When installing a plugin that specifies a SHA pin and verification fails, the error message is now specific about what went wrong:
SHA pin verification failed: expected HEAD to be <expected-sha>, got <actual-sha>.
The pinned commit may have been removed upstream, or a ref with the same name exists.
Refusing to install.If the underlying git rev-parse call itself fails, the got field shows (rev-parse failed) so the root cause is always clear.
Evidence
SHA verification error (search for "SHA pin verification failed: expected HEAD to be")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.