Repository: pantsbuild/pants

Issue:
relevant ssh-agent variables not passable to _run.sh, causing difficulty with private repository authentication
```
❯ ./pants --version
/home/vputz/.cache/pants/setup/bootstrap-Linux-x86_64/2.3.0_py38
2.3.0
```

Using a private repository in a `requirements.txt` file of the form documented in the pants documentation, ie 
```
target@ git+ssh://git@github.com:/myorg/myrepo.git@myhash
```

the `.pants` commands fail to build requirements, because the SSH authentication is not being passed to the shell.  This results in an inability to proceed; running the command with `-ldebug` gives the log messages
```
 Complete output (5 lines):
  git@github.com: Permission denied (publickey).
  fatal: Could not read from remote repository.
  Please make sure you have the correct access rights
  and the repository exists.
  ----------------------------------------
```

Running the generated `_run.sh` script within an existing user shell worked correctly.

Via conversations on slack, the problem could be due to the `SSH_AUTH_SOCK` environment variable (or possibly the `SSH_AGENT_PID` variable) not being passed to the chrooted `_run.sh` script.  @stuhood noted that the `--subprocess-environment-env-vars` flag should pass the variable, but that this flag had hard-coded limits which were recently removed.  Indeed, running the command as

```
./pants test mytarget --subprocess-environment-env-vars=SSH_AUTH_SOCK
```

resulted in the exception

```
Exception message: 1 Exception encountered:

  ValueError: SSH_AUTH_SOCK is not in the list of variable names that are allowed to be set. Must be one of ALL_PROXY,FTP_PROXY,HTTPS_PROXY,HTTP_PROXY,LANG,LC_ALL,LC_CTYPE,NO_PROXY,REQUESTS_CA_BUNDLE,all_proxy,ftp_proxy,http_proxy,https_proxy,no_proxy.
```
This particular issue has been fixed, and the command can be run with

```
PANTS_SHA=d46197d033958ffda7d434aaf9b95148c96138d7 ./pants ... --subprocess-environment-env-vars=SSH_AUTH_SOCK
```

The command then completes.

So the process of accessing private repos can work by managing the SSH_AUTH_SOCK environment variable on future releases; this should perhaps be noted in the documentation on third-party requirements from source (https://www.pantsbuild.org/docs/python-third-party-dependencies#using-custom-repositories, under "Installing from Version Control and Local Files"), and it would be nice if there was a way to set this permanently in `pants.toml` so that the flag did not need to be passed every time.



Discussion:

Resolving patch:
diff --git a/src/python/pants/core/util_rules/subprocess_environment.py b/src/python/pants/core/util_rules/subprocess_environment.py
--- a/src/python/pants/core/util_rules/subprocess_environment.py
+++ b/src/python/pants/core/util_rules/subprocess_environment.py
@@ -9,28 +9,6 @@
 from pants.option.subsystem import Subsystem
 from pants.util.frozendict import FrozenDict
 
-# Names of env vars that can be set on all subprocesses via config.
-SETTABLE_ENV_VARS = (
-    # Customarily used to control i18n settings.
-    "LANG",
-    "LC_CTYPE",
-    "LC_ALL",
-    # Customarily used to control proxy settings in various processes.
-    "http_proxy",
-    "https_proxy",
-    "ftp_proxy",
-    "all_proxy",
-    "no_proxy",
-    "HTTP_PROXY",
-    "HTTPS_PROXY",
-    "FTP_PROXY",
-    "ALL_PROXY",
-    "NO_PROXY",
-    # Allow Requests to verify SSL certificates for HTTPS requests
-    # https://requests.readthedocs.io/en/master/user/advanced/#ssl-cert-verification
-    "REQUESTS_CA_BUNDLE",
-)
-
 
 # TODO: We may want to support different sets of env vars for different types of process.
 #  Can be done via scoped subsystems, possibly.  However we should only do this if there
@@ -51,8 +29,7 @@ def register_options(cls, register):
             help=(
                 "Environment variables to set for process invocations. "
                 "Entries are either strings in the form `ENV_VAR=value` to set an explicit value; "
-                "or just `ENV_VAR` to copy the value from Pants's own environment.\n\nEach ENV_VAR "
-                f"must be one of {', '.join(f'`{v}`' for v in SETTABLE_ENV_VARS)}."
+                "or just `ENV_VAR` to copy the value from Pants's own environment."
             ),
         )
 
@@ -71,9 +48,7 @@ def get_subprocess_environment(
     subproc_env: SubprocessEnvironment, pants_env: PantsEnvironment
 ) -> SubprocessEnvironmentVars:
     return SubprocessEnvironmentVars(
-        pants_env.get_subset(
-            subproc_env.env_vars_to_pass_to_subprocesses, allowed=SETTABLE_ENV_VARS
-        )
+        pants_env.get_subset(subproc_env.env_vars_to_pass_to_subprocesses)
     )
 
 


Test patch: