Russell pointed me to this link form a post to the FreeBSD mailing list:
Source based patch update system for FreeBSD security updating http://www.roq.com/projects/quickpatch/

Barry pointed me to this port for FreeBSD, portaudit at http://www.freshports.org/security/portaudit/

I found a project called PatchMon on Sourceforge and e-mailed the author for more information. It seems we are looking into similar things. Maybe we can work together. Here is a copy of his e-mail:

"Hi Dominic,

My plans for PatchMon.. Unix/Linux only for now. Possibly Cygwin in the
distant future, but I doubt that will happen. I consider windows a beast
not worth my time any more. light weight client scripts. Perl or sh with
no extra module requirements.. I can't stand vendors who require large
software install. The script is something that can easily be audited for
naughty code and proper functioning, rather than the usual 'trust us and
our software' attitude closed source vendors have. These client scripts
would check listening ports, match the port with a running process, then
gather info about the binary like version, static/dynamic, binary type,
and maybe a hash. Then report these stats back to a main database. The
database will be manageable through web browser where reports and
notifications can happen. 

For now, the goal is simply awareness of network listening processes and
versions to help keep on top of patches. I want to know at a glance
which and how many OpenSSH/Apache/Sendmail/... hosts need to be patched
next time new code is released. This is a passive, rather than active
process. although the client could be cron'ed. automatic patching of
Unix hosts frightens me as most of my additional binaries are built from
source with custom options. 

Honestly, I don't think that any code will be developed in the next
month, maybe 2. 

Hope this helps. If there is anything I can do to assist, please don't
hesitate to ask.

--Civ


On Thu, 2004-03-04 at 14:54, Dominic White wrote:

> Hi
> 
> I want to start a project for my MSc in computer science on developing a 
>   cross platform software update service, similar to 
> http://www.patchlink.com/company/about.html but open source.
> 
> There seems to be some tie in with your and my projects. What are your 
> plans?"