Re: [OE-core][wrynose][v2 PATCH 00/27] python3-git: Security fixes

["Yoann Congal" <yoann.congal@smile.fr>]

On Fri Nov 6, 2026 at 3:43 PM CET, Yogita Urade -X (yurade - E INFOCHIPS PRIVATE LIMITED at Cisco) via openembedded-core wrote:
> Backport 27 GitPython security fixes covering 28 CVEs to the python3-git
> 3.1.43 recipe on wrynose. The series adds the fixes as patches and updates
> the recipe to apply them.
>
> CVE-2026-78678 and CVE-2026-78679 are addressed together. The CVE-2026-76222
> fix includes a regression correction and follow-up patch, CVE-2026-73619
> and CVE-2026-87819 are each carried in two patches. The patches retain
> upstream references.
>
> Changes in v2:
> - Re-reviewed all patches and removed changes that were not needed for the backports.
> - Restored upstream commit metadata and corrected CVE references.
> - Updated Backport Changes notes to describe the differences from upstream.

Hello,

> - Removed trailing whitespace and regenerated the series diffstat.
I think you should not have done this last change. Some whitespaces at
end of line are actually meaningful in the patch format (e.g. an empty
context line) also, upstream patches will have these whitespace,
removing those will add noise when I take the diff.

To help you clean this, here is the script I use to check patch format:
https://gist.github.com/ycongal-smile/3692790a48269e59d602e5be1d667982

Here is its full log on your series:
❯ git diff --numstat 63484d666ac 802fb424a4e |cut -f3 | grep "\.patch$" |xargs check_patch.py
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch:42
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch:90
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73619_p1.patch:47
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73619_p1.patch:57
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch:41
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch:50
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch:54
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch:41
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73622.patch:45
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch:40
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch:49
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch:65
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch:92
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch:132
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-73624.patch:136
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch:50
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76218.patch:73
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch:48
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch:71
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch:74
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch:78
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch:88
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch:91
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch:96
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p1.patch:104
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-76222_p2.patch:36
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch:42
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-78675.patch:45
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch:51
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch:57
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-78676.patch:66
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch:34
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch:40
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87818.patch:49
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch:44
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch:76
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:88
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:92
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:94
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:97
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:98
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:117
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:125
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:130
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:138
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.
Error: Malformed patch line at meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch:144
Line content: '\n'
Context lines must start with exactly one space. This line is missing its prefix.

Regards,
-- 
Yoann Congal
Smile ECS