does string processing on what is often untrusted input, so this seems
a good candidate for defensive use of pledge (allowing all file io,
as it creates temporary files at various points during run, but has
no need for network).
pledge() is often not a good match for software in ports, but this seems
a suitable candidate and it changes very infrequently so doesn't add a
big maintenance burden.
looks good to deraadt, ok semarie@
8503ec0f44