Subject: Re: [PATCH v3 1/2] refspec: safely parse refspecs outside a repository

From: Jeff King <[email-masked]>
Date: Mon, 23 Mar 2026 19:10:49 -0400

On Mon, Mar 23, 2026 at 03:27:29PM -0700, Junio C Hamano wrote:

> Looking good.  Shall we declare victory and mark the topic for
> 'next' by now?

I'm not entirely convinced the better solution isn't just:

diff --git a/remote-curl.c b/remote-curl.c
index 92e40bb682..60774af929 100644
--- a/remote-curl.c
+++ b/remote-curl.c
@@ -1552,6 +1552,11 @@ int cmd_main(int argc, const char **argv)
 		goto cleanup;
 	}
 
+	/* yuck, see 9e89dcb66a (builtin/ls-remote: fall back to SHA1 outside
+	 * of a repo, 2024-08-02) */
+	if (nongit)
+		repo_set_hash_algo(the_repository, GIT_HASH_DEFAULT);
+
 	options.verbosity = 1;
 	options.progress = !!isatty(2);
 	options.thin = 1;

That would make the http transport consistent with non-http ones (or at
least any that execute in-process within ls-remote).

Or alternatively, if we think that this use of parse_refspec() is the
only remaining spot for which ls-remote needs a fallback, then we could
apply the patch here and then revert 9e89dcb66a.

-Peff