git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 3/3] fetch: verify we have everything we need before updating our ref

From
Nguyen Thai Ngoc Duy <pclouds@gmail.com>
Date
Sep 2, 2011, 03:55 UTC
Message-ID
<CACsJy8C4qX=p6d1v+i7TJanACOqL9R6-pv9AOaU_CM6DNjJfyQ@mail.gmail.com>
In-Reply-To
<1314917015-3587-4-git-send-email-gitster@pobox.com>
On Fri, Sep 2, 2011 at 5:43 AM, Junio C Hamano <gitster@pobox.com> wrote:
Show 10 quoted lines
> The "git fetch" command works in two phases. The remote side tells us what
> objects are at the tip of the refs we are fetching from, and transfers the
> objects missing from our side. After storing the objects in our repository,
> we update our remote tracking branches to point at the updated tips of the
> refs.
>
> A broken or malicious remote side could send a perfectly well-formed pack
> data during the object transfer phase, but there is no guarantee that the
> given data actually fill the gap between the objects we originally had and
> the refs we are updating to.
What about receive-pack? Does it have the same breakage?
-- 
Duy
Previous: Junio C HamanoNext: Junio C Hamano
Message 11 of 18 in “Funnies with "git fetch"”
  1. Junio C HamanoSep 1, 2011
  2. Junio C HamanoSep 1, 2011
  3. Jeff KingSep 1, 2011
  4. Junio C HamanoSep 2, 2011
  5. Junio C HamanoSep 2, 2011
  6. Jeff KingSep 2, 2011
  7. 0/3 Verify the objects fetch obtained before updating refJunio C Hamano, Sep 1, 2011
  8. 1/3 list-objects: pass callback data to show_objects()Junio C Hamano, Sep 1, 2011
  9. 2/3 rev-list --verify-objectJunio C Hamano, Sep 1, 2011
  10. 3/3 fetch: verify we have everything we need before updating our refJunio C Hamano, Sep 1, 2011
  11. Nguyen Thai Ngoc DuySep 2, 2011
  12. Junio C HamanoSep 2, 2011
  13. Junio C HamanoSep 2, 2011
  14. Junio C HamanoSep 4, 2011
  15. 0/3 Add fetch.fsckobjectsJunio C Hamano, Sep 5, 2011
  16. 1/3 fetch.fsckobjects: verify downloaded objectsJunio C Hamano, Sep 5, 2011
  17. 2/3 transfer.fsckobjects: unify fetch/receive.fsckobjectsJunio C Hamano, Sep 5, 2011
  18. 3/3 test: fetch/receive with fsckobjectsJunio C Hamano, Sep 5, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.