From 0d3967d62cfc59a702cf26f30e20bc831e569e28 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 29 Apr 2025 15:25:36 +0200
Subject: [PATCH] openssh: Add ssh-keysign patch note

Copied from 9fe10288f01984963faf47e21bf1bae4d7d37962
---
 pkgs/tools/networking/openssh/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index bb06b6909478..8aa9fb053aba 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -18,7 +18,13 @@ in
       hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";
     };
 
-    extraPatches = [ ./ssh-keysign-8.5.patch ];
+    extraPatches = [
+      # Use ssh-keysign from PATH
+      # ssh-keysign is used for host-based authentication, and is designed to be used
+      # as SUID-root program. OpenSSH defaults to referencing it from libexec, which
+      # cannot be made SUID in Nix.
+      ./ssh-keysign-8.5.patch
+    ];
     extraMeta = {
       maintainers = [ lib.maintainers.philiptaron ];
       teams = [ lib.teams.helsinki-systems ];