{"action":"created","issue":{"url":"https://api.github.com/repos/isaacs/github/issues/436","labels_url":"https://api.github.com/repos/isaacs/github/issues/436/labels{/name}","comments_url":"https://api.github.com/repos/isaacs/github/issues/436/comments","events_url":"https://api.github.com/repos/isaacs/github/issues/436/events","html_url":"https://github.com/isaacs/github/issues/436","id":99765723,"number":436,"title":"Allow fetching commit by id","user":{"login":"tgr","id":145412,"avatar_url":"https://avatars.githubusercontent.com/u/145412?v=3","gravatar_id":"","url":"https://api.github.com/users/tgr","html_url":"https://github.com/tgr","followers_url":"https://api.github.com/users/tgr/followers","following_url":"https://api.github.com/users/tgr/following{/other_user}","gists_url":"https://api.github.com/users/tgr/gists{/gist_id}","starred_url":"https://api.github.com/users/tgr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tgr/subscriptions","organizations_url":"https://api.github.com/users/tgr/orgs","repos_url":"https://api.github.com/users/tgr/repos","events_url":"https://api.github.com/users/tgr/events{/privacy}","received_events_url":"https://api.github.com/users/tgr/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/isaacs/github/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-08T03:26:15Z","updated_at":"2015-08-10T07:06:12Z","closed_at":null,"body":"`git fetch <remote> <commit id>` usually does not work in git, as a security measure to avoid unintentional disclosure of information that has been made unavailable from every branch/tag but has not been garbage collected ([this discussion](http://thread.gmane.org/gmane.comp.version-control.git/257807) has some details). Recently, the `uploadpack.allowReachableSHA1InWant` configuration flag [has been added](https://github.com/git/git/commit/68ee628932c2196742b77d2961c5e16360734a62) to enable fetching of reachable commits, but it is off by default and generally advised against on performance reasons.\r\n\r\nThis makes sense, but GitHub already has [an API](https://developer.github.com/v3/git/commits/#get-a-commit) to get the contents of a particular commit, so a performant way to determine whether a commit can be reached already exists. It would be nice if commits that are accessible via the API would also be accessible via `git fetch`.\r\n\r\n(The context in which this came up - but I'm sure there are many other uses - was verifying that no one tampered with a file when I have its commit id but I cannot trust any information I receive from GitHub, e.g. I need to use an insecure connection. In such a case the commit object that's obtained via `git fetch` could be used as a cryptographically secure fingerprint of the file. It can probably be constructed from the GitHub API responses as well, but that's rather tedious.)"},"comment":{"url":"https://api.github.com/repos/isaacs/github/issues/comments/129332695","html_url":"https://github.com/isaacs/github/issues/436#issuecomment-129332695","issue_url":"https://api.github.com/repos/isaacs/github/issues/436","id":129332695,"user":{"login":"cirosantilli","id":1429315,"avatar_url":"https://avatars.githubusercontent.com/u/1429315?v=3","gravatar_id":"","url":"https://api.github.com/users/cirosantilli","html_url":"https://github.com/cirosantilli","followers_url":"https://api.github.com/users/cirosantilli/followers","following_url":"https://api.github.com/users/cirosantilli/following{/other_user}","gists_url":"https://api.github.com/users/cirosantilli/gists{/gist_id}","starred_url":"https://api.github.com/users/cirosantilli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cirosantilli/subscriptions","organizations_url":"https://api.github.com/users/cirosantilli/orgs","repos_url":"https://api.github.com/users/cirosantilli/repos","events_url":"https://api.github.com/users/cirosantilli/events{/privacy}","received_events_url":"https://api.github.com/users/cirosantilli/received_events","type":"User","site_admin":false},"created_at":"2015-08-10T07:06:12Z","updated_at":"2015-08-10T07:06:12Z","body":"@tgr GitHub likely uses https://github.com/libgit2/libgit2\r\n\r\nAlthough there are multiple implementations, the external facing API should be the same for all git clients. But true, a small extension like that could be considered.\r\n\r\nBut as you've found out (I didn't know!) it is already possible by a server config, so it definitely could be done.\r\n\r\nI understand the use case better, thanks. Safe source for checking, unsafe for fast download.\r\n\r\n"}}