[OE-core][wrynose][v2 PATCH 15/27] python3-git: fix CVE-2026-76220

[Yogita Urade <yurade@cisco.com>]

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541
[2] https://security-tracker.debian.org/tracker/CVE-2026-76220

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Changes in v2:
- Changed the advisory reference from NVD to Debian Security Tracker.
  Removed the stale cherry-pick and Signed-off-by trailers and refreshed
  the embedded hunk context.
---
 .../python/python3-git/CVE-2026-76220.patch   | 65 +++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |  1 +
 2 files changed, 66 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch
new file mode 100644
index 0000000000..1a42e7cf04
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76220.patch
@@ -0,0 +1,65 @@
+From 8f29b889df8dff1c1227dafabac0f49306d45838 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Sun, 2 Aug 2026 08:59:57 +0000
+Subject: [PATCH] Check joined short-option values before Git execution
+
+<!-- agent -->
+GHSA-wvpp-8hx9-p66j reports that unsafe-option checks omitted the value
+joined to a one-character option when split_single_char_options was false. A
+regression test reproduced the mismatch: GitPython checked only -n even though
+it emitted a joined -nVALUE token that Git parses as clustered short options.
+
+Collect the exact joined token for unsplit one-character keyword arguments so
+the existing clustered-short-option validation sees every option character.
+The split form and long-option behavior remain unchanged.
+
+A broader audit confirmed that all guarded keyword-forwarding APIs use
+_option_candidates, including clone, ls-remote, fetch, pull, push, archive,
+revision, diff, checkout-index, and tag paths. Git cf5497b14 confirms repeated
+short-option parsing within a joined token. Focused candidate and unsafe-option
+tests pass.
+
+CVE: CVE-2026-76220
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541]
+
+Backport Changes:
+- Omitted test/test_git.py because the current PyPI source archive
+  does not include the test suite and the python3-git recipe does
+  not run it.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 96a888f4d782cb2f80452148e48e60ce4af6d541)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 2ce27290..de68fa34 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -809,13 +809,21 @@ Git._option_candidates
+                 values = value if isinstance(value, (list, tuple)) else (value,)
+                 if any(value is True or (value is not False and value is not None) for value in values):
+                     key = str(key)
+-                    options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")
+-                    if len(key) == 1 and split_single_char_options:
++                    if len(key) != 1:
++                        options.append(f"--{dashify(key)}")
++                    elif split_single_char_options:
++                        options.append(f"-{key}")
+                         options.extend(
+                             str(value)
+                             for value in values
+                             if value is not True and value not in (False, None) and str(value).startswith("-")
+                         )
++                    else:
++                        options.extend(
++                            f"-{key}" if value is True else f"-{key}{value}"
++                            for value in values
++                            if value is True or (value is not False and value is not None)
++                        )
+         return options
+ 
+     class AutoInterrupt:
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 42d251a2df..4a3d516244 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -37,6 +37,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-73619_p1.patch \
            file://CVE-2026-73619_p2.patch \
            file://CVE-2026-76221.patch \
+           file://CVE-2026-76220.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.53.0