add_existing(): do not retain a reference to sha1