openssh: put tests into passthru

openssh tests are very slow (they take ~30 mins because they are not
parallelized). This makes rebuilding (esp. after changes e.g. to
systemd) painful. Putting the tests into a separate derivation solves
this without losing any testing capability.

Debian does the same: https://packages.debian.org/sid/openssh-tests

nixos/release-small.nix

@@ -78,6 +78,7 @@ in rec {
       nginx
       nodejs
       openssh
+      opensshTest
       php
       postgresql
       python
@@ -139,6 +140,7 @@ in rec {
         "nixos.tests.simple"
         "nixpkgs.jdk"
         "nixpkgs.tests-stdenv-gcc-stageCompare"
+        "nixpkgs.opensshTest"
       ])
     ];
   };

pkgs/tools/networking/openssh/common.nix

@@ -36,7 +36,7 @@
 , isNixos ? stdenv.hostPlatform.isLinux
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   inherit pname version src;
 
   patches = [
@@ -111,7 +111,7 @@ stdenv.mkDerivation {
 
   hardeningEnable = [ "pie" ];
 
-  doCheck = true;
+  doCheck = false;
   enableParallelChecking = false;
   nativeCheckInputs = [ openssl ] ++ lib.optional (!stdenv.isDarwin) hostname;
   preCheck = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
@@ -181,7 +181,11 @@ stdenv.mkDerivation {
     inherit withKerberos;
     tests = {
       borgbackup-integration = nixosTests.borgbackup;
-      openssh = nixosTests.openssh;
+      nixosTest = nixosTests.openssh;
+      openssh = finalAttrs.finalPackage.overrideAttrs (previousAttrs: {
+        pname = previousAttrs.pname + "-test";
+        doCheck = true;
+      });
     };
   };
 
@@ -194,4 +198,4 @@ stdenv.mkDerivation {
     maintainers = (extraMeta.maintainers or []) ++ (with maintainers; [ eelco aneeshusa ]);
     mainProgram = "ssh";
   } // extraMeta;
-}
+})

pkgs/top-level/all-packages.nix

@@ -11328,6 +11328,8 @@ with pkgs;
     etcDir = "/etc/ssh";
   };
 
+  opensshTest = openssh.tests.openssh;
+
   opensshWithKerberos = openssh.override {
     withKerberos = true;
   };