Here are the relevant commits to backport: Always ignore case when forbidding .git in ObjectChecker https://github.com/eclipse/jgit/commit/07612a6
Disallow ".git." and ".git<space>" https://github.com/eclipse/jgit/commit/10310bf Disallow Windows shortname "GIT~1" https://github.com/eclipse/jgit/commit/a09b1b6 Disallow names potentially mapping to ".git" on HFS+ https://github.com/eclipse/jgit/commit/d476d2f __ This is the maintainer address of Debian's Java team <http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use debian-j...@lists.debian.org for discussions and questions.