Other than failing a nix-build and looking for the expected hash in the build log, what is the best way to proactively compute the hash ahead of filling in the argument to fetchgit?

fetchgit {
  url = "…";
  rev = "…";
  hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; # ← ?
};

Assuming we already have a [possibly shallow] clone of the repository containing the same rev.