pkg_package_updates = []
pkg_package_vulnerables = []

Facter.add('pkg_has_updates') do
  confine osfamily: 'FreeBSD'
  setcode do
    if File.executable?('/usr/sbin/pkg')
      pkg_version_result = Facter::Util::Resolution.exec('/usr/sbin/pkg version -ql"<"')
      unless pkg_version_result.nil?
        pkg_version_result.each_line do |line|
          package = line.split.first
          pkg_package_updates.push(package)
        end
      end
    end

    pkg_package_updates.any?
  end
end

Facter.add('pkg_updates') do
  confine pkg_has_updates: true
  setcode do
    Integer(pkg_package_updates.length)
  end
end

Facter.add('pkg_package_updates') do
  confine pkg_has_updates: true
  setcode do
    if Facter.version < '2.0.0'
      pkg_package_updates.join(',')
    else
      pkg_package_updates
    end
  end
end

Facter.add('pkg_has_vulnerabilities') do
  confine osfamily: 'FreeBSD'
  setcode do
    if File.executable?('/usr/sbin/pkg')
      pkg_package_vulnerables = Facter::Util::Resolution.exec('/usr/sbin/pkg audit -q').split.map(&:chomp)
    end

    pkg_package_vulnerables.any?
  end
end

Facter.add('pkg_vulnerabilities') do
  confine pkg_has_vulnerabilities: true
  setcode do
    Integer(pkg_package_vulnerables.count)
  end
end

Facter.add('pkg_package_vulnerables') do
  confine pkg_has_vulnerabilities: true
  setcode do
    if Facter.version < '2.0.0'
      pkg_package_vulnerables.join(',')
    else
      pkg_package_vulnerables
    end
  end
end

Add facts to report outdated / vulnerable packages
Add facts to report outdated / vulnerable packages

When applicable, new facts where inspired by pupeptlabs-apt's facts:
https://github.com/puppetlabs/puppetlabs-apt/blob/master/lib/facter/apt_updates.rb

  - apt_has_updates     -> pkg_has_updates     (Boolean)
  - apt_updates         -> pkg_updates         (Integer)
  - apt_package_updates -> pkg_package_updates (Array[String])

Since pkg-audit(8) can report vulnerabilities in ports without updates,
it's not possible to have a strict equivalent to apt_security_updates.
So I created a bunch of facts to report vulnerable packages the same way
outdated packages are reported:

  - pkg_has_vulnerabilities (Boolean)
  - pkg_vulnerabilities     (Integer)
  - pkg_package_vulnerables (Array[String])

Sample output, on a system with 1 update and 2 vulnerable packages:

pkg_has_updates => true
pkg_has_vulnerabilities => true
pkg_package_updates => [
  "phantomjs-2.1.1"
]
pkg_package_vulnerables => [
  "OpenEXR-2.2.0_7",
  "oniguruma5-5.9.6_1"
]
pkg_updates => 1
pkg_vulnerabilities => 2

Sample output on a system up to date with no known vulnerabilities:

pkg_has_updates => false
pkg_has_vulnerabilities => false
