1 file changed, 11 insertions, 2 deletions
diff --git a/Makefile b/Makefile
index 6a91f61..0abecf8 100644
--- a/Makefile
+++ b/Makefile
@@ -25,9 +25,12 @@ BUILDDIR = build
 CGIT_ROOT = ../..
 
 # The Git release that get-git fetches when the submodule is not checked out.
-# Keep it in step with the commit the submodule is pinned to.
+# Keep it in step with the commit the submodule is pinned to, and the sum in
+# step with the one kernel.org lists for the tarball in sha256sums.asc.
 GIT_VERSION = 2.55.0
+GIT_SHA256 = 457fdb04dc8728e007d4688695e6912e6f680727920f2a40bf11eacc17505357
 GIT_URL = https://www.kernel.org/pub/software/scm/git/git-$(GIT_VERSION).tar.xz
+GIT_TARBALL = git-$(GIT_VERSION).tar.xz
 
 # Compiled-in cgit defaults, all overridable through cgit.conf. Every one
 # carries the CGIT_ prefix except CACHE_ROOT, which is inherited from upstream
@@ -129,9 +132,15 @@ clean:
 cleanall: clean
 	@if test -e $(GITDIR)/Makefile; then $(MAKE) -C $(GITDIR) clean; fi
 
+# The tarball is checked against its sum before anything is unpacked from it.
+# An older macOS has no sha256sum, but its shasum reads the same format.
 get-git:
 	mkdir -p $(dir $(GITDIR))
-	curl -L $(GIT_URL) | tar -xJf - && rm -rf $(GITDIR) && mv git-$(GIT_VERSION) $(GITDIR)
+	curl -fL -o $(GIT_TARBALL) $(GIT_URL)
+	@if command -v sha256sum >/dev/null; then sum=sha256sum; else sum='shasum -a 256'; fi; \
+	echo '$(GIT_SHA256)  $(GIT_TARBALL)' | $$sum -c - || { $(RM) $(GIT_TARBALL); exit 1; }
+	tar -xJf $(GIT_TARBALL) && rm -rf $(GITDIR) && mv git-$(GIT_VERSION) $(GITDIR)
+	$(RM) $(GIT_TARBALL)
 
 tags:
 	@mkdir -p $(BUILDDIR)