(CommandList
  children: [
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:test_description)
          op: Equal
          rhs: {(SQ <'test protocol whitelisting with submodules'>)}
          spids: [4]
        )
      ]
      spids: [4]
    )
    (C {(.)} {(./test-lib.sh)})
    (C {(.)} {(DQ ($ VSub_Name '$TEST_DIRECTORY')) (/lib-proto-disable.sh)})
    (C {(setup_ext_wrapper)})
    (C {(setup_ssh_wrapper)})
    (C {(test_expect_success)} {(SQ <'setup repository with submodules'>)} 
      {
        (SQ <'\n'> <'\tmkdir remote &&\n'> <'\tgit init remote/repo.git &&\n'> 
          <'\t(cd remote/repo.git && test_commit one) &&\n'> <'\t# submodule-add should probably trust what we feed it on the cmdline,\n'> 
          <'\t# but its implementation is overly conservative.\n'> <'\tGIT_ALLOW_PROTOCOL=ssh git submodule add remote:repo.git ssh-module &&\n'> 
          <
'\tGIT_ALLOW_PROTOCOL=ext git submodule add "ext::fake-remote %S repo.git" ext-module &&\n'
          > <'\tgit commit -m "add submodules"\n'>
        )
      }
    )
    (C {(test_expect_success)} {(SQ <'clone with recurse-submodules fails'>)} 
      {(SQ <'\n'> <'\ttest_must_fail git clone --recurse-submodules . dst\n'>)}
    )
    (C {(test_expect_success)} {(SQ <'setup individual updates'>)} 
      {
        (SQ <'\n'> <'\trm -rf dst &&\n'> <'\tgit clone . dst &&\n'> <'\tgit -C dst submodule init\n'>)
      }
    )
    (C {(test_expect_success)} {(SQ <'update of ssh allowed'>)} 
      {(SQ <'\n'> <'\tgit -C dst submodule update ssh-module\n'>)}
    )
    (C {(test_expect_success)} {(SQ <'update of ext not allowed'>)} 
      {(SQ <'\n'> <'\ttest_must_fail git -C dst submodule update ext-module\n'>)}
    )
    (C {(test_expect_success)} {(SQ <'user can override whitelist'>)} 
      {(SQ <'\n'> <'\tGIT_ALLOW_PROTOCOL=ext git -C dst submodule update ext-module\n'>)}
    )
    (C {(test_done)})
  ]
)