Fix handling "branch" set to a commit hash

There is --git-commit option for get-and-verify-source.py already. Use
its implementation, but keep verifying tags. For that, they need to be
fetched.

qubesbuilder/plugins/fetch/scripts/get-and-verify-source.py

@@ -183,7 +183,8 @@ def main(args):
         if repo.exists():
             shutil.rmtree(repo)
         try:
-            if args.git_commit:
+            looks_like_commit = re.match(r"^[a-fA-F0-9]{40}$", git_branch)
+            if args.git_commit or looks_like_commit:
                 # git clone can't handle commit reference, use fetch instead
                 repo.mkdir()
                 subprocess.run(
@@ -194,6 +195,7 @@ def main(args):
                 )
                 subprocess.run(
                     ["git", "fetch"]
+                    + (["--tags"] if looks_like_commit else [])
                     + git_options
                     + ["--", git_url, git_branch],
                     capture_output=True,

tests/test_cli.py

@@ -355,6 +355,29 @@ def test_common_component_fetch_skip_files(artifacts_dir_single):
         in result
     )
 
+def test_common_component_fetch_commit_fresh(artifacts_dir_single):
+    artifacts_dir = artifacts_dir_single
+    commit_sha = "0589ae8a242b3be6a1b8985c6eb8900e5236152a"
+    result = qb_call_output(
+        DEFAULT_BUILDER_CONF,
+        artifacts_dir,
+        "-c",
+        "core-qrexec",
+        "-o",
+        f"+components+core-qrexec:branch={commit_sha}",
+        "package",
+        "fetch",
+    ).decode()
+
+    fetch_artifact = (
+        artifacts_dir /
+        "components/core-qrexec/4.2.20-1/nodist/fetch/source.fetch.yml"
+    )
+    assert fetch_artifact.exists()
+    with open(fetch_artifact) as f:
+        info = yaml.safe_load(f.read())
+    assert info["git-commit-hash"] == commit_sha
+
 
 #
 # Pipeline for core-qrexec and host-fc37