Inconsistent git config parsing
Describe the bug
Due to maps being unordered in golang, git sometimes can choose wrong config as the so called "best candidate". (here)
Git docs explicitly lists in which order configs should be loaded:
The files are read in the order given above, with last value found taking precedence over values read earlier. When multiple values are taken then all values of a key from all files will be used.
To Reproduce
Setup the repo:
$ git init $HOME/test_repo
$ cd $HOME/test_repo
$ git remote add origin https://example.com/repo
$ openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=localhost"
$ openssl req -x509 -newkey rsa:2048 -keyout key2.pem -out cert2.pem -days 365 -nodes -subj "/CN=localhost"
$ echo '*.lfs filter=lfs diff=lfs merge=lfs -text' > .gitattributes
$ cat <<EOF > lfsfile.lfs
version https://git-lfs.github.com/spec/v1
oid sha256:96407fa5898f91a2770dfef30241c16c49e385c09cd4565e159cb37f66ac841b
size 12
EOF
$ git add .
$ git commit -m "initial"Setup the configs (make sure to replace ${HOME} with the actual value).
Append this to your /etc/gitconfig:
[http "https://example.com"]
proxy =
sslcert = ${HOME}/test_repo/cert2.pemAppend this to your ~/.gitconfig:
[http "https://example.com/"]
sslCert = ${HOME}/test_repo/cert.pem
sslKey = ${HOME}/test_repo/key.pemNow inside the repo run this
GIT_CURL_VERBOSE=1 git lfs fetch
couple of times and observe how it can behave in 2 different ways at random due to sometimes cert2.pem being chosen and sometimes cert.pem being chosen. It depends on which entry appears first in this iteration of the loop over an unordered map.
It will either start to download the file after loading key and cert correctly, or fail with:
api error: Error reading client cert/key: tls: private key does not match public key if it loads cert2.pem and key.pem.
Expected behavior
The sslCert option from ~/.gitconfig should always take precedence and be chose in a stable way.
System environment
$ cat /etc/os-release
NAME="CentOS Stream"
VERSION="9"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="9"
PLATFORM_ID="platform:el9"
PRETTY_NAME="CentOS Stream 9"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:centos:centos:9"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://issues.redhat.com/"
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_SUPPORT_PRODUCT_VERSION="CentOS Stream"Output of git lfs env
git-lfs/3.6.1 (GitHub; linux amd64; go 1.24.4 (Red Hat 1.24.4-3.el9) X:strictfipsruntime)
git version 2.47.3
Endpoint=https://example.com/repo.git/info/lfs (auth=none)
LocalWorkingDir=/home/mzr/test_repo
LocalGitDir=/home/mzr/test_repo/.git
LocalGitStorageDir=/home/mzr/test_repo/.git
LocalMediaDir=/home/mzr/test_repo/.git/lfs/objects
LocalReferenceDirs=
TempDir=/home/mzr/test_repo/.git/lfs/tmp
ConcurrentTransfers=8
TusTransfers=false
BasicTransfersOnly=false
SkipDownloadErrors=false
FetchRecentAlways=false
FetchRecentRefsDays=7
FetchRecentCommitsDays=0
FetchRecentRefsIncludeRemotes=true
PruneOffsetDays=3
PruneVerifyRemoteAlways=false
PruneVerifyUnreachableAlways=false
PruneRemoteName=origin
LfsStorageDir=/home/mzr/test_repo/.git/lfs
AccessDownload=none
AccessUpload=none
DownloadTransfers=basic,lfs-standalone-file,ssh
UploadTransfers=basic,lfs-standalone-file,ssh
GIT_CEILING_DIRECTORIES=/home
GIT_EXEC_PATH=/usr/libexec/git-core
GIT_TRACE2=/tmp/.tmpGVGBtl
GIT_TRACE2_BRIEF=1
GIT_TRACE2_PARENT_NAME=_run_dashed_
GIT_TRACE2_PARENT_SID=20250912T155313.198307Z-Hb2d21a63-P003eed46
git config filter.lfs.process = "git-lfs filter-process"
git config filter.lfs.smudge = "git-lfs smudge -- %f"
git config filter.lfs.clean = "git-lfs clean -- %f"Source: git-lfs/git-lfs