[scarthgap,12/27] python3-git: fix CVE-2026-73620

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch
new file mode 100644
index 0000000000..9b26f7bf0a
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-73620.patch
@@ -0,0 +1,130 @@ 
+From 5cb503e8d600c1946ed57e720dcee1a31dd5a65e Mon Sep 17 00:00:00 2001
+From: "GPT 5.6" <codex@openai.com>
+Date: Sun, 26 Jul 2026 05:54:27 +0200
+Subject: [PATCH 20/38] Block unsafe checkout-index and tag file options
+
+GHSA-3f7w-8rr8-f37f reports that caller-controlled options forwarded by
+IndexFile.checkout() and TagReference.create() can make Git write to or read
+from arbitrary filesystem paths.
+
+Add regression coverage proving the unsafe options are rejected by default while
+preserving the explicit allow_unsafe_options escape hatch. Reuse GitPython's
+existing option candidate normalization and unsafe-option guard at both public
+API boundaries.
+
+Git baseline: a23bace963d508bd96983cc637131392d3face18.
+Documentation/git-checkout-index.adoc defines --prefix as prepending an output
+path, and Documentation/git-tag.adoc defines -F/--file as reading a tag message
+from a file.
+
+CVE: CVE-2026-73620
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c]
+
+Backport Changes:
+- Omit upstream regression test changes because the current PyPI 
+  source archive does not include its test suite.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+(cherry picked from commit 3af0c2516c5e18c829da30338614688f6b69b49c)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/index/base.py |   12 ++++++++++++
+ git/refs/tag.py   |   13 +++++++++++++
+ 2 files changed, 25 insertions(+)
+
+diff --git a/git/index/base.py b/git/index/base.py
+index c3d1771c..687b72da 100644
+--- a/git/index/base.py
++++ b/git/index/base.py
+@@ -141,6 +141,8 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+     before operating on it using the git command.
+     """
+ 
++    unsafe_git_checkout_index_options = ["--prefix"]
++
+     __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path")
+ 
+     _VERSION = 2
+@@ -1156,6 +1158,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+         paths: Union[None, Iterable[PathLike]] = None,
+         force: bool = False,
+         fprogress: Callable = lambda *args: None,
++        allow_unsafe_options: bool = False,
+         **kwargs: Any,
+     ) -> Union[None, Iterator[PathLike], Sequence[PathLike]]:
+         """Check out the given paths or all files from the version known to the index
+@@ -1179,6 +1182,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+             explicit paths are given. Otherwise progress information will be send
+             prior and after a file has been checked out.
+ 
++        :param allow_unsafe_options:
++            Allow unsafe options, such as ``--prefix``.
++
+         :param kwargs:
+             Additional arguments to be passed to git-checkout-index.
+ 
+@@ -1200,6 +1206,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+             different to *head.checkout*, i.e. if you want git-checkout like behaviour,
+             use head.checkout instead of index.checkout.
+         """
++        if not allow_unsafe_options:
++            Git.check_unsafe_options(
++                options=Git._option_candidates([], kwargs),
++                unsafe_options=self.unsafe_git_checkout_index_options,
++            )
++
+         args = ["--index"]
+         if force:
+             args.append("--force")
+diff --git a/git/refs/tag.py b/git/refs/tag.py
+index a59a5133..640e9702 100644
+--- a/git/refs/tag.py
++++ b/git/refs/tag.py
+@@ -2,6 +2,7 @@
+ # 3-Clause BSD License: https://opensource.org/license/bsd-3-clause/
+ 
+ from .reference import Reference
++from git.cmd import Git
+ 
+ __all__ = ["TagReference", "Tag"]
+ 
+@@ -36,6 +37,8 @@ class TagReference(Reference):
+ 
+     __slots__ = ()
+ 
++    unsafe_git_tag_options = ["--file", "-F"]
++
+     _common_default = "tags"
+     _common_path_default = Reference._common_path_default + "/" + _common_default
+ 
+@@ -83,6 +86,7 @@ class TagReference(Reference):
+         reference: Union[str, "SymbolicReference"] = "HEAD",
+         logmsg: Union[str, None] = None,
+         force: bool = False,
++        allow_unsafe_options: bool = False,
+         **kwargs: Any,
+     ) -> "TagReference":
+         """Create a new tag reference.
+@@ -108,11 +112,20 @@ class TagReference(Reference):
+         :param force:
+             If True, force creation of a tag even though that tag already exists.
+ 
++        :param allow_unsafe_options:
++            Allow unsafe options, such as ``--file``.
++
+         :param kwargs:
+             Additional keyword arguments to be passed to git-tag.
+ 
+         :return: A new TagReference.
+         """
++        if not allow_unsafe_options:
++            Git.check_unsafe_options(
++                options=Git._option_candidates([], kwargs),
++                unsafe_options=cls.unsafe_git_tag_options,
++            )
++
+         if "ref" in kwargs and kwargs["ref"]:
+             reference = kwargs["ref"]
+ 
+-- 
+2.35.6
diff --git a/meta/recipes-devtools/python/python3-git_3.1.42.bb b/meta/recipes-devtools/python/python3-git_3.1.42.bb
index 5bbb20c842..3f04fe8fdb 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.42.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.42.bb
@@ -33,6 +33,7 @@  SRC_URI += "            file://CVE-2026-42284.patch \
             file://CVE-2026-73624.patch \
             file://CVE-2026-73622.patch \
             file://CVE-2026-73621.patch \
+            file://CVE-2026-73620.patch \
            "
 SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"