Subject: Re: bug#78542: [Security] hash locking needed for tree-sitter downloads

From: Dmitry Gutov <[email-masked]>
Date: Mon, 23 Jun 2025 04:47:32 +0300

On 10/06/2025 09:23, Juri Linkov wrote:
> This still keeps full history.  This means we could simply
> set the default value of treesit--install-language-grammar-full-clone
> to t, or completely remove this variable, if there is no way
> to clone at a specific commit without fetching full history?

This SO answer gives two solutions: https://stackoverflow.com/a/43136160

The first (shorter one) requires the very latest Git client to be 
installed - something for us to note for the future.

The second just requires a suitable configured Git server, which Github 
servers are. Quoting it here:

   git init
   git remote add origin <url>
   git fetch --depth 1 origin <sha1>
   git checkout FETCH_HEAD

The sha1 value must be full, but those are what we decided to use already.