dagger/dagger · error

failed to verify fetched sha %s: %w

Error message

failed to verify fetched sha %s: %w

What it means

During the named-ref retry path after a SHA fetch fails with ErrSHAFetchUnsupported, Dagger verifies each expected SHA is present locally via `git rev-parse --verify <sha>^{commit}`. This error wraps any failure of that verification command, meaning the SHA could not be resolved to a commit object in the bare repo after fetching by named refs.

Source

Thrown at core/git_remote.go:444

			gitutil.WithGitDir(gitDir),
		)
		for _, refSpec := range refSpecs {
			_, dst, ok := strings.Cut(refSpec, ":")
			if !ok || dst == "" {
				continue
			}
			_, _ = cleanupGit.Run(ctx, "update-ref", "-d", dst)
		}
	}

	verifyFetchedSHAs := func(expectedRefs []*RemoteGitRef) error {
		for _, ref := range expectedRefs {
			if ref == nil || ref.SHA == "" {
				continue
			}
			res, err := git.New(gitutil.WithIgnoreError()).Run(ctx, "rev-parse", "--verify", ref.SHA+"^{commit}")
			if err != nil {
				return fmt.Errorf("failed to verify fetched sha %s: %w", ref.SHA, err)
			}
			if strings.TrimSpace(string(res)) != ref.SHA {
				return fmt.Errorf("named-ref retry did not materialize expected sha %s for %q", ref.SHA, ref.Name)
			}
		}
		return nil
	}

	svcs, err := query.Services(ctx)
	if err != nil {
		return fmt.Errorf("failed to get services: %w", err)
	}
	detach, _, err := svcs.StartBindings(ctx, repo.Services)
	if err != nil {
		return err
	}
	defer detach()

View on GitHub (pinned to 82ba2681db)

Solutions

1. Check that ref.SHA is actually reachable from a named branch/tag currently on the remote (`git ls-remote origin`) — if it was force-pushed away, re-resolve the ref to a fresh SHA and retry.
2. Verify the named ref covering that SHA was included in the request (namedFetchRefSpecs skips refs whose Name is empty or itself a SHA; supply a branch/tag name alongside the SHA).
3. Retry the pipeline; transient network/transfer failures can leave objects missing and a later fetch can complete them.
4. Remove stale caches: prune the engine's git mirror cache (dagger core query or delete the cache volume) so a fresh clone is performed.

Example fix

// before: resolving a commit that may be unreachable from branches/tags
sha, _ := client Git ref of "main"; use sha from old build
// after: re-resolve the ref at run time so the SHA is guaranteed reachable
repo := client.Git("https://github.com/org/repo")
ctr := repo.Branch("main").Tree().Root() // resolves fresh SHA server-side

// Before relying on a SHA, confirm it is reachable from a published ref
out, err := exec.Command("git","ls-remote",url).Output()
// ensure the commit appears under some ref output, else re-resolve
reachable := strings.Contains(string(out), sha)

// treat as transient/refreshable
if strings.Contains(err.Error(), "failed to verify fetched sha") {
    fresh := lsRemote(url, refName) // re-resolve ref to a current SHA
    return fetchWithRef(url, refName, fresh)
}

When it happens

Trigger: The remote server (e.g. GitHub) did not support fetching an arbitrary commit SHA, Dagger fell back to named-ref refspecs, ran the fetch, then `rev-parse --verify <sha>^{commit}` failed because the commit still isn't in the local object store.

Common situations: Fetching an unreachable/dangling commit (e.g. a force-pushed-over SHA, a check-run merge commit, or a commit only reachable from a PR ref that the refspec didn't cover); a named ref was retargeted between SHA resolution and fetch so the fetched ref points elsewhere; shallow/partial fetch configs that omit the commit; network interruptions truncating the fetch.

Related errors

• failed to fetch ref %d: %w
• failed to fetch remote %s: %w
• failed to fetch remote %s: sha fetch failed: %w; named-ref r
• failed to fetch remote %s: named-ref retry verification fail
• failed to hydrate tags for remote %s: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/683bb0dd0dc0528b. Report an issue: GitHub.