[OE-core][wrynose][v2 PATCH 22/27] python3-git: fix CVE-2026-78676

[Yogita Urade <yurade@cisco.com>]

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/4b4e47fc1224e23b0c8ee7220a7192818f2e4abb
[2] https://security-tracker.debian.org/tracker/CVE-2026-78676

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Changes in v2:
- Changed the advisory reference from NVD to Debian Security Tracker.
- Included the reader-side prerequisite from 47e5738074e7, which prevents
  IndexError when reading serialized config values.
---
 .../python/python3-git/CVE-2026-78676.patch   | 67 +++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |  1 +
 2 files changed, 68 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch
new file mode 100644
index 0000000000..8adee8140f
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch
@@ -0,0 +1,67 @@
+From 5095b034dc451f3ec0c4c77c69403c8fce7eb6d7 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Mon, 10 Aug 2026 12:22:31 +0200
+Subject: [PATCH] fix: preserve multiline config values when writing
+
+<!-- agent -->
+GitConfigParser decoded valid multiline values into embedded newlines, but
+_write() serialized those newlines as indented physical lines. Rewriting an
+otherwise unchanged config could therefore change its meaning to Git.
+
+Serialize resident multiline values with Git-compatible escapes inside a
+quoted continuation, preserving GitPython read compatibility while keeping
+each option structurally intact. This addresses GHSA-284h-m62q-gf8w.
+
+The regression starts with an inert multiline value, performs an unrelated
+write, and verifies with both GitPython and git config that it remains one
+value and does not create another option.
+
+Git baseline: config.c parse_value() and write_pair() at cf5497b14c5a escape
+embedded LF as \\n rather than emitting it as a physical config line.
+
+CVE: CVE-2026-78676
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/4b4e47fc1224e23b0c8ee7220a7192818f2e4abb]
+
+Backport Changes:
+- Commit 47e5738074e7 is an earlier prerequisite for this serialization
+  change. Its reader-side empty-string guard prevents IndexError when
+  reading serialized config values.
+- Omitted test/test_config.py changes from both upstream commits;
+  the recipe source archive excludes the test suite and the recipe
+  does not run it.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 4b4e47fc1224e23b0c8ee7220a7192818f2e4abb)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/config.py | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/git/config.py b/git/config.py
+index 30218dba..e8482a08 100644
+--- a/git/config.py
++++ b/git/config.py
+@@ -454,8 +454,8 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+         def string_decode(v: str) -> str:
+-            if v[-1] == "\\":
++            if v and v[-1] == "\\":
+                 v = v[:-1]
+             # END cut trailing escapes to prevent decode error
+
+             return v.encode(defenc).decode("unicode_escape")
+ 
+         # END string_decode
+@@ -681,7 +681,11 @@ class GitConfigParser(cp.RawConfigParser, metaclass=MetaParserBuilder):
+                     continue
+
+                 for v in values:
+-                    fp.write(("\t%s = %s\n" % (key, self._value_to_string(v).replace("\n", "\n\t"))).encode(defenc))
++                    value = self._value_to_string(v)
++                    if any(char in value for char in '\n\t\b\\"'):
++                        value = value.replace("\\", "\\\\").replace('"', '\\"')
++                        value = '"%s\\\n"' % value.replace("\n", "\\n").replace("\t", "\\t").replace("\b", "\\b")
++                    fp.write(("\t%s = %s\n" % (key, value)).encode(defenc))
+                 # END if key is not __name__
+
+         # END section writing
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index fbb1553778..badbf04415 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -46,6 +46,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-76222_p2.patch \
            file://CVE-2026-78678_CVE-2026-78679.patch \
            file://CVE-2026-78677.patch \
+           file://CVE-2026-78676.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.53.0