[meta-python,wrynose,00/18] python3-virtualenv: Security fixes

From: Hetvi Thakar <hthakar@cisco.com>

This 18-patch series backports upstream security fixes and adds CVE
applicability statuses for python3-virtualenv 21.2.1 on Wrynose.

The backports address configuration injection, seed-wheel verification,
shell activation and prompt escaping, unsafe filesystem writes and
cleanup, copied-file permissions, and temporary-cache handling.

The following 18 CVEs are covered by the security fixes:

 - CVE-2026-102925
 - CVE-2026-102930
 - CVE-2026-102938
 - CVE-2026-113713
 - CVE-2026-113714
 - CVE-2026-113715
 - CVE-2026-113716
 - CVE-2026-113717
 - CVE-2026-113719
 - CVE-2026-113720
 - CVE-2026-113721
 - CVE-2026-113722
 - CVE-2026-113723
 - CVE-2026-113725
 - CVE-2026-113726
 - CVE-2026-113732
 - CVE-2026-113776
 - CVE-2026-115586

CVE-2026-113714 and CVE-2026-113717 are addressed by the follow-up
backport included with CVE-2026-102930. The CVE-2026-113723 commit also
includes the CVE-2026-115586 follow-up to avoid introducing the prompt
handling regression from the initial upstream fix.

The series adds separate applicability statuses for three CVEs:

 - CVE-2026-102937: Windows cmd.exe batch activation is not selected
   for Linux interpreters. The exclusion is conditional on Linux;
   other platforms, including MinGW SDK builds, remain unexcluded.

 - CVE-2026-113718: The affected Xonsh activator is absent from
   virtualenv 21.2.1.

 - CVE-2026-113724: safe_delete() uses ignore_errors=True, making
   the vulnerable chmod error callback unreachable.

The package version remains unchanged at 21.2.1. Required upstream
prerequisites and follow-up fixes are included, together with the
python3-packaging runtime dependency needed for wheel verification.

Validation performed:

 - BitBake do_patch, do_compile and package build completed successfully
   for python3-virtualenv 21.2.1.

Hetvi Thakar (18):
  python3-virtualenv: fix CVE-2026-102938
  python3-virtualenv: fix CVE-2026-102930
  python3-virtualenv: fix CVE-2026-102925
  python3-virtualenv: fix CVE-2026-113732
  python3-virtualenv: fix CVE-2026-113776
  python3-virtualenv: fix CVE-2026-113726
  python3-virtualenv: fix CVE-2026-113725
  python3-virtualenv: fix CVE-2026-113723
  python3-virtualenv: fix CVE-2026-113715
  python3-virtualenv: fix CVE-2026-113720
  python3-virtualenv: fix CVE-2026-113719
  python3-virtualenv: fix CVE-2026-113721
  python3-virtualenv: fix CVE-2026-113716
  python3-virtualenv: fix CVE-2026-113722
  python3-virtualenv: fix CVE-2026-113713
  python3-virtualenv: Ignore CVE-2026-102937
  python3-virtualenv: Ignore CVE-2026-113718
  python3-virtualenv: Ignore CVE-2026-113724

 .../python3-virtualenv/CVE-2026-102925.patch  | 296 +++++++
 .../CVE-2026-102930-dependent.patch           | 115 +++
 .../CVE-2026-102930_p1.patch                  | 309 +++++++
 .../CVE-2026-102930_p2.patch                  | 293 +++++++
 .../CVE-2026-102930_p3.patch                  | 777 ++++++++++++++++++
 .../python3-virtualenv/CVE-2026-102938.patch  | 141 ++++
 .../python3-virtualenv/CVE-2026-113713.patch  | 113 +++
 .../python3-virtualenv/CVE-2026-113715.patch  | 165 ++++
 .../python3-virtualenv/CVE-2026-113716.patch  | 208 +++++
 .../python3-virtualenv/CVE-2026-113719.patch  | 207 +++++
 .../python3-virtualenv/CVE-2026-113720.patch  | 156 ++++
 .../python3-virtualenv/CVE-2026-113721.patch  | 477 +++++++++++
 .../CVE-2026-113722_p1.patch                  | 262 ++++++
 .../CVE-2026-113722_p2.patch                  |  50 ++
 .../python3-virtualenv/CVE-2026-113723.patch  | 233 ++++++
 .../python3-virtualenv/CVE-2026-113725.patch  |  88 ++
 .../CVE-2026-113726-dependent.patch           | 168 ++++
 .../python3-virtualenv/CVE-2026-113726.patch  | 149 ++++
 .../CVE-2026-113732_p1.patch                  | 116 +++
 .../CVE-2026-113732_p2.patch                  | 120 +++
 .../python3-virtualenv/CVE-2026-113776.patch  | 133 +++
 .../python3-virtualenv/CVE-2026-115586.patch  | 526 ++++++++++++
 .../python/python3-virtualenv_21.2.1.bb       |  31 +
 23 files changed, 5133 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102925.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930-dependent.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102930_p3.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-102938.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113713.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113715.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113716.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113719.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113720.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113721.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113722_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113722_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113723.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113725.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113732_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113776.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-115586.patch