parse_object: pass on the original sha1, not the replaced one