git-lfs.yaml

package:
  name: git-lfs
  version: 3.1.4
  epoch: 0
  description: "large file support for git"
  target-architecture:
    - all
  copyright:
    - paths:
      - "*"
      attestation: TODO
      license: MIT
  dependencies:
    runtime:
      - git

environment:
  contents:
    packages:
      - busybox
      - ca-certificates-bundle
      - build-base
      - go
      - git

pipeline:
  - uses: fetch
    with:
      uri: https://github.com/git-lfs/git-lfs/archive/v${{package.version}}.tar.gz
      expected-sha256: d7bfeb6f4c219c44773da4f93da28eb1e2e654efa4cd23294d9039247d8cde64

  - runs: |
      # mitigate CVE-2021-38561
      go get golang.org/x/text

      # mitigate CVE-2022-27191
      go get golang.org/x/crypto/ssh

  - runs: |
      make EXTRA_GO_FLAGS="-v -tags netcgo" GIT_LFS_SHA="v${{package.version}}" VERSION="v${{package.version}}"

  - runs: |
      install -Dm755 bin/git-lfs "${{targets.destdir}}"/usr/bin/git-lfs

  - uses: strip