+submodule-checks ?= no-submodule-changes public-submodule-commit
+
+# Ensure that each sub-module commit we're using is public.
+# Without this, it is too easy to tag and release code that
+# cannot be built from a fresh clone.
+.PHONY: public-submodule-commit
+public-submodule-commit:
+ $(AM_V_GEN)if test -d $(srcdir)/.git; then \
+ cd $(srcdir) && \
+ git submodule --quiet foreach test '$$(git rev-parse $$sha1)' \
+ = '$$(git merge-base origin $$sha1)' \
+ || { echo '$(ME): found non-public submodule commit' >&2; \
+ exit 1; }; \
+ else \
+ : ; \
+ fi
+# This rule has a high enough utility/cost ratio that it should be a
+# dependent of "check" by default. However, some of us do occasionally
+# commit a temporary change that deliberately points to a non-public
+# submodule commit, and want to be able to use rules like "make check".
+# In that case, run e.g., "make check gl_public_submodule_commit="
+# to disable this test.
+gl_public_submodule_commit ?= public-submodule-commit
+check: $(gl_public_submodule_commit)
+