sergio/takana

b3:d0b9752d. URL/sha256 arreglados (var abuild sin expandir); fase configure explícita;
--without-pam/sssd/skey + --with-secure-path. Clave del link: --disable-shared
--enable-static-sudoers --disable-log-{server,client} (sin eso ld.lld falla por símbolos
versionados sudo_*_v1 de libsudo_util). Install con INSTALL_OWNER= (setuid lo re-aplica la
hidratación). Con doas cubre el escalado de privilegios.

diff --git a/recipes/incoming-clib/sudo.toml b/recipes/incoming-clib/sudo.toml
index e195798c..52498bf9 100644
--- a/recipes/incoming-clib/sudo.toml
+++ b/recipes/incoming-clib/sudo.toml
@@ -5,10 +5,10 @@ name    = "sudo"
 version = "1.9.17_p2"
 
 [source]
-tarball = "https://www.sudo.ws/dist/sudo-${pkgver/_/}.tar.gz"
+tarball = "https://www.sudo.ws/dist/sudo-1.9.17p2.tar.gz"
 # FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
 # sha512 = "c8abd6ca56e54a081c9ef1e9f6579d1db5b93ff857e60d1f58d1f425d7dc23c31c58d40b7819780688f66dfdf87a1f3bbe0a78387b007e2beb1b0e546203ea93"
-sha256  = "FIXME-sha256"
+sha256  = "4a38a1ab3adb1199257edc2a7c4a2bd714665eb605b04368843b06dada2cfcfb"
 
 [build]
 compiler = "zig-cc"
@@ -17,46 +17,54 @@ link     = "static"
 flags    = []
 
 [build.phases]
-# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+# fase configure EXPLÍCITA: si la receta no la define, hammer autogenera su propio
+# `./configure --prefix=/usr` (sin nuestros --without-pam/--disable-nls) y aborta antes del compile.
+# De-Alpinizado: sin PAM (musl trae crypt), sin NLS, sin SSSD; sin -flto; pie por defecto.
+configure = '''
+./configure \
+	--build=$CBUILD \
+	--host=$CHOST \
+	--prefix=/usr \
+	--libexecdir=/usr/lib \
+	--mandir=/usr/share/man \
+	--with-rundir=/run/sudo \
+	--with-vardir=/var/lib/sudo \
+	--with-tzdir=/usr/share/zoneinfo \
+	--with-logdir=/var/log \
+	--with-iologdir=/var/log/sudo-io \
+	--with-logpath=/var/log/sudo.log \
+	--with-relaydir=/var/log/sudo_logsrvd \
+	--with-secure-path \
+	--disable-shared \
+	--enable-static-sudoers \
+	--disable-log-server \
+	--disable-log-client \
+	--disable-nls \
+	--with-env-editor \
+	--with-mdoc \
+	--without-pam \
+	--without-skey \
+	--without-sssd \
+	--with-sendmail=/usr/sbin/sendmail \
+	--with-passprompt="[sudo] password for %p: "
+'''
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3):
 compile = '''
-_abuild_phase() {
-CFLAGS="$CFLAGS -flto=auto" \
-	./configure \
-		--build=$CBUILD \
-		--host=$CHOST \
-		--prefix=/usr \
-		--libexecdir=/usr/lib \
-		--mandir=/usr/share/man \
-		--with-rundir=/run/sudo \
-		--with-vardir=/var/lib/sudo \
-		--with-tzdir=/usr/share/zoneinfo \
-		--with-logdir=/var/log \
-		--with-iologdir=/var/log/sudo-io \
-		--with-logpath=/var/log/sudo.log \
-		--with-relaydir=/var/log/sudo_logsrvd \
-		--disable-nls \
-		--enable-pie \
-		--with-env-editor \
-		--with-mdoc \
-		--without-pam \
-		--without-skey \
-		--with-sendmail=/usr/sbin/sendmail \
-		--with-passprompt="[sudo] password for %p: "
-
-	make
-}
-_abuild_phase
+make
 '''
-# de package() de Alpine (traducido $pkgdir→/out):
+# de package() de Alpine (traducido $pkgdir→/out; el make install de sudo intenta chown/chmod
+# setuid — el paquete lo re-aplica al hidratar; para el build alcanza con -o/-g neutralizados):
 install = '''
-_abuild_phase() {
 # the sudo's mkinstalldir script miscreates the leading
-	# path components with bad permissions. fix this.
-	install -dm0755 "/out"/var "/out"/var/db
-	make -j1 DESTDIR="/out" install
+# path components with bad permissions. fix this.
+install -dm0755 "/out"/var "/out"/var/db
+make -j1 DESTDIR="/out" INSTALL_OWNER= install
 
-	# Exactly the same as /etc/sudoers
-	rm -v "/out"/etc/sudoers.dist
-}
-_abuild_phase
+# Exactly the same as /etc/sudoers
+rm -v "/out"/etc/sudoers.dist || true
 '''
+
+# Alpine build-deps de-Alpinizados: quitados linux-pam-dev, libxcrypt-dev (musl trae crypt).
+# zlib del catálogo; runtime deps de Alpine no son build-deps.
+[deps]
+build = ["zlib", "linux-headers"]