From 0f5bfe46dcfe25c5ddca705a177326d3484864a7 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 15 Apr 2025 01:06:27 -0700
Subject: [PATCH] openssh: add version check

Check the version of both ssh and sshd in an installCheckPhase.
Seems prudent given recent version shenanigans upstream:

https://www.openwall.com/lists/oss-security/2025/04/09/6
---
 pkgs/tools/networking/openssh/common.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 4b10b85ade86..7f94a1e8408d 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -202,6 +202,13 @@ stdenv.mkDerivation (finalAttrs: {
     "sysconfdir=\${out}/etc/ssh"
   ];
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    for binary in ssh sshd; do
+      $out/bin/$binary -V 2>&1 | grep -P "$(printf '^OpenSSH_\\Q%s\\E,' "$version")"
+    done
+  '';
+
   passthru = {
     inherit withKerberos;
     tests = {