all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe0c:7b84
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      docker_namespace: osism
      docker_registry: osism.harbor.regio.digital
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 6579185e-6658-47ca-952b-5ee0d0623a67
        host_id: 82101243836454d7401d5893feae9e2c5df7cc291646d8a99b33b53b
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe0c:7b84
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.67
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.97
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe0c:7b84
        region: null
        slot: null
  vars:
    docker_namespace: osism
    docker_registry: osism.harbor.regio.digital
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job container-image-python-osism-build explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/python-osism/.zuul.yaml@main#79>'
      - '<Job container-image-python-osism-build explicit: None implied: None source:
        osism/python-osism/.zuul.yaml@main#143>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: b1254fe0ccd249bdb2b9fdb20a861ece
      build_refs:
      - branch: main
        change: '2517'
        change_message: "Update dependency GitPython to v3.1.54 [SECURITY]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n### GitPython: Incomplete unsafe_git_clone_options denylist
          omits --template enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about these updates again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/python-osism).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/python-osism/pull/2517
        commit_id: 8c19d18bd40662c54bdae5291d9484e52bec507a
        patchset: 8c19d18bd40662c54bdae5291d9484e52bec507a
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      buildset: d412854020df46d898afbf5420e3f195
      buildset_refs:
      - branch: main
        change: '2517'
        change_message: "Update dependency GitPython to v3.1.54 [SECURITY]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n### GitPython: Incomplete unsafe_git_clone_options denylist
          omits --template enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about these updates again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/python-osism).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/python-osism/pull/2517
        commit_id: 8c19d18bd40662c54bdae5291d9484e52bec507a
        patchset: 8c19d18bd40662c54bdae5291d9484e52bec507a
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      change: '2517'
      change_message: "Update dependency GitPython to v3.1.54 [SECURITY]\n\nThis PR
        contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
        | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
        [GitPython](https://redirect.github.com/gitpython-developers/GitPython) |
        `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
        | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
        |\n\n---\n\n### GitPython: Incomplete unsafe_git_clone_options denylist omits
        --template enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
        denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
        into the new repository and runs them (`post-checkout` fires during clone),
        so a caller who can influence clone options can achieve arbitrary command
        execution in the default `allow_unsafe_options=False` configuration.\n\n#####
        Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
        \u2014 `--template` is absent. The guard candidate `['--template']` passes
        `check_unsafe_options` (verified). git copies the hook directory and executes
        `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
        do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
        Impact\nArbitrary OS command execution during clone (default config). Requires
        an attacker-readable directory containing an executable hook \u2014 a genuine
        second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
        or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
        Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
        +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
        post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
        Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x). Guard:
        n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
        Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
        Bypass proof: `--template` not on the denylist -> passes (verified candidate
        `['--template']`, no error).\n3. Sink: git copies the hook and executes `post-checkout`
        at checkout. Impact: ACE, default config (verified marker created).\n\n#####
        Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): guard candidate `['--template']`
        passed with no error; staged `post-checkout` hook executed during `clone_from`,
        creating the marker. Independent of the value-smuggle bypass (`--template`
        is a legitimate long option that survives any single-char-value fix). Not
        covered by any existing advisory.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
        Suggested Fix\nAdd `--template` (and audit for other hook/exec-influencing
        options) to `unsafe_git_clone_options`.\n\n---\nReported by **zx (Jace)**
        \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 7.5 / 10
        (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        GitPython: Arbitrary file overwrite via git diff --output argument injection
        in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()` forwards
        `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
        guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
        giving a broad surface. `git diff --output=<path>` writes real patch content
        to an attacker-chosen path, enabling arbitrary file overwrite.\n\n##### Root
        Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
        anywhere in the method (grep-confirmed). Additionally `diff.py:265` does `args.insert(0,
        other)`, placing the caller-supplied `other` ref BEFORE the `--` separator,
        so a value of `--output=/path` is parsed by git as an option \u2014 a value-only
        control path requiring no kwarg key.\n\n##### Impact\nOverwrite/corrupt any
        file at process privilege with attacker-chosen path (e.g. `~/.ssh/authorized_keys`,
        configs, lockfiles). Content is real diff/patch bytes (attacker-influenced).
        Per the skill's rule, controlling WHICH file is overwritten = I:H regardless
        of content constraints.\n\n##### Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
        output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
        (105 bytes verified)\n\n##### Value-control (attacker controls only the ref
        string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')          #
        14-byte victim -> 146 bytes of diff-tree output\n```\n\n##### Attack Chain\n1.
        Entry (value-control): `commit.diff(other=<user ref>)` with `other = \"--output=/home/app/.ssh/authorized_keys\"`.
        Guard: none in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in
        the method body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink:
        `git diff-tree <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git
        opens+truncates the target then writes diff content. Impact: overwrite/corrupt
        any file at process privilege (attacker chooses the path). Verified argv and
        victim overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag
        3.1.53): both key-control (`output=`) and value-control (`other='--output=...'`)
        overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
        This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
        \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
        Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
        to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
        before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
        by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
        Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        GitPython: Unsafe git option guard bypass via single-character kwarg value
        token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
        guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since)
        can be bypassed for **every** guarded method (`clone`/`clone_from`, `fetch`/`pull`/`push`,
        `ls_remote`, `iter_commits`, `blame`, `archive`) by smuggling an option token
        inside the VALUE of a single-character kwarg. In the default `allow_unsafe_options=False`
        configuration this yields arbitrary command execution via `--upload-pack`.\n\n#####
        Root Cause\nThe guard builds its candidate option list from kwarg KEYS only:
        `_option_candidates([], {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']`
        (cmd.py:1042-1046 derives the candidate from the key, never the value). `-n`
        is not on the denylist, so `check_unsafe_options` passes. But `transform_kwarg('n',
        value, split_single_char_options=True)` (cmd.py:1600-1606) emits **two** argv
        tokens `['-n', '--upload-pack=<cmd>']`. git then parses the second token as
        `--upload-pack` and executes the attacker-supplied command. The guard never
        inspects the value that becomes a separate argv token.\n\n##### Impact\nArbitrary
        OS command execution as the host process (via `--upload-pack`) in the default
        configuration, affecting all guarded methods since they all build candidates
        through the name-only `_option_candidates`.\n\n##### Proof of Concept\n```python\nfrom
        git import Repo\nRepo.clone_from(bare_repo, out_dir, n=\"--upload-pack=touch
        /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE created -> ACE. Direct-name
        form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write variant on
        a guarded revision command: `iter_commits('HEAD', g='--output=/path')` ->
        candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file truncated.\n\n#####
        Attack Chain\n1. Entry: app forwards a user-supplied options dict -> `Repo.clone_from(url,
        path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`. Guard: `check_unsafe_options(options=_option_candidates([],
        kwargs), unsafe=unsafe_git_clone_options)` at base.py. Bypass proof: `_option_candidates([],
        {\"n\":\"--upload-pack=...\"})` -> `['-n']` (key-only), not on denylist ->
        no UnsafeOptionError (verified live).\n2. Transform: `transform_kwarg('n',
        value, split_single_char_options=True)` -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`.
        Guard: none (guard already passed on name-only candidate). Bypass proof: verified
        transform emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
        -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
        created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
        HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
        `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from with
        the payload created the marker file; the direct-name `upload_pack=` form raised
        UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore key, GHSA-2f96
        long-option abbreviation, GHSA-v396 joined short option, GHSA-x2qx multi-before-split)
        are BLOCKED on HEAD \u2014 this is a distinct kwarg-value->separate-token
        vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nMake
        `_option_candidates` also emit candidates derived from single-character kwarg
        VALUES when `split_single_char_options` is in effect, OR run `check_unsafe_options`
        over the fully-transformed argv rather than the reconstructed name-only candidate
        list.\n\n---\nReported by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n####
        Severity\n- CVSS Score: 8.8 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
        References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
        [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
        [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
        [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
        [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
        data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
        and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
        [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
        - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
        What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
        in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
        Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
        At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
        defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
        manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
        conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
        Close this PR and you won't be reminded about these updates again.\n\n---\n\n
        - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
        box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
        View the [repository job log](https://developer.mend.io/github/osism/python-osism).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
      change_url: https://github.com/osism/python-osism/pull/2517
      child_jobs: []
      commit_id: 8c19d18bd40662c54bdae5291d9484e52bec507a
      event_id: 28eca2f0-87a0-11f1-9be6-62387ab97148
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/b1254fe0ccd249bdb2b9fdb20a861ece/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/b1254fe0ccd249bdb2b9fdb20a861ece/work/logs
        result_data_file: /var/lib/zuul/builds/b1254fe0ccd249bdb2b9fdb20a861ece/work/results.json
        src_root: /var/lib/zuul/builds/b1254fe0ccd249bdb2b9fdb20a861ece/work/src
        work_root: /var/lib/zuul/builds/b1254fe0ccd249bdb2b9fdb20a861ece/work
      include_vars: []
      items:
      - branch: main
        change: '2517'
        change_message: "Update dependency GitPython to v3.1.54 [SECURITY]\n\nThis
          PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [GitPython](https://redirect.github.com/gitpython-developers/GitPython)
          | `==3.1.53` \u2192 `==3.1.54` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gitpython/3.1.54?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gitpython/3.1.53/3.1.54?slim=true)
          |\n\n---\n\n### GitPython: Incomplete unsafe_git_clone_options denylist
          omits --template enabling arbitrary command execution via clone hooks\n[GHSA-6p8h-3wgx-97gf](https://redirect.github.com/advisories/GHSA-6p8h-3wgx-97gf)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `unsafe_git_clone_options`
          denylist omits `--template`. `git clone --template=<dir>` copies `<dir>/hooks/`
          into the new repository and runs them (`post-checkout` fires during clone),
          so a caller who can influence clone options can achieve arbitrary command
          execution in the default `allow_unsafe_options=False` configuration.\n\n#####
          Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]`
          \u2014 `--template` is absent. The guard candidate `['--template']` passes
          `check_unsafe_options` (verified). git copies the hook directory and executes
          `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL`
          do not gate `--template`; the incomplete denylist is the only defense.\n\n#####
          Impact\nArbitrary OS command execution during clone (default config). Requires
          an attacker-readable directory containing an executable hook \u2014 a genuine
          second precondition (realistic via shared filesystems, upload dirs, `/tmp`,
          or attacker-writable network paths), reflected as AC:H.\n\n##### Proof of
          Concept\n```python\n\n##### attacker stages <dir>/hooks/post-checkout (chmod
          +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='<dir>')   #
          post-checkout hook executes -> marker created (verified)\n```\n\n##### Attack
          Chain\n1. Setup: attacker stages `<dir>/hooks/post-checkout` (chmod +x).
          Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='<dir>')`.
          Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`.
          Bypass proof: `--template` not on the denylist -> passes (verified candidate
          `['--template']`, no error).\n3. Sink: git copies the hook and executes
          `post-checkout` at checkout. Impact: ACE, default config (verified marker
          created).\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          guard candidate `['--template']` passed with no error; staged `post-checkout`
          hook executed during `clone_from`, creating the marker. Independent of the
          value-smuggle bypass (`--template` is a legitimate long option that survives
          any single-char-value fix). Not covered by any existing advisory.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `--template`
          (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97](https://redirect.github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6p8h-3wgx-97gf)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Arbitrary file overwrite via git diff --output argument injection
          in Diffable.diff (key- and value-controlled)\n[GHSA-fjr4-x663-mwxc](https://redirect.github.com/advisories/GHSA-fjr4-x663-mwxc)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n`Diffable.diff()`
          forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options`
          guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`,
          giving a broad surface. `git diff --output=<path>` writes real patch content
          to an attacker-chosen path, enabling arbitrary file overwrite.\n\n#####
          Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options`
          anywhere in the method (grep-confirmed). Additionally `diff.py:265` does
          `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE
          the `--` separator, so a value of `--output=/path` is parsed by git as an
          option \u2014 a value-only control path requiring no kwarg key.\n\n#####
          Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen
          path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real
          diff/patch bytes (attacker-influenced). Per the skill's rule, controlling
          WHICH file is overwritten = I:H regardless of content constraints.\n\n#####
          Proof of Concept\n```python\n\n##### Key-control:\ncommit.diff(other_commit,
          output='/home/app/.ssh/authorized_keys')   # victim overwritten with diff
          (105 bytes verified)\n\n##### Value-control (attacker controls only the
          ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys')
          \         # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n#####
          Attack Chain\n1. Entry (value-control): `commit.diff(other=<user ref>)`
          with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none
          in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method
          body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree
          <sha> --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates
          the target then writes diff content. Impact: overwrite/corrupt any file
          at process privilege (attacker chooses the path). Verified argv and victim
          overwrite live.\n\n##### Bypass Evidence\nLive-verified on HEAD (tag 3.1.53):
          both key-control (`output=`) and value-control (`other='--output=...'`)
          overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','<sha>','--output=/victim','-r',...]`.
          This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')`
          \u2014 but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n#####
          Affected Versions\n`<= 3.1.53`\n\n##### Suggested Fix\nAdd `check_unsafe_options`
          to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options`
          before the `other` ref so it cannot be parsed as an option.\n\n---\nReported
          by **zx (Jace)** \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS
          Score: 8.1 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6](https://redirect.github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fjr4-x663-mwxc)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          GitPython: Unsafe git option guard bypass via single-character kwarg value
          token smuggling enables arbitrary command execution\n[GHSA-r9mr-m37c-5fr3](https://redirect.github.com/advisories/GHSA-r9mr-m37c-5fr3)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\nGitPython's `check_unsafe_options`
          guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened
          since) can be bypassed for **every** guarded method (`clone`/`clone_from`,
          `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`)
          by smuggling an option token inside the VALUE of a single-character kwarg.
          In the default `allow_unsafe_options=False` configuration this yields arbitrary
          command execution via `--upload-pack`.\n\n##### Root Cause\nThe guard builds
          its candidate option list from kwarg KEYS only: `_option_candidates([],
          {\"n\":\"--upload-pack=<cmd>\"})` returns `['-n']` (cmd.py:1042-1046 derives
          the candidate from the key, never the value). `-n` is not on the denylist,
          so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)`
          (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=<cmd>']`.
          git then parses the second token as `--upload-pack` and executes the attacker-supplied
          command. The guard never inspects the value that becomes a separate argv
          token.\n\n##### Impact\nArbitrary OS command execution as the host process
          (via `--upload-pack`) in the default configuration, affecting all guarded
          methods since they all build candidates through the name-only `_option_candidates`.\n\n#####
          Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo,
          out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n\n##### /tmp/ACE
          created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write
          variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')`
          -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file
          truncated.\n\n##### Attack Chain\n1. Entry: app forwards a user-supplied
          options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`.
          Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)`
          at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})`
          -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified
          live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)`
          -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none
          (guard already passed on name-only candidate). Bypass proof: verified transform
          emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack'
          -- <src> <dst>`; git parses and runs the second token. Impact: ACE (marker
          created, verified end-to-end).\n\n##### Bypass Evidence\nLive-verified on
          HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`;
          `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from
          with the payload created the marker file; the direct-name `upload_pack=`
          form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore
          key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option,
          GHSA-x2qx multi-before-split) are BLOCKED on HEAD \u2014 this is a distinct
          kwarg-value->separate-token vector.\n\n##### Affected Versions\n`<= 3.1.53`\n\n#####
          Suggested Fix\nMake `_option_candidates` also emit candidates derived from
          single-character kwarg VALUES when `split_single_char_options` is in effect,
          OR run `check_unsafe_options` over the fully-transformed argv rather than
          the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)**
          \u2014 GitHub: @&#8203;manus-use\n\n#### Severity\n- CVSS Score: 8.8 / 10
          (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n####
          References\n- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3](https://redirect.github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3)\n-
          [https://github.com/gitpython-developers/GitPython/pull/2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n-
          [https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453](https://redirect.github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453)\n-
          [https://github.com/gitpython-developers/GitPython](https://redirect.github.com/gitpython-developers/GitPython)\n-
          [https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54)\n\nThis
          data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3)
          and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Release Notes\n\n<details>\n<summary>gitpython-developers/GitPython (GitPython)</summary>\n\n###
          [`v3.1.54`](https://redirect.github.com/gitpython-developers/GitPython/releases/tag/3.1.54):
          - SECURITY\n\n[Compare Source](https://redirect.github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54)\n\n####
          What's Changed\n\n- Harden unsafe Git option validation by [@&#8203;Byron](https://redirect.github.com/Byron)
          in [#&#8203;2180](https://redirect.github.com/gitpython-developers/GitPython/pull/2180)\n\n**Full
          Changelog**: <https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54>\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about these updates again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/python-osism).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/python-osism/pull/2517
        commit_id: 8c19d18bd40662c54bdae5291d9484e52bec507a
        patchset: 8c19d18bd40662c54bdae5291d9484e52bec507a
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
        topic: null
      job: container-image-python-osism-build
      jobtags: []
      max_attempts: 3
      message: VXBkYXRlIGRlcGVuZGVuY3kgR2l0UHl0aG9uIHRvIHYzLjEuNTQgW1NFQ1VSSVRZXQoKVGhpcyBQUiBjb250YWlucyB0aGUgZm9sbG93aW5nIHVwZGF0ZXM6Cgp8IFBhY2thZ2UgfCBDaGFuZ2UgfCBbQWdlXShodHRwczovL2RvY3MucmVub3ZhdGVib3QuY29tL21lcmdlLWNvbmZpZGVuY2UvKSB8IFtDb25maWRlbmNlXShodHRwczovL2RvY3MucmVub3ZhdGVib3QuY29tL21lcmdlLWNvbmZpZGVuY2UvKSB8CnwtLS18LS0tfC0tLXwtLS18CnwgW0dpdFB5dGhvbl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbikgfCBgPT0zLjEuNTNgIOKGkiBgPT0zLjEuNTRgIHwgIVthZ2VdKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vYXBpL21jL2JhZGdlcy9hZ2UvcHlwaS9naXRweXRob24vMy4xLjU0P3NsaW09dHJ1ZSkgfCAhW2NvbmZpZGVuY2VdKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vYXBpL21jL2JhZGdlcy9jb25maWRlbmNlL3B5cGkvZ2l0cHl0aG9uLzMuMS41My8zLjEuNTQ/c2xpbT10cnVlKSB8CgotLS0KCiMjIyBHaXRQeXRob246IEluY29tcGxldGUgdW5zYWZlX2dpdF9jbG9uZV9vcHRpb25zIGRlbnlsaXN0IG9taXRzIC0tdGVtcGxhdGUgZW5hYmxpbmcgYXJiaXRyYXJ5IGNvbW1hbmQgZXhlY3V0aW9uIHZpYSBjbG9uZSBob29rcwpbR0hTQS02cDhoLTN3Z3gtOTdnZl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS02cDhoLTN3Z3gtOTdnZikKCjxkZXRhaWxzPgo8c3VtbWFyeT5Nb3JlIGluZm9ybWF0aW9uPC9zdW1tYXJ5PgoKIyMjIyBEZXRhaWxzCiMjIyMjIFN1bW1hcnkKR2l0UHl0aG9uJ3MgYHVuc2FmZV9naXRfY2xvbmVfb3B0aW9uc2AgZGVueWxpc3Qgb21pdHMgYC0tdGVtcGxhdGVgLiBgZ2l0IGNsb25lIC0tdGVtcGxhdGU9PGRpcj5gIGNvcGllcyBgPGRpcj4vaG9va3MvYCBpbnRvIHRoZSBuZXcgcmVwb3NpdG9yeSBhbmQgcnVucyB0aGVtIChgcG9zdC1jaGVja291dGAgZmlyZXMgZHVyaW5nIGNsb25lKSwgc28gYSBjYWxsZXIgd2hvIGNhbiBpbmZsdWVuY2UgY2xvbmUgb3B0aW9ucyBjYW4gYWNoaWV2ZSBhcmJpdHJhcnkgY29tbWFuZCBleGVjdXRpb24gaW4gdGhlIGRlZmF1bHQgYGFsbG93X3Vuc2FmZV9vcHRpb25zPUZhbHNlYCBjb25maWd1cmF0aW9uLgoKIyMjIyMgUm9vdCBDYXVzZQpgYmFzZS5weToxNDUtMTUyYCBkZWZpbmVzIGB1bnNhZmVfZ2l0X2Nsb25lX29wdGlvbnMgPSBbIi0tdXBsb2FkLXBhY2siLCItdSIsIi0tY29uZmlnIiwiLWMiXWAg4oCUIGAtLXRlbXBsYXRlYCBpcyBhYnNlbnQuIFRoZSBndWFyZCBjYW5kaWRhdGUgYFsnLS10ZW1wbGF0ZSddYCBwYXNzZXMgYGNoZWNrX3Vuc2FmZV9vcHRpb25zYCAodmVyaWZpZWQpLiBnaXQgY29waWVzIHRoZSBob29rIGRpcmVjdG9yeSBhbmQgZXhlY3V0ZXMgYHBvc3QtY2hlY2tvdXRgIGF0IGNoZWNrb3V0IHRpbWUuIGdpdCdzIGBwcm90b2NvbC5hbGxvd2AvYEdJVF9BTExPV19QUk9UT0NPTGAgZG8gbm90IGdhdGUgYC0tdGVtcGxhdGVgOyB0aGUgaW5jb21wbGV0ZSBkZW55bGlzdCBpcyB0aGUgb25seSBkZWZlbnNlLgoKIyMjIyMgSW1wYWN0CkFyYml0cmFyeSBPUyBjb21tYW5kIGV4ZWN1dGlvbiBkdXJpbmcgY2xvbmUgKGRlZmF1bHQgY29uZmlnKS4gUmVxdWlyZXMgYW4gYXR0YWNrZXItcmVhZGFibGUgZGlyZWN0b3J5IGNvbnRhaW5pbmcgYW4gZXhlY3V0YWJsZSBob29rIOKAlCBhIGdlbnVpbmUgc2Vjb25kIHByZWNvbmRpdGlvbiAocmVhbGlzdGljIHZpYSBzaGFyZWQgZmlsZXN5c3RlbXMsIHVwbG9hZCBkaXJzLCBgL3RtcGAsIG9yIGF0dGFja2VyLXdyaXRhYmxlIG5ldHdvcmsgcGF0aHMpLCByZWZsZWN0ZWQgYXMgQUM6SC4KCiMjIyMjIFByb29mIG9mIENvbmNlcHQKYGBgcHl0aG9uCgojIyMjIyBhdHRhY2tlciBzdGFnZXMgPGRpcj4vaG9va3MvcG9zdC1jaGVja291dCAoY2htb2QgK3gpCmZyb20gZ2l0IGltcG9ydCBSZXBvClJlcG8uY2xvbmVfZnJvbShzcmMsIGRzdCwgdGVtcGxhdGU9JzxkaXI+JykgICAjIHBvc3QtY2hlY2tvdXQgaG9vayBleGVjdXRlcyAtPiBtYXJrZXIgY3JlYXRlZCAodmVyaWZpZWQpCmBgYAoKIyMjIyMgQXR0YWNrIENoYWluCjEuIFNldHVwOiBhdHRhY2tlciBzdGFnZXMgYDxkaXI+L2hvb2tzL3Bvc3QtY2hlY2tvdXRgIChjaG1vZCAreCkuIEd1YXJkOiBuL2EgKGZpbGVzeXN0ZW0pLgoyLiBFbnRyeTogYFJlcG8uY2xvbmVfZnJvbSh1cmwsIHBhdGgsIHRlbXBsYXRlPSc8ZGlyPicpYC4gR3VhcmQ6IGBjaGVja191bnNhZmVfb3B0aW9ucyhjYW5kaWRhdGVzPVsnLS10ZW1wbGF0ZSddLCB1bnNhZmU9dW5zYWZlX2dpdF9jbG9uZV9vcHRpb25zKWAuIEJ5cGFzcyBwcm9vZjogYC0tdGVtcGxhdGVgIG5vdCBvbiB0aGUgZGVueWxpc3QgLT4gcGFzc2VzICh2ZXJpZmllZCBjYW5kaWRhdGUgYFsnLS10ZW1wbGF0ZSddYCwgbm8gZXJyb3IpLgozLiBTaW5rOiBnaXQgY29waWVzIHRoZSBob29rIGFuZCBleGVjdXRlcyBgcG9zdC1jaGVja291dGAgYXQgY2hlY2tvdXQuIEltcGFjdDogQUNFLCBkZWZhdWx0IGNvbmZpZyAodmVyaWZpZWQgbWFya2VyIGNyZWF0ZWQpLgoKIyMjIyMgQnlwYXNzIEV2aWRlbmNlCkxpdmUtdmVyaWZpZWQgb24gSEVBRCAodGFnIDMuMS41Myk6IGd1YXJkIGNhbmRpZGF0ZSBgWyctLXRlbXBsYXRlJ11gIHBhc3NlZCB3aXRoIG5vIGVycm9yOyBzdGFnZWQgYHBvc3QtY2hlY2tvdXRgIGhvb2sgZXhlY3V0ZWQgZHVyaW5nIGBjbG9uZV9mcm9tYCwgY3JlYXRpbmcgdGhlIG1hcmtlci4gSW5kZXBlbmRlbnQgb2YgdGhlIHZhbHVlLXNtdWdnbGUgYnlwYXNzIChgLS10ZW1wbGF0ZWAgaXMgYSBsZWdpdGltYXRlIGxvbmcgb3B0aW9uIHRoYXQgc3Vydml2ZXMgYW55IHNpbmdsZS1jaGFyLXZhbHVlIGZpeCkuIE5vdCBjb3ZlcmVkIGJ5IGFueSBleGlzdGluZyBhZHZpc29yeS4KCiMjIyMjIEFmZmVjdGVkIFZlcnNpb25zCmA8PSAzLjEuNTNgCgojIyMjIyBTdWdnZXN0ZWQgRml4CkFkZCBgLS10ZW1wbGF0ZWAgKGFuZCBhdWRpdCBmb3Igb3RoZXIgaG9vay9leGVjLWluZmx1ZW5jaW5nIG9wdGlvbnMpIHRvIGB1bnNhZmVfZ2l0X2Nsb25lX29wdGlvbnNgLgoKLS0tClJlcG9ydGVkIGJ5ICoqenggKEphY2UpKiog4oCUIEdpdEh1YjogQCYjODIwMzttYW51cy11c2UKCiMjIyMgU2V2ZXJpdHkKLSBDVlNTIFNjb3JlOiA3LjUgLyAxMCAoSGlnaCkKLSBWZWN0b3IgU3RyaW5nOiBgQ1ZTUzozLjEvQVY6Ti9BQzpIL1BSOkwvVUk6Ti9TOlUvQzpIL0k6SC9BOkhgCgojIyMjIFJlZmVyZW5jZXMKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtNnA4aC0zd2d4LTk3Z2ZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLTZwOGgtM3dneC05N2dmKQotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjE4MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxODApCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vY29tbWl0L2ZmY2I1MzU5ZTg3NjE5ZjRmZTRhNzBhNGFmZjVmMDhjNTU4MGJhOTddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vY29tbWl0L2ZmY2I1MzU5ZTg3NjE5ZjRmZTRhNzBhNGFmZjVmMDhjNTU4MGJhOTcpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24pCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcmVsZWFzZXMvdGFnLzMuMS41NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9yZWxlYXNlcy90YWcvMy4xLjU0KQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IFtPU1ZdKGh0dHBzOi8vb3N2LmRldi92dWxuZXJhYmlsaXR5L0dIU0EtNnA4aC0zd2d4LTk3Z2YpIGFuZCB0aGUgW0dpdEh1YiBBZHZpc29yeSBEYXRhYmFzZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZSkgKFtDQy1CWSA0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UvYmxvYi9tYWluL0xJQ0VOU0UubWQpKS4KPC9kZXRhaWxzPgoKLS0tCgojIyMgR2l0UHl0aG9uOiBBcmJpdHJhcnkgZmlsZSBvdmVyd3JpdGUgdmlhIGdpdCBkaWZmIC0tb3V0cHV0IGFyZ3VtZW50IGluamVjdGlvbiBpbiBEaWZmYWJsZS5kaWZmIChrZXktIGFuZCB2YWx1ZS1jb250cm9sbGVkKQpbR0hTQS1manI0LXg2NjMtbXd4Y10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS1manI0LXg2NjMtbXd4YykKCjxkZXRhaWxzPgo8c3VtbWFyeT5Nb3JlIGluZm9ybWF0aW9uPC9zdW1tYXJ5PgoKIyMjIyBEZXRhaWxzCiMjIyMjIFN1bW1hcnkKYERpZmZhYmxlLmRpZmYoKWAgZm9yd2FyZHMgYCoqa3dhcmdzYCBzdHJhaWdodCBpbnRvIGBkaWZmYC9gZGlmZl90cmVlYCB3aXRoICoqbm8qKiBgY2hlY2tfdW5zYWZlX29wdGlvbnNgIGd1YXJkLiBgRGlmZmFibGVgIGlzIG1peGVkIGludG8gYENvbW1pdGAsIGBUcmVlYCwgYEluZGV4RmlsZWAsIGFuZCBgU3VibW9kdWxlYCwgZ2l2aW5nIGEgYnJvYWQgc3VyZmFjZS4gYGdpdCBkaWZmIC0tb3V0cHV0PTxwYXRoPmAgd3JpdGVzIHJlYWwgcGF0Y2ggY29udGVudCB0byBhbiBhdHRhY2tlci1jaG9zZW4gcGF0aCwgZW5hYmxpbmcgYXJiaXRyYXJ5IGZpbGUgb3ZlcndyaXRlLgoKIyMjIyMgUm9vdCBDYXVzZQpgZGlmZi5weToxODgtMjgzYCBidWlsZHMgYW5kIHJ1bnMgdGhlIGRpZmYgY29tbWFuZCB3aXRoIG5vIGBjaGVja191bnNhZmVfb3B0aW9uc2AgYW55d2hlcmUgaW4gdGhlIG1ldGhvZCAoZ3JlcC1jb25maXJtZWQpLiBBZGRpdGlvbmFsbHkgYGRpZmYucHk6MjY1YCBkb2VzIGBhcmdzLmluc2VydCgwLCBvdGhlcilgLCBwbGFjaW5nIHRoZSBjYWxsZXItc3VwcGxpZWQgYG90aGVyYCByZWYgQkVGT1JFIHRoZSBgLS1gIHNlcGFyYXRvciwgc28gYSB2YWx1ZSBvZiBgLS1vdXRwdXQ9L3BhdGhgIGlzIHBhcnNlZCBieSBnaXQgYXMgYW4gb3B0aW9uIOKAlCBhIHZhbHVlLW9ubHkgY29udHJvbCBwYXRoIHJlcXVpcmluZyBubyBrd2FyZyBrZXkuCgojIyMjIyBJbXBhY3QKT3ZlcndyaXRlL2NvcnJ1cHQgYW55IGZpbGUgYXQgcHJvY2VzcyBwcml2aWxlZ2Ugd2l0aCBhdHRhY2tlci1jaG9zZW4gcGF0aCAoZS5nLiBgfi8uc3NoL2F1dGhvcml6ZWRfa2V5c2AsIGNvbmZpZ3MsIGxvY2tmaWxlcykuIENvbnRlbnQgaXMgcmVhbCBkaWZmL3BhdGNoIGJ5dGVzIChhdHRhY2tlci1pbmZsdWVuY2VkKS4gUGVyIHRoZSBza2lsbCdzIHJ1bGUsIGNvbnRyb2xsaW5nIFdISUNIIGZpbGUgaXMgb3ZlcndyaXR0ZW4gPSBJOkggcmVnYXJkbGVzcyBvZiBjb250ZW50IGNvbnN0cmFpbnRzLgoKIyMjIyMgUHJvb2Ygb2YgQ29uY2VwdApgYGBweXRob24KCiMjIyMjIEtleS1jb250cm9sOgpjb21taXQuZGlmZihvdGhlcl9jb21taXQsIG91dHB1dD0nL2hvbWUvYXBwLy5zc2gvYXV0aG9yaXplZF9rZXlzJykgICAjIHZpY3RpbSBvdmVyd3JpdHRlbiB3aXRoIGRpZmYgKDEwNSBieXRlcyB2ZXJpZmllZCkKCiMjIyMjIFZhbHVlLWNvbnRyb2wgKGF0dGFja2VyIGNvbnRyb2xzIG9ubHkgdGhlIHJlZiBzdHJpbmcpOgpjb21taXQuZGlmZihvdGhlcj0nLS1vdXRwdXQ9L2hvbWUvYXBwLy5zc2gvYXV0aG9yaXplZF9rZXlzJykgICAgICAgICAgIyAxNC1ieXRlIHZpY3RpbSAtPiAxNDYgYnl0ZXMgb2YgZGlmZi10cmVlIG91dHB1dApgYGAKCiMjIyMjIEF0dGFjayBDaGFpbgoxLiBFbnRyeSAodmFsdWUtY29udHJvbCk6IGBjb21taXQuZGlmZihvdGhlcj08dXNlciByZWY+KWAgd2l0aCBgb3RoZXIgPSAiLS1vdXRwdXQ9L2hvbWUvYXBwLy5zc2gvYXV0aG9yaXplZF9rZXlzImAuIEd1YXJkOiBub25lIGluIGBEaWZmYWJsZS5kaWZmYC4gQnlwYXNzIHByb29mOiBubyBgY2hlY2tfdW5zYWZlX29wdGlvbnNgIGluIHRoZSBtZXRob2QgYm9keSAoZ3JlcCk7IGBvdGhlcmAgaW5zZXJ0ZWQgcHJlLWAtLWAgYXQgZGlmZi5weToyNjUuCjIuIFNpbms6IGBnaXQgZGlmZi10cmVlIDxzaGE+IC0tb3V0cHV0PS9ob21lL2FwcC8uc3NoL2F1dGhvcml6ZWRfa2V5cyAtciAuLi5gIC0+IGdpdCBvcGVucyt0cnVuY2F0ZXMgdGhlIHRhcmdldCB0aGVuIHdyaXRlcyBkaWZmIGNvbnRlbnQuIEltcGFjdDogb3ZlcndyaXRlL2NvcnJ1cHQgYW55IGZpbGUgYXQgcHJvY2VzcyBwcml2aWxlZ2UgKGF0dGFja2VyIGNob29zZXMgdGhlIHBhdGgpLiBWZXJpZmllZCBhcmd2IGFuZCB2aWN0aW0gb3ZlcndyaXRlIGxpdmUuCgojIyMjIyBCeXBhc3MgRXZpZGVuY2UKTGl2ZS12ZXJpZmllZCBvbiBIRUFEICh0YWcgMy4xLjUzKTogYm90aCBrZXktY29udHJvbCAoYG91dHB1dD1gKSBhbmQgdmFsdWUtY29udHJvbCAoYG90aGVyPSctLW91dHB1dD0uLi4nYCkgb3Zlcndyb3RlIGEgdmljdGltIGZpbGUgd2l0aCByZWFsIGRpZmYtdHJlZSBjb250ZW50OyBhcmd2IGNvbmZpcm1lZCBgWydnaXQnLCdkaWZmLXRyZWUnLCc8c2hhPicsJy0tb3V0cHV0PS92aWN0aW0nLCctcicsLi4uXWAuIFRoaXMgaXMgdGhlIHNhbWUgdmFsdWUtY29udHJvbCBtb2RlbCBHSFNBLTk1NnggZGVlbWVkIGZpeC13b3J0aHkgZm9yIGBpdGVyX2NvbW1pdHMocmV2PSctLW91dHB1dD0nKWAg4oCUIGJ1dCBgZGlmZmAgaXMgYSBkaXN0aW5jdCwgdW5ndWFyZGVkIHNpbmsgTk9UIHRvdWNoZWQgYnkgdGhhdCBmaXguCgojIyMjIyBBZmZlY3RlZCBWZXJzaW9ucwpgPD0gMy4xLjUzYAoKIyMjIyMgU3VnZ2VzdGVkIEZpeApBZGQgYGNoZWNrX3Vuc2FmZV9vcHRpb25zYCB0byBgRGlmZmFibGUuZGlmZmAgKG1pcnJvcmluZyBgaXRlcl9jb21taXRzYC9gYXJjaGl2ZWApLCBhbmQvb3IgcGxhY2UgYC0tZW5kLW9mLW9wdGlvbnNgIGJlZm9yZSB0aGUgYG90aGVyYCByZWYgc28gaXQgY2Fubm90IGJlIHBhcnNlZCBhcyBhbiBvcHRpb24uCgotLS0KUmVwb3J0ZWQgYnkgKip6eCAoSmFjZSkqKiDigJQgR2l0SHViOiBAJiM4MjAzO21hbnVzLXVzZQoKIyMjIyBTZXZlcml0eQotIENWU1MgU2NvcmU6IDguMSAvIDEwIChIaWdoKQotIFZlY3RvciBTdHJpbmc6IGBDVlNTOjMuMS9BVjpOL0FDOkwvUFI6TC9VSTpOL1M6VS9DOk4vSTpIL0E6SGAKCiMjIyMgUmVmZXJlbmNlcwotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1manI0LXg2NjMtbXd4Y10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtZmpyNC14NjYzLW13eGMpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTgwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjE4MCkKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9jb21taXQvMWQ1MWI4OTFkN2YyMzYwNDRhNmFhMTc0OThlYzY4MmI2M2RhZDZlNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9jb21taXQvMWQ1MWI4OTFkN2YyMzYwNDRhNmFhMTc0OThlYzY4MmI2M2RhZDZlNikKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbikKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9yZWxlYXNlcy90YWcvMy4xLjU0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3JlbGVhc2VzL3RhZy8zLjEuNTQpCgpUaGlzIGRhdGEgaXMgcHJvdmlkZWQgYnkgW09TVl0oaHR0cHM6Ly9vc3YuZGV2L3Z1bG5lcmFiaWxpdHkvR0hTQS1manI0LXg2NjMtbXd4YykgYW5kIHRoZSBbR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlKSAoW0NDLUJZIDQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZS9ibG9iL21haW4vTElDRU5TRS5tZCkpLgo8L2RldGFpbHM+CgotLS0KCiMjIyBHaXRQeXRob246IFVuc2FmZSBnaXQgb3B0aW9uIGd1YXJkIGJ5cGFzcyB2aWEgc2luZ2xlLWNoYXJhY3RlciBrd2FyZyB2YWx1ZSB0b2tlbiBzbXVnZ2xpbmcgZW5hYmxlcyBhcmJpdHJhcnkgY29tbWFuZCBleGVjdXRpb24KW0dIU0Etcjltci1tMzdjLTVmcjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hZHZpc29yaWVzL0dIU0Etcjltci1tMzdjLTVmcjMpCgo8ZGV0YWlscz4KPHN1bW1hcnk+TW9yZSBpbmZvcm1hdGlvbjwvc3VtbWFyeT4KCiMjIyMgRGV0YWlscwojIyMjIyBTdW1tYXJ5CkdpdFB5dGhvbidzIGBjaGVja191bnNhZmVfb3B0aW9uc2AgZ3VhcmQgKHRoZSBjb250cm9sIGludHJvZHVjZWQgYnkgQ1ZFLTIwMjYtNDIyMTUgLyBHSFNBLTJmOTYgYW5kIGhhcmRlbmVkIHNpbmNlKSBjYW4gYmUgYnlwYXNzZWQgZm9yICoqZXZlcnkqKiBndWFyZGVkIG1ldGhvZCAoYGNsb25lYC9gY2xvbmVfZnJvbWAsIGBmZXRjaGAvYHB1bGxgL2BwdXNoYCwgYGxzX3JlbW90ZWAsIGBpdGVyX2NvbW1pdHNgLCBgYmxhbWVgLCBgYXJjaGl2ZWApIGJ5IHNtdWdnbGluZyBhbiBvcHRpb24gdG9rZW4gaW5zaWRlIHRoZSBWQUxVRSBvZiBhIHNpbmdsZS1jaGFyYWN0ZXIga3dhcmcuIEluIHRoZSBkZWZhdWx0IGBhbGxvd191bnNhZmVfb3B0aW9ucz1GYWxzZWAgY29uZmlndXJhdGlvbiB0aGlzIHlpZWxkcyBhcmJpdHJhcnkgY29tbWFuZCBleGVjdXRpb24gdmlhIGAtLXVwbG9hZC1wYWNrYC4KCiMjIyMjIFJvb3QgQ2F1c2UKVGhlIGd1YXJkIGJ1aWxkcyBpdHMgY2FuZGlkYXRlIG9wdGlvbiBsaXN0IGZyb20ga3dhcmcgS0VZUyBvbmx5OiBgX29wdGlvbl9jYW5kaWRhdGVzKFtdLCB7Im4iOiItLXVwbG9hZC1wYWNrPTxjbWQ+In0pYCByZXR1cm5zIGBbJy1uJ11gIChjbWQucHk6MTA0Mi0xMDQ2IGRlcml2ZXMgdGhlIGNhbmRpZGF0ZSBmcm9tIHRoZSBrZXksIG5ldmVyIHRoZSB2YWx1ZSkuIGAtbmAgaXMgbm90IG9uIHRoZSBkZW55bGlzdCwgc28gYGNoZWNrX3Vuc2FmZV9vcHRpb25zYCBwYXNzZXMuIEJ1dCBgdHJhbnNmb3JtX2t3YXJnKCduJywgdmFsdWUsIHNwbGl0X3NpbmdsZV9jaGFyX29wdGlvbnM9VHJ1ZSlgIChjbWQucHk6MTYwMC0xNjA2KSBlbWl0cyAqKnR3byoqIGFyZ3YgdG9rZW5zIGBbJy1uJywgJy0tdXBsb2FkLXBhY2s9PGNtZD4nXWAuIGdpdCB0aGVuIHBhcnNlcyB0aGUgc2Vjb25kIHRva2VuIGFzIGAtLXVwbG9hZC1wYWNrYCBhbmQgZXhlY3V0ZXMgdGhlIGF0dGFja2VyLXN1cHBsaWVkIGNvbW1hbmQuIFRoZSBndWFyZCBuZXZlciBpbnNwZWN0cyB0aGUgdmFsdWUgdGhhdCBiZWNvbWVzIGEgc2VwYXJhdGUgYXJndiB0b2tlbi4KCiMjIyMjIEltcGFjdApBcmJpdHJhcnkgT1MgY29tbWFuZCBleGVjdXRpb24gYXMgdGhlIGhvc3QgcHJvY2VzcyAodmlhIGAtLXVwbG9hZC1wYWNrYCkgaW4gdGhlIGRlZmF1bHQgY29uZmlndXJhdGlvbiwgYWZmZWN0aW5nIGFsbCBndWFyZGVkIG1ldGhvZHMgc2luY2UgdGhleSBhbGwgYnVpbGQgY2FuZGlkYXRlcyB0aHJvdWdoIHRoZSBuYW1lLW9ubHkgYF9vcHRpb25fY2FuZGlkYXRlc2AuCgojIyMjIyBQcm9vZiBvZiBDb25jZXB0CmBgYHB5dGhvbgpmcm9tIGdpdCBpbXBvcnQgUmVwbwpSZXBvLmNsb25lX2Zyb20oYmFyZV9yZXBvLCBvdXRfZGlyLCBuPSItLXVwbG9hZC1wYWNrPXRvdWNoIC90bXAvQUNFO2dpdC11cGxvYWQtcGFjayIpCgojIyMjIyAvdG1wL0FDRSBjcmVhdGVkIC0+IEFDRS4gRGlyZWN0LW5hbWUgZm9ybSB1cGxvYWRfcGFjaz0iLi4uIiBpcyBjb3JyZWN0bHkgQkxPQ0tFRC4KYGBgCkZpbGUtd3JpdGUgdmFyaWFudCBvbiBhIGd1YXJkZWQgcmV2aXNpb24gY29tbWFuZDogYGl0ZXJfY29tbWl0cygnSEVBRCcsIGc9Jy0tb3V0cHV0PS9wYXRoJylgIC0+IGNhbmRpZGF0ZSBgWyctZyddYCBwYXNzZXMsIGFyZ3YgYFsnLWcnLCctLW91dHB1dD0vcGF0aCddYCwgdmljdGltIGZpbGUgdHJ1bmNhdGVkLgoKIyMjIyMgQXR0YWNrIENoYWluCjEuIEVudHJ5OiBhcHAgZm9yd2FyZHMgYSB1c2VyLXN1cHBsaWVkIG9wdGlvbnMgZGljdCAtPiBgUmVwby5jbG9uZV9mcm9tKHVybCwgcGF0aCwgbj0iLS11cGxvYWQtcGFjaz10b3VjaCAvdG1wL0FDRTtnaXQtdXBsb2FkLXBhY2siKWAuIEd1YXJkOiBgY2hlY2tfdW5zYWZlX29wdGlvbnMob3B0aW9ucz1fb3B0aW9uX2NhbmRpZGF0ZXMoW10sIGt3YXJncyksIHVuc2FmZT11bnNhZmVfZ2l0X2Nsb25lX29wdGlvbnMpYCBhdCBiYXNlLnB5LiBCeXBhc3MgcHJvb2Y6IGBfb3B0aW9uX2NhbmRpZGF0ZXMoW10sIHsibiI6Ii0tdXBsb2FkLXBhY2s9Li4uIn0pYCAtPiBgWyctbiddYCAoa2V5LW9ubHkpLCBub3Qgb24gZGVueWxpc3QgLT4gbm8gVW5zYWZlT3B0aW9uRXJyb3IgKHZlcmlmaWVkIGxpdmUpLgoyLiBUcmFuc2Zvcm06IGB0cmFuc2Zvcm1fa3dhcmcoJ24nLCB2YWx1ZSwgc3BsaXRfc2luZ2xlX2NoYXJfb3B0aW9ucz1UcnVlKWAgLT4gYFsnLW4nLCAnLS11cGxvYWQtcGFjaz10b3VjaCAvdG1wL0FDRTtnaXQtdXBsb2FkLXBhY2snXWAuIEd1YXJkOiBub25lIChndWFyZCBhbHJlYWR5IHBhc3NlZCBvbiBuYW1lLW9ubHkgY2FuZGlkYXRlKS4gQnlwYXNzIHByb29mOiB2ZXJpZmllZCB0cmFuc2Zvcm0gZW1pdHMgdHdvIHRva2Vucy4KMy4gU2luazogYGdpdCBjbG9uZSAtbiAtLXVwbG9hZC1wYWNrPSd0b3VjaCAuLi47Z2l0LXVwbG9hZC1wYWNrJyAtLSA8c3JjPiA8ZHN0PmA7IGdpdCBwYXJzZXMgYW5kIHJ1bnMgdGhlIHNlY29uZCB0b2tlbi4gSW1wYWN0OiBBQ0UgKG1hcmtlciBjcmVhdGVkLCB2ZXJpZmllZCBlbmQtdG8tZW5kKS4KCiMjIyMjIEJ5cGFzcyBFdmlkZW5jZQpMaXZlLXZlcmlmaWVkIG9uIEhFQUQgKHRhZyAzLjEuNTMpOiBgX29wdGlvbl9jYW5kaWRhdGVzYCByZXR1cm5zIGtleS1vbmx5IGNhbmRpZGF0ZSBgWyctbiddYDsgYHRyYW5zZm9ybV9rd2FyZ3NgIGVtaXRzIHRoZSBzbXVnZ2xlZCBgLS11cGxvYWQtcGFjaz1gIHRva2VuOyBjbG9uZV9mcm9tIHdpdGggdGhlIHBheWxvYWQgY3JlYXRlZCB0aGUgbWFya2VyIGZpbGU7IHRoZSBkaXJlY3QtbmFtZSBgdXBsb2FkX3BhY2s9YCBmb3JtIHJhaXNlZCBVbnNhZmVPcHRpb25FcnJvci4gQWxsIHByaW9yIGJ5cGFzc2VzIChHSFNBLXJwbTUgdW5kZXJzY29yZSBrZXksIEdIU0EtMmY5NiBsb25nLW9wdGlvbiBhYmJyZXZpYXRpb24sIEdIU0EtdjM5NiBqb2luZWQgc2hvcnQgb3B0aW9uLCBHSFNBLXgycXggbXVsdGktYmVmb3JlLXNwbGl0KSBhcmUgQkxPQ0tFRCBvbiBIRUFEIOKAlCB0aGlzIGlzIGEgZGlzdGluY3Qga3dhcmctdmFsdWUtPnNlcGFyYXRlLXRva2VuIHZlY3Rvci4KCiMjIyMjIEFmZmVjdGVkIFZlcnNpb25zCmA8PSAzLjEuNTNgCgojIyMjIyBTdWdnZXN0ZWQgRml4Ck1ha2UgYF9vcHRpb25fY2FuZGlkYXRlc2AgYWxzbyBlbWl0IGNhbmRpZGF0ZXMgZGVyaXZlZCBmcm9tIHNpbmdsZS1jaGFyYWN0ZXIga3dhcmcgVkFMVUVTIHdoZW4gYHNwbGl0X3NpbmdsZV9jaGFyX29wdGlvbnNgIGlzIGluIGVmZmVjdCwgT1IgcnVuIGBjaGVja191bnNhZmVfb3B0aW9uc2Agb3ZlciB0aGUgZnVsbHktdHJhbnNmb3JtZWQgYXJndiByYXRoZXIgdGhhbiB0aGUgcmVjb25zdHJ1Y3RlZCBuYW1lLW9ubHkgY2FuZGlkYXRlIGxpc3QuCgotLS0KUmVwb3J0ZWQgYnkgKip6eCAoSmFjZSkqKiDigJQgR2l0SHViOiBAJiM4MjAzO21hbnVzLXVzZQoKIyMjIyBTZXZlcml0eQotIENWU1MgU2NvcmU6IDguOCAvIDEwIChIaWdoKQotIFZlY3RvciBTdHJpbmc6IGBDVlNTOjMuMS9BVjpOL0FDOkwvUFI6TC9VSTpOL1M6VS9DOkgvSTpIL0E6SGAKCiMjIyMgUmVmZXJlbmNlcwotIFtodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1yOW1yLW0zN2MtNWZyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0Etcjltci1tMzdjLTVmcjMpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcHVsbC8yMTgwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3B1bGwvMjE4MCkKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9jb21taXQvZThkMGZiZjc3NGQxZjZiYWEzYjQ4MWFkZmU0OGJkMjYyZTQzYjQ1M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9jb21taXQvZThkMGZiZjc3NGQxZjZiYWEzYjQ4MWFkZmU0OGJkMjYyZTQzYjQ1MykKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbikKLSBbaHR0cHM6Ly9naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9yZWxlYXNlcy90YWcvMy4xLjU0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL3JlbGVhc2VzL3RhZy8zLjEuNTQpCgpUaGlzIGRhdGEgaXMgcHJvdmlkZWQgYnkgW09TVl0oaHR0cHM6Ly9vc3YuZGV2L3Z1bG5lcmFiaWxpdHkvR0hTQS1yOW1yLW0zN2MtNWZyMykgYW5kIHRoZSBbR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZ2l0aHViL2Fkdmlzb3J5LWRhdGFiYXNlKSAoW0NDLUJZIDQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZS9ibG9iL21haW4vTElDRU5TRS5tZCkpLgo8L2RldGFpbHM+CgotLS0KCiMjIyBSZWxlYXNlIE5vdGVzCgo8ZGV0YWlscz4KPHN1bW1hcnk+Z2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uIChHaXRQeXRob24pPC9zdW1tYXJ5PgoKIyMjIFtgdjMuMS41NGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRweXRob24tZGV2ZWxvcGVycy9HaXRQeXRob24vcmVsZWFzZXMvdGFnLzMuMS41NCk6IC0gU0VDVVJJVFkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9jb21wYXJlLzMuMS41My4uLjMuMS41NCkKCiMjIyMgV2hhdCdzIENoYW5nZWQKCi0gSGFyZGVuIHVuc2FmZSBHaXQgb3B0aW9uIHZhbGlkYXRpb24gYnkgW0AmIzgyMDM7Qnlyb25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9CeXJvbikgaW4gWyMmIzgyMDM7MjE4MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdHB5dGhvbi1kZXZlbG9wZXJzL0dpdFB5dGhvbi9wdWxsLzIxODApCgoqKkZ1bGwgQ2hhbmdlbG9nKio6IDxodHRwczovL2dpdGh1Yi5jb20vZ2l0cHl0aG9uLWRldmVsb3BlcnMvR2l0UHl0aG9uL2NvbXBhcmUvMy4xLjUzLi4uMy4xLjU0PgoKPC9kZXRhaWxzPgoKLS0tCgojIyMgQ29uZmlndXJhdGlvbgoK8J+ThSAqKlNjaGVkdWxlKio6IChVVEMpCgotIEJyYW5jaCBjcmVhdGlvbgogIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpCi0gQXV0b21lcmdlCiAgLSBBdCBhbnkgdGltZSAobm8gc2NoZWR1bGUgZGVmaW5lZCkKCvCfmqYgKipBdXRvbWVyZ2UqKjogRGlzYWJsZWQgYnkgY29uZmlnLiBQbGVhc2UgbWVyZ2UgdGhpcyBtYW51YWxseSBvbmNlIHlvdSBhcmUgc2F0aXNmaWVkLgoK4pm7ICoqUmViYXNpbmcqKjogV2hlbmV2ZXIgUFIgYmVjb21lcyBjb25mbGljdGVkLCBvciB5b3UgdGljayB0aGUgcmViYXNlL3JldHJ5IGNoZWNrYm94LgoK8J+UlSAqKklnbm9yZSoqOiBDbG9zZSB0aGlzIFBSIGFuZCB5b3Ugd29uJ3QgYmUgcmVtaW5kZWQgYWJvdXQgdGhlc2UgdXBkYXRlcyBhZ2Fpbi4KCi0tLQoKIC0gWyBdIDwhLS0gcmViYXNlLWNoZWNrIC0tPklmIHlvdSB3YW50IHRvIHJlYmFzZS9yZXRyeSB0aGlzIFBSLCBjaGVjayB0aGlzIGJveAoKLS0tCgpUaGlzIFBSIHdhcyBnZW5lcmF0ZWQgYnkgW01lbmQgUmVub3ZhdGVdKGh0dHBzOi8vbWVuZC5pby9yZW5vdmF0ZS8pLiBWaWV3IHRoZSBbcmVwb3NpdG9yeSBqb2IgbG9nXShodHRwczovL2RldmVsb3Blci5tZW5kLmlvL2dpdGh1Yi9vc2lzbS9weXRob24tb3Npc20pLgo8IS0tcmVub3ZhdGUtZGVidWc6ZXlKamNtVmhkR1ZrU1c1V1pYSWlPaUkwTXk0eU9EQXVNQ0lzSW5Wd1pHRjBaV1JKYmxabGNpSTZJalF6TGpJNE1DNHdJaXdpZEdGeVoyVjBRbkpoYm1Ob0lqb2liV0ZwYmlJc0lteGhZbVZzY3lJNld5SnlaVzV2ZG1GMFpTSmRmUT09LS0+Cg==
      patchset: 8c19d18bd40662c54bdae5291d9484e52bec507a
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_0/github.com/osism/python-osism:
            canonical_name: github.com/osism/python-osism
            checkout: main
            commit: 161b0d935f084c3a04f86faf4a8a57b335d23a6b
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
        playbooks:
        - path: untrusted/project_0/github.com/osism/python-osism/playbooks/build.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/python-osism
        name: osism/python-osism
        short_name: python-osism
        src_dir: src/github.com/osism/python-osism
      projects:
        github.com/osism/python-osism:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          checkout: main
          checkout_description: zuul branch
          commit: 161b0d935f084c3a04f86faf4a8a57b335d23a6b
          name: osism/python-osism
          required: false
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
      ref: refs/pull/2517/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
