https://github.com/git-lfs/git-lfs/blob/v3.8.0/CHANGELOG.md

Switch the source from a `bee download` snapshot of the git repository to
the upstream `git-lfs-vendor` release tarball: it is the release tarball
plus `vendor/`, so `go build` needs no module downloads. Accordingly
GOFLAGS uses `-mod=vendor` instead of `-mod=readonly`.

The vendored modules are sources, not prebuilt objects: 783 *.go files, 41
*.s files and one *.c file, and no *.a, *.o, *.so or *.syso anywhere. Only
two files are not detected as text, and neither is code:
vendor/golang.org/x/net/publicsuffix/data/{nodes,children} (55 KB), the
lookup tables of Mozilla's Public Suffix List that table.go pulls in with
go:embed, and vendor/github.com/klauspost/compress/s2sx.sum, which is
empty. Removing vendor/ and running `go mod vendor` re-downloads every
module, verifies it against go.sum and reproduces the directory bit for
bit.

Still binary only, no man pages: generating them needs asciidoctor.

Built with go 1.25.3, `git-lfs version` reports
git-lfs/3.8.0 (GitHub; linux amd64; go 1.25.3).

Assisted-by: claude-opus-5

go(1) wants the module directory as its working directory, so pass it with
`go build -C ${S}` instead of relying on the working directory. bee's
`make` buildtype magic sets `build_in_sourcedir` on its own as soon as a
`Makefile` exists, so `${B}` is a symlink to `${S}` either way, but the
recipe no longer depends on that.

Assisted-by: claude-opus-5

bee's build archive is supposed to hold everything belonging to a build,
and it is created by tarring up ${S} and ${B}. go(1) however writes
neither into ${B}: its build artifacts go into the build cache, which
defaults to ~/.cache/go-build, and the linked binary went straight into
the image directory ${D}.

So point GOCACHE below ${B} and build the binary into ${B}, from where
mee_install() copies it into ${D}. The build archive grows from 6.3 MB to
49 MB, holding 2416 build cache entries and the binary in addition to the
sources, and the build cache is no longer shared between builds, so every
build compiles all packages again (21 s for git-lfs here).

Note that bee's `make` buildtype magic sets build_in_sourcedir() as soon
as a Makefile exists, so ${B} is a symlink to ${S} and both end up in
${S} in practice. That is of no consequence for the package, as only ${D}
is packaged.

Assisted-by: claude-opus-5