From 4246059f7c27bdcec379321994ca78dd3abd03ed Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 17:32:46 -1000
Subject: Check the submodule pin against the Makefile

The commit named is the one Git's v2.56.0 tag peels to upstream.
---
 Makefile                   |  9 ++++++---
 README.txt                 |  5 +++--
 tests/t0001-git-version.sh | 18 ++++++++++++++++--
 3 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/Makefile b/Makefile
index 50c68eb..3b8d165 100644
--- a/Makefile
+++ b/Makefile
@@ -21,10 +21,13 @@ GITDIR   = vendor/git
 BUILDDIR = build
 CGIT_ROOT = ../..
 
-# The Git release that get-git fetches when the submodule is not checked out.
-# Keep it in step with the commit the submodule is pinned to, and the sum in
-# step with the one kernel.org lists for the tarball in sha256sums.asc.
+# The Git release that get-git fetches when the submodule is not checked out,
+# and the commit its tag points at, which the submodule has to be pinned to.
+# A Git unpacked from the tarball has no history to say which commit that is,
+# so t0001 checks the pin against the one named here. Keep the sum in step
+# with the one kernel.org lists for the tarball in sha256sums.asc.
 GIT_VERSION = 2.56.0
+GIT_COMMIT = a018953688f1b10bddf91bff8747068f5f4746a4
 GIT_SHA256 = 26c56c296b38c0695b26fa95f475f1d01704d2d38e73465ca30b0b2f5dc789d3
 GIT_URL = https://www.kernel.org/pub/software/scm/git/git-$(GIT_VERSION).tar.xz
 GIT_TARBALL = git-$(GIT_VERSION).tar.xz
diff --git a/README.txt b/README.txt
index 8c241ec..a584ec0 100644
--- a/README.txt
+++ b/README.txt
@@ -363,8 +363,9 @@ and a script that finds one missing then stops with an error rather than skip
 the tests that need it. The names are CGIT_LUA for a cgit built with Lua,
 CGIT_NOLUA for build/nolua, TIDY, STRACE and STRACE_DELAY, PYTHON, XMLLINT,
 UNZIP, GZIP, BZIP2, LZIP, XZ, ZSTD, SANITY for an account other than root,
-SUBMODULE for a vendor/git cloned as a submodule, and the others the tests in a
-script name, such as CGIT_LUA_LPEG.
+CHECKOUT for a tree that is a Git checkout, SUBMODULE for a vendor/git cloned
+as a submodule, and the others the tests in a script name, such as
+CGIT_LUA_LPEG.
 
     $ make test CGIT_TEST_REQUIRE="CGIT_LUA TIDY STRACE SANITY"
 
diff --git a/tests/t0001-git-version.sh b/tests/t0001-git-version.sh
index 552b2c6..b90ec74 100755
--- a/tests/t0001-git-version.sh
+++ b/tests/t0001-git-version.sh
@@ -2,8 +2,8 @@
 
 # Checks that the Git version cgit says it is built for is the one it is
 # built against, so the Makefile, vendor/git and the submodule pin must name
-# the same version. Set CGIT_TEST_NO_GIT_VERSION to YesPlease when Git comes
-# from elsewhere.
+# the same version, and the pin must be the commit the Makefile names. Set
+# CGIT_TEST_NO_GIT_VERSION to YesPlease when Git comes from elsewhere.
 
 test_description='Check Git version is correct'
 CGIT_TEST_NO_CREATE_REPOS=YesPlease
@@ -48,4 +48,18 @@ test_expect_success SUBMODULE 'test submodule version matches Makefile' '
 	test_cmp makefile_version submodule_version
 '
 
+# The Makefile names the commit as well, so the pin can be checked from the
+# index alone, with or without the submodule. A tree that is not a checkout
+# has no index to read and skips it.
+test_lazy_prereq CHECKOUT 'test -e "$TEST_OUTPUT_DIRECTORY/../.git"'
+
+test_expect_success CHECKOUT 'test submodule commit matches Makefile' '
+	sed -n "s/^GIT_COMMIT[[:space:]]*=[[:space:]]*//p" \
+		"$TEST_OUTPUT_DIRECTORY/../Makefile" >makefile_commit &&
+	test -s makefile_commit &&
+	git -C "$TEST_OUTPUT_DIRECTORY/.." ls-files --stage -- vendor/git >gitlink &&
+	sed -n "s/^160000 \\([0-9a-f]*\\) .*/\\1/p" gitlink >submodule_commit &&
+	test_cmp makefile_commit submodule_commit
+'
+
 test_done
-- 
cgit 2.12.1