From 061b844928aaf29682025ee6653e6a2f1e82a89c Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Fri, 10 Oct 2025 21:46:51 -0400
Subject: [PATCH 1/2] openssh: split out dev and man outputs

Splitting `dev` allows to reduce the closure size for static build from
150MB to 75MB.
---
 pkgs/tools/networking/openssh/common.nix | 8 +++++++-
 pkgs/tools/networking/openssh/copyid.nix | 6 +++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 253f1aaaccc5..e06d2201a680 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -51,6 +51,12 @@ assert withFIDO -> withSecurityKey;
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version src;
 
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
   patches = [
     # Making openssh pass the LOCALE_ARCHIVE variable to the forked session processes,
     # so the session 'bash' will receive the proper locale archive, and thus process
@@ -221,7 +227,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Install ssh-copy-id, it's very useful.
     cp contrib/ssh-copy-id $out/bin/
     chmod +x $out/bin/ssh-copy-id
-    cp contrib/ssh-copy-id.1 $out/share/man/man1/
+    cp contrib/ssh-copy-id.1 $man/share/man/man1/
   '';
 
   installTargets = [ "install-nokeys" ];
diff --git a/pkgs/tools/networking/openssh/copyid.nix b/pkgs/tools/networking/openssh/copyid.nix
index 55da4a5c701c..e8d6f4b3f388 100644
--- a/pkgs/tools/networking/openssh/copyid.nix
+++ b/pkgs/tools/networking/openssh/copyid.nix
@@ -6,6 +6,10 @@
 
 runCommand "ssh-copy-id-${openssh.version}"
   {
+    outputs = [
+      "out"
+      "man"
+    ];
     meta = openssh.meta // {
       description = "Tool to copy SSH public keys to a remote machine";
       priority = (openssh.meta.priority or lib.meta.defaultPriority) - 1;
@@ -13,5 +17,5 @@ runCommand "ssh-copy-id-${openssh.version}"
   }
   ''
     install -Dm 755 {${openssh},$out}/bin/ssh-copy-id
-    install -Dm 644 {${openssh},$out}/share/man/man1/ssh-copy-id.1.gz
+    install -Dm 644 {${openssh.man},$man}/share/man/man1/ssh-copy-id.1.gz
   ''

From 4a6c158fd6ca4a6bd57d0c91ddf6470a85c8059f Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Fri, 10 Oct 2025 21:53:13 -0400
Subject: [PATCH 2/2] openssh: --replace -> --replace-fail

---
 pkgs/tools/networking/openssh/common.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index e06d2201a680..052dbc7ba215 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     # On Hydra this makes installation fail (sometimes?),
     # and nix store doesn't allow such fancy permission bits anyway.
     ''
-      substituteInPlace Makefile.in --replace '$(INSTALL) -m 4711' '$(INSTALL) -m 0711'
+      substituteInPlace Makefile.in --replace-fail '$(INSTALL) -m 4711' '$(INSTALL) -m 0711'
     '';
 
   strictDeps = true;
@@ -186,13 +186,13 @@ stdenv.mkDerivation (finalAttrs: {
 
       # explicitly enable the PermitUserEnvironment feature
       substituteInPlace regress/test-exec.sh \
-        --replace \
+        --replace-fail \
           'cat << EOF > $OBJ/sshd_config' \
           $'cat << EOF > $OBJ/sshd_config\n\tPermitUserEnvironment yes'
 
       # some tests want to use files under /bin as example files
       for f in regress/sftp-cmds.sh regress/forwarding.sh; do
-        substituteInPlace $f --replace '/bin' "$(dirname $(type -p ls))"
+        substituteInPlace $f --replace-fail '/bin' "$(dirname $(type -p ls))"
       done
 
       # set up NIX_REDIRECTS for direct invocations
@@ -205,7 +205,7 @@ stdenv.mkDerivation (finalAttrs: {
         ''
           # The extra tests check PKCS#11 interactions, which softhsm emulates with software only
           substituteInPlace regress/test-exec.sh \
-            --replace /usr/local/lib/softhsm/libsofthsm2.so ${lib.getLib softhsm}/lib/softhsm/libsofthsm2.so
+            --replace-fail /usr/local/lib/softhsm/libsofthsm2.so ${lib.getLib softhsm}/lib/softhsm/libsofthsm2.so
         ''
   );
   # integration tests hard to get working on darwin with its shaky