René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Lack of validation of objects in packfile when fetching","articleBody":"LibGit2 (unlike CLI git) does not seem to validate the contents of the packfile when fetching. \r\n\r\nThis could be a problem when fetching from a possibly compromised source, e.g. create a \"bad\" repository using [this script](https://gist.github.com/simonbyrne/e8923aec3b27b285789efcd616114a95).\r\n\r\nAttempting to clone this using CLI git throws an error:\r\n```\r\nfatal: did not receive expected object 12799ccbe7ce445b11b7bd4833bcc2c2ce1b48b7\r\nfatal: index-pack failed\r\n```\r\nHowever LibGit2 happily fetches the repository. \r\n\r\nWhile LibGit2 will throw an error if you attempt to use the invalid object, CLI git may not (e.g. it will certainly happily checkout invalid loose objects, though maybe not packed files)\r\n\r\nEssentially, the problem is that the \"security barrier\" is in different places for the different programs, so attempting to use both on the same repository may present potential security hole.\r\n","author":{"url":"https://github.com/simonbyrne","@type":"Person","name":"simonbyrne"},"datePublished":"2017-10-04T20:57:56.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/4366/libgit2/issues/4366"}