[OE-core][wrynose][v2 PATCH 16/27] python3-git: fix CVE-2026-76219

[Yogita Urade <yurade@cisco.com>]

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32
[2] https://security-tracker.debian.org/tracker/CVE-2026-76219

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Changes in v2:
- Changed the advisory reference from NVD to Debian Security Tracker.
  Removed the stale cherry-pick and Signed-off-by trailers and refreshed
  the embedded hunk context.
---
 .../python/python3-git/CVE-2026-76219.patch   | 153 ++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |   1 +
 2 files changed, 154 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch
new file mode 100644
index 0000000000..719e80b4e0
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch
@@ -0,0 +1,153 @@
+From dbf247f0779367b555b55d54941ead00e999eee6 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Sun, 2 Aug 2026 09:06:40 +0000
+Subject: [PATCH] Guard read-tree index output paths
+
+<!-- agent -->
+GHSA-4gmw-gg2m-w46p reports that caller-controlled treeish arguments could
+be parsed by git read-tree as --index-output and select an arbitrary output
+path. A regression test showed that from_tree reached Git instead of raising
+UnsafeOptionError; the same unchecked path was reachable through reset and
+both merge_tree treeish positions.
+
+Add the project-standard unsafe-option guard and explicit opt-out to
+from_tree, merge_tree, and reset. Check positional and keyword candidates so
+abbreviations and alternate forwarding forms are covered before read-tree
+runs.
+
+A broader audit found only two read-tree sinks in the codebase; both are now
+guarded, and reset delegates to the guarded from_tree path. The only remaining
+index-output use is GitPython's controlled temporary index. Git cf5497b14
+confirms read-tree parses this path-taking option before tree arguments.
+Focused index tests and Ruff checks pass.
+
+CVE: CVE-2026-76219
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32]
+
+Backport Changes:
+- Omitted test/test_index.py because the current PyPI source archive
+  does not include the test suite and the python3-git recipe does not
+  run it.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 9b5dcaf85da5946dbf69dcd53f9edba08f760b32)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/index/base.py | 40 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 37 insertions(+), 3 deletions(-)
+
+diff --git a/git/index/base.py b/git/index/base.py
+index e10bfd68..fb1acb1a 100644
+--- a/git/index/base.py
++++ b/git/index/base.py
+@@ -130,6 +130,7 @@ class IndexFile:
+     index directly before operating on it using the git command.
+     """
+     unsafe_git_checkout_index_options = ["--prefix"]
++    unsafe_git_read_tree_options = ["--index-output"]
+ 
+ 
+     __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path")
+@@ -256,7 +257,12 @@ def merge_tree
+ 
+     @post_clear_cache
+     @default_index
+-    def merge_tree(self, rhs: Treeish, base: Union[None, Treeish] = None) -> "IndexFile":
++    def merge_tree(
++        self,
++        rhs: Treeish,
++        base: Union[None, Treeish] = None,
++        allow_unsafe_options: bool = False,
++    ) -> "IndexFile":
+         """Merge the given `rhs` treeish into the current index, possibly taking
+         a common base treeish into account.
+ 
+@@ -270,6 +276,9 @@ def merge_tree
+             Optional treeish reference pointing to the common base of `rhs` and this
+             index which equals lhs.
+ 
++        :param allow_unsafe_options:
++            Allow options that may write to arbitrary paths.
++
+         :return:
+             self (containing the merge and possibly unmerged entries in case of
+             conflicts)
+@@ -280,6 +289,12 @@ def merge_tree
+             yourself, you have to commit the changed index (or make a valid tree from
+             it) and retry with a three-way :meth:`index.from_tree <from_tree>` call.
+         """
++        if not allow_unsafe_options:
++            Git.check_unsafe_options(
++                options=Git._option_candidates([base, rhs]),
++                unsafe_options=self.unsafe_git_read_tree_options,
++            )
++
+         # -i : ignore working tree status
+         # --aggressive : handle more merge cases
+         # -m : do an actual merge
+@@ -324,7 +339,13 @@ def from_tree
+         return inst
+ 
+     @classmethod
+-    def from_tree(cls, repo: "Repo", *treeish: Treeish, **kwargs: Any) -> "IndexFile":
++    def from_tree(
++        cls,
++        repo: "Repo",
++        *treeish: Treeish,
++        allow_unsafe_options: bool = False,
++        **kwargs: Any,
++    ) -> "IndexFile":
+         R"""Merge the given treeish revisions into a new index which is returned.
+         The original index will remain unaltered.
+ 
+@@ -348,6 +369,9 @@ def from_tree
+         :param kwargs:
+             Additional arguments passed to :manpage:`git-read-tree(1)`.
+ 
++        :param allow_unsafe_options:
++            Allow options that may write to arbitrary paths.
++
+         :return:
+             New :class:`IndexFile` instance. It will point to a temporary index location
+             which does not exist anymore. If you intend to write such a merged Index,
+@@ -365,6 +389,12 @@ def from_tree
+         if len(treeish) == 0 or len(treeish) > 3:
+             raise ValueError("Please specify between 1 and 3 treeish, got %i" % len(treeish))
+ 
++        if not allow_unsafe_options:
++            Git.check_unsafe_options(
++                options=Git._option_candidates(treeish, kwargs),
++                unsafe_options=cls.unsafe_git_read_tree_options,
++            )
++
+         arg_list: List[Union[Treeish, str]] = []
+         # Ignore that the working tree and index possibly are out of date.
+         if len(treeish) > 1:
+@@ -1398,6 +1428,7 @@ def reset
+         working_tree: bool = False,
+         paths: Union[None, Iterable[PathLike]] = None,
+         head: bool = False,
++        allow_unsafe_options: bool = False,
+         **kwargs: Any,
+     ) -> "IndexFile":
+         """Reset the index to reflect the tree at the given commit. This will not adjust
+@@ -1429,6 +1460,9 @@ def reset
+             The paths need to exist at the commit, otherwise an exception will be
+             raised.
+ 
++        :param allow_unsafe_options:
++            Allow options that may write to arbitrary paths.
++
+         :param kwargs:
+             Additional keyword arguments passed to :manpage:`git-reset(1)`.
+ 
+@@ -1445,7 +1479,7 @@ def reset
+         """
+         # What we actually want to do is to merge the tree into our existing index,
+         # which is what git-read-tree does.
+-        new_inst = type(self).from_tree(self.repo, commit)
++        new_inst = type(self).from_tree(self.repo, commit, allow_unsafe_options=allow_unsafe_options)
+         if not paths:
+             self.entries = new_inst.entries
+         else:
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 4a3d516244..df2eea60bc 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -38,6 +38,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-73619_p2.patch \
            file://CVE-2026-76221.patch \
            file://CVE-2026-76220.patch \
+           file://CVE-2026-76219.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.53.0