Fix handling "branch" set to a commit hash

There is --git-commit option for get-and-verify-source.py already. Use
it. And fix it to fetch tags (that are supposed to be verified) too.

qubesbuilder/plugins/fetch/__init__.py

@@ -129,6 +129,11 @@ def run(self, stage: str):
                     )
                 ]
 
+        branch_opt = "--git-branch"
+        if re.fullmatch(r"^[a-fA-F0-9]{40}$", self.component.branch):
+            # this is a commit ID
+            branch_opt = "--git-commit"
+
         # Get GIT source for a given Qubes OS component
         get_sources_cmd = [
             str(
@@ -141,7 +146,7 @@ def run(self, stage: str):
             str(
                 executor.get_plugins_dir() / "fetch/keys"
             ),  # keys for maintainers
-            "--git-branch",
+            branch_opt,
             self.component.branch,
             "--minimum-distinct-maintainers",
             str(self.component.min_distinct_maintainers),

qubesbuilder/plugins/fetch/scripts/get-and-verify-source.py

@@ -193,7 +193,7 @@ def main(args):
                     check=True,
                 )
                 subprocess.run(
-                    ["git", "fetch"]
+                    ["git", "fetch", "--tags"]
                     + git_options
                     + ["--", git_url, git_branch],
                     capture_output=True,

tests/test_cli.py

@@ -351,6 +351,29 @@ def test_common_component_fetch_skip_files(artifacts_dir_single):
         in result
     )
 
+def test_common_component_fetch_commit_fresh(artifacts_dir_single):
+    artifacts_dir = artifacts_dir_single
+    commit_sha = "0589ae8a242b3be6a1b8985c6eb8900e5236152a"
+    result = qb_call_output(
+        DEFAULT_BUILDER_CONF,
+        artifacts_dir,
+        "-c",
+        "core-qrexec",
+        "-o",
+        f"+components+core-qrexec:branch={commit_sha}",
+        "package",
+        "fetch",
+    ).decode()
+
+    fetch_artifact = (
+        artifacts_dir /
+        "components/core-qrexec/4.2.20-1/nodist/fetch/source.fetch.yml"
+    )
+    assert fetch_artifact.exists()
+    with open(fetch_artifact) as f:
+        info = yaml.safe_load(f.read())
+    assert info["git-commit-hash"] == commit_sha
+
 
 #
 # Pipeline for core-qrexec and host-fc37