git: only hardcode path to ssh binary on full build

Requirement for #146702

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -477,6 +477,15 @@
           the FIDO security key middleware interface.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>git</literal> no longer hardcodes the path to
+          openssh’ ssh binary to reduce the amount of rebuilds. If you
+          are using git with ssh remotes and do not have a ssh binary in
+          your enviroment consider adding <literal>openssh</literal> to
+          it or switching to <literal>gitFull</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>services.k3s.enable</literal> no longer implies

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -154,6 +154,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.
 
+- `git` no longer hardcodes the path to openssh' ssh binary to reduce the amount of rebuilds. If you are using git with ssh remotes and do not have a ssh binary in your enviroment consider adding `openssh` to it or switching to `gitFull`.
+
 - `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
   This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
   The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -18,6 +18,7 @@
 , withLibsecret ? false
 , pkg-config, glib, libsecret
 , gzip # needed at runtime by gitweb.cgi
+, withSsh ? false
 }:
 
 assert osxkeychainSupport -> stdenv.isDarwin;
@@ -27,7 +28,6 @@ assert svnSupport -> perlSupport;
 let
   version = "2.35.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
-
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
 
@@ -49,28 +49,27 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  ## Patch
-
   patches = [
     ./docbook2texi.patch
     ./git-sh-i18n.patch
-    ./ssh-path.patch
     ./git-send-email-honor-PATH.patch
     ./installCheck-path.patch
+  ] ++ lib.optionals withSsh [
+    ./ssh-path.patch
   ];
 
   postPatch = ''
-    for x in connect.c git-gui/lib/remote_add.tcl ; do
-      substituteInPlace "$x" \
-        --subst-var-by ssh "${openssh}/bin/ssh"
-    done
-
     # Fix references to gettext introduced by ./git-sh-i18n.patch
     substituteInPlace git-sh-i18n.sh \
         --subst-var-by gettext ${gettext}
 
     # ensure we are using the correct shell when executing the test scripts
     patchShebangs t/*.sh
+  '' + lib.optionalString withSsh ''
+    for x in connect.c git-gui/lib/remote_add.tcl ; do
+      substituteInPlace "$x" \
+        --subst-var-by ssh "${openssh}/bin/ssh"
+    done
   '';
 
   nativeBuildInputs = [ gettext perlPackages.perl makeWrapper ]

pkgs/top-level/all-packages.nix

@@ -26150,6 +26150,7 @@ with pkgs;
     svnSupport = true;
     guiSupport = true;
     sendEmailSupport = true;
+    withSsh = true;
     withLibsecret = !stdenv.isDarwin;
   };