$ git clone -n https://src.fedoraproject.org/rpms/upx.git /var/lib/mock/f31-build-89248-32069/root/chroot_tmpdir/scmroot/upx
Cloning into '/var/lib/mock/f31-build-89248-32069/root/chroot_tmpdir/scmroot/upx'...
$ git reset --hard bde670f9c8f1674af919e459d72bf1f89dabe91d
HEAD is now at bde670f Upstream patches for CVE-2019-14295 and CVE-2019-14296.