From 9bfec806dfcc0f0ae43f17ab5a139c5a45aaf5e0 Mon Sep 17 00:00:00 2001
From: edef <edef@edef.eu>
Date: Thu, 20 Jun 2019 17:15:33 +0000
Subject: [PATCH] openssh: don't let configure override SSH_KEYSIGN

While 9fe10288f01984963faf47e21bf1bae4d7d37962 ensured that the
ssh-keysign path is searched for in PATH if not absolute,
it doesn't prevent the configure script from defaulting to an
absolute path in $out/libexec, making the whole effort rather
pointless.
---
 pkgs/tools/networking/openssh/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index d592d6da8f2..2a1122029c1 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -88,6 +88,8 @@ stdenv.mkDerivation rec {
     ++ optional stdenv.isDarwin "--disable-libutil"
     ++ optional (!linkOpenssl) "--without-openssl";
 
+  buildFlags = [ "SSH_KEYSIGN=ssh-keysign" ];
+
   enableParallelBuilding = true;
 
   hardeningEnable = [ "pie" ];