rpms/python3.10
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update to Python 3.10.21

Browse source
This commit is contained in:
Karolina Surma 2026-08-13 12:14:24 +02:00
commit daba5b738c
6 changed files with 39 additions and 165 deletions
Download patch file Download diff file Expand all files Collapse all files

10
00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
View file

@ -22,10 +22,10 @@ Co-authored-by: Petr Viktorin <encukou@gmail.com>
create mode 100644 Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 0f1397de73..21d3676c22 100644
index f4bba8ff03..f772bd6ab6 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -2605,16 +2605,18 @@ def run(self):
@@ -2607,16 +2607,18 @@ def run(self):
self.write(msg.lower())
except OSError as e:
# handles SSLError and socket errors
@ -53,7 +53,7 @@ index 0f1397de73..21d3676c22 100644
try:
self.write(b"ERROR\n")
except OSError:
@@ -3296,23 +3298,16 @@ def test_wrong_cert_tls13(self):
@@ -3298,23 +3300,16 @@ def test_wrong_cert_tls13(self):
client_context.wrap_socket(socket.socket(),
server_hostname=hostname,
suppress_ragged_eofs=False) as s:
@ -82,7 +82,7 @@ index 0f1397de73..21d3676c22 100644
def test_rude_shutdown(self):
"""A brutal shutdown of an SSL server should raise an OSError
@@ -4558,8 +4553,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
@@ -4560,8 +4555,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
# test sometimes fails with EOF error. Test passes as long as
# server aborts connection with an error.
with self.assertRaisesRegex(
@ -102,7 +102,7 @@ index 0000000000..75d926ab59
+Fix the :mod:`ssl` module error handling of connection terminate by peer.
+It now throws an OSError with the appropriate error code instead of an EOFError.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 3bd8b96dcc..6f5fb23b8b 100644
index af770c7f18..7b3cf61474 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -582,7 +582,7 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) {

75
00489-openssl-3.5.7.patch
View file

@ -1,75 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: David Benjamin <davidben@google.com>
Date: Fri, 24 Mar 2023 09:04:30 -0400
Subject: 00489: Use BIO_eof to detect EOF for SSL_FILETYPE_ASN1
In PEM, we need to parse until error and then suppress `PEM_R_NO_START_LINE`, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing `ASN1_R_HEADER_TOO_LONG` doesn't quite work because that error also covers some cases that should be rejected.
Instead, check `BIO_eof` early and stop the loop that way.
This fixes https://github.com/python/cpython/issues/151504 and adds compatibility with OpenSSL 3.5.7+
(cherry-picked from commit acfe02f3b05436658d92add6b168538b30f357f0)
---
Lib/test/test_ssl.py | 2 ++
.../2022-12-20-10-55-14.gh-issue-100372.utfP65.rst | 2 ++
Modules/_ssl.c | 10 ++++++----
3 files changed, 10 insertions(+), 4 deletions(-)
create mode 100644 Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 21d3676c22..f772bd6ab6 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -1533,6 +1533,8 @@ def test_load_verify_cadata(self):
"not enough data: cadata does not contain a certificate"
):
ctx.load_verify_locations(cadata=b"broken")
+ with self.assertRaises(ssl.SSLError):
+ ctx.load_verify_locations(cadata=cacert_der + b"A")
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_load_dh_params(self):
diff --git a/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst b/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
new file mode 100644
index 0000000000..ec37aff509
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
@@ -0,0 +1,2 @@
+:meth:`ssl.SSLContext.load_verify_locations` no longer incorrectly accepts
+some cases of trailing data when parsing DER.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 6f5fb23b8b..7b3cf61474 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -3949,7 +3949,7 @@ _add_ca_certs(PySSLContext *self, const void *data, Py_ssize_t len,
{
BIO *biobuf = NULL;
X509_STORE *store;
- int retval = -1, err, loaded = 0;
+ int retval = -1, err, loaded = 0, was_bio_eof = 0;
assert(filetype == SSL_FILETYPE_ASN1 || filetype == SSL_FILETYPE_PEM);
@@ -3977,6 +3977,10 @@ _add_ca_certs(PySSLContext *self, const void *data, Py_ssize_t len,
int r;
if (filetype == SSL_FILETYPE_ASN1) {
+ if (BIO_eof(biobuf)) {
+ was_bio_eof = 1;
+ break;
+ }
cert = d2i_X509_bio(biobuf, NULL);
} else {
cert = PEM_read_bio_X509(biobuf, NULL,
@@ -4012,9 +4016,7 @@ _add_ca_certs(PySSLContext *self, const void *data, Py_ssize_t len,
}
_setSSLError(get_state_ctx(self), msg, 0, __FILE__, __LINE__);
retval = -1;
- } else if ((filetype == SSL_FILETYPE_ASN1) &&
- (ERR_GET_LIB(err) == ERR_LIB_ASN1) &&
- (ERR_GET_REASON(err) == ASN1_R_HEADER_TOO_LONG)) {
+ } else if ((filetype == SSL_FILETYPE_ASN1) && was_bio_eof) {
/* EOF ASN1 file, not an error */
ERR_clear_error();
retval = 0;

64
00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
View file

@ -1,64 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Victor Stinner <vstinner@python.org>
Date: Wed, 13 May 2026 17:27:56 +0200
Subject: 00491: gh-149776: Skip UDP Lite tests if it's not supported
Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if
it's not supported.
(cherry picked from commit 3cfc249e11a132dc69624150843779aa96c72b2b)
(cherry picked from commit 49d08674d8dba50dc29539e3c7bce21d66066b06)
---
Lib/test/test_socket.py | 22 ++++++++++++++++++-
...-05-13-14-53-23.gh-issue-149776.orqgsn.rst | 2 ++
2 files changed, 23 insertions(+), 1 deletion(-)
create mode 100644 Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py
index 15f7fb4a80..4a3d8f7ce6 100644
--- a/Lib/test/test_socket.py
+++ b/Lib/test/test_socket.py
@@ -142,6 +142,26 @@ def _have_socket_bluetooth():
return True
+def _have_udp_lite():
+ if not hasattr(socket, "IPPROTO_UDPLITE"):
+ return False
+ # Older Android versions block UDPLITE with SELinux.
+ if support.is_android and platform.android_ver().api_level < 29:
+ return False
+
+ try:
+ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDPLITE)
+ except OSError as exc:
+ # Linux 7.1 removed UDP Lite support
+ if exc.errno == errno.EPROTONOSUPPORT:
+ return False
+ raise
+ sock.close()
+
+ return True
+
+
+
@contextlib.contextmanager
def socket_setdefaulttimeout(timeout):
old_timeout = socket.getdefaulttimeout()
@@ -166,7 +186,7 @@ def socket_setdefaulttimeout(timeout):
HAVE_SOCKET_VSOCK = _have_socket_vsock()
-HAVE_SOCKET_UDPLITE = hasattr(socket, "IPPROTO_UDPLITE")
+HAVE_SOCKET_UDPLITE = _have_udp_lite()
HAVE_SOCKET_BLUETOOTH = _have_socket_bluetooth()
diff --git a/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst b/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
new file mode 100644
index 0000000000..e86a9130ff
--- /dev/null
+++ b/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
@@ -0,0 +1,2 @@
+Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it's
+not supported. Patch by Victor Stinner.

23
00494-increase-the-timeout-of-test_large_content_length_truncated.patch Normal file
View file

@ -0,0 +1,23 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Karolina Surma <ksurma@redhat.com>
Date: Fri, 14 Aug 2026 09:38:26 +0200
Subject: 00494: Increase the timeout of test_large_content_length_truncated
It has started to fail randomly when run on s390x architecture.
---
Lib/test/test_httpservers.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
index 5eb3c82fbd..aa8ad1c323 100644
--- a/Lib/test/test_httpservers.py
+++ b/Lib/test/test_httpservers.py
@@ -872,7 +872,7 @@ def test_large_content_length(self):
self.assertEqual(res.read(), b'%d %d' % (size, size) + self.linesep)
def test_large_content_length_truncated(self):
- with support.swap_attr(self.request_handler, 'timeout', 0.001):
+ with support.swap_attr(self.request_handler, 'timeout', support.LOOPBACK_TIMEOUT):
for w in range(18, 65):
size = 1 << w
headers = {'Content-Length' : str(size)}

28
python3.10.spec
View file

@ -13,11 +13,11 @@ URL: https://www.python.org/
# WARNING When rebasing to a new Python version,
# remember to update the python3-docs package as well
%global general_version %{pybasever}.20
%global general_version %{pybasever}.21
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
Release: 4%{?dist}
Release: 1%{?dist}
License: Python-2.0.1
@ -369,24 +369,11 @@ Patch474: 00474-cve-2025-15366.patch
# (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
Patch475: 00475-cve-2025-15367.patch
# 00489 # 008af720a5f6f98ed3feb8ebdbf88ab9dea4db22
# Use BIO_eof to detect EOF for SSL_FILETYPE_ASN1
# 00494 # 430aab133397ed44cc9ee621fd311e02fee317b5
# Increase the timeout of test_large_content_length_truncated
#
# In PEM, we need to parse until error and then suppress `PEM_R_NO_START_LINE`, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing `ASN1_R_HEADER_TOO_LONG` doesn't quite work because that error also covers some cases that should be rejected.
#
# Instead, check `BIO_eof` early and stop the loop that way.
#
# This fixes https://github.com/python/cpython/issues/151504 and adds compatibility with OpenSSL 3.5.7+
#
# (cherry-picked from commit acfe02f3b05436658d92add6b168538b30f357f0)
Patch489: 00489-openssl-3.5.7.patch
# 00491 # ac14737379922303720216b61803474c84f291ef
# gh-149776: Skip UDP Lite tests if it's not supported
#
# Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if
# it's not supported.
Patch491: 00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
# It has started to fail randomly when run on s390x architecture.
Patch494: 00494-increase-the-timeout-of-test_large_content_length_truncated.patch
# (New patches go here ^^^)
#
@ -1691,6 +1678,9 @@ CheckPython optimized
# ======================================================
%changelog
* Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.10.21-1
- Update to Python 3.10.21
* Thu Jul 30 2026 Miro Hrončok <mhroncok@redhat.com> - 3.10.20-4
- Skip UDP Lite tests if it's not supported
- Fixes FTBFS on Linux kernel 7.1 and newer

4
sources
View file

@ -1,2 +1,2 @@
SHA512 (Python-3.10.20.tar.xz) = 591d3acf7ef47307b8c58fec9516731b374bcdf6eb21883410f67402f823a183f1abffec1116583e394610730f414d5a98b4c3437ea5174a4d2adbb99b8f6e5b
SHA512 (Python-3.10.20.tar.xz.asc) = cb90ce514c63c63adc10cbb3db778eae626b922461715954daf08b3a3a99b8b4c750fded624787b7d28fc10a203b0e0e5494b91e5305ef56a23fda46c023c203
SHA512 (Python-3.10.21.tar.xz) = 6f6de7c5e4c0457f2d189ed5d111c83fb8775e19123afe4f9fd0ae2b93f3fa2bbb7ad849ade6bb5227d4a6a3d63abc8e167fbe5fb54fa715660c89fd6274daee
SHA512 (Python-3.10.21.tar.xz.asc) = 72d6aeaa0f51e527f82392cf1f969b0ad50a48fe10e8b7e5feb6117718223d00757f7b375b3ac82e257571d5a61f8162e9dd59b81fcf8f2a441c6deb42be71cb