parse_cmd_verify(): copy old_sha1 instead of evaluating <oldvalue> twice