programs: ship sshpass

hosts/common/programs/assorted.nix

@@ -110,6 +110,7 @@ in
       # "screen"
       "see-cat"  # pretty-print equivalent to 'cat'
       "ssh"
+      "sshpass"
       "smartmontools"  # smartctl
       # "socat"
       "strace"
@@ -1141,6 +1142,8 @@ in
     ];
     sshfs-fuse.sandbox.keepPids = true;  #< XXX: bwrap didn't need this, but bunpen does. why?
 
+    sshpass.sandbox.autodetectCliPaths = "existingFile";  #< for `sshpass -f <path/to/password/file>`
+
     strace.sandbox.enable = false;  #< needs to `exec` its args, and therefore support *anything*
 
     subversion.sandbox.net = "clearnet";