(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:test_description)
          op: assign_op.Equal
          rhs: {(SQ <'test protocol whitelisting with submodules'>)}
          spids: [4]
        )
      ]
    )
    (C {<.>} {<'./test-lib.sh'>})
    (C {<.>} {(DQ ($ Id.VSub_DollarName '$TEST_DIRECTORY')) <'/lib-proto-disable.sh'>})
    (C {<setup_ext_wrapper>})
    (C {<setup_ssh_wrapper>})
    (C {<test_expect_success>} {(SQ <'setup repository with submodules'>)} 
      {
        (SQ <'\n'> <'\tmkdir remote &&\n'> <'\tgit init remote/repo.git &&\n'> 
          <'\t(cd remote/repo.git && test_commit one) &&\n'> <'\t# submodule-add should probably trust what we feed it on the cmdline,\n'> 
          <'\t# but its implementation is overly conservative.\n'> <'\tGIT_ALLOW_PROTOCOL=ssh git submodule add remote:repo.git ssh-module &&\n'> 
          <
'\tGIT_ALLOW_PROTOCOL=ext git submodule add "ext::fake-remote %S repo.git" ext-module &&\n'
          > <'\tgit commit -m "add submodules"\n'>
        )
      }
    )
    (C {<test_expect_success>} {(SQ <'clone with recurse-submodules fails'>)} 
      {(SQ <'\n'> <'\ttest_must_fail git clone --recurse-submodules . dst\n'>)}
    )
    (C {<test_expect_success>} {(SQ <'setup individual updates'>)} 
      {(SQ <'\n'> <'\trm -rf dst &&\n'> <'\tgit clone . dst &&\n'> <'\tgit -C dst submodule init\n'>)}
    )
    (C {<test_expect_success>} {(SQ <'update of ssh allowed'>)} 
      {(SQ <'\n'> <'\tgit -C dst submodule update ssh-module\n'>)}
    )
    (C {<test_expect_success>} {(SQ <'update of ext not allowed'>)} 
      {(SQ <'\n'> <'\ttest_must_fail git -C dst submodule update ext-module\n'>)}
    )
    (C {<test_expect_success>} {(SQ <'user can override whitelist'>)} 
      {(SQ <'\n'> <'\tGIT_ALLOW_PROTOCOL=ext git -C dst submodule update ext-module\n'>)}
    )
    (C {<test_done>})
  ]
)