From 6bf187537ac094181b25ad96137e83cf31cfa356 Mon Sep 17 00:00:00 2001
From: Max Siling <root@goldstein.lol>
Date: Wed, 10 Dec 2025 15:00:26 +0300
Subject: [PATCH] libfetchers: use commit hash as `rev` for tag refs

Instead of manually reading the ref file,
which gives the tag object hash when ref is a tag,
shell out to git.

The logic for finding the ref file is left for cache TTL tracking.

Fixes: #1070
Change-Id: I490b1e62f83cf602c56232c6081a52166a6a6964
---
 doc/manual/rl-next/tag-refs-rev.md | 10 ++++++++++
 lix/libfetchers/git.cc             | 10 ++++++++--
 tests/functional/fetchGit.sh       |  4 ++--
 3 files changed, 20 insertions(+), 4 deletions(-)
 create mode 100644 doc/manual/rl-next/tag-refs-rev.md

diff --git a/doc/manual/rl-next/tag-refs-rev.md b/doc/manual/rl-next/tag-refs-rev.md
new file mode 100644
index 000000000..9af5ca5e2
--- /dev/null
+++ b/doc/manual/rl-next/tag-refs-rev.md
@@ -0,0 +1,10 @@
+---
+synopsis: "Consistently use commit hash as rev when locking git inputs"
+cls: [4762]
+category: "Fixes"
+credits: [goldstein]
+---
+
+Lix will now use commit hashes instead of tag object hashes in the `rev` field
+when fetching git inputs by tag in `flake.lock` and `builtins.fetchTree` output.
+Note that this means that Lix may change some `flake.lock` files on re-locking. Old `flake.lock` files still remain valid.
diff --git a/lix/libfetchers/git.cc b/lix/libfetchers/git.cc
index fc5f9af84..7cc655149 100644
--- a/lix/libfetchers/git.cc
+++ b/lix/libfetchers/git.cc
@@ -826,8 +826,14 @@ struct GitInputScheme : InputScheme
                 }
             }
 
-            if (!input.getRev())
-                input.attrs.insert_or_assign("rev", Hash::parseAny(chomp(readFile(localRefFile)), HashType::SHA1).gitRev());
+            if (!input.getRev()) {
+                auto rev = chomp(TRY_AWAIT(runProgram(
+                    "git",
+                    true,
+                    {"-C", repoDir, "rev-list", "--max-count=1", *input.getRef()}
+                )));
+                input.attrs.insert_or_assign("rev", rev);
+            }
 
             // cache dir lock is removed at scope end; we will only use read-only operations on specific revisions in the remainder
         }
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index 492c57602..5bae6adcc 100644
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -235,7 +235,7 @@ path9=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$rep
 # Specifying a ref without a rev shouldn't pick a cached rev for a different ref
 export _NIX_FORCE_HTTP=1
 rev_tag1_nix=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$repo\"; ref = \"refs/tags/tag1\"; }).rev")
-rev_tag1=$(git -C $repo rev-parse refs/tags/tag1)
+rev_tag1=$(git -C $repo rev-list --max-count=1 refs/tags/tag1)
 [[ $rev_tag1_nix = $rev_tag1 ]]
 
 # Allow fetching tags w/o specifying refs/tags
@@ -244,7 +244,7 @@ rev_tag1_nix_alt=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"
 [[ $rev_tag1_nix_alt = $rev_tag1 ]]
 
 rev_tag2_nix=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$repo\"; ref = \"refs/tags/tag2\"; }).rev")
-rev_tag2=$(git -C $repo rev-parse refs/tags/tag2)
+rev_tag2=$(git -C $repo rev-list --max-count=1 refs/tags/tag2)
 [[ $rev_tag2_nix = $rev_tag2 ]]
 unset _NIX_FORCE_HTTP