{
  "slug": "git-bundle",
  "term": "Git bundle",
  "aliases": [
    "Git bundle file"
  ],
  "definition": "A Git bundle packages selected references and Git objects for transfer, optionally requiring prerequisite history in the receiving repository.",
  "note": "Recovery scope: a bundle can contain complete or incremental history for its selected refs. An incremental bundle requires the earlier objects it excludes; the uncommitted working tree is outside this history export. Inventory the selected refs and prerequisites rather than treating the file as an automatic capture of every local asset. [git-bundle]\n\nVerification boundary: in Git v2.43.0, bundle verify reads the header and checks prerequisites in the recipient. The command closes the file before verify_bundle; restoration separately passes the packed payload to index-pack. This implementation scope does not establish the behavior of every later version. [git-bundle-command] [git-bundle-unpack]\n\nMeasured control: a one-byte change to a complete bundle's pack-checksum trailer still passed bundle verify in an empty repository on Git 2.43.0, but cloning failed with a pack SHA-1 mismatch. The intact control restored expected content and passed full fsck. Verify prerequisites, unpack a disposable copy and compare expected content as separate acceptance steps. [hesela-git]",
  "status": "shipping",
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-19",
  "advantages": [
    "Supports transfer of selected committed history without a live remote server."
  ],
  "limitations": [
    "An incremental bundle is not self-contained without its prerequisite history.",
    "A verification result is scoped to the checks actually performed."
  ],
  "related": [
    "git-alternate-object-database",
    "incremental-backup",
    "backup-verification",
    "restore-test"
  ],
  "citations": [
    {
      "id": "git-bundle",
      "title": "Git v2.43.0: bundle scope and prerequisites",
      "url": "https://github.com/git/git/blob/v2.43.0/Documentation/git-bundle.txt",
      "accessed": "2026-10-19"
    },
    {
      "id": "git-bundle-command",
      "title": "Git v2.43.0: bundle verify command implementation",
      "url": "https://github.com/git/git/blob/v2.43.0/builtin/bundle.c",
      "accessed": "2026-10-19"
    },
    {
      "id": "git-bundle-unpack",
      "title": "Git v2.43.0: prerequisite checks and index-pack during unbundling",
      "url": "https://github.com/git/git/blob/v2.43.0/bundle.c",
      "accessed": "2026-10-19"
    },
    {
      "id": "hesela-git",
      "title": "Hesela: Git backup dependency and verification controls",
      "url": "https://hesela.com/analyses/backup-verification-is-not-a-restore-test/#git-backup-closure",
      "accessed": "2026-10-19"
    }
  ],
  "provenance": [
    "Upstream v2.43.0 source trace and three repetitions of constructed native-Git cases; not a new vulnerability claim."
  ]
}