all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fea7:8697
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 6b980ea7-089a-4c50-8a62-e1f27807a310
        host_id: 82101243836454d7401d5893feae9e2c5df7cc291646d8a99b33b53b
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fea7:8697
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.110
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.221
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fea7:8697
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job python-black explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#54>'
      - '<Job python-black explicit: None implied: None source: osism/release/.zuul.yaml@main#14>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 8f9e91e00f294028b00ac29c945339e5
      build_refs:
      - branch: main
        change: '2625'
        change_message: "chore(deps): update dependency gitpython to v3.1.54 [security]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n### GitPython: Incomplete unsafe_git_clone_options denylist
          omits --template enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/2625
        commit_id: 0e02ffbec896bbc1029bd054681ad3acda6af8c2
        patchset: 0e02ffbec896bbc1029bd054681ad3acda6af8c2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: 113dc75da105424bb2a4d2d263364b02
      buildset_refs:
      - branch: main
        change: '2625'
        change_message: "chore(deps): update dependency gitpython to v3.1.54 [security]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n### GitPython: Incomplete unsafe_git_clone_options denylist
          omits --template enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/2625
        commit_id: 0e02ffbec896bbc1029bd054681ad3acda6af8c2
        patchset: 0e02ffbec896bbc1029bd054681ad3acda6af8c2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '2625'
      change_message: "chore(deps): update dependency gitpython to v3.1.54 [security]\n\nThis
        PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
        | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
        [GitPython](https://redirect.github.com/gitpython-developers/GitPython) |
        `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
        | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
        |\n\n---\n\n### GitPython: Incomplete unsafe_git_clone_options denylist omits
        --template enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
        denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
        into the new repository and runs them (`post-checkout` fires during clone),
        so a caller who can influence clone options can achieve arbitrary command
        execution in the default `allow_unsafe_options=False` configuration.\n\n#####
        Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
        \u2014 `--template` is absent. The guard candidate `['--template']` passes
        `check_unsafe_options` (verified). git copies the hook directory and executes
        `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
        do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
        Impact\nArbitrary OS command execution during clone (default config). Requires
        an attacker-readable directory containing an executable hook \u2014 a genuine
        second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
        or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
        Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
        +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
        post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
        Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x). Guard:
        n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
        Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
        Bypass proof: `--template` not on the denylist -> passes (verified candidate
        `['--template']`, no error).\n3. Sink: git copies the hook and executes `post-checkout`
        at checkout. Impact: ACE, default config (verified marker created).\n\n#####
        Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): guard candidate `['--template']`
        passed with no error; staged `post-checkout` hook executed during `clone_from`,
        creating the marker. Independent of the value-smuggle bypass (`--template`
        is a legitimate long option that survives any single-char-value fix). Not
        covered by any existing advisory.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
        Suggested Fix\nAdd `--template` (and audit for other hook/exec-influencing
        options) to `unsafe_git_clone_options`.\n\n---\nReported by **zx (Jace)**
        \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 7.5 / 10
        (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        GitPython: Arbitrary file overwrite via git diff --output argument injection
        in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()` forwards
        `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
        guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
        giving a broad surface. `git diff --output=<path>` writes real patch content
        to an attacker-chosen path, enabling arbitrary file overwrite.\n\n##### Root
        Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
        anywhere in the method (grep-confirmed). Additionally `diff.py:265` does `args.insert(0,
        other)`, placing the caller-supplied `other` ref BEFORE the `--` separator,
        so a value of `--output=/path` is parsed by git as an option \u2014 a value-only
        control path requiring no kwarg key.\n\n##### Impact\nOverwrite/corrupt any
        file at process privilege with attacker-chosen path (e.g. `~/.ssh/authorized_keys`,
        configs, lockfiles). Content is real diff/patch bytes (attacker-influenced).
        Per the skill's rule, controlling WHICH file is overwritten = I:H regardless
        of content constraints.\n\n##### Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
        output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
        (105 bytes verified)\n\n##### Value-control (attacker controls only the ref
        string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')          #
        14-byte victim -> 146 bytes of diff-tree output\n```\n\n##### Attack Chain\n1.
        Entry (value-control): `commit.diff(other=<user ref>)` with `other = \"--output=/home/app/.ssh/authorized_keys\"`.
        Guard: none in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in
        the method body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink:
        `git diff-tree <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git
        opens+truncates the target then writes diff content. Impact: overwrite/corrupt
        any file at process privilege (attacker chooses the path). Verified argv and
        victim overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag
        3.1.53): both key-control (`output=`) and value-control (`other='--output=...'`)
        overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
        This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
        \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
        Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
        to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
        before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
        by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
        Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        GitPython: Unsafe git option guard bypass via single-character kwarg value
        token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
        guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since)
        can be bypassed for **every** guarded method (`clone`/`clone_from`, `fetch`/`pull`/`push`,
        `ls_remote`, `iter_commits`, `blame`, `archive`) by smuggling an option token
        inside the VALUE of a single-character kwarg. In the default `allow_unsafe_options=False`
        configuration this yields arbitrary command execution via `--upload-pack`.\n\n#####
        Root Cause\nThe guard builds its candidate option list from kwarg KEYS only:
        `_option_candidates([], {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']`
        (cmd.py:1042-1046 derives the candidate from the key, never the value). `-n`
        is not on the denylist, so `check_unsafe_options` passes. But `transform_kwarg('n',
        value, split_single_char_options=True)` (cmd.py:1600-1606) emits **two** argv
        tokens `['-n', '--upload-pack=<cmd>']`. git then parses the second token as
        `--upload-pack` and executes the attacker-supplied command. The guard never
        inspects the value that becomes a separate argv token.\n\n##### Impact\nArbitrary
        OS command execution as the host process (via `--upload-pack`) in the default
        configuration, affecting all guarded methods since they all build candidates
        through the name-only `_option_candidates`.\n\n##### Proof of Concept\n```python\nfrom
        git import Repo\nRepo.clone_from(bare_repo, out_dir, n=\"--upload-pack=touch
        /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE created -> ACE. Direct-name
        form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write variant on
        a guarded revision command: `iter_commits('HEAD', g='--output=/path')` ->
        candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file truncated.\n\n#####
        Attack Chain\n1. Entry: app forwards a user-supplied options dict -> `Repo.clone_from(url,
        path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`. Guard: `check_unsafe_options(options=_option_candidates([],
        kwargs), unsafe=unsafe_git_clone_options)` at base.py. Bypass proof: `_option_candidates([],
        {\"n\":\"--upload-pack=...\"})` -> `['-n']` (key-only), not on denylist ->
        no UnsafeOptionError (verified live).\n2. Transform: `transform_kwarg('n',
        value, split_single_char_options=True)` -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`.
        Guard: none (guard already passed on name-only candidate). Bypass proof: verified
        transform emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
        -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
        created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
        HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
        `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from with
        the payload created the marker file; the direct-name `upload_pack=` form raised
        UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore key, GHSA-2f96
        long-option abbreviation, GHSA-v396 joined short option, GHSA-x2qx multi-before-split)
        are BLOCKED on HEAD \u2014 this is a distinct kwarg-value->separate-token
        vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nMake
        `_option_candidates` also emit candidates derived from single-character kwarg
        VALUES when `split_single_char_options` is in effect, OR run `check_unsafe_options`
        over the fully-transformed argv rather than the reconstructed name-only candidate
        list.\n\n---\nReported by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n####
        Severity\n- CVSS Score: 8.8 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
        [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
        - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
        What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
        in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
        Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
        At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
        defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
        manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
        conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
        Close this PR and you won't be reminded about this update again.\n\n---\n\n
        - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
        box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
        View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
      change_url: https://github.com/osism/release/pull/2625
      child_jobs: []
      commit_id: 0e02ffbec896bbc1029bd054681ad3acda6af8c2
      event_id: 1cb1cb00-87aa-11f1-85b3-e95920262be3
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/8f9e91e00f294028b00ac29c945339e5/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/8f9e91e00f294028b00ac29c945339e5/work/logs
        result_data_file: /var/lib/zuul/builds/8f9e91e00f294028b00ac29c945339e5/work/results.json
        src_root: /var/lib/zuul/builds/8f9e91e00f294028b00ac29c945339e5/work/src
        work_root: /var/lib/zuul/builds/8f9e91e00f294028b00ac29c945339e5/work
      include_vars: []
      items:
      - branch: main
        change: '2625'
        change_message: "chore(deps): update dependency gitpython to v3.1.54 [security]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n### GitPython: Incomplete unsafe_git_clone_options denylist
          omits --template enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/release/pull/2625
        commit_id: 0e02ffbec896bbc1029bd054681ad3acda6af8c2
        patchset: 0e02ffbec896bbc1029bd054681ad3acda6af8c2
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: python-black
      jobtags: []
      max_attempts: 3
      message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBkZXBlbmRlbmN5IGdpdHB5dGhvbiB0byB2My4xLjU0IFtzZWN1cml0eV0KClRoaXMgUFIgY29udGFpbnMgdGhlIGZvbGxvd2luZyB1cGRhdGVzOgoKfCBQYWNrYWdlIHwgQ2hhbmdlIHwgW0FnZV0oaHR0cHM6Ly9kb2NzLnJlbm92YXRlYm90LmNvbS9tZXJnZS1jb25maWRlbmNlLykgfCBbQ29uZmlkZW5jZV0oaHR0cHM6Ly9kb2NzLnJlbm92YXRlYm90LmNvbS9tZXJnZS1jb25maWRlbmNlLykgfAp8LS0tfC0tLXwtLS18LS0tfAp8IFtHaXRQeXRob25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24pIHwgYD09My4xLjUzYCDihpIgYD09My4xLjU0YCB8ICFbYWdlXShodHRwczovL2RldmVsb3Blci5tZW5kLmlvL2FwaS9tYy9iYWRnZXMvYWdlL3B5cGkvZ2l0cHl0aG9uLzMuMS41ND9zbGltPXRydWUpIHwgIVtjb25maWRlbmNlXShodHRwczovL2RldmVsb3Blci5tZW5kLmlvL2FwaS9tYy9iYWRnZXMvY29uZmlkZW5jZS9weXBpL2dpdHB5dGhvbi8zLjEuNTMvMy4xLjU0P3NsaW09dHJ1ZSkgfAoKLS0tCgojIyMgR2l0UHl0aG9uOiBJbmNvbXBsZXRlIHVuc2FmZV9naXRfY2xvbmVfb3B0aW9ucyBkZW55bGlzdCBvbWl0cyAtLXRlbXBsYXRlIGVuYWJsaW5nIGFyYml0cmFyeSBjb21tYW5kIGV4ZWN1dGlvbiB2aWEgY2xvbmUgaG9va3MKW0dIU0EtNnA4aC0zd2d4LTk3Z2ZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hZHZpc29yaWVzL0dIU0EtNnA4aC0zd2d4LTk3Z2YpCgo8ZGV0YWlscz4KPHN1bW1hcnk+TW9yZSBpbmZvcm1hdGlvbjwvc3VtbWFyeT4KCiMjIyMgRGV0YWlscwojIyMjIyBTdW1tYXJ5CkdpdFB5dGhvbidzIGB1bnNhZmVfZ2l0X2Nsb25lX29wdGlvbnNgIGRlbnlsaXN0IG9taXRzIGAtLXRlbXBsYXRlYC4gYGdpdCBjbG9uZSAtLXRlbXBsYXRlPTxkaXI+YCBjb3BpZXMgYDxkaXI+L2hvb2tzL2AgaW50byB0aGUgbmV3IHJlcG9zaXRvcnkgYW5kIHJ1bnMgdGhlbSAoYHBvc3QtY2hlY2tvdXRgIGZpcmVzIGR1cmluZyBjbG9uZSksIHNvIGEgY2FsbGVyIHdobyBjYW4gaW5mbHVlbmNlIGNsb25lIG9wdGlvbnMgY2FuIGFjaGlldmUgYXJiaXRyYXJ5IGNvbW1hbmQgZXhlY3V0aW9uIGluIHRoZSBkZWZhdWx0IGBhbGxvd191bnNhZmVfb3B0aW9ucz1GYWxzZWAgY29uZmlndXJhdGlvbi4KCiMjIyMjIFJvb3QgQ2F1c2UKYGJhc2UucHk6MTQ1LTE1MmAgZGVmaW5lcyBgdW5zYWZlX2dpdF9jbG9uZV9vcHRpb25zID0gWyItLXVwbG9hZC1wYWNrIiwiLXUiLCItLWNvbmZpZyIsIi1jIl1gIOKAlCBgLS10ZW1wbGF0ZWAgaXMgYWJzZW50LiBUaGUgZ3VhcmQgY2FuZGlkYXRlIGBbJy0tdGVtcGxhdGUnXWAgcGFzc2VzIGBjaGVja191bnNhZmVfb3B0aW9uc2AgKHZlcmlmaWVkKS4gZ2l0IGNvcGllcyB0aGUgaG9vayBkaXJlY3RvcnkgYW5kIGV4ZWN1dGVzIGBwb3N0LWNoZWNrb3V0YCBhdCBjaGVja291dCB0aW1lLiBnaXQncyBgcHJvdG9jb2wuYWxsb3dgL2BHSVRfQUxMT1dfUFJPVE9DT0xgIGRvIG5vdCBnYXRlIGAtLXRlbXBsYXRlYDsgdGhlIGluY29tcGxldGUgZGVueWxpc3QgaXMgdGhlIG9ubHkgZGVmZW5zZS4KCiMjIyMjIEltcGFjdApBcmJpdHJhcnkgT1MgY29tbWFuZCBleGVjdXRpb24gZHVyaW5nIGNsb25lIChkZWZhdWx0IGNvbmZpZykuIFJlcXVpcmVzIGFuIGF0dGFja2VyLXJlYWRhYmxlIGRpcmVjdG9yeSBjb250YWluaW5nIGFuIGV4ZWN1dGFibGUgaG9vayDigJQgYSBnZW51aW5lIHNlY29uZCBwcmVjb25kaXRpb24gKHJlYWxpc3RpYyB2aWEgc2hhcmVkIGZpbGVzeXN0ZW1zLCB1cGxvYWQgZGlycywgYC90bXBgLCBvciBhdHRhY2tlci13cml0YWJsZSBuZXR3b3JrIHBhdGhzKSwgcmVmbGVjdGVkIGFzIEFDOkguCgojIyMjIyBQcm9vZiBvZiBDb25jZXB0CmBgYHB5dGhvbgoKIyMjIyMgYXR0YWNrZXIgc3RhZ2VzIDxkaXI+L2hvb2tzL3Bvc3QtY2hlY2tvdXQgKGNobW9kICt4KQpmcm9tIGdpdCBpbXBvcnQgUmVwbwpSZXBvLmNsb25lX2Zyb20oc3JjLCBkc3QsIHRlbXBsYXRlPSc8ZGlyPicpICAgIyBwb3N0LWNoZWNrb3V0IGhvb2sgZXhlY3V0ZXMgLT4gbWFya2VyIGNyZWF0ZWQgKHZlcmlmaWVkKQpgYGAKCiMjIyMjIEF0dGFjayBDaGFpbgoxLiBTZXR1cDogYXR0YWNrZXIgc3RhZ2VzIGA8ZGlyPi9ob29rcy9wb3N0LWNoZWNrb3V0YCAoY2htb2QgK3gpLiBHdWFyZDogbi9hIChmaWxlc3lzdGVtKS4KMi4gRW50cnk6IGBSZXBvLmNsb25lX2Zyb20odXJsLCBwYXRoLCB0ZW1wbGF0ZT0nPGRpcj4nKWAuIEd1YXJkOiBgY2hlY2tfdW5zYWZlX29wdGlvbnMoY2FuZGlkYXRlcz1bJy0tdGVtcGxhdGUnXSwgdW5zYWZlPXVuc2FmZV9naXRfY2xvbmVfb3B0aW9ucylgLiBCeXBhc3MgcHJvb2Y6IGAtLXRlbXBsYXRlYCBub3Qgb24gdGhlIGRlbnlsaXN0IC0+IHBhc3NlcyAodmVyaWZpZWQgY2FuZGlkYXRlIGBbJy0tdGVtcGxhdGUnXWAsIG5vIGVycm9yKS4KMy4gU2luazogZ2l0IGNvcGllcyB0aGUgaG9vayBhbmQgZXhlY3V0ZXMgYHBvc3QtY2hlY2tvdXRgIGF0IGNoZWNrb3V0LiBJbXBhY3Q6IEFDRSwgZGVmYXVsdCBjb25maWcgKHZlcmlmaWVkIG1hcmtlciBjcmVhdGVkKS4KCiMjIyMjIEJ5cGFzcyBFdmlkZW5jZQpMaXZlLXZlcmlmaWVkIG9uIEhFQUQgKHRhZyAzLjEuNTMpOiBndWFyZCBjYW5kaWRhdGUgYFsnLS10ZW1wbGF0ZSddYCBwYXNzZWQgd2l0aCBubyBlcnJvcjsgc3RhZ2VkIGBwb3N0LWNoZWNrb3V0YCBob29rIGV4ZWN1dGVkIGR1cmluZyBgY2xvbmVfZnJvbWAsIGNyZWF0aW5nIHRoZSBtYXJrZXIuIEluZGVwZW5kZW50IG9mIHRoZSB2YWx1ZS1zbXVnZ2xlIGJ5cGFzcyAoYC0tdGVtcGxhdGVgIGlzIGEgbGVnaXRpbWF0ZSBsb25nIG9wdGlvbiB0aGF0IHN1cnZpdmVzIGFueSBzaW5nbGUtY2hhci12YWx1ZSBmaXgpLiBOb3QgY292ZXJlZCBieSBhbnkgZXhpc3RpbmcgYWR2aXNvcnkuCgojIyMjIyBBZmZlY3RlZCBWZXJzaW9ucwpgPD0gMy4xLjUzYAoKIyMjIyMgU3VnZ2VzdGVkIEZpeApBZGQgYC0tdGVtcGxhdGVgIChhbmQgYXVkaXQgZm9yIG90aGVyIGhvb2svZXhlYy1pbmZsdWVuY2luZyBvcHRpb25zKSB0byBgdW5zYWZlX2dpdF9jbG9uZV9vcHRpb25zYC4KCi0tLQpSZXBvcnRlZCBieSAqKnp4IChKYWNlKSoqIOKAlCBHaXRIdWI6IEAmIzgyMDM7bWFudXMtdXNlCgojIyMjIFNldmVyaXR5Ci0gQ1ZTUyBTY29yZTogNy41IC8gMTAgKEhpZ2gpCi0gVmVjdG9yIFN0cmluZzogYENWU1M6My4xL0FWOk4vQUM6SC9QUjpML1VJOk4vUzpVL0M6SC9JOkgvQTpIYAoKIyMjIyBSZWZlcmVuY2VzCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLTZwOGgtM3dneC05N2dmXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS02cDhoLTN3Z3gtOTdnZikKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxODBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTgwKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbW1pdC9mZmNiNTM1OWU4NzYxOWY0ZmU0YTcwYTRhZmY1ZjA4YzU1ODBiYTk3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbW1pdC9mZmNiNTM1OWU4NzYxOWY0ZmU0YTcwYTRhZmY1ZjA4YzU1ODBiYTk3KQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3JlbGVhc2VzL3RhZy8zLjEuNTRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcmVsZWFzZXMvdGFnLzMuMS41NCkKClRoaXMgZGF0YSBpcyBwcm92aWRlZCBieSBbT1NWXShodHRwczovL29zdi5kZXYvdnVsbmVyYWJpbGl0eS9HSFNBLTZwOGgtM3dneC05N2dmKSBhbmQgdGhlIFtHaXRIdWIgQWR2aXNvcnkgRGF0YWJhc2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UpIChbQ0MtQlkgNC4wXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlL2Jsb2IvbWFpbi9MSUNFTlNFLm1kKSkuCjwvZGV0YWlscz4KCi0tLQoKIyMjIEdpdFB5dGhvbjogQXJiaXRyYXJ5IGZpbGUgb3ZlcndyaXRlIHZpYSBnaXQgZGlmZiAtLW91dHB1dCBhcmd1bWVudCBpbmplY3Rpb24gaW4gRGlmZmFibGUuZGlmZiAoa2V5LSBhbmQgdmFsdWUtY29udHJvbGxlZCkKW0dIU0EtZmpyNC14NjYzLW13eGNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hZHZpc29yaWVzL0dIU0EtZmpyNC14NjYzLW13eGMpCgo8ZGV0YWlscz4KPHN1bW1hcnk+TW9yZSBpbmZvcm1hdGlvbjwvc3VtbWFyeT4KCiMjIyMgRGV0YWlscwojIyMjIyBTdW1tYXJ5CmBEaWZmYWJsZS5kaWZmKClgIGZvcndhcmRzIGAqKmt3YXJnc2Agc3RyYWlnaHQgaW50byBgZGlmZmAvYGRpZmZfdHJlZWAgd2l0aCAqKm5vKiogYGNoZWNrX3Vuc2FmZV9vcHRpb25zYCBndWFyZC4gYERpZmZhYmxlYCBpcyBtaXhlZCBpbnRvIGBDb21taXRgLCBgVHJlZWAsIGBJbmRleEZpbGVgLCBhbmQgYFN1Ym1vZHVsZWAsIGdpdmluZyBhIGJyb2FkIHN1cmZhY2UuIGBnaXQgZGlmZiAtLW91dHB1dD08cGF0aD5gIHdyaXRlcyByZWFsIHBhdGNoIGNvbnRlbnQgdG8gYW4gYXR0YWNrZXItY2hvc2VuIHBhdGgsIGVuYWJsaW5nIGFyYml0cmFyeSBmaWxlIG92ZXJ3cml0ZS4KCiMjIyMjIFJvb3QgQ2F1c2UKYGRpZmYucHk6MTg4LTI4M2AgYnVpbGRzIGFuZCBydW5zIHRoZSBkaWZmIGNvbW1hbmQgd2l0aCBubyBgY2hlY2tfdW5zYWZlX29wdGlvbnNgIGFueXdoZXJlIGluIHRoZSBtZXRob2QgKGdyZXAtY29uZmlybWVkKS4gQWRkaXRpb25hbGx5IGBkaWZmLnB5OjI2NWAgZG9lcyBgYXJncy5pbnNlcnQoMCwgb3RoZXIpYCwgcGxhY2luZyB0aGUgY2FsbGVyLXN1cHBsaWVkIGBvdGhlcmAgcmVmIEJFRk9SRSB0aGUgYC0tYCBzZXBhcmF0b3IsIHNvIGEgdmFsdWUgb2YgYC0tb3V0cHV0PS9wYXRoYCBpcyBwYXJzZWQgYnkgZ2l0IGFzIGFuIG9wdGlvbiDigJQgYSB2YWx1ZS1vbmx5IGNvbnRyb2wgcGF0aCByZXF1aXJpbmcgbm8ga3dhcmcga2V5LgoKIyMjIyMgSW1wYWN0Ck92ZXJ3cml0ZS9jb3JydXB0IGFueSBmaWxlIGF0IHByb2Nlc3MgcHJpdmlsZWdlIHdpdGggYXR0YWNrZXItY2hvc2VuIHBhdGggKGUuZy4gYH4vLnNzaC9hdXRob3JpemVkX2tleXNgLCBjb25maWdzLCBsb2NrZmlsZXMpLiBDb250ZW50IGlzIHJlYWwgZGlmZi9wYXRjaCBieXRlcyAoYXR0YWNrZXItaW5mbHVlbmNlZCkuIFBlciB0aGUgc2tpbGwncyBydWxlLCBjb250cm9sbGluZyBXSElDSCBmaWxlIGlzIG92ZXJ3cml0dGVuID0gSTpIIHJlZ2FyZGxlc3Mgb2YgY29udGVudCBjb25zdHJhaW50cy4KCiMjIyMjIFByb29mIG9mIENvbmNlcHQKYGBgcHl0aG9uCgojIyMjIyBLZXktY29udHJvbDoKY29tbWl0LmRpZmYob3RoZXJfY29tbWl0LCBvdXRwdXQ9Jy9ob21lL2FwcC8uc3NoL2F1dGhvcml6ZWRfa2V5cycpICAgIyB2aWN0aW0gb3ZlcndyaXR0ZW4gd2l0aCBkaWZmICgxMDUgYnl0ZXMgdmVyaWZpZWQpCgojIyMjIyBWYWx1ZS1jb250cm9sIChhdHRhY2tlciBjb250cm9scyBvbmx5IHRoZSByZWYgc3RyaW5nKToKY29tbWl0LmRpZmYob3RoZXI9Jy0tb3V0cHV0PS9ob21lL2FwcC8uc3NoL2F1dGhvcml6ZWRfa2V5cycpICAgICAgICAgICMgMTQtYnl0ZSB2aWN0aW0gLT4gMTQ2IGJ5dGVzIG9mIGRpZmYtdHJlZSBvdXRwdXQKYGBgCgojIyMjIyBBdHRhY2sgQ2hhaW4KMS4gRW50cnkgKHZhbHVlLWNvbnRyb2wpOiBgY29tbWl0LmRpZmYob3RoZXI9PHVzZXIgcmVmPilgIHdpdGggYG90aGVyID0gIi0tb3V0cHV0PS9ob21lL2FwcC8uc3NoL2F1dGhvcml6ZWRfa2V5cyJgLiBHdWFyZDogbm9uZSBpbiBgRGlmZmFibGUuZGlmZmAuIEJ5cGFzcyBwcm9vZjogbm8gYGNoZWNrX3Vuc2FmZV9vcHRpb25zYCBpbiB0aGUgbWV0aG9kIGJvZHkgKGdyZXApOyBgb3RoZXJgIGluc2VydGVkIHByZS1gLS1gIGF0IGRpZmYucHk6MjY1LgoyLiBTaW5rOiBgZ2l0IGRpZmYtdHJlZSA8c2hhPiAtLW91dHB1dD0vaG9tZS9hcHAvLnNzaC9hdXRob3JpemVkX2tleXMgLXIgLi4uYCAtPiBnaXQgb3BlbnMrdHJ1bmNhdGVzIHRoZSB0YXJnZXQgdGhlbiB3cml0ZXMgZGlmZiBjb250ZW50LiBJbXBhY3Q6IG92ZXJ3cml0ZS9jb3JydXB0IGFueSBmaWxlIGF0IHByb2Nlc3MgcHJpdmlsZWdlIChhdHRhY2tlciBjaG9vc2VzIHRoZSBwYXRoKS4gVmVyaWZpZWQgYXJndiBhbmQgdmljdGltIG92ZXJ3cml0ZSBsaXZlLgoKIyMjIyMgQnlwYXNzIEV2aWRlbmNlCkxpdmUtdmVyaWZpZWQgb24gSEVBRCAodGFnIDMuMS41Myk6IGJvdGgga2V5LWNvbnRyb2wgKGBvdXRwdXQ9YCkgYW5kIHZhbHVlLWNvbnRyb2wgKGBvdGhlcj0nLS1vdXRwdXQ9Li4uJ2ApIG92ZXJ3cm90ZSBhIHZpY3RpbSBmaWxlIHdpdGggcmVhbCBkaWZmLXRyZWUgY29udGVudDsgYXJndiBjb25maXJtZWQgYFsnZ2l0JywnZGlmZi10cmVlJywnPHNoYT4nLCctLW91dHB1dD0vdmljdGltJywnLXInLC4uLl1gLiBUaGlzIGlzIHRoZSBzYW1lIHZhbHVlLWNvbnRyb2wgbW9kZWwgR0hTQS05NTZ4IGRlZW1lZCBmaXgtd29ydGh5IGZvciBgaXRlcl9jb21taXRzKHJldj0nLS1vdXRwdXQ9JylgIOKAlCBidXQgYGRpZmZgIGlzIGEgZGlzdGluY3QsIHVuZ3VhcmRlZCBzaW5rIE5PVCB0b3VjaGVkIGJ5IHRoYXQgZml4LgoKIyMjIyMgQWZmZWN0ZWQgVmVyc2lvbnMKYDw9IDMuMS41M2AKCiMjIyMjIFN1Z2dlc3RlZCBGaXgKQWRkIGBjaGVja191bnNhZmVfb3B0aW9uc2AgdG8gYERpZmZhYmxlLmRpZmZgIChtaXJyb3JpbmcgYGl0ZXJfY29tbWl0c2AvYGFyY2hpdmVgKSwgYW5kL29yIHBsYWNlIGAtLWVuZC1vZi1vcHRpb25zYCBiZWZvcmUgdGhlIGBvdGhlcmAgcmVmIHNvIGl0IGNhbm5vdCBiZSBwYXJzZWQgYXMgYW4gb3B0aW9uLgoKLS0tClJlcG9ydGVkIGJ5ICoqenggKEphY2UpKiog4oCUIEdpdEh1YjogQCYjODIwMzttYW51cy11c2UKCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA4LjEgLyAxMCAoSGlnaCkKLSBWZWN0b3IgU3RyaW5nOiBgQ1ZTUzozLjEvQVY6Ti9BQzpML1BSOkwvVUk6Ti9TOlUvQzpOL0k6SC9BOkhgCgojIyMjIFJlZmVyZW5jZXMKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtZmpyNC14NjYzLW13eGNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLWZqcjQteDY2My1td3hjKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjE4MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxODApCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vY29tbWl0LzFkNTFiODkxZDdmMjM2MDQ0YTZhYTE3NDk4ZWM2ODJiNjNkYWQ2ZTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vY29tbWl0LzFkNTFiODkxZDdmMjM2MDQ0YTZhYTE3NDk4ZWM2ODJiNjNkYWQ2ZTYpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24pCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcmVsZWFzZXMvdGFnLzMuMS41NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9yZWxlYXNlcy90YWcvMy4xLjU0KQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IFtPU1ZdKGh0dHBzOi8vb3N2LmRldi92dWxuZXJhYmlsaXR5L0dIU0EtZmpyNC14NjYzLW13eGMpIGFuZCB0aGUgW0dpdEh1YiBBZHZpc29yeSBEYXRhYmFzZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZSkgKFtDQy1CWSA0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UvYmxvYi9tYWluL0xJQ0VOU0UubWQpKS4KPC9kZXRhaWxzPgoKLS0tCgojIyMgR2l0UHl0aG9uOiBVbnNhZmUgZ2l0IG9wdGlvbiBndWFyZCBieXBhc3MgdmlhIHNpbmdsZS1jaGFyYWN0ZXIga3dhcmcgdmFsdWUgdG9rZW4gc211Z2dsaW5nIGVuYWJsZXMgYXJiaXRyYXJ5IGNvbW1hbmQgZXhlY3V0aW9uCltHSFNBLXI5bXItbTM3Yy01ZnIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLXI5bXItbTM3Yy01ZnIzKQoKPGRldGFpbHM+CjxzdW1tYXJ5Pk1vcmUgaW5mb3JtYXRpb248L3N1bW1hcnk+CgojIyMjIERldGFpbHMKIyMjIyMgU3VtbWFyeQpHaXRQeXRob24ncyBgY2hlY2tfdW5zYWZlX29wdGlvbnNgIGd1YXJkICh0aGUgY29udHJvbCBpbnRyb2R1Y2VkIGJ5IENWRS0yMDI2LTQyMjE1IC8gR0hTQS0yZjk2IGFuZCBoYXJkZW5lZCBzaW5jZSkgY2FuIGJlIGJ5cGFzc2VkIGZvciAqKmV2ZXJ5KiogZ3VhcmRlZCBtZXRob2QgKGBjbG9uZWAvYGNsb25lX2Zyb21gLCBgZmV0Y2hgL2BwdWxsYC9gcHVzaGAsIGBsc19yZW1vdGVgLCBgaXRlcl9jb21taXRzYCwgYGJsYW1lYCwgYGFyY2hpdmVgKSBieSBzbXVnZ2xpbmcgYW4gb3B0aW9uIHRva2VuIGluc2lkZSB0aGUgVkFMVUUgb2YgYSBzaW5nbGUtY2hhcmFjdGVyIGt3YXJnLiBJbiB0aGUgZGVmYXVsdCBgYWxsb3dfdW5zYWZlX29wdGlvbnM9RmFsc2VgIGNvbmZpZ3VyYXRpb24gdGhpcyB5aWVsZHMgYXJiaXRyYXJ5IGNvbW1hbmQgZXhlY3V0aW9uIHZpYSBgLS11cGxvYWQtcGFja2AuCgojIyMjIyBSb290IENhdXNlClRoZSBndWFyZCBidWlsZHMgaXRzIGNhbmRpZGF0ZSBvcHRpb24gbGlzdCBmcm9tIGt3YXJnIEtFWVMgb25seTogYF9vcHRpb25fY2FuZGlkYXRlcyhbXSwgeyJuIjoiLS11cGxvYWQtcGFjaz08Y21kPiJ9KWAgcmV0dXJucyBgWyctbiddYCAoY21kLnB5OjEwNDItMTA0NiBkZXJpdmVzIHRoZSBjYW5kaWRhdGUgZnJvbSB0aGUga2V5LCBuZXZlciB0aGUgdmFsdWUpLiBgLW5gIGlzIG5vdCBvbiB0aGUgZGVueWxpc3QsIHNvIGBjaGVja191bnNhZmVfb3B0aW9uc2AgcGFzc2VzLiBCdXQgYHRyYW5zZm9ybV9rd2FyZygnbicsIHZhbHVlLCBzcGxpdF9zaW5nbGVfY2hhcl9vcHRpb25zPVRydWUpYCAoY21kLnB5OjE2MDAtMTYwNikgZW1pdHMgKip0d28qKiBhcmd2IHRva2VucyBgWyctbicsICctLXVwbG9hZC1wYWNrPTxjbWQ+J11gLiBnaXQgdGhlbiBwYXJzZXMgdGhlIHNlY29uZCB0b2tlbiBhcyBgLS11cGxvYWQtcGFja2AgYW5kIGV4ZWN1dGVzIHRoZSBhdHRhY2tlci1zdXBwbGllZCBjb21tYW5kLiBUaGUgZ3VhcmQgbmV2ZXIgaW5zcGVjdHMgdGhlIHZhbHVlIHRoYXQgYmVjb21lcyBhIHNlcGFyYXRlIGFyZ3YgdG9rZW4uCgojIyMjIyBJbXBhY3QKQXJiaXRyYXJ5IE9TIGNvbW1hbmQgZXhlY3V0aW9uIGFzIHRoZSBob3N0IHByb2Nlc3MgKHZpYSBgLS11cGxvYWQtcGFja2ApIGluIHRoZSBkZWZhdWx0IGNvbmZpZ3VyYXRpb24sIGFmZmVjdGluZyBhbGwgZ3VhcmRlZCBtZXRob2RzIHNpbmNlIHRoZXkgYWxsIGJ1aWxkIGNhbmRpZGF0ZXMgdGhyb3VnaCB0aGUgbmFtZS1vbmx5IGBfb3B0aW9uX2NhbmRpZGF0ZXNgLgoKIyMjIyMgUHJvb2Ygb2YgQ29uY2VwdApgYGBweXRob24KZnJvbSBnaXQgaW1wb3J0IFJlcG8KUmVwby5jbG9uZV9mcm9tKGJhcmVfcmVwbywgb3V0X2Rpciwgbj0iLS11cGxvYWQtcGFjaz10b3VjaCAvdG1wL0FDRTtnaXQtdXBsb2FkLXBhY2siKQoKIyMjIyMgL3RtcC9BQ0UgY3JlYXRlZCAtPiBBQ0UuIERpcmVjdC1uYW1lIGZvcm0gdXBsb2FkX3BhY2s9Ii4uLiIgaXMgY29ycmVjdGx5IEJMT0NLRUQuCmBgYApGaWxlLXdyaXRlIHZhcmlhbnQgb24gYSBndWFyZGVkIHJldmlzaW9uIGNvbW1hbmQ6IGBpdGVyX2NvbW1pdHMoJ0hFQUQnLCBnPSctLW91dHB1dD0vcGF0aCcpYCAtPiBjYW5kaWRhdGUgYFsnLWcnXWAgcGFzc2VzLCBhcmd2IGBbJy1nJywnLS1vdXRwdXQ9L3BhdGgnXWAsIHZpY3RpbSBmaWxlIHRydW5jYXRlZC4KCiMjIyMjIEF0dGFjayBDaGFpbgoxLiBFbnRyeTogYXBwIGZvcndhcmRzIGEgdXNlci1zdXBwbGllZCBvcHRpb25zIGRpY3QgLT4gYFJlcG8uY2xvbmVfZnJvbSh1cmwsIHBhdGgsIG49Ii0tdXBsb2FkLXBhY2s9dG91Y2ggL3RtcC9BQ0U7Z2l0LXVwbG9hZC1wYWNrIilgLiBHdWFyZDogYGNoZWNrX3Vuc2FmZV9vcHRpb25zKG9wdGlvbnM9X29wdGlvbl9jYW5kaWRhdGVzKFtdLCBrd2FyZ3MpLCB1bnNhZmU9dW5zYWZlX2dpdF9jbG9uZV9vcHRpb25zKWAgYXQgYmFzZS5weS4gQnlwYXNzIHByb29mOiBgX29wdGlvbl9jYW5kaWRhdGVzKFtdLCB7Im4iOiItLXVwbG9hZC1wYWNrPS4uLiJ9KWAgLT4gYFsnLW4nXWAgKGtleS1vbmx5KSwgbm90IG9uIGRlbnlsaXN0IC0+IG5vIFVuc2FmZU9wdGlvbkVycm9yICh2ZXJpZmllZCBsaXZlKS4KMi4gVHJhbnNmb3JtOiBgdHJhbnNmb3JtX2t3YXJnKCduJywgdmFsdWUsIHNwbGl0X3NpbmdsZV9jaGFyX29wdGlvbnM9VHJ1ZSlgIC0+IGBbJy1uJywgJy0tdXBsb2FkLXBhY2s9dG91Y2ggL3RtcC9BQ0U7Z2l0LXVwbG9hZC1wYWNrJ11gLiBHdWFyZDogbm9uZSAoZ3VhcmQgYWxyZWFkeSBwYXNzZWQgb24gbmFtZS1vbmx5IGNhbmRpZGF0ZSkuIEJ5cGFzcyBwcm9vZjogdmVyaWZpZWQgdHJhbnNmb3JtIGVtaXRzIHR3byB0b2tlbnMuCjMuIFNpbms6IGBnaXQgY2xvbmUgLW4gLS11cGxvYWQtcGFjaz0ndG91Y2ggLi4uO2dpdC11cGxvYWQtcGFjaycgLS0gPHNyYz4gPGRzdD5gOyBnaXQgcGFyc2VzIGFuZCBydW5zIHRoZSBzZWNvbmQgdG9rZW4uIEltcGFjdDogQUNFIChtYXJrZXIgY3JlYXRlZCwgdmVyaWZpZWQgZW5kLXRvLWVuZCkuCgojIyMjIyBCeXBhc3MgRXZpZGVuY2UKTGl2ZS12ZXJpZmllZCBvbiBIRUFEICh0YWcgMy4xLjUzKTogYF9vcHRpb25fY2FuZGlkYXRlc2AgcmV0dXJucyBrZXktb25seSBjYW5kaWRhdGUgYFsnLW4nXWA7IGB0cmFuc2Zvcm1fa3dhcmdzYCBlbWl0cyB0aGUgc211Z2dsZWQgYC0tdXBsb2FkLXBhY2s9YCB0b2tlbjsgY2xvbmVfZnJvbSB3aXRoIHRoZSBwYXlsb2FkIGNyZWF0ZWQgdGhlIG1hcmtlciBmaWxlOyB0aGUgZGlyZWN0LW5hbWUgYHVwbG9hZF9wYWNrPWAgZm9ybSByYWlzZWQgVW5zYWZlT3B0aW9uRXJyb3IuIEFsbCBwcmlvciBieXBhc3NlcyAoR0hTQS1ycG01IHVuZGVyc2NvcmUga2V5LCBHSFNBLTJmOTYgbG9uZy1vcHRpb24gYWJicmV2aWF0aW9uLCBHSFNBLXYzOTYgam9pbmVkIHNob3J0IG9wdGlvbiwgR0hTQS14MnF4IG11bHRpLWJlZm9yZS1zcGxpdCkgYXJlIEJMT0NLRUQgb24gSEVBRCDigJQgdGhpcyBpcyBhIGRpc3RpbmN0IGt3YXJnLXZhbHVlLT5zZXBhcmF0ZS10b2tlbiB2ZWN0b3IuCgojIyMjIyBBZmZlY3RlZCBWZXJzaW9ucwpgPD0gMy4xLjUzYAoKIyMjIyMgU3VnZ2VzdGVkIEZpeApNYWtlIGBfb3B0aW9uX2NhbmRpZGF0ZXNgIGFsc28gZW1pdCBjYW5kaWRhdGVzIGRlcml2ZWQgZnJvbSBzaW5nbGUtY2hhcmFjdGVyIGt3YXJnIFZBTFVFUyB3aGVuIGBzcGxpdF9zaW5nbGVfY2hhcl9vcHRpb25zYCBpcyBpbiBlZmZlY3QsIE9SIHJ1biBgY2hlY2tfdW5zYWZlX29wdGlvbnNgIG92ZXIgdGhlIGZ1bGx5LXRyYW5zZm9ybWVkIGFyZ3YgcmF0aGVyIHRoYW4gdGhlIHJlY29uc3RydWN0ZWQgbmFtZS1vbmx5IGNhbmRpZGF0ZSBsaXN0LgoKLS0tClJlcG9ydGVkIGJ5ICoqenggKEphY2UpKiog4oCUIEdpdEh1YjogQCYjODIwMzttYW51cy11c2UKCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA4LjggLyAxMCAoSGlnaCkKLSBWZWN0b3IgU3RyaW5nOiBgQ1ZTUzozLjEvQVY6Ti9BQzpML1BSOkwvVUk6Ti9TOlUvQzpIL0k6SC9BOkhgCgojIyMjIFJlZmVyZW5jZXMKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0Etcjltci1tMzdjLTVmcjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLXI5bXItbTM3Yy01ZnIzKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjE4MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxODApCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vY29tbWl0L2U4ZDBmYmY3NzRkMWY2YmFhM2I0ODFhZGZlNDhiZDI2MmU0M2I0NTNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vY29tbWl0L2U4ZDBmYmY3NzRkMWY2YmFhM2I0ODFhZGZlNDhiZDI2MmU0M2I0NTMpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24pCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcmVsZWFzZXMvdGFnLzMuMS41NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9yZWxlYXNlcy90YWcvMy4xLjU0KQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IFtPU1ZdKGh0dHBzOi8vb3N2LmRldi92dWxuZXJhYmlsaXR5L0dIU0Etcjltci1tMzdjLTVmcjMpIGFuZCB0aGUgW0dpdEh1YiBBZHZpc29yeSBEYXRhYmFzZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZSkgKFtDQy1CWSA0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UvYmxvYi9tYWluL0xJQ0VOU0UubWQpKS4KPC9kZXRhaWxzPgoKLS0tCgojIyMgUmVsZWFzZSBOb3RlcwoKPGRldGFpbHM+CjxzdW1tYXJ5PmdpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbiAoR2l0UHl0aG9uKTwvc3VtbWFyeT4KCiMjIyBbYHYzLjEuNTRgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3JlbGVhc2VzL3RhZy8zLjEuNTQpOiAtIFNFQ1VSSVRZCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vY29tcGFyZS8zLjEuNTMuLi4zLjEuNTQpCgojIyMjIFdoYXQncyBDaGFuZ2VkCgotIEhhcmRlbiB1bnNhZmUgR2l0IG9wdGlvbiB2YWxpZGF0aW9uIGJ5IFtAJiM4MjAzO0J5cm9uXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vQnlyb24pIGluIFsjJiM4MjAzOzIxODBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTgwKQoKKipGdWxsIENoYW5nZWxvZyoqOiA8aHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9jb21wYXJlLzMuMS41My4uLjMuMS41ND4KCjwvZGV0YWlscz4KCi0tLQoKIyMjIENvbmZpZ3VyYXRpb24KCvCfk4UgKipTY2hlZHVsZSoqOiAoVVRDKQoKLSBCcmFuY2ggY3JlYXRpb24KICAtIEF0IGFueSB0aW1lIChubyBzY2hlZHVsZSBkZWZpbmVkKQotIEF1dG9tZXJnZQogIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpCgrwn5qmICoqQXV0b21lcmdlKio6IERpc2FibGVkIGJ5IGNvbmZpZy4gUGxlYXNlIG1lcmdlIHRoaXMgbWFudWFsbHkgb25jZSB5b3UgYXJlIHNhdGlzZmllZC4KCuKZuyAqKlJlYmFzaW5nKio6IFdoZW5ldmVyIFBSIGJlY29tZXMgY29uZmxpY3RlZCwgb3IgeW91IHRpY2sgdGhlIHJlYmFzZS9yZXRyeSBjaGVja2JveC4KCvCflJUgKipJZ25vcmUqKjogQ2xvc2UgdGhpcyBQUiBhbmQgeW91IHdvbid0IGJlIHJlbWluZGVkIGFib3V0IHRoaXMgdXBkYXRlIGFnYWluLgoKLS0tCgogLSBbIF0gPCEtLSByZWJhc2UtY2hlY2sgLS0+SWYgeW91IHdhbnQgdG8gcmViYXNlL3JldHJ5IHRoaXMgUFIsIGNoZWNrIHRoaXMgYm94CgotLS0KClRoaXMgUFIgd2FzIGdlbmVyYXRlZCBieSBbTWVuZCBSZW5vdmF0ZV0oaHR0cHM6Ly9tZW5kLmlvL3Jlbm92YXRlLykuIFZpZXcgdGhlIFtyZXBvc2l0b3J5IGpvYiBsb2ddKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vZ2l0aHViL29zaXNtL3JlbGVhc2UpLgo8IS0tcmVub3ZhdGUtZGVidWc6ZXlKamNtVmhkR1ZrU1c1V1pYSWlPaUkwTXk0eU9EQXVNQ0lzSW5Wd1pHRjBaV1JKYmxabGNpSTZJalF6TGpJNE1DNHdJaXdpZEdGeVoyVjBRbkpoYm1Ob0lqb2liV0ZwYmlJc0lteGhZbVZzY3lJNld5SnlaVzV2ZG1GMFpTSmRmUT09LS0+Cg==
      patchset: 0e02ffbec896bbc1029bd054681ad3acda6af8c2
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/python-black/run.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: 09c0078be2c3dd59396dca34088e764ec0f16157
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/2625/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
