all submodules should be use read-only url