Cargo: how does it find git binary to use

Question

In light of the new security vulnerability in git (quickly patched), I'm wondering how to verify the particular git binary cargo uses for cloning repositories to verify that it has the patch?

https://bugs.chromium.org/p/project-zero/issues/detail?id=2021

Answer 1

Cargo does not call any git binary. It internally uses the git2 crate, which binds libgit2.

The libgit2 that git2 binds to is included as a Git submodule and it currently points to version 1.0.0.