Merge pull request git-lfs#4448 from git-lfs/release-next

release: v2.13.3

Author: bk2204

.github/workflows/ci.yml

@@ -6,11 +6,15 @@ jobs:
     name: Build with default Git
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-20.04, macos-latest]
+        go: ['1.16.x']
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v1
     - uses: actions/setup-ruby@v1
+    - uses: actions/setup-go@v2
+      with:
+        go-version: ${{ matrix.go }}
     - run: gem install ronn
     - run: script/cibuild
     - run: CGO_ENABLED=0 make release
@@ -25,10 +29,10 @@ jobs:
     strategy:
       matrix:
         go: ['1.11.x', '1.12.x', '1.13.x', '1.14.x']
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
     - uses: actions/checkout@v1
-    - uses: actions/setup-go@v1
+    - uses: actions/setup-go@v2
       with:
         go-version: ${{ matrix.go }}
     - run: script/cibuild
@@ -77,7 +81,7 @@ jobs:
     name: Build with latest Git
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-20.04, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v1
@@ -88,7 +92,7 @@ jobs:
     name: Build with earliest Git
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-20.04, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v1
@@ -97,7 +101,7 @@ jobs:
     - run: script/cibuild
   build-docker:
     name: Build Linux packages
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
     - uses: actions/checkout@v1
     - uses: actions/setup-ruby@v1

.github/workflows/release.yml

@@ -7,9 +7,15 @@ jobs:
   build-windows:
     name: Build Windows Assets
     runs-on: windows-latest
+    strategy:
+      matrix:
+        go: ['1.16.x']
     steps:
     - uses: actions/checkout@v1
     - uses: actions/setup-ruby@v1
+    - uses: actions/setup-go@v2
+      with:
+        go-version: ${{ matrix.go }}
     - run: mkdir -p "$HOME/go/bin"
       shell: bash
     - run: set GOPATH=%HOME%\go
@@ -45,9 +51,15 @@ jobs:
   build-macos:
     name: Build macOS Assets
     runs-on: macos-latest
+    strategy:
+      matrix:
+        go: ['1.16.x']
     steps:
     - uses: actions/checkout@v1
     - uses: actions/setup-ruby@v1
+    - uses: actions/setup-go@v2
+      with:
+        go-version: ${{ matrix.go }}
     - run: brew install mitchellh/gon/gon
     - run: gem install ronn
     - run: make release
@@ -71,10 +83,16 @@ jobs:
     needs:
       - build-windows
       - build-macos
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
+    strategy:
+      matrix:
+        go: ['1.16.x']
     steps:
     - uses: actions/checkout@v1
     - uses: actions/setup-ruby@v1
+    - uses: actions/setup-go@v2
+      with:
+        go-version: ${{ matrix.go }}
     - uses: actions/download-artifact@v1
       with:
         name: windows-assets
@@ -91,7 +109,7 @@ jobs:
         GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
   build-docker:
     name: Build Linux Packages
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
     - uses: actions/checkout@v1
     - uses: actions/setup-ruby@v1

CHANGELOG.md

@@ -1,6 +1,22 @@
 # Git LFS Changelog
 
-## 2.13.2 (13 Jan 2020)
+## 2.13.3 (26 Mar 2021)
+
+This release fixes two bugs that caused `git lfs prune` to hang, updates some
+dependencies to versions which lack a security issue (which did not affect Git
+LFS), and adds support for ARM64 builds on macOS.
+
+### Bugs
+
+* lfs: don't invoke diff drivers when pruning repositories #4407 (@bk2204)
+* Parse stash log entries parsimonously in prune command #4449 (@chrisd8088)
+
+### Misc
+
+* Darwin ARM64 support #4437 (@bk2204)
+* vendor,go.{mod,sum}: update x/net and dependencies #4398 (@chrisd8088)
+
+## 2.13.2 (13 Jan 2021)
 
 This release introduces a security fix for Windows systems, which has been
 assigned CVE-2021-21237.

Makefile

@@ -175,6 +175,7 @@ BUILD = GOOS=$(1) GOARCH=$(2) \
 # built for.
 BUILD_TARGETS = \
 	bin/git-lfs-darwin-amd64 \
+	bin/git-lfs-darwin-arm64 \
 	bin/git-lfs-linux-arm \
 	bin/git-lfs-linux-arm64 \
 	bin/git-lfs-linux-amd64 \
@@ -212,6 +213,8 @@ all build : $(BUILD_TARGETS)
 # embeds the versioninfo into the binary.
 bin/git-lfs-darwin-amd64 : $(SOURCES) mangen
 	$(call BUILD,darwin,amd64,-darwin-amd64)
+bin/git-lfs-darwin-arm64 : $(SOURCES) mangen
+	$(call BUILD,darwin,arm64,-darwin-arm64)
 bin/git-lfs-linux-arm : $(SOURCES) mangen
 	GOARM=5 $(call BUILD,linux,arm,-linux-arm)
 bin/git-lfs-linux-arm64 : $(SOURCES) mangen
@@ -276,6 +279,7 @@ script/windows-installer/git-lfs-wizard-image.bmp
 # 	make VERSION=my-version bin/releases/git-lfs-darwin-amd64-my-version.tar.gz
 RELEASE_TARGETS = \
 	bin/releases/git-lfs-darwin-amd64-$(VERSION).zip \
+	bin/releases/git-lfs-darwin-arm64-$(VERSION).zip \
 	bin/releases/git-lfs-linux-arm-$(VERSION).tar.gz \
 	bin/releases/git-lfs-linux-arm64-$(VERSION).tar.gz \
 	bin/releases/git-lfs-linux-amd64-$(VERSION).tar.gz \
@@ -399,11 +403,11 @@ release-windows-rebuild: bin/releases/git-lfs-windows-assets-$(VERSION).tar.gz
 #
 # You may sign with a different certificate by specifying DARWIN_CERT_ID.
 .PHONY : release-darwin
-release-darwin: bin/releases/git-lfs-darwin-amd64-$(VERSION).zip
+release-darwin: bin/releases/git-lfs-darwin-amd64-$(VERSION).zip bin/releases/git-lfs-darwin-arm64-$(VERSION).zip
 	for i in $^; do \
 		temp=$$(mktemp -d) && \
 		( \
-			unzip -d "$$temp" $^ && \
+			unzip -d "$$temp" "$$i" && \
 			codesign --keychain $(DARWIN_KEYCHAIN_ID) -s "$(DARWIN_CERT_ID)" --force --timestamp -vvvv --options runtime "$$temp/git-lfs" && \
 			codesign -dvvv "$$temp/git-lfs" && \
 			zip -j $$i "$$temp/git-lfs" && \

config/version.go

@@ -13,7 +13,7 @@ var (
 )
 
 const (
-	Version = "2.13.2"
+	Version = "2.13.3"
 )
 
 func init() {

debian/changelog

@@ -1,3 +1,9 @@
+git-lfs (2.13.3) stable; urgency=low
+
+  * New upstream version
+
+ -- brian m. carlson <[email protected]>  Fri, 26 Mar 2021 14:29:00 -0000
+
 git-lfs (2.13.2) stable; urgency=low
 
   * New upstream version

go.mod

@@ -21,9 +21,10 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v0.0.0-20170210233622-6b67b3fab74d
-	golang.org/x/net v0.0.0-20191027093000-83d349e8ac1a
-	golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4
-	golang.org/x/sys v0.0.0-20200922070232-aee5d888a860
+	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 // indirect
+	golang.org/x/net v0.0.0-20210119194325-5f4716e94777
+	golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9
+	golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4
 	gopkg.in/jcmturner/goidentity.v2 v2.0.0 // indirect
 	gopkg.in/yaml.v2 v2.2.8 // indirect
 )

go.sum

@@ -55,20 +55,30 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90Pveol
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734 h1:p/H982KKEjUnLJkM3tt/LemDnOc1GiZL5FCVlORJ5zo=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20191027093000-83d349e8ac1a h1:Yu34BogBivvmu7SAzHHaB9nZWH5D1C+z3F1jyIaYZSQ=
 golang.org/x/net v0.0.0-20191027093000-83d349e8ac1a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.0.0-20210119194325-5f4716e94777 h1:003p0dJM77cxMSyCPFphvZf/Y5/NXf5fzg6ufd1/Oew=
+golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9 h1:SQFwaSi55rU7vdNs9Yr0Z324VNlrF+0wMqRXT4St8ck=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a h1:1BGLXjeY4akVXGgbC9HugT3Jv3hCI0z56oJR5vAMgBU=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200922070232-aee5d888a860 h1:YEu4SMq7D0cmT7CBbXfcH0NZeuChAXwsHe/9XueUO6o=
-golang.org/x/sys v0.0.0-20200922070232-aee5d888a860/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4 h1:myAQVi0cGEoqQVR5POX+8RR2mrocKqNN1hmeMqhX27k=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/jcmturner/aescts.v1 v1.0.1 h1:cVVZBK2b1zY26haWB4vbBiZrfFQnfbTVrE3xZq6hrEw=

lfs/gitscanner_log.go

@@ -29,6 +29,8 @@ var (
 	// Arguments to append to a git log call which will limit the output to
 	// lfs changes and format the output suitable for parseLogOutput.. method(s)
 	logLfsSearchArgs = []string{
+		"--no-ext-diff",
+		"--no-textconv",
 		"-G", "oid sha256:", // only diffs which include an lfs file SHA change
 		"-p",                             // include diff so we can read the SHA
 		"-U12",                           // Make sure diff context is always big enough to support 10 extension lines to get whole pointer
@@ -81,7 +83,7 @@ func scanStashed(cb GitScannerFoundPointer, s *GitScanner) error {
 	// older Git versions (at least <=2.7) don't report merge parents in
 	// the reflog, we can't extract the parent SHAs from "Merge:" lines
 	// in the log; we can, however, use the "git log -m" option to force
-	// individual diffs of all the merge parents in a second step.
+	// an individual diff with the first merge parent in a second step.
 	logArgs := []string{"-g", "--format=%h", "refs/stash", "--"}
 
 	cmd, err := git.Log(logArgs...)
@@ -93,29 +95,35 @@ func scanStashed(cb GitScannerFoundPointer, s *GitScanner) error {
 
 	var stashMergeShas []string
 	for scanner.Scan() {
-		stashMergeShas = append(stashMergeShas, strings.TrimSpace(scanner.Text()))
+		stashMergeSha := strings.TrimSpace(scanner.Text())
+		stashMergeShas = append(stashMergeShas, fmt.Sprintf("%v^..%v", stashMergeSha, stashMergeSha))
 	}
 	err = cmd.Wait()
 	if err != nil {
 		// Ignore this error, it really only happens when there's no refs/stash
 		return nil
 	}
 
-	// We can use the log parser if we provide the -m option to get
-	// merge diffs shown individually
-	logArgs = []string{"-m"}
+	// We can use the log parser if we provide the -m and --first-parent
+	// options to get the first WIP merge diff shown individually, then
+	// no additional options to get the second index merge diff and
+	// possible third untracked files merge diff in a subsequent step.
+	stashMergeLogArgs := [][]string{{"-m", "--first-parent"}, {}}
 
-	// Add standard search args to find lfs references
-	logArgs = append(logArgs, logLfsSearchArgs...)
+	for _, logArgs := range stashMergeLogArgs {
+		// Add standard search args to find lfs references
+		logArgs = append(logArgs, logLfsSearchArgs...)
 
-	logArgs = append(logArgs, stashMergeShas...)
+		logArgs = append(logArgs, stashMergeShas...)
 
-	cmd, err = git.Log(logArgs...)
-	if err != nil {
-		return err
+		cmd, err = git.Log(logArgs...)
+		if err != nil {
+			return err
+		}
+
+		parseScannerLogOutput(cb, LogDiffAdditions, cmd)
 	}
 
-	parseScannerLogOutput(cb, LogDiffAdditions, cmd)
 	return nil
 }
 

rpm/SPECS/git-lfs.spec

@@ -1,5 +1,5 @@
 Name:           git-lfs
-Version:        2.13.2
+Version:        2.13.3
 Release:        1%{?dist}
 Summary:        Git extension for versioning large files
 

script/upload

@@ -161,8 +161,12 @@ release_files () {
 
   [ -n "$version" ] || return 1
 
-  find "$assets" -name '*.tar.gz' -o -name '*386*.zip' -o \
-    -name '*amd64*.zip' -o -name '*.exe' -o -name 'sha256sums.asc' | \
+  find "$assets" -name '*.tar.gz' -o \
+      -name '*386*.zip' -o \
+      -name '*amd64*.zip' -o \
+      -name '*arm64*.zip' -o \
+      -name '*.exe' -o \
+      -name 'sha256sums.asc' | \
     grep -E "$version|sha256sums.asc" | \
     grep -v "assets" | \
     LC_ALL=C sort