(command.CommandList
  children: [
    (command.ShAssignment
      left: <Id.Lit_VarLike 'test_description='>
      pairs: [
        (AssignPair
          left: <Id.Lit_VarLike 'test_description='>
          lhs: (sh_lhs_expr.Name left:<Id.Lit_VarLike 'test_description='> name:test_description)
          op: assign_op.Equal
          rhs: {(SQ <'test protocol whitelisting with submodules'>)}
        )
      ]
      redirects: []
    )
    (command.Simple
      blame_tok: <.>
      more_env: []
      words: [{<.>} {<'./test-lib.sh'>}]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <.>
      more_env: []
      words: [{<.>} {(DQ ($ Id.VSub_DollarName TEST_DIRECTORY)) <'/lib-proto-disable.sh'>}]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <setup_ext_wrapper>
      more_env: []
      words: [{<setup_ext_wrapper>}]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <setup_ssh_wrapper>
      more_env: []
      words: [{<setup_ssh_wrapper>}]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <test_expect_success>
      more_env: []
      words: [
        {<test_expect_success>}
        {(SQ <'setup repository with submodules'>)}
        {
          (SQ <'\n'> <'\tmkdir remote &&\n'> <'\tgit init remote/repo.git &&\n'> 
            <'\t(cd remote/repo.git && test_commit one) &&\n'> <'\t# submodule-add should probably trust what we feed it on the cmdline,\n'> 
            <'\t# but its implementation is overly conservative.\n'> <'\tGIT_ALLOW_PROTOCOL=ssh git submodule add remote:repo.git ssh-module &&\n'> 
            <
'\tGIT_ALLOW_PROTOCOL=ext git submodule add "ext::fake-remote %S repo.git" ext-module &&\n'
            > <'\tgit commit -m "add submodules"\n'>
          )
        }
      ]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <test_expect_success>
      more_env: []
      words: [
        {<test_expect_success>}
        {(SQ <'clone with recurse-submodules fails'>)}
        {(SQ <'\n'> <'\ttest_must_fail git clone --recurse-submodules . dst\n'>)}
      ]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <test_expect_success>
      more_env: []
      words: [
        {<test_expect_success>}
        {(SQ <'setup individual updates'>)}
        {
          (SQ <'\n'> <'\trm -rf dst &&\n'> <'\tgit clone . dst &&\n'> <'\tgit -C dst submodule init\n'>)
        }
      ]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <test_expect_success>
      more_env: []
      words: [
        {<test_expect_success>}
        {(SQ <'update of ssh allowed'>)}
        {(SQ <'\n'> <'\tgit -C dst submodule update ssh-module\n'>)}
      ]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <test_expect_success>
      more_env: []
      words: [
        {<test_expect_success>}
        {(SQ <'update of ext not allowed'>)}
        {(SQ <'\n'> <'\ttest_must_fail git -C dst submodule update ext-module\n'>)}
      ]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <test_expect_success>
      more_env: []
      words: [
        {<test_expect_success>}
        {(SQ <'user can override whitelist'>)}
        {(SQ <'\n'> <'\tGIT_ALLOW_PROTOCOL=ext git -C dst submodule update ext-module\n'>)}
      ]
      redirects: []
      do_fork: T
    )
    (command.Simple
      blame_tok: <test_done>
      more_env: []
      words: [{<test_done>}]
      redirects: []
      do_fork: T
    )
  ]
)