8 ms·
> I.e. can I rely on getting a non-maliciously-modified repo when I ask for particular SHA1? Someone could serve you a maliciously-modified repo, but Git itsel
by cjbprime 11y ago
> I.e. can I rely on getting a non-maliciously-modified repo when I ask for particular SHA1?
Someone could serve you a maliciously-modified repo, but Git itself would then reject those objects, since they won't lead to the SHA1 that Git knows that it's looking for -- you would keep trying other peers until someone gave you bits that match the correct SHA1.