Git 2.53.0 and Git LFS 3.7.1 as distributed in Tellop: source code
===================================================================

Tellop, published by Pathnomic Labs FZ-LLC, carries a copy of Git 2.53.0
for macOS on Apple silicon, with Git LFS 3.7.1 inside it. Git is free
software under the GNU General Public License, version 2 (the file
COPYING inside Git's source). This archive is the complete corresponding
source for that copy of Git, offered under section 3(a) of the licence:
Git's own source, the build scripts that compiled it, and these
instructions. It also holds Git LFS's source, and the source of the two
parts of Git LFS whose licence asks for it, both under the Mozilla
Public License 2.0: go-uuid, and the Public Suffix List (section 2 says
why). Pathnomic Labs made no changes to any of this source code.

The archive covers the copy for Macs with Apple silicon, the only one
Tellop carries today. A copy for Intel Macs would be built with the x64
values in dugite-native's script (HOST_CPU=x86_64 and
-target x86_64-apple-darwin) and would carry Git LFS's darwin-amd64
release; this archive does not cover such a copy.


1. What is in this archive
--------------------------

  README.txt
      This file.

  SHA256SUMS
      The SHA-256 of every other file here. Check them with:
          shasum -a 256 -c SHA256SUMS

  upstream/git-2.53.0.tar.xz
      Git 2.53.0 exactly as Git's maintainers released it.
      From:    https://www.kernel.org/pub/software/scm/git/git-2.53.0.tar.xz
      SHA-256: 5818bd7d80b061bbbdfec8a433d609dc8818a05991f731ffc4a561e2ca18c653
      kernel.org publishes the same digest in its signed list,
      https://www.kernel.org/pub/software/scm/git/sha256sums.asc

  upstream/dugite-native-2.53.0-3.tar.gz
      dugite-native release v2.53.0-3: the scripts that built the Git
      copy Tellop carries (GitHub's own build of Git, used by GitHub
      Desktop). Also under GPL version 2 (its LICENSE.md).
      From:    https://github.com/desktop/dugite-native/archive/refs/tags/v2.53.0-3.tar.gz
      SHA-256: fabc3e1b3c055e80b7b46ce97dc418ffae29ffda0116e49fc86592d68c1fa551
      Commit:  f49d0098409aa243de8b9162127025ab0bb07a88 (the f49d009 in
               the name of the built release,
               dugite-native-v2.53.0-f49d009-macOS-arm64.tar.gz)

  upstream/git-lfs-3.7.1.tar.gz
      Git LFS release v3.7.1's source, as GitHub serves its tag.
      From:    https://github.com/git-lfs/git-lfs/archive/refs/tags/v3.7.1.tar.gz
      SHA-256: 0e83566a9e2477e03627e7fd6bf81f01fadbf93dcaf6abd2686fca90f6bac7dd
      Commit:  b84b33847fe6458f36ef521534dc0eac953cb379 (the b84b3384
               that Tellop's copy reports in "git-lfs version")

  upstream/go-uuid-v1.0.2.zip
      The Go module github.com/hashicorp/go-uuid v1.0.2, as the Go
      module mirror serves it (section 2 says why it is here).
      From:    https://proxy.golang.org/github.com/hashicorp/go-uuid/@v/v1.0.2.zip
      SHA-256: 30e419ebb4658e789be8ef1f5629faccc15d6571c6914a51afdcbaf74a5862b8

  upstream/public_suffix_list-2c960dac.dat
      The Public Suffix List (publicsuffix.org): its file
      public_suffix_list.dat at commit
      2c960dac3d39ba521eb5db9da192968f5be0aded of its repository,
      github.com/publicsuffix/list, as GitHub serves it (section 2 says
      why it is here).
      From:    https://raw.githubusercontent.com/publicsuffix/list/2c960dac3d39ba521eb5db9da192968f5be0aded/public_suffix_list.dat
      SHA-256: 67567d9849ba4ff4f3ca65fb54e978ae310f8f9228c2d5c5ef23a2dabcbc7feb

All five upstream files are the bytes their publishers serve, unchanged,
so anyone can compare them with the originals.


2. Where each part of Tellop's Git copy comes from
---------------------------------------------------

  bin/git, bin/scalar, libexec/git-core/ (the git-* programs and
  scripts, and mergetools/), share/git-core/templates/ and
  share/bash-completion/completions/git
      Built and installed from git-2.53.0.tar.xz by dugite-native's
      script/build-macos.sh, as section 3 shows. Scalar, the merge-tool
      scripts and the shell completion are part of Git's own source.

  etc/gitconfig
      dugite-native's resources/posix.gitconfig, copied unchanged.

  libexec/git-core/git-lfs
      Git LFS 3.7.1, a separate program, not under the GPL.
      dugite-native adds Git LFS's own prebuilt release,
      git-lfs-darwin-arm64-v3.7.1.zip, SHA-256
      76260fb34f4ee622ff0a66b857e5954aa49c7e343a92e57a1ec4a760618c94b2
      (pinned in dugite-native's dependencies.json). Git LFS's own code
      is under the MIT licence, with the BSD-3-Clause licence for the
      parts it copied from Go (its LICENSE.md). The program also holds
      the Go standard library and runtime of go1.25.1 (BSD-3-Clause)
      and these 27 Go modules, each under its own licence. The list is
      the program's own build record, which "go version -m" prints:

      MIT           github.com/dpotapov/go-spnego@v0.0.0-20210315154721-298b63a54430
      MIT           github.com/git-lfs/gitobj/v2@v2.1.1
      MIT           github.com/git-lfs/go-netrc@v0.0.0-20250218165306-ba0029b43d11
      MIT           github.com/git-lfs/pktline@v0.0.0-20210330133718-06e9096e2825
      MIT           github.com/git-lfs/wildmatch/v2@v2.0.1
      Apache-2.0    github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8
      MPL-2.0       github.com/hashicorp/go-uuid@v1.0.2
      Apache-2.0    github.com/jcmturner/aescts/v2@v2.0.0
      Apache-2.0    github.com/jcmturner/dnsutils/v2@v2.0.0
      BSD-3-Clause  github.com/jcmturner/gofork@v1.0.0
      Apache-2.0    github.com/jcmturner/goidentity/v6@v6.0.1
      Apache-2.0    github.com/jcmturner/gokrb5/v8@v8.4.2
      Apache-2.0    github.com/jcmturner/rpc/v2@v2.0.3
      MIT           github.com/jmhodges/clock@v1.2.0
      MIT           github.com/leonelquinteros/gotext@v1.5.0
      MIT           github.com/mattn/go-isatty@v0.0.4
      MIT           github.com/olekukonko/ts@v0.0.0-20171002115256-78ecb04241c0
      BSD-2-Clause  github.com/pkg/errors@v0.0.0-20170505043639-c605e284fe17
      MIT           github.com/rubyist/tracerx@v0.0.0-20170927163412-787959303086
      Apache-2.0    github.com/spf13/cobra@v1.7.0
      BSD-3-Clause  github.com/spf13/pflag@v1.0.5
      MIT           github.com/ssgelm/cookiejarparser@v1.0.1
      BSD-3-Clause  golang.org/x/crypto@v0.36.0
      BSD-3-Clause  golang.org/x/net@v0.38.0
      BSD-3-Clause  golang.org/x/sync@v0.12.0
      BSD-3-Clause  golang.org/x/sys@v0.31.0
      BSD-3-Clause  golang.org/x/text@v0.23.0

Which of these licences require source: only the Mozilla Public License
2.0 (MPL-2.0), which covers go-uuid and the Public Suffix List data that
golang.org/x/net carries (below). Its section 3.2(a) asks whoever
distributes a program built with MPL-covered files to make those files'
source available and to say how to get it. So go-uuid's source is in
this archive (upstream/go-uuid-v1.0.2.zip), and Go's checksum over that
file's contents is the one in git-lfs's build record,
h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
so it is exactly the source Go compiled into the program. The MIT, BSD
and Apache-2.0 licences ask for their notices to travel with the
program, which Tellop's notices do, and not for source. No module is
under another licence that asks for source (the LGPL, EPL, CDDL or GPL).

The Public Suffix List. One module carries data under a licence of its
own: golang.org/x/net, under BSD-3-Clause, has a package,
golang.org/x/net/publicsuffix, that holds a compressed copy of the
Public Suffix List, which is under the MPL-2.0. Git LFS uses it, through
github.com/ssgelm/cookiejarparser, when it reads a cookie file. The copy
is not the list's file itself: x/net's generator (publicsuffix/gen.go,
part of the x/net module listed above) read the list's file
public_suffix_list.dat at commit 2c960dac3d39ba521eb5db9da192968f5be0aded
of its repository and wrote it out as three tables (the files text,
nodes and children in publicsuffix/data/) that the package embeds. The
package's table.go and Tellop's copy of git-lfs both name that revision:
    publicsuffix.org's public_suffix_list.dat, git revision 2c960dac3d39ba521eb5db9da192968f5be0aded (2025-03-18T07:22:13Z)
That file is the source the tables were generated from, and it is in
this archive (upstream/public_suffix_list-2c960dac.dat). Its 9,747
rules (6,871 in its ICANN section) are, in order, the rules x/net
v0.38.0 lists in its own test of the tables (publicsuffix/table_test.go).
x/net's own source, generator included, is the Go module
golang.org/x/net v0.38.0, which the Go module mirror serves at
https://proxy.golang.org/golang.org/x/net/@v/v0.38.0.zip (its Go
checksum is the one in the build record).

Git LFS's own source (upstream/git-lfs-3.7.1.tar.gz) is here too,
though its licence does not require it: it is what the program was
built from, and its go.sum names every module above at the same Go
checksum. Its README.md says how to build it (with Go and GNU make);
Tellop carries Git LFS's prebuilt program, not a build of its own.

Every program in the copy, Git LFS included, links only libraries that
are part of macOS itself: libSystem, libz, libiconv, libcurl, libexpat,
libresolv and the CoreFoundation, CoreServices and Security frameworks.
No other library is built into them (check with otool -L).


3. Building it
--------------

You need a Mac with Apple silicon and Apple's command line developer
tools (xcode-select --install), which provide clang, GNU make and
/usr/bin/curl-config. For the steps below nothing else is needed, and
no network: Git's optional Rust parts are off by default and this build
does not turn them on.

From the folder this archive unpacked into:

    shasum -a 256 -c SHA256SUMS
    mkdir build
    tar -xJf upstream/git-2.53.0.tar.xz -C build
    tar -xzf upstream/dugite-native-2.53.0-3.tar.gz -C build
    cd build/git-2.53.0
    make clean
    DESTDIR="$PWD/../out" make strip install prefix=/ \
      DEVELOPER_CFLAGS="-target arm64-apple-darwin -Werror=unsupported-availability-guard" \
      HOST_CPU=arm64 \
      CURL_CONFIG=/usr/bin/curl-config \
      NO_PERL=1 \
      NO_TCLTK=1 \
      NO_GETTEXT=1 \
      NO_DARWIN_PORTS=1 \
      NO_HOMEBREW=1 \
      NO_INSTALL_HARDLINKS=1 \
      MACOSX_DEPLOYMENT_TARGET=10.15
    ../out/bin/git --version

The last line prints "git version 2.53.0". The make line is the one in
dugite-native's script/build-macos.sh (in build/dugite-native-2.53.0-3/)
with that script's Apple-silicon values filled in. Run it as written:
adding -j to it lets "strip" and "install" race, and the installed
programs then keep the symbols strip removes.

dugite-native then finishes the copy (the rest of build-macos.sh):

    cd ../out
    rm bin/git-cvsserver bin/git-receive-pack bin/git-upload-archive \
       bin/git-upload-pack bin/git-shell
    rm libexec/git-core/git-svn libexec/git-core/git-p4
    mkdir etc
    cp ../dugite-native-2.53.0-3/resources/posix.gitconfig etc/gitconfig

and adds Git LFS's prebuilt program to libexec/git-core/ (section 2).
Instead of the make line and these steps, dugite-native's own script
does all of it in one go, downloading Git LFS itself. After the three
tar commands above, from the folder this archive unpacked into:

    cd build/dugite-native-2.53.0-3
    TARGET_ARCH=arm64 SOURCE="$PWD/../git-2.53.0" \
      DESTINATION="$PWD/../out" bash script/build-macos.sh

That route also needs jq (recent versions of macOS include it, at
/usr/bin/jq) and the network: the script downloads Git LFS's prebuilt
program and Git Credential Manager, which Tellop removes (section 4).


4. What Tellop does after the build
-----------------------------------

None of these change Git's source code or how it is compiled.

  - Git Credential Manager 2.7.3 and the .NET runtime that comes with
    it, which dugite-native adds, are removed. Tellop never uses them
    and does not distribute them.
  - Each symbolic link in the copy (the git-* programs that are links
    to git, and the links to git-remote-http) is replaced by a hard
    link to the same file, so every name holds the same bytes.
  - Each program is signed with Pathnomic Labs' Apple Developer ID when
    the Tellop app is built. Signing adds a signature to the file and
    changes none of its code.


5. How a rebuild compares with the copy Tellop carries
------------------------------------------------------

dugite-native built the release on GitHub's macos-15 machines with
Xcode 16.4 (the programs record its macOS SDK 15.5 and its linker
1167.5, and a minimum of macOS 11.0), from Git's repository at commit
67ad42147a7acc2af6074753ebd03d904476118f. Tellop's copy names that
commit and reports its version as exactly "2.53.0", which a build from
a repository reports only at a release tag with no local changes. A
rebuild from this archive differs from it in two ways and matches it in
the rest:

  - "git version --build-options" on Tellop's copy says "built from
    commit: 67ad42147a7acc2af6074753ebd03d904476118f"; a build from
    this archive's release tarball says "no commit associated with this
    build". Every other line is the same (arm64, libcurl, zlib, SHA1_DC,
    SHA256_BLK, rust: disabled, fsmonitor--daemon).
  - The programs' machine code differs with the Xcode version that
    compiles them. To come closest, build with Xcode 16.4.
  - Every file that is not a program (the scripts, merge tools,
    completion, templates and etc/gitconfig: 61 files) is byte-for-byte
    the same.

The programs say macOS 11.0 although the make line asks for 10.15: no
Mac with Apple silicon runs a macOS older than 11, so Apple's linker
raises the minimum of every Apple-silicon program to 11.0. A rebuild
from this archive records 11.0 too.


6. Questions
------------

support@pathnomic.com, or Pathnomic Labs FZ-LLC, Compass Building -
Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, 16111,
United Arab Emirates.
