parse_encrypt: Don't let e.g. "*.ext" match files in subdirs

This matches the behavior before 3.4.0. Also silent errors from ls-files to
avoid warnings about e.g. directories that aren't readable (#521).

test/test_encryption.py

@@ -92,6 +92,7 @@ def encrypt_targets(yadm_cmd, paths):
     paths.work.join("globs dir/globs file2").write("globs file2")
     expected.append("globs dir/globs file2")
     paths.encrypt.write("globs*\n", mode="a")
+    paths.encrypt.write("globs*/globs*\n", mode="a")
 
     # blank lines
     paths.encrypt.write("\n        \n\t\n", mode="a")

test/test_unit_parse_encrypt.py

@@ -100,10 +100,11 @@ def create_test_encrypt_data(paths):
     edata += "*card1\n"  # matches same file as the one above
     paths.work.join("wildcard1").write("", ensure=True)
     paths.work.join("wildcard2").write("", ensure=True)
+    paths.work.join("subdir/wildcard1").write("", ensure=True)
     expected.add("wildcard1")
     expected.add("wildcard2")
 
-    edata += "dirwild*\n"
+    edata += "dirwild*/file*\n"
     paths.work.join("dirwildcard/file1").write("", ensure=True)
     paths.work.join("dirwildcard/file2").write("", ensure=True)
     expected.add("dirwildcard/file1")
@@ -125,6 +126,9 @@ def create_test_encrypt_data(paths):
     expected.add("ex ex/file4")
     expected.add("ex ex/file6.text")
 
+    paths.work.join("dirwildcard/file7.ex").write("", ensure=True)
+    expected.add("dirwildcard/file7.ex")
+
     # double star
     edata += "doublestar/**/file*\n"
     edata += "!**/file3\n"

yadm

@@ -1932,7 +1932,7 @@ function parse_encrypt() {
         # Ignore comments
         ;;
       !*)
-        exclude+=("--exclude=${pattern:1}")
+        exclude+=("--exclude=/${pattern:1}")
         ;;
       *)
         if ! [[ $pattern =~ ^[[:blank:]]*$ ]]; then
@@ -1945,7 +1945,10 @@ function parse_encrypt() {
   if [[ ${#include} -gt 0 ]]; then
     while IFS= read -r filename; do
       ENCRYPT_INCLUDE_FILES+=("${filename%/}")
-    done <<<"$("$GIT_PROGRAM" ls-files --others "${exclude[@]}" -- "${include[@]}")"
+    done <<<"$(
+      "$GIT_PROGRAM" --glob-pathspecs ls-files --others \
+        "${exclude[@]}" -- "${include[@]}" 2>/dev/null
+    )"
   fi
 }