git fix docs and wrapper script (#77588) (#77603)

* git fix docs and wrapper script

 fixes #77582

 now env var is set to wrapper or full command depending on version
 as was the intent of previous PR
 added ref to git commit from git for why/how we used the env vars

* handle key_file

(cherry picked from commit d06d99cbb6)

changelogs/fragments/git_fixes.yml

@@ -1,3 +1,4 @@
 bugfixes:
   - git module no longer uses wrapper script for ssh options.
   - git module is more consistent and clearer about which ssh options are added to git calls.
+  - git module fix docs and proper use of ssh wrapper script and GIT_SSH_COMMAND depending on version.

lib/ansible/modules/git.py

@@ -61,8 +61,10 @@ options:
         version_added: "2.12"
     ssh_opts:
         description:
-            - Options git will pass to ssh when used as protocol, it works via GIT_SSH_OPTIONS.
+            - Options git will pass to ssh when used as protocol, it works via C(git)'s
-            - For older versions it appends GIT_SSH_OPTIONS to GIT_SSH/GIT_SSH_COMMAND.
+              GIT_SSH/GIT_SSH_COMMAND environment variables.
+            - For older versions it appends GIT_SSH_OPTS (specific to this module) to the
+              variables above or via a wrapper script.
             - Other options can add to this list, like I(key_file) and I(accept_hostkey).
             - An example value could be "-o StrictHostKeyChecking=no" (although this particular
               option is better set by I(accept_hostkey)).
@@ -441,7 +443,7 @@ def write_ssh_wrapper(module):
 
     # use existing git_ssh/ssh_command, fallback to 'ssh'
     template = b("""#!/bin/sh
-%s $GIT_SSH_OPTS
+%s $GIT_SSH_OPTS "$@"
 """ % os.environ.get('GIT_SSH', os.environ.get('GIT_SSH_COMMAND', 'ssh')))
 
     # write it
@@ -484,27 +486,33 @@ def set_git_ssh_env(key_file, ssh_opts, git_version, module):
 
     # deal with key file
     if key_file:
-        os.environ["GIT_KEY"] = key_file
+        key_opt = '-i %s' % key_file
+        if key_opt not in ssh_opts:
+            ssh_opts += '  %s' % key_opt
 
         ikey = 'IdentitiesOnly=yes'
         if ikey not in ssh_opts:
             ssh_opts += ' -o %s' % ikey
 
-    # we should always have finalized string here.
+    # older than 2.3 does not know how to use git_ssh_command,
-    os.environ["GIT_SSH_OPTS"] = ssh_opts
+    # so we force it into get_ssh var
-
+    # https://github.com/gitster/git/commit/09d60d785c68c8fa65094ecbe46fbc2a38d0fc1f
-    # older than 2.3 does not know how to use git_ssh_opts,
-    # so we force it into ssh command var
     if git_version < LooseVersion('2.3.0'):
+        # for use in wrapper
+        os.environ["GIT_SSH_OPTS"] = ssh_opts
 
         # these versions don't support GIT_SSH_OPTS so have to write wrapper
         wrapper = write_ssh_wrapper(module)
 
-        # force use of git_ssh_opts via wrapper
+        # force use of git_ssh_opts via wrapper, git_ssh cannot not handle arguments
-        os.environ["GIT_SSH"] = wrapper
+        os.environ['GIT_SSH'] = wrapper
-
+    else:
-        # same as above but older git uses git_ssh_command
+        # we construct full finalized command string here
-        os.environ["GIT_SSH_COMMAND"] = wrapper
+        full_cmd = os.environ.get('GIT_SSH', os.environ.get('GIT_SSH_COMMAND', 'ssh'))
+        if ssh_opts:
+            full_cmd += ' ' + ssh_opts
+        # git_ssh_command can handle arguments to ssh
+        os.environ["GIT_SSH_COMMAND"] = full_cmd
 
 
 def get_version(module, git_path, dest, ref="HEAD"):