See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813157 for more information why.
The tl;dr here is: * By default Git doesn't verify the sha1 checksums it receives by default. * It doesn't look like we've got any inconsistencies in our repositories I use, though. That's good! * To turn on verification, I think you run:
git config --add transfer.fsckobjects true git config --add fetch.fsckobjects true git config --add receive.fsckobjects true
peace,