Re: [PATCH] fsckObjects tests: show how v2.17.1 can exploit downstream

[Junio C Hamano <gitster@pobox.com>]

Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes:

> The receive.fsckObjects variable only kicks in when someone pushes to
> you, not when you fetch something malicious and someone then fetches
> from you.
> ...

Yes, that is what was described in the release notes as the server
side support.  If you want to avoid fetching from contaminated
sources, that protection applies to both leaf clients and
intermediate relays, and I tend to agree that it is worth helping
those who want to use fetch.fsckObjects (or the blanket transfer.*
variant) the same way.

> Unlike documentation, when we change something in the code we're forced
> to take notice that the test suite changes, ...

But then the test you want to have is not the one you posted, which
is "when disabled, the feature should not kick in and should not
protect you".  That, even together with hot-sounding word "exploit"
in the title, does not have enough sensational value to grab people's
attension as you seem to be hoping to do here.

A test that checks "when enabled, the feature kicks in as expected
and protects you" does make sense.  So is (maybe) additional
description around fetch.fsckObjects if we currently lack one.