title: Test if a remote repository known by a URL contains a commit by hash
body: <p>Given a remote repository URL and a SHA hash, is it possible to test whether the hash represents a commit in the repository:</p>
  
  <ol>
  <li>Without fetching at all?</li>
  <li>If not, with as little fetching (shallow, not all branches) as possible?</li>
  </ol>
  
  <p>A closest answer I think of as a related one states that <code>git fetch</code> <a href="https://stackoverflow.com/a/14370219/1149924">cannot fetch a commit by hash</a>, which is not very promising. <code>ls-remote</code> also works only with refs. I cannot find any more related commands that look helpful.</p>
  
  <p>Background: a build/packaging tool needs to verify that the build, which contains an SHA hash of a commit, is trackable to source in a particular “golden” repository–not in the legal or cryptographically sound sense of <em>trackable</em>, rather just to prevent the common human error of not sharing the code before pushing binaries into production. Any thoughts on a solution to this problem are appreciated.</p>
  
  <p>Indeed, the local git repository almost certainly exists, and the remote with the given URL very likely exists in it also (or how else the commit could have been pushed into the golden repository?), but I would prefer to avoid, if possible, altering the state of that user's repository with a <code>fetch</code>.</p>