The way git works means that you can check that you have an un-doctored clone of a repo just by checking that the commit hash matches. Which in this instance is

The way git works means that you can check that you have an un-doctored clone of a repo just by checking that the commit hash matches. Which in this instance is quite unfortunate, because it would be very funny. (barring a SHA-1 collision, of course) EDIT: i suppose another approach could be to invent poisoned repos out of whole cloth and only show them to Amazon, but I susepct that'd be even easier to detect.