Match Git submodule symlink validation

Replace resolved-path containment with Git-compatible component validation: normalize and confine the checkout path, then reject every existing symlink component before filesystem use.

This follows git.git commit e8d0608944 (validate_submodule_path) and t/t7423-submodule-symlinks.sh, including rejection of symlinks that still resolve inside the worktree.

Validation: .venv/bin/python -m pytest test/test_submodule.py -q; focused path regressions; pre-commit run --files git/objects/submodule/base.py test/test_submodule.py; mypy git/objects/submodule/base.py; git diff --check.

Author: codex

git/objects/submodule/base.py

@@ -416,11 +416,14 @@ def _to_relative_path(cls, parent_repo: "Repo", path: PathLike) -> PathLike:
 
     @property
     def abspath(self) -> PathLike:
-        path = super().abspath
         root = self.repo.working_tree_dir
-        assert root is not None
-        if _to_relative_path(osp.realpath(root), osp.realpath(path)) == ".":
-            raise ValueError("Submodule checkout path must not be the repository root")
+        if root is None:
+            return super().abspath
+        path = root
+        for component in os.fspath(self._to_relative_path(self.repo, self.path)).split("/"):
+            path = join_path_native(path, component)
+            if osp.islink(path):
+                raise ValueError("Submodule checkout path %r contains a symbolic link" % self.path)
         return path
 
     @classmethod

test/test_submodule.py

@@ -1385,9 +1385,10 @@ def test_update_rejects_checkout_path_outside_parent(self, rwdir):
                 submodule.update(init=True)
 
     @with_rw_directory
-    def test_update_rejects_checkout_path_through_outside_symlink(self, rwdir):
+    def test_update_rejects_checkout_path_through_symlink(self, rwdir):
         parent = git.Repo.init(osp.join(rwdir, "parent"))
-        os.symlink(osp.join(rwdir, "outside"), osp.join(parent.working_tree_dir, "link"))
+        os.mkdir(osp.join(parent.working_tree_dir, "target"))
+        os.symlink("target", osp.join(parent.working_tree_dir, "link"))
         submodule = Submodule(
             parent,
             Submodule.NULL_BIN_SHA,
@@ -1397,7 +1398,7 @@ def test_update_rejects_checkout_path_through_outside_symlink(self, rwdir):
         )
 
         with mock.patch.object(Submodule, "_clone_repo", side_effect=AssertionError("clone attempted")):
-            with pytest.raises(ValueError, match="is not in repository"):
+            with pytest.raises(ValueError, match="contains a symbolic link"):
                 submodule.update(init=True)
 
     @with_rw_directory