Module git_lfs 

Git-LFS pointer recognition, shared by the scanner (oid suppression) and sources (unscanned-blob coverage gap). Git-LFS pointer recognition.

A file tracked by Git LFS is committed not as its real bytes but as a tiny text pointer, the actual blob lives in LFS storage and is only materialised on git lfs pull. A canonical pointer is:

version https://git-lfs.github.com/spec/v1
oid sha256:<64 lowercase hex>
size <decimal bytes>

The spec fixes the version line first and then lists the remaining keys in alphabetical order, so oid always precedes size; optional ext-* lines may appear between version and oid.

Two consumers share this recognition, which is why it lives in core:

• the scanner suppresses the pointer’s 64-hex oid (it is a content hash, not a leaked secret, yet matches a generic high-entropy hex shape), and
• a source records a coverage gap, the pointer’s real blob (size bytes) was NOT scanned, so a repo of unmaterialised LFS pointers is not reported as a false-clean.

Recognition is deliberately strict (all three well-formed lines, in order): a false positive would suppress a real credential, and a whole-file pointer is unambiguous, so strictness costs no recall.

Constants

GIT_LFS_VERSION_LINE

The exact first line of every Git-LFS pointer. Compared case-insensitively because the recognition is content-classification, not byte-exact parsing.

SHA256_HEX_LEN

The number of hex characters in a sha256 object id.

Functions

is_git_lfs_oid_line

True if line is a Git-LFS oid sha256:<64 hex> line. The 64-hex body is what the scanner must NOT flag as a secret.

is_git_lfs_pointer

True if content is a whole Git-LFS pointer file: a version line, then an oid line, then a size line, in that spec-mandated order. Lines that are none of the three (e.g. optional ext-* lines, or blank lines) are tolerated between the anchors, matching real pointers.

is_git_lfs_size_line

True if line is a Git-LFS size <decimal> line.

is_git_lfs_version_line

True if line (ignoring surrounding ASCII whitespace) is the Git-LFS version line.