[PATCH 1/3] python3-git: fix CVE_PRODUCT

[PATCH 1/3] python3-git: fix CVE_PRODUCT

[tim.orling]

From: Tim Orling <tim.orling@konsulko.com>

Using the pypi.bbclass default CPE of python:GitPython detects no CVEs.
With CVE_PRODUCT = "gitpython_project:gitpython" we properly detect
9 CVEs, with 4 unpatched.

WARNING: core-image-full-cmdline-1.0-r0 do_sbom_cve_check:
python3-git-3.1.43: Found unpatched CVEs: CVE-2026-42215, CVE-2026-42284,
CVE-2026-44243, CVE-2026-44244

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 meta/recipes-devtools/python/python3-git_3.1.43.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 45c988117b..ccf6def292 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -10,6 +10,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=5279a7ab369ba336989dcf2a107e5c8e"
 
 PYPI_PACKAGE = "GitPython"
 
+CVE_PRODUCT = "gitpython_project:gitpython"
+
 inherit pypi python_setuptools_build_meta
 
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
-- 
2.47.3

[PATCH 2/3] pypi.bbclass: improve UPSTREAM_CHECK_REGEX

[tim.orling]

From: Tim Orling <tim.orling@konsulko.com>

UPSTREAM_CHECK_REGEX was case-sensitive, but PyPI's simple index now lists
lowercase sdist filenames (e.g. gitpython-*.tar.gz) for packages whose
PYPI_PACKAGE is mixed-case (e.g. GitPython).

Added an (?i) inline flag so the regex matches regardless of case — this
fixes AUH detection for python3-git and any other pypi.bbclass recipe hit
by the same upstream lowercase-normalization trend, without needing
per-recipe overrides.

This will not magically fix fetching, but WILL at least mean AUH will
detect more upstream releases and maintainers will see when the
resulting default PYPI_SRC_URI is failing.

A fix for some recipes might be to set:

PYPI_SRC_URI = ""${@pypi_src_uri(d).lower()}"

but it is premature to set that globally, as legacy recipes with
releases before the PEP-625 normalization still exist.

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 meta/classes-recipe/pypi.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes-recipe/pypi.bbclass b/meta/classes-recipe/pypi.bbclass
index bd21557c60..0897994bb6 100644
--- a/meta/classes-recipe/pypi.bbclass
+++ b/meta/classes-recipe/pypi.bbclass
@@ -51,7 +51,7 @@ UPSTREAM_CHECK_PYPI_PACKAGE ?= "${PYPI_PACKAGE}"
 #
 # NOTE: All URLs for the simple API MUST request canonical normalized URLs per the spec
 UPSTREAM_CHECK_URI ?= "https://pypi.org/simple/${@pypi_normalize(d)}/"
-UPSTREAM_CHECK_REGEX ?= "${UPSTREAM_CHECK_PYPI_PACKAGE}-(?P<pver>(\d+[\.\-_]*)+).(tar\.gz|tgz|zip|tar\.bz2)"
+UPSTREAM_CHECK_REGEX ?= "(?i)${UPSTREAM_CHECK_PYPI_PACKAGE}-(?P<pver>(\d+[\.\-_]*)+).(tar\.gz|tgz|zip|tar\.bz2)"
 
 CVE_PRODUCT ?= "python:${PYPI_PACKAGE}"
 
-- 
2.47.3

[PATCH 3/3] python3-gitpython: upgrade 3.1.43 -> 3.1.58

[tim.orling]

From: Tim Orling <tim.orling@konsulko.com>

Upstream tarballs changed from mixed case GitPython-3.1.43.tar.gz to
all lowercase gitpython-3.1.44.gz and the regex in pypi.bbclass was
not catching it.

Similarly, per PEP-625, the PYPI_SRC_URI since 3.1.44 needs to be
lowercase.

It appears the proper fix for fetching is to set
PYPI_PACKAGE = "gitpython".

Multiple security releases, see the change logs:
https://gitpython.readthedocs.io/en/3.1.58/changes.html
https://gitpython.readthedocs.io/en/3.1.57/changes.html
https://gitpython.readthedocs.io/en/3.1.56/changes.html
https://gitpython.readthedocs.io/en/3.1.55/changes.html
https://gitpython.readthedocs.io/en/3.1.54/changes.html
https://gitpython.readthedocs.io/en/3.1.53/changes.html
https://gitpython.readthedocs.io/en/3.1.52/changes.html
https://gitpython.readthedocs.io/en/3.1.51/changes.html

CVE: CVE-2026-42215
CVE: CVE-2026-42284
CVE: CVE-2026-44243
CVE: CVE-2026-44244

To see the details of each release:
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.46
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.45
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.44

For the full comparison changes (1292 commits, 201 files changed), see:
https://github.com/gitpython-developers/GitPython/compare/3.1.43...3.1.58

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 .../python/{python3-git_3.1.43.bb => python3-git_3.1.58.bb}   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-devtools/python/{python3-git_3.1.43.bb => python3-git_3.1.58.bb} (90%)

diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.58.bb
similarity index 90%
rename from meta/recipes-devtools/python/python3-git_3.1.43.bb
rename to meta/recipes-devtools/python/python3-git_3.1.58.bb
index ccf6def292..82c8076a97 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.58.bb
@@ -8,13 +8,13 @@ SECTION = "devel/python"
 LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=5279a7ab369ba336989dcf2a107e5c8e"
 
-PYPI_PACKAGE = "GitPython"
+PYPI_PACKAGE = "gitpython"
 
 CVE_PRODUCT = "gitpython_project:gitpython"
 
 inherit pypi python_setuptools_build_meta
 
-SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
+SRC_URI[sha256sum] = "621416df10ef3fd0e19fabf9172ddeed0fa704d353d04f194eec56a625a95b22"
 
 DEPENDS += " python3-gitdb"
 
-- 
2.47.3