Log message:
*: recursive bump for default Kerberos implementation switch

Log message:
sudo: Enable PAM by default where available.

Verified to build successfully on SunOS, Linux, FreeBSD, NetBSD
via drecklypkg ci.

Log message:
sudo: Build fixes for SunOS and OpenBSD.

Found via drecklypkg CI.

Log message:
security/sudo: update to sudo-1.9.16

# noteworthy changes (since 1.9.16)

* Sudo 1.9.16p2
	Sudo now passes the terminal device number to the policy plugin even
	if it cannot resolve it to a path name. This allows sudo to run
	without warnings in a chroot jail when the terminal device files
	are not present. GitHub issue #421.

	On Linux systems, sudo will now attempt to use the symbolic links in
	/proc/self/fd/{0,1,2} when resolving the terminal device number.
	This can allow sudo to map a terminal device to its path name even
	when /dev/pts is not mounted in a chroot jail.

	Fixed compilation errors with gcc and clang in C23 mode. C23 no
	longer supports functions with unspecified arguments. GitHub issue
	#420.

* Sudo 1.9.16p1
	Fixed the test for cross-compiling when checking for C99 snprintf().
	The changes made to the test in sudo 1.9.16 resulted in a different
	problem. GitHub issue #386.

	Fixed the date used by the exit record in sudo-format log files.
	This was a regression introduced in sudo 1.9.16 and only affected
	file-based logs, not syslog. GitHub issue #405.

	Fixed the root cause of the “unable to find terminal name for
	device” message when running sudo on AIX when no terminal is
	present. In sudo 1.9.16 this was turned from a debug message into a
	warning. GitHub issue #408.

	When a duplicate alias is found in the sudoers file, the warning
	message now includes the file and line number of the previous
	definition.

	Added support for the --with-secure-path-value=no configure option
	to allow packagers to ship the default sudoers file with the secure
	path line commented out.

	Sudo no longer sends mail when a user runs sudo -nv or sudo -nl,
	even if mail_badpass or mail_always are set. Sudo already avoids
	logging to a file or syslog in this case

Log message:
sudo: Append ${PREFIX} directories to the default secure_path

Now that secure_path is enabled in the default sudoers file as of
sudo version 1.9.16, it seems important to me to include the pkgsrc
${PREFIX}/sbin and ${PREFIX}/bin in it.

Log message:
sudo: updated to 1.9.16

What's new in Sudo 1.9.16

 * Added the "cmddenial_message" sudoers option to provide additional
   information to the user when a command is denied by the sudoers
   policy.  The default message is still displayed.

 * The time stamp used for file-based logs is now more consistent
   with the time stamp produced by syslog.

 * Sudo will now warn the user if it can detect the user's terminal
   but cannot determine the path to the terminal device.  The sudoers
   time stamp file will now use the terminal device number directly.

 * The embedded copy of zlib has been updated to version 1.3.1.

 * Improved error handling if generating the list of signals and signal
   names fails at build time.

 * Fixed a compilation issue on Linux systems without process_vm_readv().

 * Fixed cross-compilation with WolfSSL.

 * Added a "json_compact" value for the sudoers "log_format" \ 
option
   which can be used when logging to a file.  The existing "json"
   value has been aliased to "json_pretty".  In a future release,
   "json" will be an alias for "json_compact".

 * A new "pam_silent" sudoers option has been added which may be
   negated to avoid suppressing output from PAM authentication modules.

 * Fixed several cvtsudoers JSON output problems.

 * When sudo runs a command in a pseudo-terminal and the user's
   terminal is revoked, the pseudo-terminal's foreground process
   group will now receive SIGHUP before the terminal is revoked.
   This emulates the behavior of the session leader exiting and is
   consistent with what happens when, for example, an ssh session
   is closed.

 * Fixed "make test" with Python 3.12.

 * In schema.ActiveDirectory, fixed the quoting in the example command.

 * Paths specified via a Chdir_Spec or Chroot_Spec in sudoers may
   now be double-quoted.

 * Sudo insults are now included by default, but disabled unless
   the --with-insults configure option is specified or the "insults"
   sudoers option is enabled.

 * The default sudoers file now enables the "secure_path" option by
   default and preserves the EDITOR, VISUAL, and SUDO_EDITOR environment
   variables when running visudo.  The new --with-secure-path-value
   configure option can be used to set the value of "secure_path" in
   the default sudoers file.

 * A sudoers schema for IBM Directory Server (aka IBM Tivoli Directory
   Server, IBM Security Directory Server, and IBM Security Verify
   Directory) is now included.

 * When cross-compiling sudo, the configure script now assumes that
   the snprintf() function is C99-compliant if the C compiler
   supports the C99 standard.  Previously, configure would use
   sudo's own snprintf() when cross-compiling.

Log message:
security/sudo: update to 1.9.15p5

1.9.15p3 (2023-12-13)

 * Always disable core dumps when sudo sends itself a fatal signal.
   Fixes a problem where sudo could potentially dump core dump when
   it re-sends the fatal signal to itself.  This is only an issue
   if the command received a signal that would normally result in
   a core dump but the command did not actually dump core.

 * Fixed a bug matching a command with a relative path name when
   the sudoers rule uses shell globbing rules for the path name.
   Bug #1062.

 * Permit visudo to be run even if the local host name is not set.
   GitHub issue #332.

 * Fixed an editing error introduced in sudo 1.9.15 that could
   prevent sudoreplay from replaying sessions correctly.
   GitHub issue #334.

 * Fixed a bug introduced in sudo 1.9.15 where "sudo -l > /dev/null"
   could hang on Linux systems.  GitHub issue #335.

 * Fixed a bug introduced in sudo 1.9.15 where Solaris privileges
   specified in sudoers were not applied to the command being run.

1.9.15p4 (2023-12-15)

 * Fixed a bug introduced in sudo 1.9.15 that could prevent a user's
   privileges from being listed by "sudo -l" if the sudoers entry
   in /etc/nsswitch.conf contains "[SUCCESS=return]".  This did not
   affect the ability to run commands via sudo.  Bug #1063.

1.9.15p5 (2023-12-30)

 * Fixed evaluation of the "lecture", "listpw", \ 
"verifypw", and
   "fdexec" sudoers Defaults settings when used without an explicit
   value.  Previously, if specified without a value they were
   evaluated as boolean "false", even when the negation operator
   ('!') was not present.

 * Fixed a bug introduced in sudo 1.9.14 that prevented LDAP
   netgroup queries using the NETGROUP_BASE setting from being
   performed.

 * Sudo will now transparently rename a user's lecture file from
   the older name-based path to the newer user-ID-based path.
   GitHub issue #342.

 * Fixed a bug introduced in sudo 1.9.15 that could cause a memory
   allocation failure if sysconf(_SC_LOGIN_NAME_MAX) fails.  Bug #1066.

Log message:
sudo: fix unportable test(1) operator