Re:GitHub is down
by cjbprime on Tuesday April 05, 2016 @05:35PM
(#11434707)
> I.e. can I rely on getting a non-maliciously-modified repo when I ask for particular SHA1?
Someone could serve you a maliciously-modified repo, but Git itself would then reject those objects, since they won't lead to the SHA1 that Git knows that it's looking for -- you would keep trying other peers until someone gave you bits that match the correct SHA1.
Someone could serve you a maliciously-modified repo, but Git itself would then reject those objects, since they won't lead to the SHA1 that Git knows that it's looking for -- you would keep trying other peers until someone gave you bits that match the correct SHA1.