From: Shawn Pearce Date: Fri, 18 Nov 2011 23:50:51 GMT Subject: Re: [PATCH] receive-pack, fetch-pack: reject bogus pack that records objects twice Message-ID: In-Reply-To: <20111118103355.GA4854@sigill.intra.peff.net> On Fri, Nov 18, 2011 at 02:33, Jeff King wrote: > On Wed, Nov 16, 2011 at 10:04:13PM -0800, Junio C Hamano wrote: > >> When receive-pack & fetch-pack are run and store the pack obtained over >> the wire to a local repository, they internally run the index-pack command >> with the --strict option. Make sure that we reject incoming packfile that >> records objects twice to avoid spreading such a damage. > > If we are fixing a thin pack (which should be the case most of the > time), we are rewriting the packfile anyway. Shouldn't we just omit > the duplicate? > > I guess I'm a little confused about what is generating these duplicates. > A buggy git? A malicious server? Bad luck? A buggy Git. We found a case where JGit could generate duplicate objects in the pack stream during a clone. The resulting client worked... until it tried to do `git gc` or really any sort of `git pack-objects`. In my opinion, a pack should never contain duplicate objects. Its a buggy remote that sends them. What I like about this patch is it stops and tells the user the remote is broken, which it is.