From e6ab94024c017c72ed0dc2835de5e0d4b8201f6d Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Wed, 3 Dec 2025 12:53:58 -0800
Subject: [PATCH] openssh: add withAudit (default false)

libaudit linking should be controllable independently of the static
build and should explicitly be added to configureFlags for users
that need it.
---
 pkgs/tools/networking/openssh/common.nix | 38 ++++++++++++++++--------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 26999bd53ed5..1ebc5179bad7 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -18,7 +18,9 @@
   fetchurl,
   fetchpatch,
   autoreconfHook,
+  withAudit ? false,
   audit,
+  libcap_ng,
   zlib,
   openssl,
   softhsm,
@@ -46,6 +48,9 @@
   isNixos ? stdenv.hostPlatform.isLinux,
 }:
 
+# libaudit support requires Linux
+assert withAudit -> stdenv.hostPlatform.isLinux;
+
 # FIDO support requires SK support
 assert withFIDO -> withSecurityKey;
 
@@ -99,7 +104,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional withKerberos krb5
   ++ lib.optional withLdns ldns
   ++ lib.optional withPAM pam
-  ++ lib.optional stdenv.hostPlatform.isStatic audit;
+  ++ lib.optionals withAudit [
+    audit
+    libcap_ng
+  ];
 
   preConfigure = ''
     # Setting LD causes `configure' and `make' to disagree about which linker
@@ -107,11 +115,22 @@ stdenv.mkDerivation (finalAttrs: {
     unset LD
   '';
 
-  env = lib.optionalAttrs isNixos {
-    # openssh calls passwd to allow the user to reset an expired password, but nixos
-    # doesn't ship it at /usr/bin/passwd.
-    PATH_PASSWD_PROG = "/run/wrappers/bin/passwd";
-  };
+  env =
+    lib.optionalAttrs isNixos {
+      # openssh calls passwd to allow the user to reset an expired password, but nixos
+      # doesn't ship it at /usr/bin/passwd.
+      PATH_PASSWD_PROG = "/run/wrappers/bin/passwd";
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isStatic {
+      NIX_LDFLAGS = lib.concatStringsSep " " (
+        lib.optional withKerberos "-lkeyutils"
+        ++ lib.optional withLdns "-lcrypto"
+        ++ lib.optionals withAudit [
+          "-laudit"
+          "-lcap-ng"
+        ]
+      );
+    };
 
   # I set --disable-strip because later we strip anyway. And it fails to strip
   # properly when cross building.
@@ -136,14 +155,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional withLdns "--with-ldns"
   ++ lib.optional stdenv.hostPlatform.isOpenBSD "--with-bsd-auth"
   ++ lib.optional withLinuxMemlock "--with-linux-memlock-onfault"
+  ++ lib.optional withAudit "--with-audit=linux"
   ++ extraConfigureFlags;
 
-  ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null} = [
-    "-laudit"
-  ]
-  ++ lib.optional withKerberos "-lkeyutils"
-  ++ lib.optional withLdns "-lcrypto";
-
   buildFlags = [ "SSH_KEYSIGN=ssh-keysign" ];
 
   enableParallelBuilding = true;