populate: check the hooks and submodules of Git work trees

git submodule update uses the .git of a submodule as it finds it in the
work tree: a repository of its own, with configuration that runs
commands, or a file naming a repository elsewhere.  So git_problems
also requires each .git below the work tree to be a file naming a
repository in .git/modules.  And it refuses hooks in .git/hooks, which
populate's Git doesn't run, but Nix's does, writing the lock file of a
flake in a git source.

git-submodule plants a submodule's .git in the work tree: a repository
of its own whose configuration names a filter, and a file naming a
repository elsewhere.  The fixture withsub has gitsrc as its submodule
sub.

5 files changed, 116 insertions, 6 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f5f2c4..e19decc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,9 @@
   and the other functions keep their arguments.
 - Git can't take a `git` source's `url` or `ref`, or a `pass` source's
   `name`, for an option.
+- `git` sources also refuse work trees whose `.git` directory contains
+  hooks, or in which a submodule's `.git` isn't a file naming a repository
+  in `.git/modules`, unless `reclone` is set.
 - `git` sources with a branch or tag as `ref` follow it: populate fetches
   the branch or tag on every run, and resets the work tree to what it
   fetched.
diff --git a/README.md b/README.md
index 93cd2ca..e46ef4b 100644
--- a/README.md
+++ b/README.md
@@ -333,8 +333,10 @@ everything else.  It doesn't change or remove anything outside:
   `git` source as well.
 
 * A `git` source only uses a work tree whose `.git` directory contains no
-  symlinks, no `commondir` file and no linked work trees, and only the
-  configuration that `git clone` and populate write.  Otherwise Git's
+  symlinks, no `commondir` file, no linked work trees, and no hooks, and
+  only the configuration that `git clone` and populate write, and in which
+  each `.git` of a submodule is a file naming a repository in
+  `.git/modules`.  Otherwise Git's
   commands could change what's elsewhere, or run commands, so populating
   fails, telling what's wrong, unless the source's `reclone` is set.  Git
   runs no hooks.
diff --git a/pkgs/populate/src/sh.rs b/pkgs/populate/src/sh.rs
index ce42e12..f76a0f7 100644
--- a/pkgs/populate/src/sh.rs
+++ b/pkgs/populate/src/sh.rs
@@ -244,10 +244,11 @@ ln -fnsT "$2" "$1"
 /// Defines git_problems PATH, which prints why populate can't use the .git
 /// directory of the Git work tree at PATH, or nothing.  A .git directory
 /// that git clone and populate made has no symlinks, no commondir file,
-/// which names another repository, no linked work trees, and only the
-/// configuration they write: the repository's format, the remote, branches,
-/// and submodules, whose repositories have their work tree in the work
-/// tree.
+/// which names another repository, no linked work trees, no hooks, and only
+/// the configuration they write: the repository's format, the remote,
+/// branches, and submodules, whose repositories have their work tree in the
+/// work tree.  And each .git below the work tree, which Git uses for a
+/// submodule there, is a file naming a repository in .git/modules.
 pub const GIT_PROBLEMS: &str = r#"
 git_problems() (
   path=$1
@@ -266,6 +267,33 @@ git_problems() (
     printf '%s has linked work trees' "$git_dir"
     exit
   fi
+  if test -d "$git_dir"/hooks; then
+    hooks=$(find "$git_dir"/hooks -mindepth 1 ! -name '*.sample' | head -n 3 | paste -s -d ' ' -)
+    if test -n "$hooks"; then
+      printf '%s contains hooks: %s' "$git_dir" "$hooks"
+      exit
+    fi
+  fi
+  nested=$(
+    find "$path" -path "$git_dir" -prune -o -name .git -exec sh -c '
+      modules=$1
+      shift
+      for git; do
+        if ! test -L "$git" && test -f "$git"; then
+          gitdir=$(sed -n "s/^gitdir: //p" "$git")
+          resolved=$(cd "${git%/.git}" && cd "$gitdir" 2>/dev/null && pwd -P) || :
+          case $resolved in
+            "$modules"/?*) continue ;;
+          esac
+        fi
+        printf "%s\n" "$git"
+      done
+    ' sh "$(cd "$git_dir" && pwd -P)/modules" {} + | head -n 1
+  )
+  if test -n "$nested"; then
+    printf '%s is not a file naming a repository in %s/modules' "$nested" "$git_dir"
+    exit
+  fi
   find "$git_dir" -name config -type f | while IFS= read -r config; do
     command git config --file "$config" --list --name-only |
     while IFS= read -r key; do
diff --git a/tests/fixtures.sh b/tests/fixtures.sh
index ccd55a0..85701a1 100755
--- a/tests/fixtures.sh
+++ b/tests/fixtures.sh
@@ -307,6 +307,23 @@ mkdir /fixtures/git
 git clone -q --bare /fixtures/gitsrc /fixtures/git/gitsrc.git
 git -C /fixtures/git/gitsrc.git config uploadpack.allowReachableSHA1InWant true
 
+# withsub: a Git repository with gitsrc as its submodule sub, served by git
+# daemon like gitsrc, which the tests reach as git://deployer/gitsrc.git.
+mkdir /fixtures/withsub
+cat > /fixtures/withsub/.gitmodules <<'GIT'
+[submodule "sub"]
+	path = sub
+	url = git://deployer/gitsrc.git
+GIT
+(
+  cd /fixtures/withsub
+  git init -q -b master
+  git update-index --add --cacheinfo 160000,"$git_head",sub
+  git add .gitmodules
+  git commit -q -m withsub
+)
+git clone -q --bare /fixtures/withsub /fixtures/git/withsub.git
+
 # pass: password stores with x/a, without and with Git.
 if ! gpg --list-secret-keys spam@krebsco.de >/dev/null 2>&1; then
   gpg --batch --passphrase '' --quick-gen-key spam@krebsco.de default default never
diff --git a/tests/scenarios.nix b/tests/scenarios.nix
index 85b481e..d12dcd1 100644
--- a/tests/scenarios.nix
+++ b/tests/scenarios.nix
@@ -2105,6 +2105,66 @@ assert !(krops.isLocalTarget (targets.remote "/"));
         }
       ];
     }))
+    # A Git work tree whose submodule's .git, which Git uses as it finds it,
+    # isn't the gitfile git clone made, naming the repository in
+    # .git/modules: a repository of its own, whose configuration names a
+    # command, and a gitfile naming a repository elsewhere.
+    (s "git-submodule" (let
+      elsewhere = "/var/krops-elsewhere";
+      url = dirOf gitUrl + "/withsub.git";
+      git = reclone: { x.git = { inherit url reclone; ref = "master"; }; };
+      untouched = ''
+        test ! -e ${elsewhere}/ran || fail "a command in a .git directory ran"
+        expect_eq "HEAD elsewhere" "$(git -C ${elsewhere}/repo rev-parse HEAD)" ${gitFirst}
+      '';
+    in {
+      isolate = true;
+      prepare = ''
+        rm -fR ${elsewhere}
+        git clone -q ${gitUrl} ${elsewhere}/repo
+        git -C ${elsewhere}/repo checkout -q ${gitFirst}
+      '';
+      phases = [
+        {
+          sources = git false;
+          check = untouched + ''
+            expect_eq "sub HEAD" "$(git -C "$T"/x/sub rev-parse HEAD)" ${gitHead}
+          '';
+          mutate = ''
+            rm "$T"/x/sub/.git
+            cp -R "$T"/x/.git/modules/sub "$T"/x/sub/.git
+            git config --file "$T"/x/sub/.git/config --unset core.worktree
+            git config --file "$T"/x/sub/.git/config \
+                filter.x.smudge "touch ${elsewhere}/ran; cat"
+            echo '* filter=x' > "$T"/x/sub/.git/info/attributes
+            git -C "$T"/x/sub update-ref --no-deref HEAD ${gitFirst}
+            git -C "$T"/x/sub read-tree ${gitFirst}
+            rm "$T"/x/sub/two
+          '';
+        }
+        {
+          sources = git false;
+          expect.fail = "error: populate doesn't use the Git work tree";
+          check = untouched;
+          mutate = ''
+            rm -fR "$T"/x/sub
+            mkdir "$T"/x/sub
+            echo gitdir: ${elsewhere}/repo/.git > "$T"/x/sub/.git
+          '';
+        }
+        {
+          sources = git false;
+          expect.fail = "error: populate doesn't use the Git work tree";
+          check = untouched;
+        }
+        {
+          sources = git true;
+          check = untouched + ''
+            expect_eq "sub HEAD" "$(git -C "$T"/x/sub rev-parse HEAD)" ${gitHead}
+          '';
+        }
+      ];
+    }))
     # A ref that git fetch would take for an option: --upload-pack runs a
     # command where the repository is local.
     (s "git-ref-option" (let