[OE-core][wrynose][v2 PATCH 18/27] python3-git: fix CVE-2026-76217

[Yogita Urade <yurade@cisco.com>]

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c
[2] https://security-tracker.debian.org/tracker/CVE-2026-76217

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Changes in v2:
- Changed the advisory reference from NVD to Debian Security Tracker.
  Removed the stale cherry-pick and Signed-off-by trailers and
  refreshed the embedded hunk context.
---
 .../python/python3-git/CVE-2026-76217.patch   | 179 ++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |   1 +
 2 files changed, 180 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch
new file mode 100644
index 0000000000..f369c778b0
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-76217.patch
@@ -0,0 +1,179 @@
+From c99cba55c8ad6eff105ee61b15f7c683e7e4d878 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Tue, 4 Aug 2026 03:18:54 +0000
+Subject: [PATCH] Guard pathspec file inputs in high-level commands
+
+<!-- agent -->
+GHSA-hh9p-6wh2-4mfc reports that high-level rm and checkout wrappers
+forwarded pathspec file options without GitPython's unsafe-option policy.
+A regression showed that both commands surfaced multi-line pathspec data in
+Git errors, while reset consumed the same caller-selected file without a
+validation error. The audit also found that reset's positional commit could
+carry the option before its argument separator.
+
+Define one shared unsafe pathspec-file option list and apply it to
+IndexFile.remove, Head.checkout, and HEAD.reset before invoking Git. Check
+reset's positional commit as well as keyword options, retain the standard
+allow_unsafe_options escape hatch for trusted callers, and cover abbreviated
+long-option spellings.
+
+An audit against Git cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a
+(v2.55.0.windows.3-16-gcf5497b14c) found pathspec-file support in add,
+checkout/restore, commit, reset, rm, and stash. GitPython has no arbitrary
+high-level option forwarding to the other commands, and git mv does not
+support this option.
+
+Validated with focused rejection and opt-in tests, 214 affected-module
+regressions, Ruff, basedpyright, and git diff --check.
+
+CVE: CVE-2026-76217
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c]
+
+Backport Changes:
+- Omitted test/test_git.py, test/test_index.py, test/test_refs.py because the
+  current PyPI source archive does not include the test suite and the
+  python3-git recipe does not run it.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit f2550b65bf60ca087190981e2c7b6865e201f40c)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py        |  6 ++++++
+ git/index/base.py | 10 ++++++++++
+ git/refs/head.py  | 27 ++++++++++++++++++++++++++-
+ 3 files changed, 42 insertions(+), 1 deletion(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 63bbb3f7..20abd015 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -421,6 +421,12 @@ class Git(metaclass=_GitMeta):
+ 
+     re_unsafe_protocol = re.compile(r"(.+)::.+")
+ 
++    unsafe_git_pathspec_from_file_options = [
++        # Reads pathspecs from a caller-controlled file. Some commands include an
++        # unmatched pathspec in their error output, which can disclose the file.
++        "--pathspec-from-file",
++    ]
++
+     def __getstate__(self) -> Dict[str, Any]:
+         return slots_to_dict(self, exclude=self._excluded_)
+ 
+
+diff --git a/git/index/base.py b/git/index/base.py
+index fb1acb1a..f5932f2d 100644
+--- a/git/index/base.py
++++ b/git/index/base.py
+@@ -1011,6 +1011,7 @@ IndexFile.remove
+         self,
+         items: Sequence[Union[PathLike, Blob, BaseIndexEntry, "Submodule"]],
+         working_tree: bool = False,
++        allow_unsafe_options: bool = False,
+         **kwargs: Any,
+     ) -> List[str]:
+         R"""Remove the given items from the index and optionally from the working tree
+@@ -1041,6 +1042,10 @@ IndexFile.remove documentation
+             physically removing the respective file. This may fail if there are
+             uncommitted changes in it.
+ 
++        :param allow_unsafe_options:
++            Allow unsafe options such as ``--pathspec-from-file`` to be passed to
++            :manpage:`git-rm(1)`.
++
+         :param kwargs:
+             Additional keyword arguments to be passed to :manpage:`git-rm(1)`, such as
+             ``r`` to allow recursive removal.
+@@ -1052,6 +1057,11 @@ IndexFile.remove unsafe-option validation
+             This is interesting to know in case you have provided a directory or globs.
+             Paths are relative to the repository.
+         """
++        if not allow_unsafe_options:
++            Git.check_unsafe_options(
++                options=Git._option_candidates([], kwargs),
++                unsafe_options=Git.unsafe_git_pathspec_from_file_options,
++            )
+         args = []
+         if not working_tree:
+             args.append("--cached")
+
+diff --git a/git/refs/head.py b/git/refs/head.py
+index 7e6fc337..1b82fbd3 100644
+--- a/git/refs/head.py
++++ b/git/refs/head.py
+@@ -19,6 +19,7 @@ HEAD.reset import
+ 
+ from typing import Any, Sequence, TYPE_CHECKING, Union
+ 
++from git.cmd import Git
+ from git.types import Commit_ish, PathLike
+ 
+ if TYPE_CHECKING:
+@@ -66,6 +67,7 @@ HEAD.reset signature
+         index: bool = True,
+         working_tree: bool = False,
+         paths: Union[PathLike, Sequence[PathLike], None] = None,
++        allow_unsafe_options: bool = False,
+         **kwargs: Any,
+     ) -> "HEAD":
+         """Reset our HEAD to the given commit optionally synchronizing the index and
+@@ -88,12 +90,21 @@ HEAD.reset option validation and documentation
+             Single path or list of paths relative to the git root directory
+             that are to be reset. This allows to partially reset individual files.
+ 
++        :param allow_unsafe_options:
++            Allow unsafe options such as ``--pathspec-from-file`` to be passed to
++            :manpage:`git-reset(1)`.
++
+         :param kwargs:
+             Additional arguments passed to :manpage:`git-reset(1)`.
+ 
+         :return:
+             self
+         """
++        if not allow_unsafe_options:
++            Git.check_unsafe_options(
++                options=Git._option_candidates([commit], kwargs),
++                unsafe_options=Git.unsafe_git_pathspec_from_file_options,
++            )
+         mode: Union[str, None]
+         mode = "--soft"
+         if index:
+@@ -238,7 +249,12 @@ Head.checkout signature
+         self.path = "%s/%s" % (self._common_path_default, new_path)
+         return self
+ 
+-    def checkout(self, force: bool = False, **kwargs: Any) -> Union["HEAD", "Head"]:
++    def checkout(
++        self,
++        force: bool = False,
++        allow_unsafe_options: bool = False,
++        **kwargs: Any,
++    ) -> Union["HEAD", "Head"]:
+         """Check out this head by setting the HEAD to this reference, by updating the
+         index to reflect the tree we point to and by updating the working tree to
+         reflect the latest index.
+@@ -250,6 +266,10 @@ Head.checkout documentation
+             If ``False``, :exc:`~git.exc.GitCommandError` will be raised in that
+             situation.
+ 
++        :param allow_unsafe_options:
++            Allow unsafe options such as ``--pathspec-from-file`` to be passed to
++            :manpage:`git-checkout(1)`.
++
+         :param kwargs:
+             Additional keyword arguments to be passed to git checkout, e.g.
+             ``b="new_branch"`` to create a new branch at the given spot.
+@@ -265,6 +285,11 @@ Head.checkout unsafe-option validation
+             the HEAD detached which is allowed and possible, but remains a special state
+             that some tools might not be able to handle.
+         """
++        if not allow_unsafe_options:
++            Git.check_unsafe_options(
++                options=Git._option_candidates([], kwargs),
++                unsafe_options=Git.unsafe_git_pathspec_from_file_options,
++            )
+         kwargs["f"] = force
+         if kwargs["f"] is False:
+             kwargs.pop("f")
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 173643a49b..4e5eec73f1 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -40,6 +40,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-76220.patch \
            file://CVE-2026-76219.patch \
            file://CVE-2026-76218.patch \
+           file://CVE-2026-76217.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.53.0