Only package the bits from LFS that we really need

script/build-macos.sh

@@ -36,6 +36,8 @@ GIT_LFS_FILENAME="$(jq --raw-output ".\"git-lfs\".files[] | select(.arch == \"$D
 
 # shellcheck source=script/compute-checksum.sh
 source "$CURRENT_DIR/compute-checksum.sh"
+# shellcheck source=script/verify-lfs-contents.sh
+source "$CURRENT_DIR/verify-lfs-contents.sh"
 
 echo "-- Building git at $SOURCE to $DESTINATION"
 
@@ -84,6 +86,9 @@ if [[ "$GIT_LFS_VERSION" ]]; then
   if [ "$COMPUTED_SHA256" = "$GIT_LFS_CHECKSUM" ]; then
     echo "Git LFS: checksums match"
     SUBFOLDER="$DESTINATION/libexec/git-core"
+
+    verify_lfs_contents "$GIT_LFS_FILE"
+
     unzip -j $GIT_LFS_FILE -d "$SUBFOLDER" "*/git-lfs"
 
     if [[ ! -f "$SUBFOLDER/git-lfs" ]]; then

script/build-ubuntu.sh

@@ -63,6 +63,8 @@ GCM_URL="$(jq --raw-output ".\"git-credential-manager\".files[] | select(.arch =
 source "$CURRENT_DIR/compute-checksum.sh"
 # shellcheck source=script/check-static-linking.sh
 source "$CURRENT_DIR/check-static-linking.sh"
+# shellcheck source=script/verify-lfs-contents.sh
+source "$CURRENT_DIR/verify-lfs-contents.sh"
 
 echo " -- Building vanilla curl at $CURL_INSTALL_DIR instead of distro-specific version"
 
@@ -108,7 +110,10 @@ if [[ "$GIT_LFS_VERSION" ]]; then
   if [ "$COMPUTED_SHA256" = "$GIT_LFS_CHECKSUM" ]; then
     echo "Git LFS: checksums match"
     SUBFOLDER="$DESTINATION/libexec/git-core"
-    tar -xvf $GIT_LFS_FILE -C "$SUBFOLDER" --strip-components=1 --exclude='*.sh' --exclude="*.md"
+
+    verify_lfs_contents "$GIT_LFS_FILE"
+
+    tar -zxvf "$GIT_LFS_FILE" --strip-components=1 -C "$SUBFOLDER" --wildcards "*/git-lfs"
 
     if [[ ! -f "$SUBFOLDER/git-lfs" ]]; then
       echo "After extracting Git LFS the file was not found under libexec/git-core/"

script/build-win32.sh

@@ -27,6 +27,8 @@ GIT_FOR_WINDOWS_CHECKSUM=$(jq --raw-output ".git.packages[] | select(.arch == \"
 CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 # shellcheck source=script/compute-checksum.sh
 source "$CURRENT_DIR/compute-checksum.sh"
+# shellcheck source=script/verify-lfs-contents.sh
+source "$CURRENT_DIR/verify-lfs-contents.sh"
 
 mkdir -p "$DESTINATION"
 
@@ -55,7 +57,10 @@ if [[ "$GIT_LFS_VERSION" ]]; then
   if [ "$COMPUTED_SHA256" = "$GIT_LFS_CHECKSUM" ]; then
     echo "Git LFS: checksums match"
     SUBFOLDER="$DESTINATION/$MINGW_DIR/libexec/git-core"
-    unzip -j $GIT_LFS_FILE -x '*.md' -d "$SUBFOLDER"
+
+    verify_lfs_contents "$GIT_LFS_FILE"
+
+    unzip -j $GIT_LFS_FILE -d "$SUBFOLDER" "*/git-lfs.exe"
 
     if [[ ! -f "$SUBFOLDER/git-lfs.exe" ]]; then
       echo "After extracting Git LFS the file was not found under /mingw64/libexec/git-core/"

script/verify-lfs-contents.sh

@@ -0,0 +1,32 @@
+#!/bin/bash -e
+
+verify_lfs_contents() {
+
+  CONTENTS=""
+
+  if [[ "$1" == *.zip ]]; then
+    CONTENTS=$(unzip -qql "$1")
+  elif [[ "$1" == *.tar.gz ]]; then
+    CONTENTS=$(tar -tzf "$1")
+  else
+    echo "Unknown file type for $1"
+    exit 1
+  fi
+
+  test -z "$CONTENTS" && {
+    echo "Git LFS: found no contents in LFS archive, aborting..."
+    exit 1
+  }
+
+  TOPLEVEL=$(echo "$CONTENTS" | cut -d/ -f2 | sort | uniq | grep .)
+
+  # Sanity check to make sure we react if git-lfs starts adding more stuff to
+  # their release packages. Note that this only looks that the top
+  # (technically second) level folder so new stuff in the man folder won't
+  # get caught here.
+  # shellcheck disable=SC2015
+  grep -qvE "^(CHANGELOG\.md|README\.md|git-lfs(\.exe)?|install\.sh|man)$" <<< "$TOPLEVEL" && {
+    echo "Git LFS: unexpected files in the LFS archive, aborting..."
+    exit 1
+  } || true
+}