{"id":"a7902a199e75dad0","repo":"pypa/pip","slug":"unexpected-show-ref-line-line-r","errorCode":null,"errorMessage":"unexpected show-ref line: {line!r}","messagePattern":"unexpected show-ref line: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/pip/_internal/vcs/git.py","lineNumber":173,"sourceCode":"            cwd=dest,\n            show_stdout=False,\n            stdout_only=True,\n            on_returncode=\"ignore\",\n        )\n        refs = {}\n        # NOTE: We do not use splitlines here since that would split on other\n        #       unicode separators, which can be maliciously used to install a\n        #       different revision.\n        for line in output.strip().split(\"\\n\"):\n            line = line.rstrip(\"\\r\")\n            if not line:\n                continue\n            try:\n                ref_sha, ref_name = line.split(\" \", maxsplit=2)\n            except ValueError:\n                # Include the offending line to simplify troubleshooting if\n                # this error ever occurs.\n                raise ValueError(f\"unexpected show-ref line: {line!r}\")\n\n            refs[ref_name] = ref_sha\n\n        branch_ref = f\"refs/remotes/origin/{rev}\"\n        tag_ref = f\"refs/tags/{rev}\"\n\n        sha = refs.get(branch_ref)\n        if sha is not None:\n            return (sha, True)\n\n        sha = refs.get(tag_ref)\n\n        return (sha, False)\n\n    @classmethod\n    def _should_fetch(cls, dest: str, rev: str) -> bool:\n        \"\"\"\n        Return true if rev is a ref or is a commit that we don't have locally.","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_internal/vcs/git.py#L155-L191","documentation":"ValueError raised by Git.resolve_revision while parsing `git show-ref` output when a line cannot be split into exactly sha + ref name. Each line should look like '<40-hex-sha> refs/...'. If split(' ', maxsplit=2) yields a different arity, the offending line is included verbatim for diagnosis. This is a defensive guard against unexpected git output (or malicious unicode separators — note pip deliberately does NOT use splitlines for that reason).","triggerScenarios":"Calling pip's VCS git support to resolve a revision when `git show-ref <rev>` emits a line that isn't the standard '<sha> <ref>' format. Possible if a hooked-in git wrapper, an alias, or a tampered git binary emits extra output, or if a unicode separator sneaks through despite the splitlines guard.","commonSituations":"Custom GIT_EXECUTABLE or wrapper script that prints banners/logs to stdout; git alias output; corrupted/old git version; very unusual ref names; security probe trying to inject a ref via unicode separators.","solutions":["Reproduce manually: `git show-ref <rev>` in the checkout and inspect non-standard lines.","Remove any git wrapper/alias that prints extra output to stdout (move it to stderr).","Upgrade git to a standard release; avoid patched distributions.","Ensure GIT_EXECUTABLE points at the real git binary."],"exampleFix":"// before\n# ~/.gitconfig aliases or a wrapper printed a banner to stdout\npip install git+https://example.com/repo.git@v1\n\n// after\n# remove stdout noise; rerun:\ngit config --global --unset core.gitproxy\npip install -v git+https://example.com/repo.git@v1","handlingStrategy":"validation","validationCode":"import subprocess, re\nLINE_RE = re.compile(r'^[0-9a-f]{40} \\S+$')\ndef show_ref_clean(repo: str, rev: str) -> bool:\n    out = subprocess.run(['git','show-ref',rev], cwd=repo,\n                         capture_output=True, text=True).stdout\n    return all(LINE_RE.match(l) for l in out.splitlines() if l.strip())","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Use the system git binary; avoid wrappers that print to stdout.","Remove git aliases that emit banners/logs to stdout.","Upgrade git to a standard release.","Verify GIT_EXECUTABLE points at real git."],"tags":["pip","vcs","git","parsing","configuration"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}