diff --git a/security/vault/Makefile b/security/vault/Makefile
index ccc89a0cdfa1..e68014c93b41 100644
--- a/security/vault/Makefile
+++ b/security/vault/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.44 2019/10/18 14:58:56 bsiegert Exp $
+# $NetBSD: Makefile,v 1.45 2019/10/23 15:00:05 he Exp $
 
-DISTNAME=	vault-0.11.2
-PKGREVISION=	10
+DISTNAME=	vault-1.2.3
 CATEGORIES=	security
 MASTER_SITES=	${MASTER_SITE_GITHUB:=hashicorp/}
 
diff --git a/security/vault/distinfo b/security/vault/distinfo
index f3a06254e649..8bc4d4fc6611 100644
--- a/security/vault/distinfo
+++ b/security/vault/distinfo
@@ -1,6 +1,11 @@
-$NetBSD: distinfo,v 1.22 2018/10/07 20:19:38 fhajny Exp $
+$NetBSD: distinfo,v 1.23 2019/10/23 15:00:05 he Exp $
 
-SHA1 (vault-0.11.2.tar.gz) = edf3693416121ed75244afab37db1bad491733b1
-RMD160 (vault-0.11.2.tar.gz) = 27c7f6a5a8148c993c746b4be7198caa6b37a4f0
-SHA512 (vault-0.11.2.tar.gz) = 2feacee3180aee48a868e40fe295bb96196c84b0cfb4b6486dee5c0899f5baaa4f45a1a1ca0939fad8ca062ca97d5e256b66dd6e91f88471816e41ccf991dc03
-Size (vault-0.11.2.tar.gz) = 24804472 bytes
+SHA1 (vault-1.2.3.tar.gz) = 83765d89ce4630e8e61e81d830378b11af8078e5
+RMD160 (vault-1.2.3.tar.gz) = cd82e5658a8018eb5be7cad8a71b860d5fad0162
+SHA512 (vault-1.2.3.tar.gz) = 9543e394f187cd9b06e88b64319504e07519041741650db3b7b905f1b34348ed7d9e22955ce2a456ffd2e06210e9e01b1a0ded459cde4840fbf5903ff6e21e75
+Size (vault-1.2.3.tar.gz) = 27773681 bytes
+SHA1 (patch-scripts_gen__openapi.sh) = 1ad66480ef135adec05f58b088440e0bec6b4ab8
+SHA1 (patch-vendor_github.com_ory_dockertest_docker_pkg_system_stat__netbsd.go) = 6bdcd546eb5ac7354d4bbe8abbb91cc000378101
+SHA1 (patch-vendor_github.com_ory_dockertest_docker_pkg_term_tc.go) = c88c7ade723612ec994fa0b53d6a08f3491226f8
+SHA1 (patch-vendor_github.com_ory_dockertest_docker_pkg_term_term.go) = ce99675f1881a6b3cdf47d1b5d95d9c3df141d61
+SHA1 (patch-vendor_github.com_ory_dockertest_docker_pkg_term_termios__bsd.go) = 10bf19ea57dc7c742c49b43cd5bf6aea7057f044
diff --git a/security/vault/patches/patch-scripts_gen__openapi.sh b/security/vault/patches/patch-scripts_gen__openapi.sh
new file mode 100644
index 000000000000..b04c87782235
--- /dev/null
+++ b/security/vault/patches/patch-scripts_gen__openapi.sh
@@ -0,0 +1,15 @@
+$NetBSD: patch-scripts_gen__openapi.sh,v 1.1 2019/10/23 15:00:05 he Exp $
+
+Fix shell portability problem.
+
+--- scripts/gen_openapi.sh.orig	2019-09-09 21:08:25.000000000 +0000
++++ scripts/gen_openapi.sh
+@@ -72,7 +72,7 @@ then
+ fi
+ 
+ # Output OpenAPI, optionally formatted
+-if [ "$1" == "-p" ]; then
++if [ "$1" = "-p" ]; then
+   curl -H "X-Vault-Token: root" "http://127.0.0.1:8200/v1/sys/internal/specs/openapi" | jq > openapi.json
+ else
+   curl -H "X-Vault-Token: root" "http://127.0.0.1:8200/v1/sys/internal/specs/openapi" > openapi.json
diff --git a/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_system_stat__netbsd.go b/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_system_stat__netbsd.go
new file mode 100644
index 000000000000..fbc6838e3c98
--- /dev/null
+++ b/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_system_stat__netbsd.go
@@ -0,0 +1,20 @@
+$NetBSD: patch-vendor_github.com_ory_dockertest_docker_pkg_system_stat__netbsd.go,v 1.1 2019/10/23 15:00:05 he Exp $
+
+Create stat_netbsd.go file so that fromStatT is defined.
+
+--- /dev/null	2019-10-22 10:44:39.662720199 +0200
++++ vendor/github.com/ory/dockertest/docker/pkg/system/stat_netbsd.go	2019-10-22 10:51:32.742089646 +0200
+@@ -0,0 +1,13 @@
++package system // import "github.com/ory/dockertest/docker/pkg/system"
++
++import "syscall"
++
++// fromStatT converts a syscall.Stat_t type to a system.Stat_t type
++func fromStatT(s *syscall.Stat_t) (*StatT, error) {
++	return &StatT{size: s.Size,
++		mode: uint32(s.Mode),
++		uid:  s.Uid,
++		gid:  s.Gid,
++		rdev: uint64(s.Rdev),
++		mtim: s.Mtimespec}, nil
++}
diff --git a/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_tc.go b/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_tc.go
new file mode 100644
index 000000000000..17f0cecd568f
--- /dev/null
+++ b/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_tc.go
@@ -0,0 +1,22 @@
+$NetBSD: patch-vendor_github.com_ory_dockertest_docker_pkg_term_tc.go,v 1.1 2019/10/23 15:00:05 he Exp $
+
+Use syscall.Termios, not just Termios, so that this builds on at
+least NetBSD.
+
+--- vendor/github.com/ory/dockertest/docker/pkg/term/tc.go.orig	2019-09-09 21:08:25.000000000 +0000
++++ vendor/github.com/ory/dockertest/docker/pkg/term/tc.go
+@@ -9,12 +9,12 @@ import (
+ 	"golang.org/x/sys/unix"
+ )
+ 
+-func tcget(fd uintptr, p *Termios) syscall.Errno {
++func tcget(fd uintptr, p *syscall.Termios) syscall.Errno {
+ 	_, _, err := unix.Syscall(unix.SYS_IOCTL, fd, uintptr(getTermios), uintptr(unsafe.Pointer(p)))
+ 	return err
+ }
+ 
+-func tcset(fd uintptr, p *Termios) syscall.Errno {
++func tcset(fd uintptr, p *syscall.Termios) syscall.Errno {
+ 	_, _, err := unix.Syscall(unix.SYS_IOCTL, fd, setTermios, uintptr(unsafe.Pointer(p)))
+ 	return err
+ }
diff --git a/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_term.go b/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_term.go
new file mode 100644
index 000000000000..7c6d1e5ea6a5
--- /dev/null
+++ b/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_term.go
@@ -0,0 +1,32 @@
+$NetBSD: patch-vendor_github.com_ory_dockertest_docker_pkg_term_term.go,v 1.1 2019/10/23 15:00:05 he Exp $
+
+Use syscall.Termios and import "syscall", so that this builds on NetBSD.
+
+--- vendor/github.com/ory/dockertest/docker/pkg/term/term.go.orig	2019-09-09 21:08:25.000000000 +0000
++++ vendor/github.com/ory/dockertest/docker/pkg/term/term.go
+@@ -10,6 +10,7 @@ import (
+ 	"io"
+ 	"os"
+ 	"os/signal"
++	"syscall"
+ 
+ 	"golang.org/x/sys/unix"
+ )
+@@ -21,7 +22,7 @@ var (
+ 
+ // State represents the state of the terminal.
+ type State struct {
+-	termios Termios
++	termios syscall.Termios
+ }
+ 
+ // Winsize represents the size of the terminal window.
+@@ -50,7 +51,7 @@ func GetFdInfo(in interface{}) (uintptr,
+ 
+ // IsTerminal returns true if the given file descriptor is a terminal.
+ func IsTerminal(fd uintptr) bool {
+-	var termios Termios
++	var termios syscall.Termios
+ 	return tcget(fd, &termios) == 0
+ }
+ 
diff --git a/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_termios__bsd.go b/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_termios__bsd.go
new file mode 100644
index 000000000000..35776844de24
--- /dev/null
+++ b/security/vault/patches/patch-vendor_github.com_ory_dockertest_docker_pkg_term_termios__bsd.go
@@ -0,0 +1,12 @@
+$NetBSD: patch-vendor_github.com_ory_dockertest_docker_pkg_term_termios__bsd.go,v 1.1 2019/10/23 15:00:05 he Exp $
+
+Build this on NetBSD as well.
+
+--- vendor/github.com/ory/dockertest/docker/pkg/term/termios_bsd.go.orig	2019-09-09 21:08:25.000000000 +0000
++++ vendor/github.com/ory/dockertest/docker/pkg/term/termios_bsd.go
+@@ -1,4 +1,4 @@
+-// +build darwin freebsd openbsd
++// +build darwin freebsd openbsd netbsd
+ 
+ package term // import "github.com/ory/dockertest/docker/pkg/term"
+