$ git clone -n https://src.fedoraproject.org/rpms/git-lfs.git /var/lib/mock/f42-build-side-1-3586033-46913/root/chroot_tmpdir/scmroot/git-lfs
Cloning into '/var/lib/mock/f42-build-side-1-3586033-46913/root/chroot_tmpdir/scmroot/git-lfs'...
$ git fetch origin 346574b0c83e6839866701f218d308623c92f088:KOJI_FETCH_HEAD
From https://src.fedoraproject.org/rpms/git-lfs
 * [new ref]         346574b0c83e6839866701f218d308623c92f088 -> KOJI_FETCH_HEAD
$ git reset --hard KOJI_FETCH_HEAD
HEAD is now at 346574b Fixed signature spoofing vulnerability.