Change:
Running with my still-quite-new nix environment, I get: Installing openssh fixes the problem for me, of course. But this means that git really ought to declare a dependency on openssh, no?
Hmm, currently I see two other alternatives: wrap all to have ssh in path (this seems the cleanest way), add it to , or or leave it as it is.
Or patch git to invoke ssh via an absolute path. (I'm not really fond of wrappers...)
Personally, I'd be very much in favor of patching git to call via an absolute path. At the same time, maintaining that patch over time is tedious and error-prone work, and I'd rather not be responsible for that. IMHO, patching SSH would be a feasible alternative only if we get that patch included upstream.
Has anyone taken a look at patching git to see how hard it will be?
There are two places. One is in connect.c where it reads GIT_SSH and then does Another is in git-gui where it does more or less the same, but in TCL.
I just found out that openssh isn't even a build input of git at the moment. :-)
I've decided to add a wrapper, since maintaining patches for references is going to be a burden. We still need to be able to specify public keys for ssh to pick them up.
your patch broke git-annex:
Reverted
that's an old build, now src is using https for sxiv
Is there a recommended solution for this now?
The recommended solution is to patch git, IMHO. It's not hard, as pointed out.
Triage: this issue does still exist on 16.03-beta:
Patched in
The solution to this issue is now causing a different issue on Fedora: () I'm not sure if we should really hard-code a SSH binary or if we should e.g. just reference a SSH binary as a fallback. Opinions welcome :)
FYI: is about to revert this and I currently believe that this is a good idea.

Discussion:
gitBase = lib.makeOverridable (import ./git) { inherit fetchurl stdenv curl openssl zlib expat perl python gettext gnugrep asciidoc xmlto docbook2x docbook_xsl docbook_xml_dtd_45 libxslt cpio tcl <del> tk makeWrapper subversionClient gzip libiconv; </del> <ins> tk makeWrapper subversionClient gzip openssh libiconv; </ins> texinfo = texinfo5; svnSupport = false;         # for git-svn support guiSupport = false;         # requires tcl/tk

<del> { fetchurl, stdenv, curl, openssl, zlib, expat, perl, python, gettext, cpio, gnugrep, gzip </del> <ins> { fetchurl, stdenv, curl, openssl, zlib, expat, perl, python, gettext, cpio , gnugrep, gzip, openssh </ins> , asciidoc, texinfo, xmlto, docbook2x, docbook_xsl, docbook_xml_dtd_45 , libxslt, tcl, tk, makeWrapper, libiconv , svnSupport, subversionClient, perlLibs, smtpPerlLibs

./docbook2texi.patch ./symlinks-in-bin.patch ./git-sh-i18n.patch <ins> ./ssh-path.patch </ins> ]; <ins> postPatch = '' for x in connect.c git-gui/lib/remote_add.tcl ; do substituteInPlace "$x"  --subst-var-by ssh "${openssh}/bin/ssh" done ''; </ins> buildInputs = [curl openssl zlib expat gettext cpio makeWrapper libiconv] ++ stdenv.lib.optionals withManual [ asciidoc texinfo xmlto docbook2x docbook_xsl docbook_xml_dtd_45 libxslt ]

<ins> diff --git a/connect.c b/connect.c index fd7ffe1..20cd992 100644 --- a/connect.c +++ b/connect.c @@ -768,7 +768,7 @@ struct child_process *git_connect(int fd[2], const char *url, ssh = getenv("GIT_SSH"); if (!ssh) -					ssh = "ssh"; +					ssh = "@ssh@"; ssh_dup = xstrdup(ssh); base = basename(ssh_dup); diff --git a/git-gui/lib/remote_add.tcl b/git-gui/lib/remote_add.tcl index 50029d0..17b9594 100644 --- a/git-gui/lib/remote_add.tcl +++ b/git-gui/lib/remote_add.tcl @@ -139,7 +139,7 @@ method _add {} { # Parse the location if { [regexp {(?:git+)?ssh://([^/]+)(/.+)} $location xx host path] || [regexp {([^:][^:]+):(.+)} $location xx host path]} { -			set ssh ssh +			set ssh @ssh@ if {[info exists env(GIT_SSH)]} { set ssh $env(GIT_SSH) } </ins>