Allow trusted submodule metadata redirection

codex · Byron · commit 79db2ac55dba · 2026-08-10T11:37:25.000+02:00
The Python package and Alpine test workflows failed across the submodule suite because GitPython internally supplies --separate-git-dir when creating modern submodule layouts. The new public clone guard correctly rejected that option, but could not distinguish the library-generated path from caller input.

Validate caller-provided keyword and multi-options before adding the library-controlled metadata path, then explicitly allow the resulting trusted clone invocation. This preserves rejection of unsafe clone_multi_options while restoring normal submodule creation. Update the one test that intentionally invokes Repo.clone_from() with its own separate git directory to opt in explicitly.

Validation: test/test_submodule.py and test/test_clone.py (62 passed, 4 skipped, 1 xfailed).
diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py
@@ -9,6 +9,7 @@
 import ntpath
 import os
 import os.path as osp
+import shlex
 import stat
 import sys
 import uuid
@@ -363,6 +364,17 @@ def _clone_repo(
         module_abspath = cls._module_abspath(repo, path, name)
         module_checkout_path = module_abspath
         if cls._need_gitfile_submodules(repo.git):
+            if not allow_unsafe_options:
+                Git.check_unsafe_options(
+                    Git._option_candidates([], kwargs), repo.unsafe_git_clone_options
+                )
+                multi_options = kwargs.get("multi_options")
+                if multi_options:
+                    Git.check_unsafe_options(
+                        shlex.split(" ".join(cast("Sequence[str]", multi_options))),
+                        repo.unsafe_git_clone_options,
+                    )
+            allow_unsafe_options = True
             kwargs["separate_git_dir"] = module_abspath
             module_abspath_dir = osp.dirname(module_abspath)
             if not osp.isdir(module_abspath_dir):
diff --git a/test/test_submodule.py b/test/test_submodule.py
@@ -954,6 +954,7 @@ def test_update_rejects_parent_component_in_name(self, rwdir):
             source.working_tree_dir,
             osp.join(clone.working_tree_dir, "module"),
             separate_git_dir=osp.join(rwdir, "escaped", "module"),
+            allow_unsafe_options=True,
         )
         with pytest.raises(ValueError, match="submodule name"):
             clone.submodules[0].update(init=True)

Original file line number	Diff line number	Diff line change
`@@ -954,6 +954,7 @@ def test_update_rejects_parent_component_in_name(self, rwdir):`
`954`	`954`	`source.working_tree_dir,`
`955`	`955`	`osp.join(clone.working_tree_dir, "module"),`
`956`	`956`	`separate_git_dir=osp.join(rwdir, "escaped", "module"),`
	`957`	`+ allow_unsafe_options=True,`
`957`	`958`	`)`
`958`	`959`	`with pytest.raises(ValueError, match="submodule name"):`
`959`	`960`	`clone.submodules[0].update(init=True)`