ssh: Pass the user-specified ssh options last

[thufschmitt]

Motivation

When NIX_SSHOPTS is set, append it to the generate it ssh command-line rather than adding it in the middle. This allows doing nasty things like prepending anything to the command than Nix runs, and provides a workaround for #1078.

Context

Fix #8292

Checklist for maintainers

Maintainers: tick if completed or explain if not relevant

• agreed on idea
• agreed on implementation strategy
• tests, as appropriate
  • functional tests - tests/**.sh
  • unit tests - src/*/tests
  • integration tests - tests/nixos/*
• documentation in the manual
• documentation in the internal API docs
• code and comments are self-explanatory
• commit message explains why the change was made
• new feature or incompatible change: updated release notes

Priorities

Add 👍 to pull requests you find important.

[edolstra]

This seems like a really nasty hack. If I came across this, I would assume it was a (shell injection) bug.

Wouldn't it be better to add a setting for prepending stuff to the remote command?

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tweag-nix-dev-update-48/28102/1

[thufschmitt]

Wouldn't it be better to add a setting for prepending stuff to the remote command?

Wouldn't that just add one more setting for something that's not much less of a hack?

[quentinmit]

Wouldn't it be better to add a setting for prepending stuff to the remote command?

Wouldn't that just add one more setting for something that's not much less of a hack?

A better argument is that this applies to ssh options, too, since later options override earlier options. Without fixing the order of the arguments, users can't override any of the options nix itself is trying to set.