From b8d7d975b34299870d9087a8146bc8bdac6c9b05 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Fri, 28 Nov 2025 14:11:13 -0800
Subject: [PATCH] openssh: fix PKCS#11 key enumeration and pin entry

Arch has cherry-picked these commits to fix a bug in OpenSSH's PKCS#11
support; we should do them ourselves too.

https://gitlab.archlinux.org/archlinux/packaging/packages/openssh/-/issues/23

Replace our hand-rolled patch for the PKCS#11 tests with the
corresponding commits landing upstream.

Fixes: #466049
Signed-off-by: Morgan Jones <me@numin.it>
---
 pkgs/tools/networking/openssh/common.nix      | 28 +++++++++-
 .../networking/openssh/fix_pkcs11_tests.patch | 51 -------------------
 2 files changed, 27 insertions(+), 52 deletions(-)
 delete mode 100644 pkgs/tools/networking/openssh/fix_pkcs11_tests.patch

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 26999bd53ed5..3be6e5704320 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -67,9 +67,35 @@ stdenv.mkDerivation (finalAttrs: {
     # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
     ./dont_create_privsep_path.patch
 
+    # See discussion in https://github.com/NixOS/nixpkgs/issues/466049 and
+    # https://gitlab.archlinux.org/archlinux/packaging/packages/openssh/-/issues/23
+    (fetchpatch {
+      name = "pkcs11-fetchkey-error-to-debug.patch";
+      url = "https://github.com/openssh/openssh-portable/commit/607f337637f2077b34a9f6f96fc24237255fe175.patch";
+      hunks = [ "2-" ];
+      hash = "sha256-rdvKL6/rwrdhGKlcmdy6fxVgJgaaRsmngX0KkShXAhQ=";
+    })
+    (fetchpatch {
+      name = "pkcs11-fix-pinentry.patch";
+      url = "https://github.com/openssh/openssh-portable/commit/434ba7684054c0637ce8f2486aaacafe65d9b8aa.patch";
+      # only applies to Makefile.in (which doesn't have a date header) so no hunks= needed
+      hash = "sha256-3JQ3IJurngXclORrfC2Bx7xvmGA6w2nIh+eZ0zd0bLY=";
+    })
+
     # See discussion in https://github.com/NixOS/nixpkgs/issues/453782 and
     # https://github.com/openssh/openssh-portable/pull/602
-    ./fix_pkcs11_tests.patch
+    (fetchpatch {
+      name = "pkcs11-tests-allow-module-path.patch";
+      url = "https://github.com/openssh/openssh-portable/commit/5e7c3f33b2693b668ecfbac84b85f2c0c84410c2.patch";
+      hunks = [ "2-" ];
+      hash = "sha256-mGpRGXurg8K9Wp8qoojG5MQ+3sZW2XKy2z0RDXLHaEc=";
+    })
+    (fetchpatch {
+      name = "ssh-agent-tests-increase-timeout.patch";
+      url = "https://github.com/openssh/openssh-portable/commit/1fdc3c61194819c16063dc430eeb84b81bf42dcf.patch";
+      hunks = [ "2-" ];
+      hash = "sha256-b9YCOav32kY5VEvIG3W1fyD87HaQxof6Zwq9Oo+/Lac=";
+    })
   ]
   ++ extraPatches;
 
diff --git a/pkgs/tools/networking/openssh/fix_pkcs11_tests.patch b/pkgs/tools/networking/openssh/fix_pkcs11_tests.patch
deleted file mode 100644
index c4459c8ee0e1..000000000000
--- a/pkgs/tools/networking/openssh/fix_pkcs11_tests.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 642218d8dd1ec79fa0c8db491fd46faa3ab026f7 Mon Sep 17 00:00:00 2001
-From: Morgan Jones <me@numin.it>
-Date: Tue, 21 Oct 2025 01:15:55 -0700
-Subject: [PATCH 1/2] test-exec: use -P for allowed PKCS#11 library when
- starting agent
-
-If we just loaded a PKCS#11 library, we should allow it so the
-regression test can run.
-
-Fixes: https://github.com/NixOS/nixpkgs/issues/453782
----
- regress/test-exec.sh | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/regress/test-exec.sh b/regress/test-exec.sh
-index 5b0c91f3faa..30b3da8709d 100644
---- a/regress/test-exec.sh
-+++ b/regress/test-exec.sh
-@@ -1023,6 +1023,9 @@ p11_ssh_add() {
- 
- start_ssh_agent() {
- 	EXTRA_AGENT_ARGS="$1"
-+	if [ "$PKCS11_OK" = "yes" ]; then
-+		EXTRA_AGENT_ARGS="${EXTRA_AGENT_ARGS} -P${TEST_SSH_PKCS11}"
-+	fi
- 	SSH_AUTH_SOCK="$OBJ/agent.sock"
- 	export SSH_AUTH_SOCK
- 	rm -f $SSH_AUTH_SOCK $OBJ/agent.log
-
-From 5ae735db7d81b38ee059d63a4011291cb4456aef Mon Sep 17 00:00:00 2001
-From: Morgan Jones <me@numin.it>
-Date: Tue, 21 Oct 2025 01:50:23 -0700
-Subject: [PATCH 2/2] test-exec: give more time for ssh-agent to start
-
----
- regress/test-exec.sh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/regress/test-exec.sh b/regress/test-exec.sh
-index 30b3da8709d..56a7653b386 100644
---- a/regress/test-exec.sh
-+++ b/regress/test-exec.sh
-@@ -1034,7 +1034,7 @@ start_ssh_agent() {
- 	    > $OBJ/agent.log 2>&1 &
- 	AGENT_PID=$!
- 	trap "kill $AGENT_PID" EXIT
--	for x in 0 1 2 3 4 ; do
-+	for x in $(seq 15); do
- 		# Give it a chance to start
- 		${SSHADD} -l > /dev/null 2>&1
- 		r=$?