once dev-util/cvs updates to include an env.d setting that sets CVS_RSH to ssh, we can drop it from baselayout
Fixed in cvs-1.12.12-r9