From 360007500cf322ea43cf4fbf50247058d8dfcb10 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Tue, 11 Aug 2026 17:41:33 +0200
Subject: [PATCH] python3Packages.unearth: fix CVE-2026-73030

Apply upstream path normalization and symlink target validation to prevent tar archives from writing outside the extraction directory.

https://redirect.github.com/frostming/unearth/commit/6c78164e7bfa28b8b3d6f247b87e560692e3c8ba

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit a34877a5d64ecf457971af72c6dd5f5858320eee)
---
 pkgs/development/python-modules/unearth/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/unearth/default.nix b/pkgs/development/python-modules/unearth/default.nix
index a2f6ab05c389..bfced8e1259f 100644
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@@ -32,6 +32,12 @@ buildPythonPackage rec {
       hash = "sha256-t/Ubv9qC1Fvh4JsnfVgOZO/O7ZpCGHugBUt9qAjnH8c=";
       excludes = [ "pdm.lock" ];
     })
+    # Remove when updating to the first release containing this fix.
+    (fetchpatch {
+      name = "CVE-2026-73030.patch";
+      url = "https://github.com/frostming/unearth/commit/6c78164e7bfa28b8b3d6f247b87e560692e3c8ba.patch";
+      hash = "sha256-OEf4YnpNhZcIWaFMSXQP0SA7kRV9FqKIpnkLbUrQj+4=";
+    })
   ];
 
   build-system = [ pdm-backend ];