submodule must be https