Insecure git clone in import-gnulib.sh

[kpcyrd]

Hello!

Just letting you know, the following lines:

git_repo="git://git.savannah.gnu.org/gnulib.git"

# ...

	if test -d gnulib/.git ; then
	  echo "Git repository was already initialised."
	else
	  echo "Cloning the git repository..."
	  # In the future we may use a shallow clone to 
	  # save bandwidth.
	  git clone "$git_repo"
	fi
	cd gnulib
	set -x
	git fetch origin
	git checkout "$gnulib_version"
	set +x

Are not secure to run, it's pulling executable code over an unauthenticated network connection, similar to how curl http://... | sh isn't secure.

Thanks!