security vulnerability is discovered so as to reduce the number of vulnerable FreeBSD hosts (we like being known for being secure), however sometimes there is a noticeable time gap between disclosure of a vulnerability and an updated software release of a piece of vulnerable software. Do not mark a port FORBIDDEN for any reason other than security.
IGNORE is reserved for ports that should not be built for one reason or another. Users and the Bento cluster cluster will not, under any circumstances, build ports marked as IGNORE. If in doubt, do use IGNORE to prevent a port from being built.
Do remember that these variables are to be used as a last resort if a port is not upgradeable. Permanently broken ports should be removed from the tree entirely.