Looks like a good idea, but probably can be "fixed" only in LR 3 for compatibility reasons.

Implementation-wise, it doesn't look like git lets you clone a specific commit, so instead you need to pick the closest branch/tag and then git checkout from there.

How would you pick the branch? I think this requires cloning full repo and then checking out the revision directly.

I swear I've requested before somewhere but I can't find a link.

FWIW some git programs use the fragment to indicate it.
i.e. url = "git://my/repo#86d59e66d0c12656ed34d4f4a9bab06ac7775f77"

FWIW some git programs use the fragment to indicate it.
i.e. url = "git://my/repo#86d59e66d0c12656ed34d4f4a9bab06ac7775f77"

This doesn't appear to work with the regular command line git which luarocks uses. (at least with my git 2.7.4)

Luarocks could split out the revision itself, of course.

This doesn't appear to work with the regular command line git which luarocks uses. (at least with my git 2.7.4)

Correct. it's not used by the git command line tool AFAIK, but it is used by other systems.
e.g. the docker build command
This form usually allows any git 'ref-spec', so can be used for branches too.

Which brings me to an alternate idea: we already have a branch field: why not just allow commit hashes in there too? (that works with some git sub commands but not others)

Which brings me to an alternate idea: we already have a branch field: why not just allow commit hashes in there too? (that works with some git sub commands but not others)

It doesn't work with clone, and it's impossible to know whether it's a branch or a commit hash beforehand if it only consists of hexadecimal characters.

It doesn't work with clone, and it's impossible to know whether it's a branch or a commit hash beforehand if it only consists of hexadecimal characters.

We can pass it straight to e.g. git checkout.

But then we have to always clone full repo.

I wonder how e.g. npm handle this? (they use the same fragment thing)

here's the relevant part of the npm source afaict
https://github.com/npm/npm/blob/6823807bba6c00228a724e1205ae90d67df0adad/lib/cache/add-remote-git.js#L242

It looks like they do a full clone into a cache, and then every time they need a version of that package they clone->checkout from it.

And in hererocks I do full clone if the ref is hexadecimal and pass it to --branch otherwise. But for LuaRocks I don't think there is need to overload source.branch or source.tag because it's not a command-line argument, adding a new source.revision field looks better to me.