$ git clone -n https://src.fedoraproject.org/rpms/grub2.git /var/lib/mock/f40-build-2691711-68151/root/chroot_tmpdir/scmroot/grub2
Cloning into '/var/lib/mock/f40-build-2691711-68151/root/chroot_tmpdir/scmroot/grub2'...
$ git fetch origin d2fcd91e363b55a6080af0e2bd427948014e51a9:KOJI_FETCH_HEAD
From https://src.fedoraproject.org/rpms/grub2
 * [new ref]         d2fcd91e363b55a6080af0e2bd427948014e51a9 -> KOJI_FETCH_HEAD
$ git reset --hard KOJI_FETCH_HEAD
HEAD is now at d2fcd91 GRUB2 NTFS driver vulnerabilities