On Sun, May 10, 2020 at 10:36:36AM +0200, Stefan Sperling wrote:
> 
> We currently do not support submodules. So far, we only support them
> when parsing tree objects to avoid a hard error when such tree objects
> are read.

I expected a bit more than "read-only" repository if having submodules.
 
> Submodules rely on data in Git's configuration file, outside of object
> storag,e for consistency. This is a very bad design decision from my
> point of view.
> 
> Automatically fetching data from URLs stored in repository data is bad
> for several reasons. It's one of the areas where most version control
> systems ended up with security holes. All of SVN, Git, and Mercurial have
> had very bad bugs in such features. And I don't see any need for this in
> OpenBSD's workflow, where 3rd party software is imported rather than linked. 

I agree.
 
> To make committing work in your case, we could allow the creation of this
> tree entry as a submodule. But that alone will not make submodules work.
> So my next question would be: Does merely writing this tree entry allow
> you to do any meaningful work on a project that uses submodules?
> 
> My expectation is that once you can make this commit, you will hit another
> problem in the workflow, and you won't be able to use Got for this project
> until we actually implement proper support for submodules.
> 
> So unless you have a convincing use case that shows that just writing such
> entries by itself is useful, I would say this where I would draw a line and
> ask users to use Git instead of Got to work on such projects.

I understand your point of vue, and I am a bit shared here.

I agree that for any "real" work (a bit more than regenerate a lock file with
updated crates as here) I will need complete submodules support, and I wouldn't
expect Got to provide that.

On the other hand, forbidding commits whereas the code would be simple seems a
bit excessive. But it makes the line clear for Got: read-only repository if
having submodule.

> To improve the user experience slightly, we could detect this condition and
> write a specific error message which states that submodules are not supported.
> We could also warn on checkout/update if such entries appear.

Yes, it makes sense to have either a specific error message or a warning on
checkout/update.

Thanks.
-- 
Sebastien Marie