apt: allow for --allow-unauthenticated in upgrade (#38381)

* apt: allow for --allow-unauthenticated in upgrade

* Style fix

* Another style fix

* Add trailing comma

lib/ansible/modules/packaging/os/apt.py

@@ -762,7 +762,9 @@ def cleanup(m, purge=False, force=False, operation=None,
 
 def upgrade(m, mode="yes", force=False, default_release=None,
             use_apt_get=False,
-            dpkg_options=expand_dpkg_options(DPKG_OPTIONS), autoremove=False):
+            dpkg_options=expand_dpkg_options(DPKG_OPTIONS), autoremove=False,
+            allow_unauthenticated=False,
+            ):
 
     if autoremove:
         autoremove = '--auto-remove'
@@ -802,6 +804,8 @@ def upgrade(m, mode="yes", force=False, default_release=None,
     else:
         force_yes = ''
 
+    allow_unauthenticated = '--allow-unauthenticated' if allow_unauthenticated else ''
+
     if apt_cmd is None:
         if use_apt_get:
             apt_cmd = APT_GET_CMD
@@ -810,8 +814,8 @@ def upgrade(m, mode="yes", force=False, default_release=None,
                             "to have APTITUDE in path or use 'force_apt_get=True'")
     apt_cmd_path = m.get_bin_path(apt_cmd, required=True)
 
-    cmd = '%s -y %s %s %s %s' % (apt_cmd_path, dpkg_options,
+    cmd = '%s -y %s %s %s %s %s' % (apt_cmd_path, dpkg_options, force_yes, allow_unauthenticated,
-                                 force_yes, check_arg, upgrade_command)
+                                    check_arg, upgrade_command)
 
     if default_release:
         cmd += " -t '%s'" % (default_release,)
@@ -1028,7 +1032,7 @@ def main():
         force_yes = p['force']
 
         if p['upgrade']:
-            upgrade(module, p['upgrade'], force_yes, p['default_release'], use_apt_get, dpkg_options, autoremove)
+            upgrade(module, p['upgrade'], force_yes, p['default_release'], use_apt_get, dpkg_options, autoremove, allow_unauthenticated)
 
         if p['deb']:
             if p['state'] != 'present':
@@ -1048,7 +1052,7 @@ def main():
         if latest and all_installed:
             if packages:
                 module.fail_json(msg='unable to install additional packages when upgrading all installed packages')
-            upgrade(module, 'yes', force_yes, p['default_release'], use_apt_get, dpkg_options, autoremove)
+            upgrade(module, 'yes', force_yes, p['default_release'], use_apt_get, dpkg_options, autoremove, allow_unauthenticated)
 
         if packages:
             for package in packages:

test/integration/targets/apt/tasks/repo.yml

@@ -49,7 +49,7 @@
     apt:
       upgrade: dist
       autoremove: yes
-      force: yes  # workaround for --allow-unauthenticated used along with upgrade
+      allow_unauthenticated: yes
 
   - name: Check foo with dpkg
     shell: dpkg-query -l foo