openssh: Add ssh-keysign patch note

Copied from 9fe10288f0
2025-04-29 15:47:54 +02:00
parent 3e63191753
commit 0d3967d62c
1 changed files with 7 additions and 1 deletions
@@ -18,7 +18,13 @@ in
      hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";
    };

-    extraPatches = [ ./ssh-keysign-8.5.patch ];
+    extraPatches = [
+      # Use ssh-keysign from PATH
+      # ssh-keysign is used for host-based authentication, and is designed to be used
+      # as SUID-root program. OpenSSH defaults to referencing it from libexec, which
+      # cannot be made SUID in Nix.
+      ./ssh-keysign-8.5.patch
+    ];
    extraMeta = {
      maintainers = [ lib.maintainers.philiptaron ];
      teams = [ lib.teams.helsinki-systems ];