Git bundle
A Git bundle packages selected references and Git objects for transfer, optionally requiring prerequisite history in the receiving repository.
Recovery scope: a bundle can contain complete or incremental history for its selected refs. An incremental bundle requires the earlier objects it excludes; the uncommitted working tree is outside this history export. Inventory the selected refs and prerequisites rather than treating the file as an automatic capture of every local asset. [1]
Verification boundary: in Git v2.43.0, bundle verify reads the header and checks prerequisites in the recipient. The command closes the file before verify_bundle; restoration separately passes the packed payload to index-pack. This implementation scope does not establish the behavior of every later version. [2] [3]
Measured control: a one-byte change to a complete bundle's pack-checksum trailer still passed bundle verify in an empty repository on Git 2.43.0, but cloning failed with a pack SHA-1 mismatch. The intact control restored expected content and passed full fsck. Verify prerequisites, unpack a disposable copy and compare expected content as separate acceptance steps. [4]
Relations
Advantages
- Supports transfer of selected committed history without a live remote server.
Limitations
- An incremental bundle is not self-contained without its prerequisite history.
- A verification result is scoped to the checks actually performed.
Citations
- Git v2.43.0: bundle scope and prerequisites
- Git v2.43.0: bundle verify command implementation
- Git v2.43.0: prerequisite checks and index-pack during unbundling
- Hesela: Git backup dependency and verification controls
Sources & caveats
- Upstream v2.43.0 source trace and three repetitions of constructed native-Git cases; not a new vulnerability claim.