fetchgit: factor-out the hash logic to `lib.fetchers.withNormalizedHash`

    appendShort = lib.optionalString ((builtins.match "[a-f0-9]*" rev) != null) "-${short}";

  in "${if matched == null then base else builtins.head matched}${appendShort}";

in

lib.makeOverridable (

{ url, rev ? "HEAD", sha256 ? "", hash ? "", leaveDotGit ? deepClone

lib.makeOverridable (lib.fetchers.withNormalizedHash { } (

{ url, rev ? "HEAD", leaveDotGit ? deepClone

, outputHash ? lib.fakeHash, outputHashAlgo ? null

, fetchSubmodules ? true, deepClone ? false

, branchName ? null

, sparseCheckout ? []

assert deepClone -> leaveDotGit;

assert nonConeMode -> (sparseCheckout != []);

if hash != "" && sha256 != "" then

  throw "Only one of sha256 or hash can be set"

else if builtins.isString sparseCheckout then

if builtins.isString sparseCheckout then

  # Changed to throw on 2023-06-04

  throw "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more."

else

  nativeBuildInputs = [ git cacert ]

    ++ lib.optionals fetchLFS [ git-lfs ];

  outputHashAlgo = if hash != "" then null else "sha256";

  inherit outputHash outputHashAlgo;

  outputHashMode = "recursive";

  outputHash = if hash != "" then

    hash

  else if sha256 != "" then

    sha256

  else

    lib.fakeSha256;

  # git-sparse-checkout(1) says:

  # > When the --stdin option is provided, the directories or patterns are read

    gitRepoUrl = url;

  };

}

)

))