I don't know why you'd trust a checksum structure your adversary has complete control over
I don't know why you'd trust a checksum structure your adversary has complete control over. That Merkle tree prevents the naive case where the adversary tries to serve a version of a repo, to a client who already has an older version, differing in a part the client already has. (The part the client has local checksums for). They shouldn't do that. The git client tells the server what commits it doesn't have, so this is simple to check. Code signing could be a safeguard if people did it, but here they don't so it's moot. I found no mention of a signing key in this repo's docs. The checksum tree could be a useful audit if there were a transparency log somewhere that git tools automatically checked against, but there isn't so it's moot. We put full trust in Microsoft's versions. Lots of things could be helpful, but here and now in front of us is a source tree fully in Microsoft's control, with no visible safeguards against Microsoft doing something evil to it. Just like countless others. It's the default state of trust today.
Original discussionICE is using fake cell towers to spy on people's phones256 source comments · at import