docker/compose · error

invalid commit sha %q

Error message

invalid commit sha %q

What it means

The first 40 bytes of `git ls-remote` output did not match `^[a-f0-9]{40}$`, so they cannot be a commit SHA. Like the short-output check, this guards against malformed git responses before caching the resolved ref.

Source

Thrown at pkg/remote/git.go:188

}

func (g gitRemoteLoader) resolveGitRef(ctx context.Context, path string, ref *gitutil.GitRef) error {
	if !commitSHA.MatchString(ref.Ref) {
		cmd := exec.CommandContext(ctx, "git", "ls-remote", "--exit-code", ref.Remote, ref.Ref)
		cmd.Env = g.gitCommandEnv()
		out, err := cmd.CombinedOutput()
		if err != nil {
			if cmd.ProcessState.ExitCode() == 2 {
				return fmt.Errorf("repository does not contain ref %s, output: %q: %w", path, string(out), err)
			}
			return fmt.Errorf("failed to access repository at %s:\n %s", ref.Remote, out)
		}
		if len(out) < 40 {
			return fmt.Errorf("unexpected git command output: %q", string(out))
		}
		sha := string(out[:40])
		if !commitSHA.MatchString(sha) {
			return fmt.Errorf("invalid commit sha %q", sha)
		}
		ref.Ref = sha
	}
	return nil
}

func (g gitRemoteLoader) checkout(ctx context.Context, path string, ref *gitutil.GitRef) error {
	err := os.MkdirAll(path, 0o700)
	if err != nil {
		return err
	}
	err = exec.CommandContext(ctx, "git", "init", path).Run()
	if err != nil {
		return err
	}

	cmd := exec.CommandContext(ctx, "git", "remote", "add", "origin", ref.Remote)
	cmd.Dir = path

View on GitHub (pinned to ddc4b044b6)

Solutions

1. Reproduce with `git ls-remote <remote> <ref>` and inspect exactly what precedes the SHA
2. Pin the include to a literal 40-char SHA to avoid parsing ls-remote output
3. Fix the server/proxy that prepends non-git content to responses

When it happens

Trigger: A server returning output that begins with something other than a hex SHA (warning banners, HTML error pages captured by CombinedOutput, annotated tag peeling oddities from non-standard servers).

Common situations: Git HTTP endpoints fronted by proxies that inject headers/banners; misconfigured git smart-HTTP on private servers; essentially never occurs with GitHub/GitLab.

Related errors

• unexpected git command output: %q
• --wait-timeout must be a non-negative integer
• --abort-on-container-failure cannot be combined with --abort
• --wait cannot be combined with --abort-on-container-exit, --
• --build and --no-build are incompatible

AI-assisted analysis of docker/compose@ddc4b044b6 (2026-08-15). Data as JSON: /api/errors/53efc742ee0764d2. Report an issue: GitHub.