feat: git cloning should verify the cryptograhic hash

[yurivict]

Feature Description

The cloning operation here just clones the latest revision.

Git is not a secure protocol and resulting download can be easily substituted by a malicious party who might control network connections.

Such git clone should be always for a particular repository tag or revision, and should always verify the cryptographic hash of the downloaded content.

In fact there is no need for clone. You can just download a desired tarball.

The Solution

Verify cryptographic hash.

Considered Alternatives

Alternatives are not secure.

Additional Context

No response

Related Features to This Feature Request

• Metal support
• CUDA support
• Vulkan support
• Grammar
• Function calling

Are you willing to resolve this issue by submitting a Pull Request?

Yes, I have the time, and I know how to start.