🚨 Shai-Hulud Strikes Again:834 Packages Compromised.Technical Analysis →
Socket
Book a DemoInstallSign in
Socket

check_submodules

Package Overview
Dependencies
Maintainers
3
Versions
5
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

check_submodules

Build a tree of all submodules in a github repository and prints it, with small warning signs if a submodule is referenced twice with different references.

latest
npmnpm
Version
0.0.5
Version published
Weekly downloads
1
Maintainers
3
Weekly downloads
 
Created
Source

check_submodules

Small command line utility to verify submodule references in a git repository.

WARNING: This script was designed specifically for https://github.com/azure/azure-iot-sdk-c and its submodules. While it should in theory work against other repos, you should carefully test as the script itself doesn't receive generic testing.

What problems is it trying to solve?

Problem 1: Submodule mismatch

Some repositories (such as https://github.com/azure/azure-iot-sdk-c) reference the same submodule at multiple places in their source tree. Sometimes it's even more complicated, for example:

a (main repository)
  -> submodule b
  -> submodule c
      -> submodule b (ie. submodule c also references b as a submodule)

In those cases it might be useful to verify that when a submodule is reused in multiple places in the source tree, all the references to that submodule point to the same commit hash.

This utility performs that check.

Problem 2: Referencing submodules ahead of master|main

Even if the submodules are consistent, it is possible for a submodule to be on a branch and later that branch could get deleted. This leaves the master (or main) in an inconsistent state.

To avoid this hazard, this utility also verifies that submodules being checked in are 0 commits ahead of their own masters when merging into a branch into master.

FAQs

Package last updated on 18 Nov 2021

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts