Git 2.38.1 breaks submodule kata

[JKrag]

2.38.1 introduces a change (due to CVE-2022-39253) that disables git submodule add using the file protocol.

➜  product git:(master) git submodule add ../remote
Cloning into '/Users/.../git-katas/submodules/exercise/product/remote'...
fatal: transport 'file' not allowed
fatal: clone of '/Users/.../git-katas/submodules/exercise/remote' into submodule path '/Users/.../git-katas/submodules/exercise/product/remote' failed

Apparently this can be alleviated by setting git config --global protocol.file.allow always.
Unfortunately this can not be solved with a --local setting as that only applies to the parent repo, not the submodule.

I would prefer not to have the setup.sh script mess with users global config, especially regarding something security related, but we need a solution.

Using git -c protocol.file.allow=always submodule add ../remote works, but is not a nice command to have to explain in a kata.

[acikgozb]

Isn't changing a config value on a command basis a lot better than changing/reverting the value globally?
It also doesn't need additional explanation/reminders for potential warnings and to revert it back (like how it is done on the PR).

Just asking out of curiosity.

[JKrag]

@acikgozb Thanks for the question/comment. I do agree that a single per command override of settings is in many ways better than changing the global. The challenge, however, is that the kata, at least in its current form, asks the user to add a submodule along the way, which is exactly the part that is now prohibited.
So as I see it, I am left with a choice of either asking the user to override the global setting and optionally clean up afterwards, or to explain why they need to run the annoying git -c protocol.file.allow=always submodule add ../remote

The second option might still be preferable, which I believe is what you are trying to suggest.

I was just really hoping I could come up with something better - but I haven't really had time to investigate this further since I wrote the issue a year ago.

[juanpabloinformatica]

Hello, I think it would be nice the user knows what could be happening and in such a way, it avoids users to spend time in something irrelevant to the purpose of the Kata.