[OE-core][wrynose][v2 PATCH 07/27] python3-git: fix CVE-2026-73625

[Yogita Urade <yurade@cisco.com>]

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453
[2] https://security-tracker.debian.org/tracker/CVE-2026-73625

Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Changes in v2:
- Changed the advisory reference from NVD to Debian Security Tracker.
  Refreshed the embedded hunk context and index hashes.
---
 .../python/python3-git/CVE-2026-73625.patch   | 59 +++++++++++++++++++
 .../python/python3-git_3.1.43.bb              |  1 +
 2 files changed, 60 insertions(+)
 create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch
new file mode 100644
index 0000000000..8f2638017c
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73625.patch
@@ -0,0 +1,59 @@
+From ef95f1434023af72deabaf91e7154260d4625271 Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Wed, 22 Jul 2026 04:39:00 +0200
+Subject: [PATCH] fix: validate split short-option values
+
+<!-- agent -->
+
+Single-character keyword arguments are transformed into an option token and
+a separate value token. The unsafe-option candidate builder only checked the
+keyword name, allowing an option-like value to bypass guards shared by clone,
+remote, revision, blame, and archive operations.
+
+Include dash-prefixed values only when short options are actually split,
+including sequence values, while preserving bare values and the non-splitting
+compatibility path.
+
+Git baseline a23bace9 defines clone -n and --upload-pack as distinct options,
+matching the argv boundary this validation now preserves.
+
+Refs GHSA-r9mr-m37c-5fr3.
+
+CVE: CVE-2026-73625
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453]
+
+Backport Changes:
+- Omitted test/test_git.py because the current PyPI source archive
+  does not include the test suite and the python3-git recipe does
+  not run it.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit e8d0fbf774d1f6baa3b481adfe48bd262e43b453)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index eb7bf055..2ce27290 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -804,11 +804,18 @@ Git._option_candidates
+             option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-")
+         ]
+         if kwargs:
++            split_single_char_options = kwargs.get("split_single_char_options", True)
+             for key, value in kwargs.items():
+                 values = value if isinstance(value, (list, tuple)) else (value,)
+                 if any(value is True or (value is not False and value is not None) for value in values):
+                     key = str(key)
+                     options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")
++                    if len(key) == 1 and split_single_char_options:
++                        options.extend(
++                            str(value)
++                            for value in values
++                            if value is not True and value not in (False, None) and str(value).startswith("-")
++                        )
+         return options
+ 
+     class AutoInterrupt:
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 781ec512cc..551b47fc39 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -28,6 +28,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-67324.patch \
            file://CVE-2026-67322.patch \
            file://CVE-2026-69097.patch \
+           file://CVE-2026-73625.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
 
-- 
2.53.0