I'm using pkgbase for now just for testing it but I'll eventually migrate to compiling from source like always.
hm... i'm not sure if this is something we want to commit to supporting long-term, which would probably be necessary if it's documented in the Handbook since someone will find a way to rely on it. going in the other direction (dist sets -> pkgbase) will only be supported for 15.0, and maybe 16.0, as a temporary migration path.
but you should be able to do this by saving a list of installed ports, then deleting
/var/db/pkg
, then re-installing your ports. obviously create a new BE to try this on, i've never tested it.
Also, how are security vulnerabilities handled with pkgbase?
if you build pkgbase from source, there's no difference. if you're using the packages from pkg.freebsd.org, those are not supported by secteam, so security updates are on a best-effort basis. in practice, those packages are rebuilt from each branch twice daily, so it shouldn't take too long for updated packages to arrive.
for 15.0-RELEASE there will be a new repository which will be managed by releng/secteam and update information will be in the security notifications.
I tried yesterday a `pkg update` to mitigate against this OpenSSL vulnerability but there are no updated packages, so I contemplated compiling myself, but then realized I couldn't realibly do it because the binaries would no longer be those installed by the FreeBSD-* packages
you still get FreeBSD-* packages if you build pkgbase from source, the problem (at least for development branches like -CURRENT and -STABLE) is the packages are stamped with the build date, so if you switch from pkg.freebsd.org to local packages, then back, pkg might be confused about what the latest version of the package is. i expect that would sort itself out after a couple of days though.
My little theory on this: if patched packages didn't landed on ALPHA4 it could be because BETA1 is coming out tomorrow, therefore they might not want to waste resources to build those packages for a version that will be dead very soon.
the package builds for pkg.freebsd.org are automated, releng has nothing to do with that. (i believe bapt is the one who mostly takes care of them.)