# Fetch by SHA missing

3 messages from 2010-10-05 to 2010-10-06. Participants: Jan Engelhardt, Johannes Sixt, Nicolas Pitre.
Thread: https://gitlist.dev/t/25359

## Jan Engelhardt, 2010-10-05 19:37

Subject: Fetch by SHA missing
Message-ID: <alpine.LNX.2.01.1010052136280.21719@obet.zrqbmnf.qr>
URL: https://gitlist.dev/e/alpine.LNX.2.01.1010052136280.21719%40obet.zrqbmnf.qr

```
Hi,


it is possible to select single heads/tags for download, but this does 
not work with SHA IDs as of 1.7.1.

$ git fetch linus 3c06806e690885ce978ef180c8f8b6f8c17fb4b4:x
fatal: Couldn't find remote ref 3c06806e690885ce978ef180c8f8b6f8c17fb4b4
$ git fetch linus refs/heads/master
remote: Counting objects: 1254, done.
remote: Compressing objects: 100% (234/234), done.
remote: Total 709 (delta 562), reused 602 (delta 475)
Receiving objects: 100% (709/709), 112.41 KiB, done.
Resolving deltas: 100% (562/562), completed with 212 local objects.
From git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6
 * branch            master     -> FETCH_HEAD

```

## Johannes Sixt, 2010-10-06 06:02

Subject: Re: Fetch by SHA missing
Message-ID: <4CAC110C.2000804@viscovery.net>
URL: https://gitlist.dev/e/4CAC110C.2000804%40viscovery.net
In-Reply-To: <alpine.LNX.2.01.1010052136280.21719@obet.zrqbmnf.qr>

```
Am 10/5/2010 21:37, schrieb Jan Engelhardt:
> Hi,
> 
> 
> it is possible to select single heads/tags for download, but this does 
> not work with SHA IDs as of 1.7.1.
> 
> $ git fetch linus 3c06806e690885ce978ef180c8f8b6f8c17fb4b4:x
> fatal: Couldn't find remote ref 3c06806e690885ce978ef180c8f8b6f8c17fb4b4
> $ git fetch linus refs/heads/master
> remote: Counting objects: 1254, done.
> remote: Compressing objects: 100% (234/234), done.
> remote: Total 709 (delta 562), reused 602 (delta 475)
> Receiving objects: 100% (709/709), 112.41 KiB, done.
> Resolving deltas: 100% (562/562), completed with 212 local objects.
> From git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6
>  * branch            master     -> FETCH_HEAD

That's by design:

http://thread.gmane.org/gmane.comp.version-control.git/73368/focus=73994

That is, when you accidentally push secret data, you can rewind your refs
on the server. Even though the objects still live on the server (until
they are garbage-collected) nobody will be able to fetch your secret stuff
even if they happen to know the SHA1.

```

## Nicolas Pitre, 2010-10-06 20:35

Subject: Re: Fetch by SHA missing
Message-ID: <alpine.LFD.2.00.1010061631420.3107@xanadu.home>
URL: https://gitlist.dev/e/alpine.LFD.2.00.1010061631420.3107%40xanadu.home
In-Reply-To: <4CAC110C.2000804@viscovery.net>

```
On Wed, 6 Oct 2010, Johannes Sixt wrote:

> Am 10/5/2010 21:37, schrieb Jan Engelhardt:
> > Hi,
> > 
> > 
> > it is possible to select single heads/tags for download, but this does 
> > not work with SHA IDs as of 1.7.1.
> > 
> > $ git fetch linus 3c06806e690885ce978ef180c8f8b6f8c17fb4b4:x
> > fatal: Couldn't find remote ref 3c06806e690885ce978ef180c8f8b6f8c17fb4b4
> > $ git fetch linus refs/heads/master
> > remote: Counting objects: 1254, done.
> > remote: Compressing objects: 100% (234/234), done.
> > remote: Total 709 (delta 562), reused 602 (delta 475)
> > Receiving objects: 100% (709/709), 112.41 KiB, done.
> > Resolving deltas: 100% (562/562), completed with 212 local objects.
> > From git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6
> >  * branch            master     -> FETCH_HEAD
> 
> That's by design:
> 
> http://thread.gmane.org/gmane.comp.version-control.git/73368/focus=73994
> 
> That is, when you accidentally push secret data, you can rewind your refs
> on the server. Even though the objects still live on the server (until
> they are garbage-collected) nobody will be able to fetch your secret stuff
> even if they happen to know the SHA1.

One improvement could be for the server to accept serving commits 
provided a raw SHA1 instead of a branch name if that SHA1 corresponds to 
a commit that is reachable through the actually exported refs.


Nicolas

```