Subject: [PATCH V2 1/2] show-index: warn when falling back to SHA-1 outside a repository

From: Shreyansh Paliwal <[email-masked]>
Date: Fri, 30 Jan 2026 21:01:23 +0530

When 'git show-index' is run outside of a repository and no hashing
algorithm is specified via --object-format, it silently falls back
to SHA-1, relying on the historical default.

This works for existing SHA-1 based index files, but the behavior can
be ambiguous and confusing when the input index file uses a different
hash algorithm, such as SHA-256.

Add a warning when this fallback happens to make the assumption
explicit and to guide users toward using --object-format when needed.

Signed-off-by: Shreyansh Paliwal <[email-masked]>
---
 builtin/show-index.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/builtin/show-index.c b/builtin/show-index.c
index 2c3e2940ce..45795da2da 100644
--- a/builtin/show-index.c
+++ b/builtin/show-index.c
@@ -43,11 +43,14 @@ int cmd_show_index(int argc,
 	/*
 	 * Fallback to SHA1 if we are running outside of a repository.
 	 *
-	 * TODO: Figure out and implement a way to detect the hash algorithm in use by the
-	 *       the index file passed in and use that instead.
+	 * TODO: If a future implementation of index file version encodes the hash
+	 *       algorithm in its header, enable show-index to infer it from the
+	 *       header rather than relying on repository context or a default fallback.
 	 */
-	if (!the_hash_algo)
+	if (!the_hash_algo) {
+		warning(_("assuming SHA-1; use --object-format to override"));
 		repo_set_hash_algo(the_repository, GIT_HASH_DEFAULT);
+	}
 
 	hashsz = the_hash_algo->rawsz;
 
-- 
2.52.0