.git-lfs.metadata

@@ -0,0 +1,2 @@
+e76897da8f89170b2e23db7723408a7bdd038ee8 SOURCES/git-lfs-v3.4.1.tar.gz
+8f640c97e9736385e8cad79c91c983de895d6053 SOURCES/manpages.tgz

.gitignore

@@ -1,28 +1,2 @@
-/git-lfs-2.2.1.tar.gz
-/git-lfs-2.3.4.tar.gz
-/git-lfs-2.4.0.tar.gz
-/git-lfs-2.4.1.tar.gz
-/git-lfs-2.4.2.tar.gz
-/git-lfs-2.5.0.tar.gz
-/git-lfs-2.5.1.tar.gz
-/git-lfs-2.5.2.tar.gz
-/git-lfs-2.6.1.tar.gz
-/git-lfs-2.7.0.tar.gz
-/git-lfs-2.7.1.tar.gz
-/git-lfs-2.7.2.tar.gz
-/git-lfs-v2.8.0.tar.gz
-/git-lfs-v2.9.0.tar.gz
-/git-lfs-v2.9.2.tar.gz
-/git-lfs-v2.10.0.tar.gz
-/git-lfs-v2.11.0.tar.gz
-/git-lfs-v2.12.0.tar.gz
-/git-lfs-v2.12.1.tar.gz
-/git-lfs-v2.13.0.tar.gz
-/git-lfs-2.13.3.tar.gz
-/git-lfs-v2.13.3.tar.gz
-/git-lfs-v3.3.0.tar.gz
-/git-lfs-v3.2.0.tar.gz
-/git-lfs-v3.4.1.tar.gz
-/git-lfs-v3.6.0.tar.gz
-/git-lfs-v3.6.1.tar.gz
-/git-lfs-v3.7.1.tar.gz
+SOURCES/git-lfs-v3.4.1.tar.gz
+SOURCES/manpages.tgz

0001-commands-fix-format-string-type-mismatch-in-lockveri.patch

@@ -1,29 +0,0 @@
-From b1620879b0e615e03c1e89aeafc33940a0ed4ba3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Poho=C5=99elsk=C3=BD?= <opohorel@redhat.com>
-Date: Thu, 9 Apr 2026 11:03:37 +0200
-Subject: [PATCH] commands: fix format string type mismatch in lockverifier
-
-The addLocks() method passes a *git.Ref value to a %q format verb in
-a tr.Tr.Get() call, but %q expects a string. Newer versions of Go
-recognize tr.Tr.Get() as a printf-like function and flag this as an
-error during go vet.
-
-Pass ref.Refspec() instead, which returns the reference name as a
-string.
----
- commands/lockverifier.go | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/commands/lockverifier.go b/commands/lockverifier.go
-index d7d2d38682..96301937cc 100644
---- a/commands/lockverifier.go
-+++ b/commands/lockverifier.go
-@@ -90,7 +90,7 @@ func (lv *lockVerifier) addLocks(ref *git.Ref, locks []locking.Lock, set map[str
- 	for _, l := range locks {
- 		if rl, ok := set[l.Path]; ok {
- 			if err := rl.Add(ref, l); err != nil {
--				Error(tr.Tr.Get("warning: error adding %q lock for ref %q: %+v", l.Path, ref, err))
-+				Error(tr.Tr.Get("warning: error adding %q lock for ref %q: %+v", l.Path, ref.Refspec(), err))
- 			}
- 		} else {
- 			set[l.Path] = lv.newRefLocks(ref, l)

11fe8dc62ed2eb158eaec28af90d2f509e7fd91f.patch

@@ -1,25 +0,0 @@
-From a119ca768dfeefef7609b55acbf6400fafb0ee5a Mon Sep 17 00:00:00 2001
-From: "brian m. carlson" <bk2204@github.com>
-Date: Mon, 25 Jul 2022 17:29:34 +0000
-Subject: [PATCH] t: set init.defaultBranch
-
-Previously, we used a template to set the default HEAD ref to "main" so
-that our branch would be correct.  It appears that Git has changed
-things so that that no longer works, so set init.defaultBranch as well
-to make sure we initialize new repositories properly.
----
- t/testhelpers.sh | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/t/testhelpers.sh b/t/testhelpers.sh
-index 7c921f43e8..ea5dc05c4f 100644
---- a/t/testhelpers.sh
-+++ b/t/testhelpers.sh
-@@ -607,6 +607,7 @@ setup() {
-     git config --global http.$LFS_CLIENT_CERT_URL/.sslKey "$LFS_CLIENT_KEY_FILE"
-     git config --global http.$LFS_CLIENT_CERT_URL/.sslCert "$LFS_CLIENT_CERT_FILE"
-     git config --global http.$LFS_CLIENT_CERT_URL/.sslVerify "false"
-+    git config --global init.defaultBranch main
-   fi | sed -e 's/^/# /g'
- 
-   # setup the git credential password storage

README.Fedora

@@ -1,11 +0,0 @@
-git-lfs on Fedora
-=================
-
-By default, the package will run a post-install/post-uninstall task to
-enable/disable git-lfs filters in the system git configuration.
-
-If you wish to enable/disable git-lfs manually, you can set the following
-option in the system git config, and package install/uninstall will no longer
-do this:
-
-# git config --system 'fedora.git-lfs.no-modify-config' true

SOURCES/gen-manpages.sh

@@ -0,0 +1,15 @@
+# As `asciidoctor` package has not been packaged to RHEL 8:
+
+# Pass package version(eg. `3.4.0`) as argument
+
+VERSION=$1
+
+cd git-lfs-$VERSION
+
+make man GIT_LFS_SHA=unused VERSION=unused PREFIX=unused
+rm -r man/html
+
+tar -czvf manpages.tgz man/*
+
+cp manpages.tgz ../
+

SOURCES/git-lfs-3.4.1-cve-2024-53263.patch

@@ -0,0 +1,358 @@
+diff -urN b/creds/creds.go a/creds/creds.go
+--- b/creds/creds.go	2023-12-13 19:56:25.000000000 +0100
++++ a/creds/creds.go	2025-01-17 08:55:10.175959181 +0100
+@@ -53,11 +53,20 @@
+ // as input.
+ type Creds map[string][]string
+ 
+-func bufferCreds(c Creds) *bytes.Buffer {
++func (c Creds) buffer(protectProtocol bool) (*bytes.Buffer, error) {
+ 	buf := new(bytes.Buffer)
+ 
+ 	for k, v := range c {
+ 		for _, item := range v {
++			if strings.Contains(item, "\n") {
++				return nil, errors.Errorf(tr.Tr.Get("credential value for %s contains newline: %q", k, item))
++			}
++			if protectProtocol && strings.Contains(item, "\r") {
++				return nil, errors.Errorf(tr.Tr.Get("credential value for %s contains carriage return: %q\nIf this is intended, set `credential.protectProtocol=false`", k, item))
++			}
++			if strings.Contains(item, string(rune(0))) {
++				return nil, errors.Errorf(tr.Tr.Get("credential value for %s contains null byte: %q", k, item))
++			}
+ 			buf.Write([]byte(k))
+ 			buf.Write([]byte("="))
+ 			buf.Write([]byte(item))
+@@ -65,7 +74,7 @@
+ 		}
+ 	}
+ 
+-	return buf
++	return buf, nil
+ }
+ 
+ type CredentialHelperContext struct {
+@@ -153,6 +162,9 @@
+ 			helpers = append(helpers, ctxt.askpassCredHelper)
+ 		}
+ 	}
++
++	ctxt.commandCredHelper.protectProtocol = ctxt.urlConfig.Bool("credential", rawurl, "protectProtocol", true)
++
+ 	return CredentialHelperWrapper{CredentialHelper: NewCredentialHelpers(append(helpers, ctxt.commandCredHelper)), Input: input, Url: u}
+ }
+ 
+@@ -292,7 +304,8 @@
+ }
+ 
+ type commandCredentialHelper struct {
+-	SkipPrompt bool
++	SkipPrompt      bool
++	protectProtocol bool
+ }
+ 
+ func (h *commandCredentialHelper) Fill(creds Creds) (Creds, error) {
+@@ -323,7 +336,10 @@
+ 	if err != nil {
+ 		return nil, errors.New(tr.Tr.Get("failed to find `git credential %s`: %v", subcommand, err))
+ 	}
+-	cmd.Stdin = bufferCreds(input)
++	cmd.Stdin, err = input.buffer(h.protectProtocol)
++	if err != nil {
++		return nil, errors.New(tr.Tr.Get("invalid input to `git credential %s`: %v", subcommand, err))
++	}
+ 	cmd.Stdout = output
+ 	/*
+ 	   There is a reason we don't read from stderr here:
+diff -urN b/creds/creds_test.go a/creds/creds_test.go
+--- b/creds/creds_test.go	2023-12-13 19:56:25.000000000 +0100
++++ a/creds/creds_test.go	2025-01-17 08:55:21.318023782 +0100
+@@ -1,12 +1,89 @@
+ package creds
+ 
+ import (
++	"bytes"
+ 	"errors"
++	"slices"
++	"strings"
+ 	"testing"
+ 
+ 	"github.com/stretchr/testify/assert"
+ )
+ 
++func assertCredsLinesMatch(t *testing.T, expected []string, buf *bytes.Buffer) {
++	actual := strings.SplitAfter(buf.String(), "\n")
++
++	slices.Sort(expected)
++	slices.Sort(actual)
++
++	assert.Equal(t, expected, actual)
++}
++func TestCredsBufferFormat(t *testing.T) {
++	creds := make(Creds)
++
++	expected := []string{""}
++
++	buf, err := creds.buffer(true)
++	assert.NoError(t, err)
++	assertCredsLinesMatch(t, expected, buf)
++
++	creds["protocol"] = []string{"https"}
++	creds["host"] = []string{"example.com"}
++
++	expected = []string{"host=example.com\n", "protocol=https\n", ""}
++
++	buf, err = creds.buffer(true)
++	assert.NoError(t, err)
++	assertCredsLinesMatch(t, expected, buf)
++
++	creds["wwwauth[]"] = []string{"Basic realm=test", "Negotiate"}
++
++	expected = append(expected, "wwwauth[]=Basic realm=test\n", "wwwauth[]=Negotiate\n")
++	buf, err = creds.buffer(true)
++	assert.NoError(t, err)
++	assertCredsLinesMatch(t, expected, buf)
++}
++
++func TestCredsBufferProtect(t *testing.T) {
++	creds := make(Creds)
++
++	// Always disallow LF characters
++	creds["protocol"] = []string{"https"}
++	creds["host"] = []string{"one.example.com\nhost=two.example.com"}
++
++	buf, err := creds.buffer(false)
++	assert.Error(t, err)
++	assert.Nil(t, buf)
++
++	buf, err = creds.buffer(true)
++	assert.Error(t, err)
++	assert.Nil(t, buf)
++
++	// Disallow CR characters unless protocol protection disabled
++	creds["host"] = []string{"one.example.com\rhost=two.example.com"}
++
++	expected := []string{"", "protocol=https\n", "host=one.example.com\rhost=two.example.com\n"}
++
++	buf, err = creds.buffer(false)
++	assert.NoError(t, err)
++	assertCredsLinesMatch(t, expected, buf)
++
++	buf, err = creds.buffer(true)
++	assert.Error(t, err)
++	assert.Nil(t, buf)
++
++	// Always disallow null bytes
++	creds["host"] = []string{"one.example.com\x00host=two.example.com"}
++
++	buf, err = creds.buffer(false)
++	assert.Error(t, err)
++	assert.Nil(t, buf)
++
++	buf, err = creds.buffer(true)
++	assert.Error(t, err)
++	assert.Nil(t, buf)
++}
++
+ type testCredHelper struct {
+ 	fillErr    error
+ 	approveErr error
+diff -urN b/t/cmd/lfstest-gitserver.go a/t/cmd/lfstest-gitserver.go
+--- b/t/cmd/lfstest-gitserver.go	2023-12-13 19:56:25.000000000 +0100
++++ a/t/cmd/lfstest-gitserver.go	2025-01-16 14:33:23.825991696 +0100
+@@ -27,6 +27,7 @@
+ 	"net/http"
+ 	"net/http/httptest"
+ 	"net/textproto"
++	"net/url"
+ 	"os"
+ 	"os/exec"
+ 	"regexp"
+@@ -252,6 +253,7 @@
+ }
+ 
+ func lfsUrl(repo, oid string, redirect bool) string {
++	repo = url.QueryEscape(repo)
+ 	if redirect {
+ 		return server.URL + "/redirect307/objects/" + oid + "?r=" + repo
+ 	}
+diff -urN b/t/t-credentials-protect.sh a/t/t-credentials-protect.sh
+--- b/t/t-credentials-protect.sh	1970-01-01 01:00:00.000000000 +0100
++++ a/t/t-credentials-protect.sh	2025-01-16 14:03:23.597029590 +0100
+@@ -0,0 +1,146 @@
++#!/usr/bin/env bash
++
++. "$(dirname "$0")/testlib.sh"
++
++ensure_git_version_isnt $VERSION_LOWER "2.3.0"
++
++export CREDSDIR="$REMOTEDIR/creds-credentials-protect"
++setup_creds
++
++# Copy the default record file for the test credential helper to match the
++# hostname used in the Git LFS configurations of the tests.
++cp "$CREDSDIR/127.0.0.1" "$CREDSDIR/localhost"
++
++begin_test "credentials rejected with line feed"
++(
++  set -e
++
++  reponame="protect-linefeed"
++  setup_remote_repo "$reponame"
++  clone_repo "$reponame" "$reponame"
++
++  contents="a"
++  contents_oid=$(calc_oid "$contents")
++
++  git lfs track "*.dat"
++  printf "%s" "$contents" >a.dat
++  git add .gitattributes a.dat
++  git commit -m "add a.dat"
++
++  # Using localhost instead of 127.0.0.1 in the LFS API URL ensures this URL
++  # is used when filling credentials rather than the Git remote URL, which
++  # would otherwise be used since it would have the same scheme and hostname.
++  gitserver="$(echo "$GITSERVER" | sed 's/127\.0\.0\.1/localhost/')"
++  testreponame="test%0a$reponame"
++  git config lfs.url "$gitserver/$testreponame.git/info/lfs"
++
++  GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
++  if [ "0" -eq "${PIPESTATUS[0]}" ]; then
++    echo >&2 "fatal: expected 'git lfs push' to fail ..."
++    exit 1
++  fi
++  grep "batch response: Git credentials for $gitserver.* not found" push.log
++  grep "credential value for path contains newline" push.log
++  refute_server_object "$testreponame" "$contents_oid"
++
++  git config credential.protectProtocol false
++
++  GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
++  if [ "0" -eq "${PIPESTATUS[0]}" ]; then
++    echo >&2 "fatal: expected 'git lfs push' to fail ..."
++    exit 1
++  fi
++  grep "batch response: Git credentials for $gitserver.* not found" push.log
++  grep "credential value for path contains newline" push.log
++  refute_server_object "$testreponame" "$contents_oid"
++)
++end_test
++
++begin_test "credentials rejected with carriage return"
++(
++  set -e
++
++  reponame="protect-return"
++  setup_remote_repo "$reponame"
++  clone_repo "$reponame" "$reponame"
++
++  contents="a"
++  contents_oid=$(calc_oid "$contents")
++
++  git lfs track "*.dat"
++  printf "%s" "$contents" >a.dat
++  git add .gitattributes a.dat
++  git commit -m "add a.dat"
++
++  # Using localhost instead of 127.0.0.1 in the LFS API URL ensures this URL
++  # is used when filling credentials rather than the Git remote URL, which
++  # would otherwise be used since it would have the same scheme and hostname.
++  gitserver="$(echo "$GITSERVER" | sed 's/127\.0\.0\.1/localhost/')"
++  testreponame="test%0d$reponame"
++  git config lfs.url "$gitserver/$testreponame.git/info/lfs"
++
++  GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
++  if [ "0" -eq "${PIPESTATUS[0]}" ]; then
++    echo >&2 "fatal: expected 'git lfs push' to fail ..."
++    exit 1
++  fi
++  grep "batch response: Git credentials for $gitserver.* not found" push.log
++  grep "credential value for path contains carriage return" push.log
++  refute_server_object "$testreponame" "$contents_oid"
++
++  git config credential.protectProtocol false
++
++  git lfs push origin main 2>&1 | tee push.log
++  if [ "0" -ne "${PIPESTATUS[0]}" ]; then
++    echo >&2 "fatal: expected 'git lfs push' to succeed ..."
++    exit 1
++  fi
++  [ $(grep -c "Uploading LFS objects: 100% (1/1)" push.log) -eq 1 ]
++  assert_server_object "$testreponame" "$contents_oid"
++)
++end_test
++
++begin_test "credentials rejected with null byte"
++(
++  set -e
++
++  reponame="protect-null"
++  setup_remote_repo "$reponame"
++  clone_repo "$reponame" "$reponame"
++
++  contents="a"
++  contents_oid=$(calc_oid "$contents")
++
++  git lfs track "*.dat"
++  printf "%s" "$contents" >a.dat
++  git add .gitattributes a.dat
++  git commit -m "add a.dat"
++
++  # Using localhost instead of 127.0.0.1 in the LFS API URL ensures this URL
++  # is used when filling credentials rather than the Git remote URL, which
++  # would otherwise be used since it would have the same scheme and hostname.
++  gitserver="$(echo "$GITSERVER" | sed 's/127\.0\.0\.1/localhost/')"
++  testreponame="test%00$reponame"
++  git config lfs.url "$gitserver/$testreponame.git/info/lfs"
++
++  GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
++  if [ "0" -eq "${PIPESTATUS[0]}" ]; then
++    echo >&2 "fatal: expected 'git lfs push' to fail ..."
++    exit 1
++  fi
++  grep "batch response: Git credentials for $gitserver.* not found" push.log
++  grep "credential value for path contains null byte" push.log
++  refute_server_object "$testreponame" "$contents_oid"
++
++  git config credential.protectProtocol false
++
++  GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
++  if [ "0" -eq "${PIPESTATUS[0]}" ]; then
++    echo >&2 "fatal: expected 'git lfs push' to fail ..."
++    exit 1
++  fi
++  grep "batch response: Git credentials for $gitserver.* not found" push.log
++  grep "credential value for path contains null byte" push.log
++  refute_server_object "$testreponame" "$contents_oid"
++)
++end_test
+diff -urN b/t/testhelpers.sh a/t/testhelpers.sh
+--- b/t/testhelpers.sh	2023-12-13 19:56:25.000000000 +0100
++++ a/t/testhelpers.sh	2025-01-16 14:15:19.240279305 +0100
+@@ -557,6 +557,14 @@
+   fi
+ }
+ 
++
++setup_creds() {
++  mkdir -p "$CREDSDIR"
++  write_creds_file "user:pass" "$CREDSDIR/127.0.0.1"
++  write_creds_file ":pass" "$CREDSDIR/--$certpath"
++  write_creds_file ":pass" "$CREDSDIR/--$keypath"
++}
++
+ # setup initializes the clean, isolated environment for integration tests.
+ setup() {
+   cd "$ROOTDIR"
+@@ -613,10 +621,7 @@
+   # setup the git credential password storage
+   local certpath="$(echo "$LFS_CLIENT_CERT_FILE" | tr / -)"
+   local keypath="$(echo "$LFS_CLIENT_KEY_FILE_ENCRYPTED" | tr / -)"
+-  mkdir -p "$CREDSDIR"
+-  write_creds_file "user:pass" "$CREDSDIR/127.0.0.1"
+-  write_creds_file ":pass" "$CREDSDIR/--$certpath"
+-  write_creds_file ":pass" "$CREDSDIR/--$keypath"
++  setup_creds
+ 
+   echo "#"
+   echo "# HOME: $HOME"

SOURCES/git-lfs-3.4.1-cve-2026-39821.patch

@@ -0,0 +1,39 @@
+From adfb8ef6fc0e091b061472cf8e68122be1bbd907 Mon Sep 17 00:00:00 2001
+From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
+Date: Fri, 12 Jun 2026 11:09:33 +0000
+Subject: [PATCH] idna: reject xn-- labels that decode to all-ASCII
+
+Add an all-ASCII rejection check in the process method of the IDNA
+package. After Punycode decoding an xn-- label, check if the decoded
+result is pure ASCII. If so, return an A3 error (invalid Punycode label).
+
+This fixes a specification bug in UTS 46 (corrected in revision 33)
+where xn-- labels that decode to all-ASCII were not properly rejected.
+
+The upstream fix in golang/net@8c4c965 guards this check behind a
+unicode16 flag, but since RHEL 8 ships Go 1.21 with Unicode 15.0.0,
+the guard is removed here so the fix is always active.
+
+For golang/go#78760
+CVE: CVE-2026-39821
+---
+ vendor/golang.org/x/net/idna/idna10.0.0.go | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/vendor/golang.org/x/net/idna/idna10.0.0.go b/vendor/golang.org/x/net/idna/idna10.0.0.go
+index 64ccf85..170095d 100644
+--- a/vendor/golang.org/x/net/idna/idna10.0.0.go
++++ b/vendor/golang.org/x/net/idna/idna10.0.0.go
+@@ -371,6 +371,9 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
+ 				// Spec says keep the old label.
+ 				continue
+ 			}
++			if err == nil && ascii(u) {
++				err = punyError(label[len(acePrefix):])
++			}
+ 			isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
+ 			labels.set(u)
+ 			if err == nil && p.fromPuny != nil {
+-- 
+2.52.0
+

SPECS/git-lfs.spec

@@ -1,27 +1,49 @@
+# Build man pages
+%global with_manpages 1
+
 %bcond_without check
 
 # https://github.com/git-lfs/git-lfs
-%global goipath         github.com/git-lfs/git-lfs/v3
-Version:                3.7.1
+%global goipath         github.com/git-lfs/git-lfs
+Version:                3.4.1
 
+# golang doesn't ship i686 binaries, we don't need the build
+# https://bugzilla.redhat.com/show_bug.cgi?id=1752991#c9
+%global golang_arches %(echo %{golang_arches} | sed "s|%{ix86}||")
 %gometa
 
 %global gobuilddir %{_builddir}/%{name}-%{version}/_build
 
+# define gobuild macro to not lose hardening, because of macro conflict
+# https://bugzilla.redhat.com/show_bug.cgi?id=1919348
+%global gobuild CGO_CPPFLAGS="-D_FORTIFY_SOURCE=2 -fstack-protector-all" go build -compiler gc -buildmode pie '-tags=rpm_crashtraceback libtrust_openssl ' -ldflags "-linkmode=external -compressdwarf=false ${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**}
+
 Name:           git-lfs
-Release:        6%{?dist}
+Release:        12%{?dist}
 Summary:        Git extension for versioning large files
 
 License:        MIT
 URL:            https://git-lfs.github.io/
 Source0:        https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name}-v%{version}.tar.gz
-Source1:        README.Fedora
-
-# https://github.com/git-lfs/git-lfs/pull/6237
-Patch0:         0001-commands-fix-format-string-type-mismatch-in-lockveri.patch
+Source1:        manpages.tgz
+# See this script. Generating of manpages is performed on other distros due to some missing rubygem-asciidoctor on RHEL-8
+Source2:        gen-manpages.sh
 
+# https://github.com/advisories/GHSA-q6r2-x2cc-vrp7
+# Backports 268628b, 4423696, 0345b6f and f6904cc that resolves the CVE-2024-53263
+# Aditionally backports b326b63
+# Commits had to be adapted as git-lfs-3.4.1 doesn't support multistage authentication
+Patch1:          git-lfs-3.4.1-cve-2024-53263.patch
+# Fixes CVE-2025-26625
+# Backports all the commits from:
+# https://github.com/git-lfs/git-lfs/compare/v3.7.0...v3.7.1
+# And additional commits to support the fix
+# Some tests had to be skipped as they require features not present in v3.4.1. and always fail
+Patch2:          git-lfs-3.4.1-cve-2025-26625.patch
+# Fixes CVE-2026-39821
+# Vendored golang.org/x/net idna: reject xn-- labels that decode to all-ASCII
 # https://github.com/golang/net/commit/8c4c965e028475082408749b50ed7a686df0d265
-Patch1:         git-lfs-3.7.1-CVE-2026-39821.patch
+Patch3:          git-lfs-3.4.1-cve-2026-39821.patch
 
 # Generated provides by vendor2provides.py
 # https://src.fedoraproject.org/rpms/syncthing/blob/603e4e03a92a7d704d199629dd85304018e8279d/f/vendor2provides.py
@@ -30,45 +52,40 @@ Provides:       bundled(golang(github.com/avast/retry-go)) = 2.4.2+incompatible
 Provides:       bundled(golang(github.com/davecgh/go-spew)) = 1.1.1
 Provides:       bundled(golang(github.com/dpotapov/go-spnego)) = 298b63a
 Provides:       bundled(golang(github.com/git-lfs/gitobj/v2)) = 2.1.1
-Provides:       bundled(golang(github.com/git-lfs/go-netrc)) = ba0029b
+Provides:       bundled(golang(github.com/git-lfs/go-netrc)) = f0c862d
 Provides:       bundled(golang(github.com/git-lfs/pktline)) = 06e9096
 Provides:       bundled(golang(github.com/git-lfs/wildmatch/v2)) = 2.0.1
-Provides:       bundled(golang(github.com/golang/groupcache)) = 2c02b82
 Provides:       bundled(golang(github.com/hashicorp/go-uuid)) = 1.0.2
-Provides:       bundled(golang(github.com/inconshreveable/mousetrap)) = 1.1.0
+Provides:       bundled(golang(github.com/inconshreveable/mousetrap)) = 1.0.1
 Provides:       bundled(golang(github.com/jcmturner/aescts/v2)) = 2.0.0
 Provides:       bundled(golang(github.com/jcmturner/dnsutils/v2)) = 2.0.0
 Provides:       bundled(golang(github.com/jcmturner/gofork)) = 1.0.0
 Provides:       bundled(golang(github.com/jcmturner/goidentity/v6)) = 6.0.1
 Provides:       bundled(golang(github.com/jcmturner/gokrb5/v8)) = 8.4.2
 Provides:       bundled(golang(github.com/jcmturner/rpc/v2)) = 2.0.3
-Provides:       bundled(golang(github.com/jmhodges/clock)) = 1.2.0
 Provides:       bundled(golang(github.com/leonelquinteros/gotext)) = 1.5.0
 Provides:       bundled(golang(github.com/mattn/go-isatty)) = 0.0.4
 Provides:       bundled(golang(github.com/olekukonko/ts)) = 78ecb04
 Provides:       bundled(golang(github.com/pkg/errors)) = c605e28
 Provides:       bundled(golang(github.com/pmezard/go-difflib)) = 1.0.0
 Provides:       bundled(golang(github.com/rubyist/tracerx)) = 7879593
-Provides:       bundled(golang(github.com/spf13/cobra)) = 1.7.0
+Provides:       bundled(golang(github.com/spf13/cobra)) = 1.6.0
 Provides:       bundled(golang(github.com/spf13/pflag)) = 1.0.5
 Provides:       bundled(golang(github.com/ssgelm/cookiejarparser)) = 1.0.1
 Provides:       bundled(golang(github.com/stretchr/testify)) = 1.6.1
 Provides:       bundled(golang(github.com/xeipuuv/gojsonpointer)) = 4e3ac27
 Provides:       bundled(golang(github.com/xeipuuv/gojsonreference)) = bd5ef7b
 Provides:       bundled(golang(github.com/xeipuuv/gojsonschema)) = 6b67b3f
-Provides:       bundled(golang(golang.org/x/crypto)) = 0.36.0
-Provides:       bundled(golang(golang.org/x/net)) = 0.38.0
-Provides:       bundled(golang(golang.org/x/sync)) = 0.12.0
-Provides:       bundled(golang(golang.org/x/sys)) = 0.31.0
-Provides:       bundled(golang(golang.org/x/text)) = 0.23.0
+Provides:       bundled(golang(golang.org/x/crypto)) = 7b82a4e
+Provides:       bundled(golang(golang.org/x/net)) = 0.7.0
+Provides:       bundled(golang(golang.org/x/sync)) = 0.1.0
+Provides:       bundled(golang(golang.org/x/sys)) = 0.5.0
+Provides:       bundled(golang(golang.org/x/text)) = 0.7.0
 Provides:       bundled(golang(gopkg.in/yaml.v3)) = 3.0.1
 
 
-# Generate man pages
-BuildRequires:  /usr/bin/asciidoctor
-
-%if %{with check}
-# Tests
+%if 0%{?with_check}
+# For tests
 BuildRequires:  perl-Digest-SHA
 BuildRequires:  perl-Test-Harness
 # Tests require full git suite, but not generally needed.
@@ -90,6 +107,11 @@ install -m 0755 -vd %{gobuilddir}/bin
 install -m 0755 -vd "$(dirname %{gobuilddir}/src/%{goipath})"
 ln -fs "$(pwd)" "%{gobuilddir}/src/%{goipath}"
 
+%if %{?with_manpages}
+# Unpack manpages generated by %%{SOURCE2}
+tar -xf %{SOURCE1}
+%endif
+
 # Modify tests so that they expect binaries where we build them.
 sed -i -e 's!\.\./bin/!/%{gobuilddir}/bin/!g' t/Makefile
 sed -i -e 's!^BINPATH=.\+!BINPATH="%{gobuilddir}/bin"!g' t/testenv.sh
@@ -98,15 +120,13 @@ sed -i -e 's!^BINPATH=.\+!BINPATH="%{gobuilddir}/bin"!g' t/testenv.sh
 export GOPATH=%{gobuilddir}:%{gopath}
 export GO111MODULE=off
 
-# Enable FIPS support at build time by enabling CGO and enforcing strict FIPS runtime
-export CGO_ENABLED=1
-export GOEXPERIMENT=strictfipsruntime
-
 # Build manpages first (some embedding in the executable is done.)
-make man GIT_LFS_SHA=unused VERSION=unused PREFIX=unused
 pushd docs
-%gobuild -o %{gobuilddir}/bin/mangen man/mangen.go
-%{gobuilddir}/bin/mangen
+%gobuild -o mangen man/mangen.go
+./mangen
+# Removes unwanted source files
+# https://bugzilla.redhat.com/show_bug.cgi?id=1852842
+rm mangen man/mangen.go
 popd
 
 %gobuild -o %{gobuilddir}/bin/git-lfs %{goipath}
@@ -119,17 +139,21 @@ done
 %gobuild -o "%{gobuilddir}/bin/git-lfs-test-server-api" t/git-lfs-test-server-api/*.go
 popd
 
-# Remove man pages from docs so they don't get installed twice.
-rm -r docs/man
-
 
 %install
 # In Fedora this is done by using %%gopkginstall
 install -Dpm0755 %{gobuilddir}/bin/git-lfs %{buildroot}%{_bindir}/%{name}
-for section in 1 5 7; do
-  install -d -p %{buildroot}%{_mandir}/man${section}/
-  install -Dpm0644 man/man${section}/*.${section} %{buildroot}%{_mandir}/man${section}/
-done
+install -d -p %{buildroot}%{_mandir}/man1/
+install -Dpm0644 man/man1/*.1 %{buildroot}%{_mandir}/man1/
+install -d -p %{buildroot}%{_mandir}/man5/
+install -Dpm0644 man/man5/*.5 %{buildroot}%{_mandir}/man5/
+install -d -p %{buildroot}%{_mandir}/man7/
+install -Dpm0644 man/man7/*.7 %{buildroot}%{_mandir}/man7/
+
+# Remove unwanted files from man folder
+# https://bugzilla.redhat.com/show_bug.cgi?id=1852842
+rm -r man/*
+
 
 %post
 %{_bindir}/%{name} install --system --skip-repo
@@ -143,7 +167,6 @@ exit 0
 
 %if %{with check}
 %check
-%gocheck
 PATH=%{buildroot}%{_bindir}:%{gobuilddir}/bin:$PATH \
 # https://github.com/git-lfs/git-lfs/issues/5609
 # tests fails when running with low level of parallelism
@@ -162,164 +185,86 @@ PATH=%{buildroot}%{_bindir}:%{gobuilddir}/bin:$PATH \
 
 
 %changelog
-* Tue Jul 14 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.7.1-6
-- Fix CVE-2026-39821 in vendored golang.org/x/net/idna
-- Resolves: RHEL-183843, RHEL-187313
-
-* Mon May 19 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-5
+* Thu Jul 09 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.4.1-12
 - Rebuild with new Golang
-- Resolves: RHEL-156656, RHEL-166700, RHEL-167695, RHEL-167389, RHEL-166345, RHEL-177321
+- Resolves: RHEL-187191
 
-* Mon Feb 16 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-3
+* Fri Jun 12 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.4.1-11
+- Backport CVE-2026-39821 fix (vendored golang.org/x/net IDNA)
+- Resolves: RHEL-183731
+
+* Mon May 04 2026 RHEL Packaging Agent <jotnar@redhat.com> - 3.4.1-10
 - Rebuild with new Golang
-- Resolves: RHEL-146102, RHEL-149638
+- Resolves: RHEL-167541, RHEL-167379, RHEL-166518
 
-* Thu Jan 22 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-2
+* Fri Mar 27 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-9
 - Rebuild with new Golang
-- Resolves: RHEL-140548
+- Resolves: RHEL-156637
 
-* Mon Jan 05 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-1
-- Update to 3.7.1
-- Resolves: RHEL-118154, RHEL-122429
-
-* Mon Aug 11 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.6.1-3
-- Add patch to fix build failures with Go 1.24<
-- Resolves: RHEL-106475
-
-* Tue Jun 03 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.6.1-2
+* Mon Feb 16 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-8
 - Rebuild with new Golang
-- Resolves: RHEL-89304
+- Resolves: RHEL-146094, RHEL-149269
 
-* Wed Jan 15 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.6.1-1
-- Update to 3.6.1
-- Resolves: RHEL-73940
-
-* Thu Nov 28 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.6.0-1
-- Update to 3.6.0
-- Resolves: RHEL-63968, RHEL-61045, RHEL-47219, RHEL-43318, RHEL-35936, RHEL-2791
-
-* Wed Aug 07 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-3
-- Make Git-LFS FIPS compliant
-- Resolves: RHEL-53086
-
-* Wed May 22 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-2
+* Thu Jan 22 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-7
 - Rebuild with new Golang
-- Resolves: RHEL-32571
+- Resolves: RHEL-140536
 
-* Mon Dec 18 2023 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-1
-- Update to 3.4.1
-- Resolves: RHEL-17101
+* Thu Dec 04 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-6
+- Backport CVE-2025-26625 fixes
+- Resolves: RHEL-122423
 
-* Thu Jan 05 2023 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.0-1
-- Update to 3.2.0
-- Resolves: #2139383
+* Tue Jun 10 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-5
+- Rebuild with new Golang
+- Resolves: RHEL-89264
 
-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2.13.3-4
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
+* Fri Jan 17 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-4
+- Backport CVE-2024-53263 fixes
+- Resolves: RHEL-73931
 
-* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 2.13.3-3
-- Rebuilt for RHEL 9 BETA for openssl 3.0
-  Related: rhbz#1971065
+* Mon Sep 23 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-3
+- Rebuild with new Golang
+- Resolves: RHEL-57900
 
-* Wed May 05 2021 Ondřej Pohořelský <opohorel@redhat.com> - 2.13.3-2
-- Fixed name of source tarball
-- Fixed date in the latest changelog entry 
-- Related: #1952517
+* Mon Apr 22 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-2
+- Rebuild with new Golang
+- Resolves: RHEL-32543, RHEL-28377, RHEL-28399, RHEL-28423
 
-* Thu Apr 22 2021 Ondřej Pohořelský <opohorel@redhat.com> - 2.13.3-1
-- Update to latest version
-- Resolves: #1952517
+* Mon Dec 18 2023 Ondrej Pohorelsky <opohorel@redhat.com> - 3.4.1-1
+- Update to version 3.4.1
+- Resolves: RHEL-17102
 
-* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 2.13.0-2
-- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+* Mon Jan 30 2023 Ondrej Pohorelsky <opohorel@redhat.com> - 3.2.0-2
+- Rebuild with Golang-1.19.4
+- Resolves: #2163744
 
-* Wed Jan 06 2021 Ondřej Pohořelský <opohorel@redhat.com> - 2.13.0-1
-- Enable bundling
-- Update to latest version
+* Mon Jan 09 2023 Ondrej Pohorelsky <opohorel@redhat.com> - 3.2.0-1
+- Update to version 3.2.0
+- Resolves: #2139382
 
-* Mon Nov 09 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.12.1-1
-- Update to latest version (#1894780)
+* Mon Jan 17 2022 Ondrej Pohorelsky <opohorel@redhat.com> - 2.13.3-2
+- Define %%gobuild macro with proper ldflags
+- Related: rhbz#2021549
 
-* Thu Sep 03 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.12.0-1
-- Update to latest version (#1874604)
-- Remove duplicate docs/man directory (#1852765)
-- Add an option to disable modifying the git filter config (#1768060)
+* Tue Nov 23 2021 Ondrej Pohorelsky <opohorel@redhat.com> - 2.13.3-1
+- Update to version 2.13.3
+- Fixed round brackets in Provides
+- Moved manpages.tgz to look-a-side cache
+- Resolves: rhbz#2021549, rhbz#1870080, rhbz#1866441
 
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.11.0-3
-- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+* Wed Jul 1 2020 Ondrej Pohorelsky <opohorel@redhat.com> - 2.11.0-2
+- Removed mangen source file
+- Cleaned docs/man folder
+- Resolves: rhbz#1852842
 
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.11.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+* Wed Jun 10 2020 Ondrej Pohorelsky <opohorel@redhat.com> - 2.11.0-1
+- Update to version 2.11.0
+- Resolves: rhbz#1783391
 
-* Sun May 10 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.11.0-1
-- Update to latest version
+* Thu Jul 19 2018 Sebastian Kisela <skisela@redhat.com> - 2.4.1-3
+- Add pregenerated manpages, due to missing dependency 'ronn' in rhel7.
 
-* Thu Feb 20 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.10.0-1
-- Update to latest version
-
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Tue Jan 07 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.9.2-1
-- Update to latest version
-
-* Wed Jan 01 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.9.0-1
-- Update to latest version
-
-* Fri Aug 30 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.8.0-4
-- Customize vendor information in version
-
-* Fri Aug 30 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.8.0-3
-- Update to latest version
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Wed Jul 10 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.7.2-2
-- Update to latest Go macros
-
-* Wed Apr 24 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.7.2-1
-- Update to latest version
-
-* Wed Feb 27 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.7.1-1
-- Update to latest version
-
-* Thu Feb 21 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.7.0-1
-- Update to latest version
-
-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Tue Jan 15 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.6.1-1
-- Update to latest version
-
-* Mon Jan 14 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.2-4
-- Rebuilt for dependencies
-
-* Tue Oct 23 2018 Nicolas Mailhot <nim@fedoraproject.org>
-- 2.5.2-3
-- redhat-rpm-config-123 triggers bugs in gosetup, remove it from Go spec files as it’s just an alias
-- https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/RWD5YATAYAFWKIDZBB7EB6N5DAO4ZKFM/
-
-* Fri Oct 12 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.2-2
-- rebuilt
-
-* Wed Oct 10 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.2-1
-- Update to latest version
-
-* Tue Sep 04 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.1-1
-- Update to latest version
-
-* Mon Sep 03 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.0-1
-- Update to 2.5.0
-
-* Wed Aug 29 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.4.2-1
-- Update to 2.4.2
-
-* Tue Jul 31 2018 Florian Weimer <fweimer@redhat.com> - 2.4.1-3
-- Rebuild with fixed binutils
+* Wed Jul 18 2018 Sebastian Kisela <skisela@redhat.com> - 2.4.1-2
+- Initial build for rh-git218-git-lfs-2.4.1
 
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-9
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}

sources

@@ -1 +0,0 @@
-SHA512 (git-lfs-v3.7.1.tar.gz) = d8ffb262949c661b13cbfb733786701f2acc95b05f11d3d327eff585911b203ef6fc104d1060c57a62a7fb5117909e5e805d5fabbefb0da8c966227c528e2ea6