push sheeet

pkgs/by-name/dr/dropbear/package.nix

@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  zlib,
+  libxcrypt,
+  enableSCP ? false,
+  sftpPath ? "/run/current-system/sw/libexec/sftp-server",
+}:
+
+let
+  # NOTE: DROPBEAR_PATH_SSH_PROGRAM is only necessary when enableSCP is true,
+  # but it is enabled here always anyways for consistency
+  dflags = {
+    SFTPSERVER_PATH = sftpPath;
+    DROPBEAR_PATH_SSH_PROGRAM = "${placeholder "out"}/bin/dbclient";
+  };
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "dropbear";
+  version = "2025.88";
+
+  src = fetchurl {
+    url = "https://matt.ucc.asn.au/dropbear/releases/dropbear-${version}.tar.bz2";
+    sha256 = "sha256-eD9Q6iexfBbaiVePr9tt7PpEu49lkOVpik5NNnLcU9Q=";
+  };
+
+  CFLAGS = lib.pipe (lib.attrNames dflags) [
+    (map (name: "-D${name}=\\\"${dflags.${name}}\\\""))
+    (lib.concatStringsSep " ")
+  ];
+
+  configureFlags = lib.optionals stdenv.hostPlatform.isMusl [
+    "--enable-wtmp=no"
+    "--enable-wtmpx=no"
+  ];
+
+  # https://www.gnu.org/software/make/manual/html_node/Libraries_002fSearch.html
+  preConfigure = ''
+    makeFlagsArray=(
+      VPATH=$(cat $NIX_CC/nix-support/orig-libc)/lib
+      PROGRAMS="${
+        lib.concatStringsSep " " (
+          [
+            "dropbear"
+            "dbclient"
+            "dropbearkey"
+            "dropbearconvert"
+          ]
+          ++ lib.optionals enableSCP [ "scp" ]
+        )
+      }"
+    )
+  '';
+
+  postInstall = lib.optionalString enableSCP ''
+    ln -rs $out/bin/scp $out/bin/dbscp
+  '';
+
+  patches = [
+    # Allow sessions to inherit the PATH from the parent dropbear.
+    # Otherwise they only get the usual /bin:/usr/bin kind of PATH
+    ./pass-path.patch
+  ];
+
+  buildInputs = [
+    zlib
+    libxcrypt
+  ];
+
+  meta = {
+    description = "Small footprint implementation of the SSH 2 protocol";
+    homepage = "https://matt.ucc.asn.au/dropbear/dropbear.html";
+    changelog = "https://github.com/mkj/dropbear/raw/DROPBEAR_${version}/CHANGES";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/dr/dropbear/pass-path.patch

@@ -0,0 +1,39 @@
+diff --git a/src/svr-chansession.c b/src/svr-chansession.c
+index 9ae2e60..2db7598 100644
+--- a/src/svr-chansession.c
++++ b/src/svr-chansession.c
+@@ -948,6 +948,8 @@ static void addchildpid(struct ChanSess *chansess, pid_t pid) {
+ static void execchild(const void *user_data) {
+ 	const struct ChanSess *chansess = user_data;
+ 	char *usershell = NULL;
++	const char *path = (getuid() == 0) ? DEFAULT_ROOT_PATH : DEFAULT_PATH;
++	const char *ldpath = NULL;
+ 	char *cp = NULL;
+ 	char *envcp = getenv("LANG");
+ 	if (envcp != NULL) {
+@@ -965,6 +967,11 @@ static void execchild(const void *user_data) {
+ 	seedrandom();
+ #endif
+ 
++	if (getenv("PATH")) {
++		path = getenv("PATH");
++	}
++	ldpath = getenv("LD_LIBRARY_PATH");
++
+ 	/* clear environment if -e was not set */
+ 	/* if we're debugging using valgrind etc, we need to keep the LD_PRELOAD
+ 	 * etc. This is hazardous, so should only be used for debugging. */
+@@ -1012,10 +1019,9 @@ static void execchild(const void *user_data) {
+ 	addnewvar("LOGNAME", ses.authstate.pw_name);
+ 	addnewvar("HOME", ses.authstate.pw_dir);
+ 	addnewvar("SHELL", get_user_shell());
+-	if (getuid() == 0) {
+-		addnewvar("PATH", DEFAULT_ROOT_PATH);
+-	} else {
+-		addnewvar("PATH", DEFAULT_PATH);
++	addnewvar("PATH", path);
++	if (ldpath != NULL) {
++		addnewvar("LD_LIBRARY_PATH", ldpath);
+ 	}
+ 	if (cp != NULL) {
+ 		addnewvar("LANG", cp);