libfetchers: verify git-lfs returns the same objects as git

[RossComputerGuy]

Motivation

Git LFS objects should return the same OID as regular Git.

Context

Prevents servers from returning the wrong objects, or objects with different sizes.

Summary by CodeRabbit

• Bug Fixes
  • Improved Git LFS download integrity checks: the client now validates downloads against the pointer file’s checksum and size and rejects mismatches reported by the server before processing, preventing corrupted or tampered LFS content.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f7dea4d5-f44d-4456-b106-67a74b84c204

📥 Commits

Reviewing files that changed from the base of the PR and between c0d8573 and a06c705.

📒 Files selected for processing (1)

• src/libfetchers/git-lfs-fetch.cc

🚧 Files skipped from review as they are similar to previous changes (1)

• src/libfetchers/git-lfs-fetch.cc

---

📝 Walkthrough

Walkthrough

Fetch::fetch now uses the committed LFS pointer's oid and size as the source of truth for expected SHA-256 and size, validates the server-returned oid/size match the pointer exactly, and then proceeds to download and verify content.

Changes

Git-LFS Integrity Verification

Layer / File(s)	Summary
Pointer-based integrity verification src/libfetchers/git-lfs-fetch.cc	Download integrity checks now use the committed LFS pointer's oid and size instead of server-provided values. Server response oid and size are validated against the pointer values before content download; mismatches trigger an error. The compilation unit also adds #include "nix/util/json-utils.hh".

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

A rabbit checks each byte and size with care,
"Trust what's committed," it hums in the air,
Server whispers may sway,
But the pointer holds sway,
So downloads stay true and rare. 🐰

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding verification that git-lfs downloads match the committed git object identifiers and sizes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/git-lfs

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🚀 Deployed on https://6a03513e6ceba0a3ec019508--determinate-nix.netlify.app