Re: [yocto-patches] [AUH] [PATCH 1/2] git: use temp file for commit message to avoid shell escaping issues

On Mon, 2026-05-25 at 10:04 +0200, Daniel Turull via lists.yoctoproject.org wrote:
> From: Daniel Turull <[email protected]>
> 
> Passing the commit message via -m "..." interpolates it directly into
> a shell command, causing a syntax error when the message contains special
> characters such as backticks, double quotes, or shell metacharacters.
> 
> Use a temporary file with -F instead, which bypasses shell interpretation
> entirely.
> 
> AI-Generated: kiro with claude-opus-4.6 model
> Signed-off-by: Daniel Turull <[email protected]>
> ---
>  modules/utils/git.py | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/modules/utils/git.py b/modules/utils/git.py
> index b383049..b732cdb 100644
> --- a/modules/utils/git.py
> +++ b/modules/utils/git.py
> @@ -54,10 +54,17 @@ class Git(object):
>          return self._cmd("add " + src)
>  
>      def commit(self, commit_message, author=None):
> -        if author is None:
> -            return self._cmd("commit -a -s -m \"" + commit_message + "\"")
> -        else:
> -            return self._cmd("commit -a --author=\"" + author + "\" -m \"" + commit_message + "\"")
> +        import tempfile
> +        with tempfile.NamedTemporaryFile(mode='w', suffix='.txt', delete=False) as f:
> +            f.write(commit_message)
> +            tmp = f.name
> +        try:
> +            if author is None:
> +                return self._cmd("commit -a -s -F " + tmp)
> +            else:
> +                return self._cmd("commit -a --author=\"" + author + "\" -F " + tmp)
> +        finally:
> +            os.unlink(tmp)
> 


Why delete=False and then the try/finally?

Cheers,

Richard