sha from git, not the files