Looks exactly like what's needed. Is it safe enough though? I.e. can I rely on getting a non-maliciously-modified repo when I ask for particular SHA1?

Also:

sudo npm install --global gittorrent

Cool! It automatically installs a local copy of half of GitHub! ;).

> I.e. can I rely on getting a non-maliciously-modified repo when I ask for particular SHA1?

Someone could serve you a maliciously-modified repo, but Git itself would then reject those objects, since they won't lead to the SHA1 that Git knows that it's looking for -- you would keep trying other peers until someone gave you bits that match the correct SHA1.

> Is it safe enough though?

I'm not so sure about that. I've only used it once, an only to test its functionality, I didn't do any in-depth testing. Well I wouln't use it in production, but in a non-critical, small-scale project it could be worth a try...