peel_ref: do not return a null sha1