[wrynose,v2,20/27] python3-git: fix CVE-2026-78678 CVE-2026-78679

diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch
new file mode 100644
index 0000000000..337efbe22f
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch
@@ -0,0 +1,220 @@ 
+From 51216053bd6885b546be8e9ed2e8e1000e7ee5a3 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Wed, 5 Aug 2026 04:48:36 +0200
+Subject: [PATCH] Block file-reading Git options
+
+<!-- agent -->
+Reject file-reading options passed to blame, diff, and tag APIs. Inspect
+positional values after resolving aliases, recognize unsafe options
+behind command-specific short-flag clusters, and retain the explicit
+allow_unsafe_options escape hatch. This closes GHSA-5xxx-qhh7-9287 and
+GHSA-3wxw-xv34-2frg and covers the adjacent diff order-file sink.
+
+Regression tests cover long, short, and clustered options, incremental blame,
+tag path/reference positionals, the ref keyword alias, both diff entry points,
+and preservation of diff pickaxe behavior.
+
+Git baseline: cf5497b14c; git-blame, git-diff, and git-tag document the relevant file-input options.
+
+CVE: CVE-2026-78678 CVE-2026-78679
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6]
+
+Backport Changes:
+- Omitted test/test_diff.py, test/test_refs.py, test/test_remote.py,
+  test/test_repo.py because the Wrynose PyPI source archive does not include
+  the test suite and the python3-git recipe does not run it.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py        | 11 +++++++----
+ git/diff.py       |  7 ++++---
+ git/index/base.py |  3 ++-
+ git/refs/tag.py   | 10 ++++++----
+ git/repo/base.py  | 24 ++++++++++++++++++++----
+ 5 files changed, 39 insertions(+), 16 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index 20abd015..b8ad449f 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -417,6 +417,7 @@ Git.unsafe_git_ls_remote_options
+     unsafe_git_ls_remote_options = [
+         # This option allows arbitrary command execution in git-ls-remote.
+         "--upload-pack",
++        "--exec",
+     ]
+ 
+     re_unsafe_protocol = re.compile(r"(.+)::.+")
+@@ -743,7 +744,9 @@ Git.check_unsafe_options signature
+         return dashify(option_tokens[0])
+ 
+     @classmethod
+-    def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
++    def check_unsafe_options(
++        cls, options: List[str], unsafe_options: List[str], clusterable_short_options: str = "46flnqsv"
++    ) -> None:
+         """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings.
+ 
+         In addition to exact matches, this rejects abbreviated long options accepted
+@@ -778,7 +781,7 @@ Git.check_unsafe_options clusterable short flags
+         # These value-less Git flags can be clustered before another short option
+         # (for example, ``-fuVALUE``). Stop at any other character because it may
+         # begin an attached value, as ``o`` does in the safe option ``-oupstream``.
+-        clusterable_short_options = frozenset("46flnqsv")
++        clusterable_short_options_set = frozenset(clusterable_short_options)
+         options_are_kwargs = all(not option.startswith("-") for option in options)
+         for option in options:
+             candidate = cls._canonicalize_option_name(option)
+@@ -795,7 +798,7 @@ Git.check_unsafe_options short-option parsing
+                         raise UnsafeOptionError(
+                             f"{unsafe_option} is not allowed, use `allow_unsafe_options=True` to allow it."
+                         )
+-                    if option_char not in clusterable_short_options:
++                    if option_char not in clusterable_short_options_set:
+                         break
+             if not (option.startswith("--") or (options_are_kwargs and len(candidate) > 1)):
+                 continue
+@@ -1101,7 +1104,7 @@ Git.ls_remote documentation
+         """List references in a remote repository.
+ 
+         :param allow_unsafe_options:
+-            Allow unsafe options, like ``--upload-pack``.
++            Allow unsafe options, like ``--upload-pack`` or ``--exec``.
+         """
+         if not allow_unsafe_options:
+             candidate_options = self._option_candidates(args, kwargs)
+
+diff --git a/git/diff.py b/git/diff.py
+index 9a1f107b..032dfb25 100644
+--- a/git/diff.py
++++ b/git/diff.py
+@@ -216,8 +216,8 @@ Diffable.diff documentation
+             to be read and diffed.
+ 
+         :param allow_unsafe_options:
+-            If ``True``, allow options such as ``--output`` that can write to arbitrary
+-            filesystem paths.
++            If ``True``, allow options such as ``--output`` and ``-O`` that can write to
++            or read from arbitrary filesystem paths.
+ 
+         :param kwargs:
+             Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to
+@@ -234,7 +234,8 @@ Diffable.diff unsafe-option validation
+         if not allow_unsafe_options:
+             Git.check_unsafe_options(
+                 options=Git._option_candidates([other], kwargs),
+-                unsafe_options=self.repo.unsafe_git_revision_options,
++                unsafe_options=self.repo.unsafe_git_diff_options,
++                clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW",
+             )
+ 
+         args: List[Union[PathLike, Diffable]] = []
+
+diff --git a/git/index/base.py b/git/index/base.py
+index f5932f2d..0ff15794 100644
+--- a/git/index/base.py
++++ b/git/index/base.py
+@@ -1550,7 +1550,8 @@ IndexFile.diff unsafe-option validation
+         if not allow_unsafe_options:
+             Git.check_unsafe_options(
+                 options=Git._option_candidates([other], kwargs),
+-                unsafe_options=self.repo.unsafe_git_revision_options,
++                unsafe_options=self.repo.unsafe_git_diff_options,
++                clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW",
+             )
+ 
+         # Only run if we are the default repository index.
+
+diff --git a/git/repo/base.py b/git/repo/base.py
+index b6fd7620..c91dd1f2 100644
+--- a/git/repo/base.py
++++ b/git/repo/base.py
+@@ -198,6 +198,19 @@ Repo unsafe-option lists
+     ]
+ 
+ 
++    unsafe_git_blame_options = unsafe_git_revision_options + [
++        # These options read from arbitrary files and expose their contents through blame output.
++        "--contents",
++        "-S",
++        "--ignore-revs-file",
++    ]
++
++    unsafe_git_diff_options = unsafe_git_revision_options + [
++        # Reads caller-controlled order patterns from an arbitrary file.
++        "-O",
++        "--orderfile",
++    ]
++
+     # Invariants
+     config_level: ConfigLevels_Tup = ("system", "user", "global", "repository")
+     """Represents the configuration level of a configuration file."""
+@@ -1102,7 +1115,7 @@ Repo.blame_incremental documentation and validation
+             :manpage:`git-rev-parse(1)` is a valid option.
+ 
+         :param allow_unsafe_options:
+-            Allow unsafe options in revision argument, like ``--output``.
++            Allow unsafe options in revision argument, like ``--output`` or ``--contents``.
+ 
+         :return:
+             Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the
+@@ -1115,7 +1128,9 @@ Repo.blame_incremental unsafe-option validation
+ 
+         if not allow_unsafe_options:
+             Git.check_unsafe_options(
+-                options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options
++                options=Git._option_candidates([rev], kwargs),
++                unsafe_options=self.unsafe_git_blame_options,
++                clusterable_short_options="46bceflnpqstvw",
+             )
+         data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs)
+         commits: Dict[bytes, Commit] = {}
+@@ -1205,7 +1220,7 @@ Repo.blame documentation
+             uncommitted changes. Otherwise, anything successfully parsed by
+             :manpage:`git-rev-parse(1)` is a valid option.
+         :param allow_unsafe_options:
+-            Allow unsafe options in revision argument, like ``--output``.
++            Allow unsafe options in revision argument, like ``--output`` or ``--contents``.
+ 
+ 
+         :return:
+@@ -1222,7 +1237,8 @@ Repo.blame unsafe-option validation
+         if not allow_unsafe_options:
+             Git.check_unsafe_options(
+                 options=Git._option_candidates([rev, rev_opts_list], kwargs),
+-                unsafe_options=self.unsafe_git_revision_options,
++                unsafe_options=self.unsafe_git_blame_options,
++                clusterable_short_options="46bceflnpqstvw",
+             )
+         data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs)
+         commits: Dict[str, Commit] = {}
+
+diff --git a/git/refs/tag.py b/git/refs/tag.py
+index 07efa62f..d45fb7eb 100644
+--- a/git/refs/tag.py
++++ b/git/refs/tag.py
+@@ -134,15 +134,17 @@ TagReference.create unsafe-option validation
+         :return:
+             A new :class:`TagReference`.
+         """
++        legacy_ref = kwargs.pop("ref", None)
++        if legacy_ref:
++            reference = legacy_ref
++
+         if not allow_unsafe_options:
+             Git.check_unsafe_options(
+-                options=Git._option_candidates([], kwargs),
++                options=Git._option_candidates([path, reference], kwargs),
+                 unsafe_options=cls.unsafe_git_tag_options,
++                clusterable_short_options="46adefilnqsv",
+             )
+ 
+-        if "ref" in kwargs and kwargs["ref"]:
+-            reference = kwargs["ref"]
+-
+         if "message" in kwargs and kwargs["message"]:
+             kwargs["m"] = kwargs["message"]
+             del kwargs["message"]
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index ef1c687c02..dc7694f593 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -44,6 +44,7 @@  SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-76222_p1.patch \
            file://CVE-2026-76222-regression.patch \
            file://CVE-2026-76222_p2.patch \
+           file://CVE-2026-78678_CVE-2026-78679.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"