(EDIT: Fixes for the issue described below, and for a second issue which is more severe, have now been shipped in got and got -portable 0.125)
If you are using #gameoftrees (on #OpenBSD or anywhere else) please always be diligent about checking SSH host key fingerprints.
Versioned files inside the work tree's meta-data .got directory can be created during 'got checkout' or changed during 'got update'. Files in the meta-data directory should never be under version control, yet the current implementation unfortunately allows this.
Which provides a way for malicious repositories to configure remote servers stored in .got/got.conf which would then be used by the fetch and send commands. Unless you already have the bad host key stored, SSH will ask for verification of the bad server's host key fingerprint as the last line of defense against a man-in-the-middle.
The problem was reported to me by Runxi Yu about 2 hours ago. A fix for this issue is being worked on: https://marc.gameoftrees.org/mail/1778362202.49408_0.html