> “It appears that a build/test system was compromised some time last year and the exploited added to code in the directory from which packages are built (and f

> “It appears that a build/test system was compromised some time last year and the exploited added to code in the directory from which packages are built (and file timestamps modified to make this change not show up in a git diff),” Cameron said in an email. How, exactly, does that happen? Does git look at timestamps first and, assuming they aren't different, not hash the file contents to compare the SHA1? This [0] git FAQ makes me think the answer is "no". Another FAQ: > git diff and other Git operations is optimized so it does not even look at files whose status (size, modification time etc) on disk and in Git's index are different. [...] If the file has been touched somehow, git diff has to look at the content of and compare it which is a much slower operation even when there is in fact no change. [0]: https://git.wiki.kernel.org/index.php/Git_FAQ#Why_isn.27t_Git_preserving_modification_time_on_files.3F https://git.wiki.kernel.org/index.php/Git_FAQ#Why_isn.27t_Gi...