git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: git push over http is very dangerous

From
Junio C Hamano <junkio@cox.net>
Date
Apr 21, 2007, 18:28 UTC
Message-ID
<7v4pn9vaye.fsf@assigned-by-dhcp.cox.net>
In-Reply-To
<462A44B6.30404@beronet.com>
Christian <crich-ml@beronet.com> writes:
Show 6 quoted lines
> The central machine is a  AMD Sempron, it runs Debian Sarge (3.1)
> We've installed git from source, because sarge has it not in its
> archives.
>
> Maybe we did something wrong at building time ? or you're right and
> the debian sarge zlib does not fit good to the current git versions ?

What I have been suspecting since I got that not-corrupted but reported to be corrupt tree is that the version running on your "unable to fsck" machine -- the one you use as the central machine -- has a dud (or miscompiled) version of git, which somehow reports corruption incorrectly on perfectly good objects when it validates it before using them.

And to that machine, push over http succeeds fine only because push over http is "dangerous" in that it does not "validate" the pushed data on the receiving end like other codepaths do.

It would be interesting to find out what the breakage is on that central machine. I think enough people run Sarge that it is unlikely it's zlib at fault, but the way git uses the zlib API, which was cleaned up in the current tree with the two fixes from Linus I mentioned earlier.

Previous: ChristianNext: Christian
Message 8 of 9 in “git push over http is very dangerous”
  1. ChristianApr 16, 2007
  2. Linus TorvaldsApr 16, 2007
  3. Junio C HamanoApr 16, 2007
  4. Linus TorvaldsApr 16, 2007
  5. ChristianApr 20, 2007
  6. Junio C HamanoApr 21, 2007
  7. ChristianApr 21, 2007
  8. Junio C HamanoApr 21, 2007
  9. ChristianApr 22, 2007

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.