Subject: Re: Replacing large blobs in git history

From: Holger Hellmuth <[email-masked]>
Date: Thu, 08 Mar 2012 16:39:57 +0100

On 07.03.2012 22:27, Ævar Arnfjörð Bjarmason wrote:
> Does something other than git-fsck actually check whether the
> collection of blobs you're getting from the remote when you clone have
> sensible sha1's?
>
> What'll happen if he replaces that 550MB blob with a 0 byte blob but
> hacks the object store so that it pretends to have the same sha1?

This is something I tested once because of security concerns (i.e. what 
happens if a malicious intruder just drops something else into the 
object store) and if I remember correctly only git-fsck was able to spot 
the switch. But I didn't test cloning, only a few local operations.