Re: Fetch/push lets a malicious server steal the targets of "have" lines

From: Junio C Hamano <gitster@pobox.com>
Date: Oct 30, 2016, 08:16 UTC
Message-ID: <xmqqpomiuu8q.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <E1c0XaZ-0007Ab-QI@mylo.jdl.com>

Jon Loeliger <jdl@jdl.com> writes:

> Is there an existing protocol provision, or an extension to
> the protocol that would allow a distrustful client to say to
> the server, "Really, you have Y2?  Prove it."

There is not, but I do not think it would be an effective solution.

The issue is not the lack of protocol support, but how to determine that the other side needs such a proof for Y2 but not for other commits. How does your side know what makes Y2 special and why does yout side think they should not have Y2?

Once you know how to determine Y2 is special, that knowledge can be used to abort the "push" before even starting. When you are pushing back the 'master' and that 'master' reaches Y2, which must be kept secret, you shouldn't be pushing that 'master' to them, whether they claim to have Y2 or not.

I think the above is just a different way to say what Peff just said (paraphrasing, do not push what is secret).