Subject: Re: bug#78542: [Security] hash locking needed for tree-sitter downloads

From: Juri Linkov <[email-masked]>
Date: Mon, 23 Jun 2025 19:51:35 +0300

>> When I tried various similar recipes, they all failed.  Maybe because I tried
>> with abbreviated SHA1s.  However, with the full SHA1 this seems to work.
>> I don't know how reliable this method is, since it requires setting
>> uploadpack.allowReachableSHA1InWant=true on the server side.
>
> I wonder if the new --revision option relies on that server setting anyway
> (how else would it be implemented?)

Can't find any mentions of allowReachableSHA1InWant in
https://github.com/git/git/commit/337855629f59a3f435dabef900e22202ce8e00e1

Probably because --revision is a simplified and limited version of --branch:

  Option `--revision` on contrary detaches HEAD, creates no tracking
  branches, and writes no fetch refspec.

>> Otherwise, let's wait until the new --revision option becomes more widespread.
>
> Might take a few years (or 5-10). This script runs on the user's machine,
> and historically we've been hesitant to up the requirements on the
> installed version of Git.

Meanwhile we could use something like
(version<= "2.49.0" (vc-git--program-version))