epicmorg/git repository overview

⁠epicmorg/git

Every git release branch from 1.8 to the latest, each at its newest patch release, built from the kernel.org source tarballs (sha256-checked) on Debian 13 trixie. The point of the image is to be a source for COPY --from: an application image picks exactly the git it needs instead of whatever the distro or a PPA ships today. The newest branch is also tagged latest, and that is the git of the Debian base images (epicmorg/debian:trixie and children).

⁠What's inside

• git in /usr/local/share/epicmorg/git/<major.minor> (bin/, libexec/git-core/, share/), on PATH;
• man pages (share/man) and /emg-export - git + its libraries as a self-contained tree for COPY --from;
• git-lfs = the base image's (epicmorg/git-lfs:latest⁠), not part of /emg-export;
• only the baked libraries git links, under /usr/local/share/epicmorg/: curl 8.21 + OpenSSL 3.5 (LTS), zlib, zstd, pcre2 - linked with a real RPATH, nothing in ld.so.conf;
• system libs from Debian: libexpat1 (http push), perl (send-email, svn, ... scripts).

Built with the system compiler (gcc 14) from epicmorg/gcc:14. Fatal build-time checks: exact git --version, no unresolved libraries in any git binary, no RUNPATH, one libssl/libcurl/libz across all binaries, git-remote-https on the baked curl and OpenSSL, and an init + commit smoke test.

Environment: EMG_GIT_VERSION (branch), EMG_GIT_FULL_VERSION, EMG_GIT_DIR. System config is /etc/gitconfig (built with sysconfdir=/etc, like Debian's git). They are deliberately not named GIT_* - git itself reads GIT_DIR, GIT_PREFIX, ... from the environment.

⁠Tags

Every tag is pushed to docker.io, quay.io and ghcr.io (epicmorg/git:<tag> on each) - same digest everywhere.

⁠Usage

Copy one git into your image (/emg-export = git + exactly the libraries it links; libexpat1 and perl are already in the epicmorg Debian bases):

FROM ghcr.io/epicmorg/debian:trixie
COPY --from=ghcr.io/epicmorg/git:2.47 /emg-export/ /
ENV PATH="/usr/local/share/epicmorg/git/2.47/bin:${PATH}"
RUN git --version

Or just run it:

docker run --rm -v "$PWD:/work" -w /work docker.io/epicmorg/git:2.56 git log --oneline -5

⁠Notes

• Old branches build from the original tarballs with two build-only adjustments: below 2.34 a broken curl "compat" define in http.h is disabled (modern curl has CURLOPT_USE_SSL as an enum), and the oldest trees (HMAC_CTX on the stack in imap-send) are built NO_OPENSSL - only git imap-send loses its own TLS; https still goes through the baked curl + OpenSSL 3.5.
• Old git versions carry their old bugs and security issues - use them only where a consumer needs that exact version (e.g. a tool version range), and prefer the newest branch otherwise.
• New branches and patch bumps: bin/python/git-versions-sync.py (reads kernel.org sha256sums.asc).

⁠Links

• Source: EpicMorg/docker⁠ - issues and PRs welcome
• Tags float and are rebuilt weekly; pin by digest for reproducible builds: Tags, pinning and updates⁠
• CHANGELOG⁠ - License: MIT