How can I get a git submodule's associated commit ID from a past commit in the parent clone?

You may use git-ls-tree to see what the SHA-1 id of a given path was during a given commit:

$ git ls-tree released-1.2.3 foo
160000 commit c0f065504bb0e8cfa2b107e975bb9dc5a34b0398  foo

(My first thought was git show released-1.2.3 foo, but that fails with "fatal: bad object".)

Since you are scripting the output, you will probably want to get just the SHA-1 id by itself, e.g.:

$ git ls-tree released-1.2.3 foo | awk '{print $3}'
c0f065504bb0e8cfa2b107e975bb9dc5a34b0398

Also: When writing scripts around git, try to stick to the plumbing commands, as described in the manual. They have a more stable interface, while the more familiar “porcelain” commands will possibly change in incompatible ways.

This one worked for me:

$ git rev-parse released-1.2.3^{commit}:foo
<SHA1>

Perhaps also quite easy to use in script.

I did find one promising avenue:

$ git log --raw <since>..<until> --submodule -- <path/to/submodule>

With the --raw option, this does print out the (abbreviated) SHA-1 IDs corresponding to the submodule's associated commits. Unfortunately the output is very verbose and will take some work to process in a script.

What I really need is a git facility that, given a parent commit ID, gives me the latest change to a submodule prior to that commit. I.e. which submodule SHA-1 'git submodule update' would check out if I were to actually checkout that parent commit.