@johanot is right - and I think morph should work fine for actions not requiring ssh (like morph build), but complain if we try to deploy without the ssh binary in $PATH.

@johanot is right - and I think morph should work fine for actions not requiring ssh (like morph build), but complain if we try to deploy without the ssh binary in $PATH.

Aaah, right, i'm closing this PR then. Sorry for the fuss!

Just for the reference: DBCDK/morph#102

Until this is fixed upstream, we might want to add openssh as a runtime dependency.

This won't magically add openssh to $PATH, though - the binary needs to be wrapped.

See how this is done with borgbackup.

Yeah well. We have to agree on what we are actually fixing though? #78106 gives the example of morph build (build subcommand) failing because of openssh missing. This is obviously wrong, since morph can build machine expressions just fine without ever needing ssh.

I kinda feel that morph shouldn't be nixpkgs-wrapped with openssh, since it is possible to use morph as a standalone build tool, without ssh. But i do agree that morph build should stop failing when openssh is missing on $PATH. See my proposed upstream PR regarding that issue: DBCDK/morph#103

If a program requires a dependency to work (in any use case), we as <nixpkgs> should ship it with that dependency.

If that dependency is too large, we can split it into different derivation (example that comes in mind is a server application with GUI support, such as bitcoin{,d}), but in case of morph the majority of use cases are going to use deploy anyway, so I feel it is okay to ship it with openssh as a dependency.

FWIW, as someone that was trying out morph in a nix-shell --pure just now, I would expect that it'd be wrapped so that it "just worked" with SSH. A Go-based SSH implementation is neat, but makes e.g. using SSH keys on a smart card via the SSH agent more annoying, doesn't support everything in my ~/.ssh/config, etc.

Very +1 to wrapping the binary.

Right, we are using morph with Trezor to hold our ssh keys and I'm not sure if the gossh will support that.