Recognise tags pinned by their object hash instead of their name as secure

[diabonas]

archlinux-inputs-fsck currently only recognises Git sources pinned by a commit hash as secure. However as outlined in a recent arch-dev-public mailing list post, pinning the SHA-1 hash of the tag object is as secure as pinning the commit ID:

_tag=1234567890123456789012345678901234567890 # git rev-parse "$tag_name"
source=("git+$url?signed#tag=$_tag")

Therefore is_commit_securely_pinned() should distinguish the case when the tag "name" is a 40-digit hex ID and return true in this case.

[kpcyrd]

Fixed in ada3c9e, thanks!

[diabonas]

Awesome, thank you very much for the quick fix!