From bf6855be79dcf742403084ab8851121e03261949 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Tue, 9 Jun 2026 17:55:30 +0200
Subject: [PATCH] libssh: Add optional support for gssapi

Similar to the openssh package, I am introducing a new package,
libsshWithGssapi, which enables the gssapi flag
---
 pkgs/by-name/li/libssh/package.nix           | 20 ++++++++++++++++----
 pkgs/by-name/li/libsshWithGssapi/package.nix |  3 +++
 2 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/by-name/li/libsshWithGssapi/package.nix

diff --git a/pkgs/by-name/li/libssh/package.nix b/pkgs/by-name/li/libssh/package.nix
index 93876d1b72d8..2c786b504b1a 100644
--- a/pkgs/by-name/li/libssh/package.nix
+++ b/pkgs/by-name/li/libssh/package.nix
@@ -8,6 +8,9 @@
   openssl,
   libsodium,
 
+  withGssapi ? false,
+  krb5,
+
   # for passthru.tests
   ffmpeg,
   sshping,
@@ -28,20 +31,29 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
   postPatch = ''
     # Fix headers to use libsodium instead of NaCl
     sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
   '';
 
-  # Don’t build examples, which are not installed and require additional dependencies not
-  # included in `buildInputs` such as libx11.
-  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
+  cmakeFlags = [
+    # Don’t build examples, which are not installed and require additional dependencies not
+    # included in `buildInputs` such as libx11.
+    "-DWITH_EXAMPLES=OFF"
+
+    (lib.cmakeBool "USE_GSSAPI" withGssapi)
+  ];
 
   buildInputs = [
     zlib
     openssl
     libsodium
-  ];
+  ]
+  ++ lib.optional withGssapi krb5;
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/li/libsshWithGssapi/package.nix b/pkgs/by-name/li/libsshWithGssapi/package.nix
new file mode 100644
index 000000000000..73876b693484
--- /dev/null
+++ b/pkgs/by-name/li/libsshWithGssapi/package.nix
@@ -0,0 +1,3 @@
+{ libssh }:
+
+libssh.override { withGssapi = true; }