5 ms·

Correct, but git doesn't recompute the hashes locally, so it wouldn't know they are wrong.

• u801e 9y ago
  Ah, so if I were to manually craft a commit in a text editor in the format: tree sha1 parent sha1 of parent I want to attach it to author some string committer some string The commit message I could add this to the git object store manually under the same sha1 file and a client could just fetch it? Would the client try to fetch the faked objects when it already has the real objects in its copy of the object store? That is, would it think it has the commit because the sha1 hasn't changed, but the tree sha1 has been updated and it would presumably refer to blobs that the client doesn't already have and try to fetch them. Or would it not proceed because it already has the commit?
• simonbyrne 9y ago
  It doesn't seem to verify hashes of objects on checkout, but it does when receiving packfiles. So it's difficult to see how this could be an exploit unless the attacker has access to your local .git directory.
  • eridius 9y ago
    If you're syncing the repository itself (e.g. over Dropbox) instead of using git remotes, then it could be exploited.
    • mlindner 9y ago
      Why the hell would you do that. That defeats the point of git.
      • ianamartin 9y ago
        Because anything that can be misused will be. I’m sure there’s a law with someone’s name that states that. But just in case it hasn’t been claimed yet, I’m proposing that we call it the fuck you law. Because the next time someone comes to me to ask me to fix their trello to zappier to email to google sheets setup they use as a project management tool, I want to be able to say, “Fuck you and there’s a law that says so.”
      • FullyFunctional 9y ago
        No it doesn't. I have many of my git repos in Dropbox but I'm not using Dropbox for sharing. Having those in Dropbox means I get automatic backup and that they are available when I switch to a different computer, which I do, but not frequently. As only I use my Dropbox account, I'm aware of the potential sync problem, but it's never been a problem. I do run fsck & gc more frequently than most, but I probably don't need to. EDIT: I should emphasize that this model is way more convenient than manually having to remember to push and pull all the time. Now push is only for publishing outside as it should be.
        • mlindner 9y ago
          If you're doing this then there's no reason to use git. Just sync a raw directory.
          • FullyFunctional 9y ago
            No, I use git to track my development history and I push to github. These are two difference issues.
      • deleted 9y ago
        [deleted]