Re: git submodule: update=!command

[Ryan Lortie <desrt@desrt.ca>]

[-- Attachment #1: Type: text/plain, Size: 160 bytes --]

On Tue, Mar 17, 2015, at 15:50, Jeff King wrote:
> Yeah, spelling out the security model more explicitly would be good.

Please see the attached patch.

Cheers

[-- Attachment #2: 0001-docs-clarify-command-submodule-update-policy.patch --]
[-- Type: application/octet-stream, Size: 2625 bytes --]

From a6d70056f21f039db8676f72a1deca00c39121bd Mon Sep 17 00:00:00 2001
From: Ryan Lortie <desrt@desrt.ca>
Date: Tue, 17 Mar 2015 16:29:51 -0400
Subject: [PATCH] docs: clarify !command submodule update policy

Clarify that the !command submodule update policy is not available from
.gitmodules files.

This should help calm any fears people have about the security
implications of this otherwise scary-looking feature.

Signed-off-by: Ryan Lortie <desrt@desrt.ca>
---
 Documentation/git-submodule.txt | 10 +++++++---
 Documentation/gitmodules.txt    | 11 ++++++++---
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/Documentation/git-submodule.txt b/Documentation/git-submodule.txt
index 8e6af65..a033e26 100644
--- a/Documentation/git-submodule.txt
+++ b/Documentation/git-submodule.txt
@@ -159,9 +159,13 @@ update::
 	This will make the submodules HEAD be detached unless `--rebase` or
 	`--merge` is specified or the key `submodule.$name.update` is set to
 	`rebase`, `merge` or `none`. `none` can be overridden by specifying
-	`--checkout`. Setting the key `submodule.$name.update` to `!command`
-	will cause `command` to be run. `command` can be any arbitrary shell
-	command that takes a single argument, namely the sha1 to update to.
+	`--checkout`.
++
+Setting the key `submodule.$name.update` in `.git/config` to
+`!command` will cause `command` to be run. `command` can be any
+arbitrary shell command that takes a single argument, namely the sha1
+to update to.  For security reasons, this feature is not supported
+from the `.gitmodules` file.
 +
 If the submodule is not yet initialized, and you just want to use the
 setting as stored in .gitmodules, you can automatically initialize the
diff --git a/Documentation/gitmodules.txt b/Documentation/gitmodules.txt
index f6c0dfd..f11e872 100644
--- a/Documentation/gitmodules.txt
+++ b/Documentation/gitmodules.txt
@@ -47,9 +47,14 @@ submodule.<name>.update::
 	in the submodule.
 	If 'none', the submodule with name `$name` will not be updated
 	by default.
-
-	This config option is overridden if 'git submodule update' is given
-	the '--merge', '--rebase' or '--checkout' options.
++
+This config option is overridden if 'git submodule update' is given
+the '--merge', '--rebase' or '--checkout' options.
++
+Only the values 'checkout', 'rebase', 'merge' and 'none' are
+recognized when this key appears in the `.gitmodules` file.  In
+particular, '!command' is not recognised, and will be rewritten to
+'none' by "git submodule init".
 
 submodule.<name>.branch::
 	A remote branch name for tracking updates in the upstream submodule.
-- 
2.1.4