{"record":{"id":"683bb0dd0dc0528b","repo":"dagger/dagger","slug":"failed-to-verify-fetched-sha-s-w","errorCode":null,"errorMessage":"failed to verify fetched sha %s: %w","messagePattern":"failed to verify fetched sha (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/git_remote.go","lineNumber":444,"sourceCode":"\t\t\tgitutil.WithGitDir(gitDir),\n\t\t)\n\t\tfor _, refSpec := range refSpecs {\n\t\t\t_, dst, ok := strings.Cut(refSpec, \":\")\n\t\t\tif !ok || dst == \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\t_, _ = cleanupGit.Run(ctx, \"update-ref\", \"-d\", dst)\n\t\t}\n\t}\n\n\tverifyFetchedSHAs := func(expectedRefs []*RemoteGitRef) error {\n\t\tfor _, ref := range expectedRefs {\n\t\t\tif ref == nil || ref.SHA == \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tres, err := git.New(gitutil.WithIgnoreError()).Run(ctx, \"rev-parse\", \"--verify\", ref.SHA+\"^{commit}\")\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to verify fetched sha %s: %w\", ref.SHA, err)\n\t\t\t}\n\t\t\tif strings.TrimSpace(string(res)) != ref.SHA {\n\t\t\t\treturn fmt.Errorf(\"named-ref retry did not materialize expected sha %s for %q\", ref.SHA, ref.Name)\n\t\t\t}\n\t\t}\n\t\treturn nil\n\t}\n\n\tsvcs, err := query.Services(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get services: %w\", err)\n\t}\n\tdetach, _, err := svcs.StartBindings(ctx, repo.Services)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer detach()\n","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/core/git_remote.go#L426-L462","documentation":"During the named-ref retry path after a SHA fetch fails with ErrSHAFetchUnsupported, Dagger verifies each expected SHA is present locally via `git rev-parse --verify <sha>^{commit}`. This error wraps any failure of that verification command, meaning the SHA could not be resolved to a commit object in the bare repo after fetching by named refs.","triggerScenarios":"The remote server (e.g. GitHub) did not support fetching an arbitrary commit SHA, Dagger fell back to named-ref refspecs, ran the fetch, then `rev-parse --verify <sha>^{commit}` failed because the commit still isn't in the local object store.","commonSituations":"Fetching an unreachable/dangling commit (e.g. a force-pushed-over SHA, a check-run merge commit, or a commit only reachable from a PR ref that the refspec didn't cover); a named ref was retargeted between SHA resolution and fetch so the fetched ref points elsewhere; shallow/partial fetch configs that omit the commit; network interruptions truncating the fetch.","solutions":["Check that ref.SHA is actually reachable from a named branch/tag currently on the remote (`git ls-remote origin`) — if it was force-pushed away, re-resolve the ref to a fresh SHA and retry.","Verify the named ref covering that SHA was included in the request (namedFetchRefSpecs skips refs whose Name is empty or itself a SHA; supply a branch/tag name alongside the SHA).","Retry the pipeline; transient network/transfer failures can leave objects missing and a later fetch can complete them.","Remove stale caches: prune the engine's git mirror cache (dagger core query or delete the cache volume) so a fresh clone is performed."],"exampleFix":"// before: resolving a commit that may be unreachable from branches/tags\nsha, _ := client Git ref of \"main\"; use sha from old build\n// after: re-resolve the ref at run time so the SHA is guaranteed reachable\nrepo := client.Git(\"https://github.com/org/repo\")\nctr := repo.Branch(\"main\").Tree().Root() // resolves fresh SHA server-side","handlingStrategy":"retry","validationCode":"// Before relying on a SHA, confirm it is reachable from a published ref\nout, err := exec.Command(\"git\",\"ls-remote\",url).Output()\n// ensure the commit appears under some ref output, else re-resolve\nreachable := strings.Contains(string(out), sha)","typeGuard":null,"tryCatchPattern":"// treat as transient/refreshable\nif strings.Contains(err.Error(), \"failed to verify fetched sha\") {\n    fresh := lsRemote(url, refName) // re-resolve ref to a current SHA\n    return fetchWithRef(url, refName, fresh)\n}","preventionTips":["Always keep the named ref alongside the SHA when resolving git inputs","Re-resolve refs close to the point of use rather than caching SHAs across runs","Avoid building from force-pushed-over commits","Monitor git server config for uploadpack.allow*SHA1InWant settings"],"tags":["git","sha-verification","fetch","network"],"backgroundTag":"git-sha-fetch-verification","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}