Subject: bug#78542: [Security] hash locking needed for tree-sitter downloads

From: Dmitry Gutov <[email-masked]>
Date: Mon, 23 Jun 2025 18:46:21 +0300

On 23/06/2025 09:39, Juri Linkov wrote:
> When I tried various similar recipes, they all failed.  Maybe because I tried
> with abbreviated SHA1s.  However, with the full SHA1 this seems to work.
> I don't know how reliable this method is, since it requires setting
> uploadpack.allowReachableSHA1InWant=true on the server side.

I wonder if the new --revision option relies on that server setting 
anyway (how else would it be implemented?)

> Otherwise, let's wait until the new --revision option becomes more widespread.

Might take a few years (or 5-10). This script runs on the user's 
machine, and historically we've been hesitant to up the requirements on 
the installed version of Git.