Subject: bug#78542: [Security] hash locking needed for tree-sitter downloads

From: Daniel Colascione <[email-masked]>
Date: Thu, 19 Jun 2025 14:12:56 -0400

On June 19, 2025 1:54:08 PM EDT, Juri Linkov <[email-masked]> wrote:
>> +            (if commit
>> +                ;; Force blobless full clone to be able later
>> +                ;; to checkout a commit (bug#78542).
>> +                (let ((treesit--install-language-grammar-blobless t)
>> +                      (treesit--install-language-grammar-full-clone t))
>> +                  (treesit--git-clone-repo url revision workdir))
>> +              (treesit--git-clone-repo url revision workdir)))
>
>Since with this change it's possible to specify the commit,
>let's also improve the format of the source list.
>Currently adding a commit to the list requires
>prefixing it with four nils:
>
>  (treesit--install-language-grammar-1
>   (locate-user-emacs-file "tree-sitter") 'json
>   "https://github.com/tree-sitter/tree-sitter-json"
>   nil nil nil nil "4d770d3")
>
>The following patch introduces an alternative format
>using keywords, e.g.:
>
>  (treesit--install-language-grammar-1
>   (locate-user-emacs-file "tree-sitter") 'json
>   "https://github.com/tree-sitter/tree-sitter-json"
>   :commit "4d770d3")
>

Great. While you're doing this, can you also please use full hashes? Short ones aren't particularly collision resistant.