Hi,
It seems like git doesn't actually verify checksums by default.
https://groups.google.com/forum/?_escaped_fragment_=msg/binary-transparency…
I think it makes sense to perform the following on all repos:
printf "[transfer]\n\tfsckobjects = true\n[fetch]\n\tfsckobjects =
true\n[receive]\n\tfsckobjects = true\n" >> .git/config
git fsck --full