Starting with Git version 2.5+ (Q2 2015), fetching a single commit (without cloning the full repo) is actually possible.

See commit 68ee628 by Fredrik Medley (moroten), 21 May 2015.
^{(Merged by Junio C Hamano — gitster — in commit a9d3493, 01 Jun 2015)}

You now have a new config (on the server side)

uploadpack.allowReachableSHA1InWant

Allow upload-pack to accept a fetch request that asks for an object that is reachable from any ref tip. However, note that calculating object reachability is computationally expensive.
Defaults to false.

If you combine that server-side configuration with a shallow clone (git fetch --depth=1), you can ask for a single commit (see t/t5516-fetch-push.sh:

git fetch --depth=1 ../testrepo/.git <full-length SHA1>

You can use the git cat-file command to see that the commit has been fetched:

git cat-file commit <full-length SHA1>

“git upload-pack” that serves “git fetch” can be told to serve
commits that are not at the tip of any ref, as long as they are
reachable from a ref, with uploadpack.allowReachableSHA1InWant
configuration variable.

As noted by matt in the comments:

Note that SHA must be the full unabbreviated SHA, otherwise Git will claim it couldn’t find the commit

---

The full documentation is:

upload-pack: optionally allow fetching reachable sha1

With uploadpack.allowReachableSHA1InWant configuration option set on the server side, “git fetch” can make a request with a “want” line that names an object that has not been advertised (likely to have been obtained out of band or from a submodule pointer).
Only objects reachable from the branch tips, i.e. the union of advertised branches and branches hidden by transfer.hideRefs, will be processed.
Note that there is an associated cost of having to walk back the history to check the reachability.

This feature can be used when obtaining the content of a certain commit,
for which the sha1 is known, without the need of cloning the whole
repository, especially if a shallow fetch is used.

Useful cases are e.g.

• repositories containing large files in the history,
• fetching only the needed data for a submodule checkout,
• when sharing a sha1 without telling which exact branch it belongs to and in Gerrit, if you think in terms of commits instead of change numbers.
  (The Gerrit case has already been solved through allowTipSHA1InWant as every Gerrit change has a ref.)

---

Git 2.6 (Q3 2015) will improve that model.
See commit 2bc31d1, commit cc118a6 (28 Jul 2015) by Jeff King (peff).
^{(Merged by Junio C Hamano — gitster — in commit 824a0be, 19 Aug 2015)}

refs: support negative transfer.hideRefs

If you hide a hierarchy of refs using the transfer.hideRefs config, there is no way to later override that config to “unhide” it.
This patch implements a “negative” hide which causes matches to immediately be marked as unhidden, even if another match would hide it.
We take care to apply the matches in reverse-order from how they are fed to us by the config machinery, as that lets our usual “last one wins” config precedence work (and entries in .git/config, for example, will override /etc/gitconfig).

So you can now do:

git config --system transfer.hideRefs refs/secret
git config transfer.hideRefs '!refs/secret/not-so-secret'

to hide refs/secret in all repos, except for one public bit
in one specific repo.

---

Git 2.7 (Nov/Dec 2015) will improve again:

See commit 948bfa2, commit 00b293e (05 Nov 2015), commit 78a766a, commit 92cab49, commit 92cab49, commit 92cab49 (03 Nov 2015), commit 00b293e, commit 00b293e (05 Nov 2015), and commit 92cab49, commit 92cab49, commit 92cab49, commit 92cab49 (03 Nov 2015) by Lukas Fleischer (lfos).
Helped-by: Eric Sunshine (sunshineco).
^{(Merged by Jeff King — peff — in commit dbba85e, 20 Nov 2015)}

config.txt: document the semantics of hideRefs with namespaces

Right now, there is no clear definition of how transfer.hideRefs should
behave when a namespace is set.
Explain that hideRefs prefixes match stripped names in that case. This is how hideRefs patterns are currently
handled in receive-pack.

hideRefs: add support for matching full refs

In addition to matching stripped refs, one can now add hideRefs patterns that the full (unstripped) ref is matched against.
To distinguish between stripped and full matches, those new patterns must be prefixed with a circumflex (^).

Hence the new documentation:

transfer.hideRefs:

If a namespace is in use, the namespace prefix is stripped from each reference before it is matched against transfer.hiderefs patterns.
For example, if refs/heads/master is specified in transfer.hideRefs and
the current namespace is foo, then refs/namespaces/foo/refs/heads/master
is omitted from the advertisements but refs/heads/master and
refs/namespaces/bar/refs/heads/master are still advertised as so-called
“have” lines.
In order to match refs before stripping, add a ^ in front of
the ref name. If you combine ! and ^, ! must be specified first.

---

R.. mentions in the comments the config uploadpack.allowAnySHA1InWant, which allows upload-pack to accept a fetch request that asks for any object at all. (Defaults to false).

See commit f8edeaa (Nov. 2016, Git v2.11.1) by David “novalis” Turner (novalis):

upload-pack: optionally allow fetching any sha1

It seems a little silly to do a reachabilty check in the case where we
trust the user to access absolutely everything in the repository.

Also, it’s racy in a distributed system — perhaps one server
advertises a ref, but another has since had a force-push to that ref,
and perhaps the two HTTP requests end up directed to these different
servers.

---

With Git 2.34 (Q4 2021), “git upload-pack“^(man) which runs on the other side of git fetch^(man) forgot to take the ref namespaces into account when handling want-ref requests.

See commit 53a66ec, commit 3955140, commit bac01c6 (13 Aug 2021) by Kim Altintop (kim).
^{(Merged by Junio C Hamano — gitster — in commit 1ab13eb, 10 Sep 2021)}

docs: clarify the interaction of transfer.hideRefs and namespaces

^{Signed-off-by: Kim Altintop
Reviewed-by: Jonathan Tan}

Expand the section about namespaces in the documentation of transfer.hideRefs to point out the subtle differences between upload-pack and receive-pack.

3955140 (“upload-pack.c: treat want-ref relative to namespace”, 2021-07-30, Git v2.34.0 — merge listed in batch #5) taught upload-pack to reject want-refs for hidden refs, which is now mentioned.
It is clarified that at no point the name of a hidden ref is revealed, but the object id it points to may.

git config now includes in its man page:

reference before it is matched against transfer.hiderefs patterns. In
order to match refs before stripping, add a ^ in front of the ref name. If
you combine ! and ^, ! must be specified first.

git config now includes in its man page:

is omitted from the advertisements. If uploadpack.allowRefInWant is set,
upload-pack will treat want-ref refs/heads/master in a protocol v2
fetch command as if refs/namespaces/foo/refs/heads/master did not exist.
receive-pack, on the other hand, will still advertise the object id the
ref is pointing to without mentioning its name (a so-called “.have” line).