Make IDLE work without python3-test installed

Fix CVE-2022-42919
Update to 3.10.8
2022-11-14 16:25:09 +01:00 · 2022-11-09 12:09:08 +01:00 · 2022-10-12 15:58:11 +02:00 · 2022-09-07 16:29:08 +02:00 · 2022-08-02 15:31:52 +02:00 · 2022-06-09 21:59:36 +02:00
23 changed files with 599 additions and 2326 deletions
--- a/00001-rpath.patch
+++ b/00001-rpath.patch
@ -1,10 +1,9 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Wed, 13 Jan 2010 21:25:18 +0000
-Subject: 00001: Fixup distutils/unixccompiler.py to remove standard library
+Subject: [PATCH] 00001: Fixup distutils/unixccompiler.py to remove standard
- path from rpath
+ library path from rpath Was Patch0 in ivazquez' python3000 specfile
 Was Patch0 in ivazquez' python3000 specfile
 ---
 Lib/distutils/unixccompiler.py | 9 +++++++++
 1 file changed, 9 insertions(+)
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@ -1,38 +1,30 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+From: Michal Cyprian <m.cyprian@gmail.com>
-Date: Mon, 15 Feb 2021 12:19:27 +0100
+Date: Mon, 26 Jun 2017 16:32:56 +0200
-Subject: 00251: Change user install location
+Subject: [PATCH] 00251: Change user install location
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Set values of base and platbase in sysconfig from /usr
 to /usr/local when RPM build is not detected
 to make pip and similar tools install into separate location.
 Set values of prefix and exec_prefix in distutils install command
 to /usr/local if executable is /usr/bin/python* and RPM build
-is not detected to make distutils and pypa/distutils install into separate location.
+is not detected to make pip and distutils install into separate location.
 Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-Downstream only.
+Downstream only: Reworked in Fedora 36+ to follow https://bugs.python.org/issue43976
 We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
 but we have identified serious problems with that approach,
 see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
 pypa/distutils integration: https://github.com/pypa/distutils/pull/70
-Co-authored-by: Petr Viktorin <encukou@gmail.com>
+Also set sysconfig._PIP_USE_SYSCONFIG = False, to force pip-upgraded-pip
 to respect this patched distutils install command.
 See https://bugzilla.redhat.com/show_bug.cgi?id=2014513
 Co-authored-by: Miro Hrončok <miro@hroncok.cz>
 Co-authored-by: Michal Cyprian <m.cyprian@gmail.com>
 Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
 ---
- Lib/distutils/command/install.py |  8 +++--
+ Lib/distutils/command/install.py |  8 ++++++--
- Lib/site.py                      |  9 +++++-
+ Lib/site.py                      |  9 ++++++++-
- Lib/sysconfig.py                 | 53 +++++++++++++++++++++++++++++++-
+ Lib/sysconfig.py                 | 16 ++++++++++++++++
- Lib/test/test_sysconfig.py       | 17 ++++++++--
+ 3 files changed, 30 insertions(+), 3 deletions(-)
 4 files changed, 81 insertions(+), 6 deletions(-)
 diff --git a/Lib/distutils/command/install.py b/Lib/distutils/command/install.py
 index 01d5331a63..79f70f0de4 100644
@ -61,10 +53,10 @@ index 01d5331a63..79f70f0de4 100644
             else:
                 if self.exec_prefix is None:
 diff --git a/Lib/site.py b/Lib/site.py
-index 5302037e0b..4ef002c6bc 100644
+index 939893eb5e..d1316c3355 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
-@@ -390,8 +390,15 @@ def getsitepackages(prefixes=None):
+@@ -380,8 +380,15 @@ def getsitepackages(prefixes=None):
     return sitepackages
 def addsitepackages(known_paths, prefixes=None):
@ -82,30 +74,17 @@ index 5302037e0b..4ef002c6bc 100644
         if os.path.isdir(sitedir):
             addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index daf9f00006..10368c92a7 100644
+index daf9f00006..b88f9a9de0 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
-@@ -58,6 +58,16 @@
+@@ -58,6 +58,22 @@
         },
     }
-+# For a brief period of time in the Fedora 36 life cycle,
+# Force pip to use distutils paths instead of sysconfig
-+# this installation scheme existed and was documented in the release notes.
+# https://github.com/pypa/pip/issues/10647
-+# For backwards compatibility, we keep it here (at least on 3.10 and 3.11).
+_PIP_USE_SYSCONFIG = False
-+_INSTALL_SCHEMES['rpm_prefix'] = _INSTALL_SCHEMES['posix_prefix']
+
 +# Virtualenv >= 20.10.0 favors the "venv" scheme over the defaults when creating virtual environments.
 +# See: https://github.com/pypa/virtualenv/commit/8da79db86d8a5c74d03667a40e64ff832076445e
 +# See: https://bugs.python.org/issue45413
 +# "venv" should be the same as the posix_prefix for us,
 +# so new virtual environments aren't created with paths like venv/local/bin/python.
 +_INSTALL_SCHEMES['venv'] = _INSTALL_SCHEMES['posix_prefix']
 # NOTE: site.py has copy of this function.
 # Sync it when modify this function.
@@ -117,6 +127,19 @@ def joinuser(*args):
             },
     }
 +# This is used by distutils.command.install in the stdlib
 +# as well as pypa/distutils (e.g. bundled in setuptools).
 +# The self.prefix value is set to sys.prefix + /local/
@ -116,93 +95,8 @@ index daf9f00006..10368c92a7 100644
 +if (not (hasattr(sys, 'real_prefix') or
 +    sys.prefix != sys.base_prefix) and
 +    'RPM_BUILD_ROOT' not in os.environ):
-+    _prefix_addition = '/local'
+    _prefix_addition = "/local"
 +
 +
 _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
                 'scripts', 'data')
-@@ -211,11 +234,39 @@ def _extend_dict(target_dict, other_dict):
+ # NOTE: site.py has copy of this function.
-         target_dict[key] = value
+ # Sync it when modify this function.
 +_CONFIG_VARS_LOCAL = None
 +
 +
 +def _config_vars_local():
 +    # This function returns the config vars with prefixes amended to /usr/local
 +    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +    global _CONFIG_VARS_LOCAL
 +    if _CONFIG_VARS_LOCAL is None:
 +        _CONFIG_VARS_LOCAL = dict(get_config_vars())
 +        _CONFIG_VARS_LOCAL['base'] = '/usr/local'
 +        _CONFIG_VARS_LOCAL['platbase'] = '/usr/local'
 +    return _CONFIG_VARS_LOCAL
 +
 +
 def _expand_vars(scheme, vars):
     res = {}
     if vars is None:
         vars = {}
 -    _extend_dict(vars, get_config_vars())
 +
 +    # when we are not in a virtual environment or an RPM build
 +    # we change '/usr' to '/usr/local'
 +    # to avoid surprises, we explicitly check for the /usr/ prefix
 +    # Python virtual environments have different prefixes
 +    # we only do this for posix_prefix, not to mangle the venv scheme
 +    # posix_prefix is used by sudo pip install
 +    # we only change the defaults here, so explicit --prefix will take precedence
 +    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +    if (scheme == 'posix_prefix' and
 +        _PREFIX == '/usr' and
 +        'RPM_BUILD_ROOT' not in os.environ):
 +            _extend_dict(vars, _config_vars_local())
 +    else:
 +        _extend_dict(vars, get_config_vars())
     for key, value in _INSTALL_SCHEMES[scheme].items():
         if os.name in ('posix', 'nt'):
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
 index 5ee9839c04..16e92ca86f 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
@@ -105,8 +105,19 @@ def test_get_path(self):
         for scheme in _INSTALL_SCHEMES:
             for name in _INSTALL_SCHEMES[scheme]:
                 expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
 +                tested = get_path(name, scheme)
 +                # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +                if tested.startswith('/usr/local'):
 +                    # /usr/local should only be used in posix_prefix
 +                    self.assertEqual(scheme, 'posix_prefix')
 +                    # Fedora CI runs tests for venv and virtualenv that check for other prefixes
 +                    self.assertEqual(sys.prefix, '/usr')
 +                    # When building the RPM of Python, %check runs this with RPM_BUILD_ROOT set
 +                    # Fedora CI runs this with RPM_BUILD_ROOT unset
 +                    self.assertNotIn('RPM_BUILD_ROOT', os.environ)
 +                    tested = tested.replace('/usr/local', '/usr')
                 self.assertEqual(
 -                    os.path.normpath(get_path(name, scheme)),
 +                    os.path.normpath(tested),
                     os.path.normpath(expected),
                 )
@@ -263,7 +274,7 @@ def test_get_config_h_filename(self):
         self.assertTrue(os.path.isfile(config_h), config_h)
     def test_get_scheme_names(self):
 -        wanted = ['nt', 'posix_home', 'posix_prefix']
 +        wanted = ['nt', 'posix_home', 'posix_prefix', 'rpm_prefix', 'venv']
         if HAS_USER_BASE:
             wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
         self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
@@ -274,6 +285,8 @@ def test_symlink(self): # Issue 7880
             cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
             self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
 +    @unittest.skipIf('RPM_BUILD_ROOT' not in os.environ,
 +                     "Test doesn't expect Fedora's paths")
     def test_user_similar(self):
         # Issue #8759: make sure the posix scheme for the users
         # is similar to the global posix_prefix one
--- a/00328-pyc-timestamp-invalidation-mode.patch
+++ b/00328-pyc-timestamp-invalidation-mode.patch
@ -0,0 +1,54 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
 Date: Thu, 11 Jul 2019 13:44:13 +0200
 Subject: [PATCH] 00328: Restore pyc to TIMESTAMP invalidation mode as default
 in rpmbuild
 Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
 %changelog date. This makes Python default to the CHECKED_HASH pyc
 invalidation mode, bringing more reproducible builds traded for an import
 performance decrease. To avoid that, we don't default to CHECKED_HASH
 when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
 See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
 Downstream only: only used when building RPM packages
 Ideally, we should talk to upstream and explain why we don't want this
 ---
 Lib/py_compile.py           | 3 ++-
 Lib/test/test_py_compile.py | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)
 diff --git a/Lib/py_compile.py b/Lib/py_compile.py
 index 388614e51b..db52725016 100644
 --- a/Lib/py_compile.py
 +++ b/Lib/py_compile.py
@@ -70,7 +70,8 @@ class PycInvalidationMode(enum.Enum):
 def _get_default_invalidation_mode():
 -    if os.environ.get('SOURCE_DATE_EPOCH'):
 +    if (os.environ.get('SOURCE_DATE_EPOCH') and not
 +            os.environ.get('RPM_BUILD_ROOT')):
         return PycInvalidationMode.CHECKED_HASH
     else:
         return PycInvalidationMode.TIMESTAMP
 diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
 index 5ed98dbff1..f30c4e43de 100644
 --- a/Lib/test/test_py_compile.py
 +++ b/Lib/test/test_py_compile.py
@@ -19,6 +19,7 @@ def without_source_date_epoch(fxn):
     def wrapper(*args, **kwargs):
         with os_helper.EnvironmentVarGuard() as env:
             env.unset('SOURCE_DATE_EPOCH')
 +            env.unset('RPM_BUILD_ROOT')
             return fxn(*args, **kwargs)
     return wrapper
@@ -29,6 +30,7 @@ def with_source_date_epoch(fxn):
     def wrapper(*args, **kwargs):
         with os_helper.EnvironmentVarGuard() as env:
             env['SOURCE_DATE_EPOCH'] = '123456789'
 +            env.unset('RPM_BUILD_ROOT')
             return fxn(*args, **kwargs)
     return wrapper
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
 Date: Tue, 7 Dec 2021 14:41:59 +0100
-Subject: 00371: Revert "bpo-1596321: Fix threading._shutdown() for the main
+Subject: [PATCH] 00371: Revert "bpo-1596321: Fix threading._shutdown() for the
- thread (GH-28549) (GH-28589)"
+ main thread (GH-28549) (GH-28589)"
 This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
 introduced regression causing FreeIPA's tests to fail.
--- a/00391-don-t-use-linux-abstract-sockets-for-multiprocessing.patch
+++ b/00391-don-t-use-linux-abstract-sockets-for-multiprocessing.patch
@ -0,0 +1,66 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
 Date: Thu, 20 Oct 2022 16:55:51 -0700
 Subject: [PATCH] 00391: Don't use Linux abstract sockets for multiprocessing
 Linux abstract sockets are insecure as they lack any form of filesystem
 permissions so their use allows anyone on the system to inject code into
 the process.
 This removes the default preference for abstract sockets in
 multiprocessing introduced in Python 3.9+ via
 https://github.com/python/cpython/pull/18866 while fixing
 https://github.com/python/cpython/issues/84031.
 Explicit use of an abstract socket by a user now generates a
 RuntimeWarning.  If we choose to keep this warning, it should be
 backported to the 3.7 and 3.8 branches.
 (cherry picked from commit 49f61068f49747164988ffc5a442d2a63874fc17)
 Co-authored-by: Gregory P. Smith <greg@krypto.org>
 Automerge-Triggered-By: GH:gpshead
 ---
 Lib/multiprocessing/connection.py                 |  5 -----
 .../2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst | 15 +++++++++++++++
 2 files changed, 15 insertions(+), 5 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst
 diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py
 index 510e4b5aba..8e2facf92a 100644
 --- a/Lib/multiprocessing/connection.py
 +++ b/Lib/multiprocessing/connection.py
@@ -73,11 +73,6 @@ def arbitrary_address(family):
     if family == 'AF_INET':
         return ('localhost', 0)
     elif family == 'AF_UNIX':
 -        # Prefer abstract sockets if possible to avoid problems with the address
 -        # size.  When coding portable applications, some implementations have
 -        # sun_path as short as 92 bytes in the sockaddr_un struct.
 -        if util.abstract_sockets_supported:
 -            return f"\0listener-{os.getpid()}-{next(_mmap_counter)}"
         return tempfile.mktemp(prefix='listener-', dir=util.get_temp_dir())
     elif family == 'AF_PIPE':
         return tempfile.mktemp(prefix=r'\\.\pipe\pyc-%d-%d-' %
 diff --git a/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst b/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst
 new file mode 100644
 index 0000000000..02d95b5705
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Security/2022-09-07-10-42-00.gh-issue-97514.Yggdsl.rst
@@ -0,0 +1,15 @@
 +On Linux the :mod:`multiprocessing` module returns to using filesystem backed
 +unix domain sockets for communication with the *forkserver* process instead of
 +the Linux abstract socket namespace.  Only code that chooses to use the
 +:ref:`"forkserver" start method <multiprocessing-start-methods>` is affected.
 +
 +Abstract sockets have no permissions and could allow any user on the system in
 +the same `network namespace
 +<https://man7.org/linux/man-pages/man7/network_namespaces.7.html>`_ (often the
 +whole system) to inject code into the multiprocessing *forkserver* process.
 +This was a potential privilege escalation. Filesystem based socket permissions
 +restrict this to the *forkserver* process user as was the default in Python 3.8
 +and earlier.
 +
 +This prevents Linux `CVE-2022-42919
 +<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42919>`_.
--- a/00393-idle---fix-buggy-macosx-patch.patch
+++ b/00393-idle---fix-buggy-macosx-patch.patch
@ -0,0 +1,111 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
 Date: Sun, 16 Oct 2022 08:33:33 -0700
 Subject: [PATCH] 00393: IDLE - fix buggy macosx patch
 GH-97530 fixed IDLE tests possibly crashing on a Mac without a GUI.
 But it resulted in IDLE not starting in 3.10.8, 3.12.0a1, and
 Microsoft Python 3.10.2288.0 when test/* is not installed.
 After this patch, test.* is only imported when testing on Mac.
 (cherry picked from commit 35fa5d5e7f2b0971b39b2659dc70cb77e34a7dd6)
 Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
 ---
 Lib/idlelib/NEWS.txt                          |  5 +++
 Lib/idlelib/macosx.py                         | 42 ++++++++++++-------
 ...2-10-15-21-20-40.gh-issue-97527.otAHJM.rst |  3 ++
 3 files changed, 34 insertions(+), 16 deletions(-)
 create mode 100644 Misc/NEWS.d/next/IDLE/2022-10-15-21-20-40.gh-issue-97527.otAHJM.rst
 diff --git a/Lib/idlelib/NEWS.txt b/Lib/idlelib/NEWS.txt
 index 277fd9429a..521b1f12f9 100644
 --- a/Lib/idlelib/NEWS.txt
 +++ b/Lib/idlelib/NEWS.txt
@@ -4,6 +4,11 @@ Released 2023-04-03?
 =========================
 +gh-97527: Fix a bug in the previous bugfix that caused IDLE to not
 +start when run with 3.10.8, 3.12.0a1, and at least Microsoft Python
 +3.10.2288.0 installed without the Lib/test package.  3.11.0 was never
 +affected.
 +
 gh-65802: Document handling of extensions in Save As dialogs.
 gh-95191: Include prompts when saving Shell (interactive input/output).
 diff --git a/Lib/idlelib/macosx.py b/Lib/idlelib/macosx.py
 index 1085d689f6..f53bd58970 100644
 --- a/Lib/idlelib/macosx.py
 +++ b/Lib/idlelib/macosx.py
@@ -4,7 +4,6 @@
 from os.path import expanduser
 import plistlib
 from sys import platform  # Used in _init_tk_type, changed by test.
 -from test.support import requires, ResourceDenied
 import tkinter
@@ -16,27 +15,38 @@
 def _init_tk_type():
     """ Initialize _tk_type for isXyzTk functions.
 +
 +    This function is only called once, when _tk_type is still None.
     """
     global _tk_type
     if platform == 'darwin':
 -        try:
 -            requires('gui')
 -        except ResourceDenied:  # Possible when testing.
 -            _tk_type = "cocoa"  # Newest and most common.
 -        else:
 -            root = tkinter.Tk()
 -            ws = root.tk.call('tk', 'windowingsystem')
 -            if 'x11' in ws:
 -                _tk_type = "xquartz"
 -            elif 'aqua' not in ws:
 -                _tk_type = "other"
 -            elif 'AppKit' in root.tk.call('winfo', 'server', '.'):
 +
 +        # When running IDLE, GUI is present, test/* may not be.
 +        # When running tests, test/* is present, GUI may not be.
 +        # If not, guess most common.  Does not matter for testing.
 +        from idlelib.__init__ import testing
 +        if testing:
 +            from test.support import requires, ResourceDenied
 +            try:
 +                requires('gui')
 +            except ResourceDenied:
                 _tk_type = "cocoa"
 -            else:
 -                _tk_type = "carbon"
 -            root.destroy()
 +                return
 +
 +        root = tkinter.Tk()
 +        ws = root.tk.call('tk', 'windowingsystem')
 +        if 'x11' in ws:
 +            _tk_type = "xquartz"
 +        elif 'aqua' not in ws:
 +            _tk_type = "other"
 +        elif 'AppKit' in root.tk.call('winfo', 'server', '.'):
 +            _tk_type = "cocoa"
 +        else:
 +            _tk_type = "carbon"
 +        root.destroy()
     else:
         _tk_type = "other"
 +    return
 def isAquaTk():
     """
 diff --git a/Misc/NEWS.d/next/IDLE/2022-10-15-21-20-40.gh-issue-97527.otAHJM.rst b/Misc/NEWS.d/next/IDLE/2022-10-15-21-20-40.gh-issue-97527.otAHJM.rst
 new file mode 100644
 index 0000000000..e7fda89741
 --- /dev/null
 +++ b/Misc/NEWS.d/next/IDLE/2022-10-15-21-20-40.gh-issue-97527.otAHJM.rst
@@ -0,0 +1,3 @@
 +Fix a bug in the previous bugfix that caused IDLE to not start when run with
 +3.10.8, 3.12.0a1, and at least Microsoft Python 3.10.2288.0 installed
 +without the Lib/test package.  3.11.0 was never affected.
--- a/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
+++ b/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
@ -1,51 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
 Date: Mon, 31 Mar 2025 20:29:04 +0200
 Subject: 00452: Properly apply exported CFLAGS for dtrace/systemtap builds
 When using --with-dtrace the resulting object file could be missing
 specific CFLAGS exported by the build system due to the systemtap
 script using specific defaults.
 Exporting the CC and CFLAGS variables before the dtrace invocation
 allows us to properly apply CFLAGS exported by the build system
 even when cross-compiling.
 Co-authored-by: stratakis <cstratak@redhat.com>
 ---
 Makefile.pre.in                                               | 4 ++--
 .../next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
 diff --git a/Makefile.pre.in b/Makefile.pre.in
 index fa99dd86c4..e9ba702a5c 100644
 --- a/Makefile.pre.in
 +++ b/Makefile.pre.in
@@ -1001,7 +1001,7 @@ Python/frozen.o: $(srcdir)/Python/importlib.h $(srcdir)/Python/importlib_externa
 # an include guard, so we can't use a pipeline to transform its output.
 Include/pydtrace_probes.h: $(srcdir)/Include/pydtrace.d
 	$(MKDIR_P) Include
 -	$(DTRACE) $(DFLAGS) -o $@ -h -s $<
 +	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -h -s $<
 	: sed in-place edit with POSIX-only tools
 	sed 's/PYTHON_/PyDTrace_/' $@ > $@.tmp
 	mv $@.tmp $@
@@ -1011,7 +1011,7 @@ Python/import.o: $(srcdir)/Include/pydtrace.h
 Modules/gcmodule.o: $(srcdir)/Include/pydtrace.h
 Python/pydtrace.o: $(srcdir)/Include/pydtrace.d $(DTRACE_DEPS)
 -	$(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
 +	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
 Objects/typeobject.o: Objects/typeslots.inc
 diff --git a/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
 new file mode 100644
 index 0000000000..a287e0b228
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
@@ -0,0 +1,2 @@
 +The DTrace build now properly passes the ``CC`` and ``CFLAGS`` variables
 +to the ``dtrace`` command when utilizing SystemTap on Linux.
--- a/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
+++ b/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
@ -1,214 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: yevgeny hong <hongyevgeny@gmail.com>
 Date: Tue, 26 Mar 2024 16:45:43 +0900
 Subject: 00462: Fix PySSL_SetError handling SSL_ERROR_SYSCALL
 Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
 SSL_read_ex(), but did not update handling of the return value.
 Change error handling so that the return value is not examined.
 OSError (not EOF) is now returned when retval is 0.
 This resolves the issue of failing tests when a system is
 stressed on OpenSSL 3.5.
 Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
 Co-authored-by: Petr Viktorin <encukou@gmail.com>
 ---
 Lib/test/test_ssl.py                          | 41 +++++++---------
 ...-02-18-09-50-31.gh-issue-115627.HGchj0.rst |  2 +
 Modules/_ssl.c                                | 48 +++++++------------
 3 files changed, 38 insertions(+), 53 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
 diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
 index f4bba8ff03..f772bd6ab6 100644
 --- a/Lib/test/test_ssl.py
 +++ b/Lib/test/test_ssl.py
@@ -2607,16 +2607,18 @@ def run(self):
                         self.write(msg.lower())
                 except OSError as e:
                     # handles SSLError and socket errors
 +                    if isinstance(e, ConnectionError):
 +                        # OpenSSL 1.1.1 sometimes raises
 +                        # ConnectionResetError when connection is not
 +                        # shut down gracefully.
 +                        if self.server.chatty and support.verbose:
 +                            print(f" Connection reset by peer: {self.addr}")
 +
 +                        self.close()
 +                        self.running = False
 +                        return
                     if self.server.chatty and support.verbose:
 -                        if isinstance(e, ConnectionError):
 -                            # OpenSSL 1.1.1 sometimes raises
 -                            # ConnectionResetError when connection is not
 -                            # shut down gracefully.
 -                            print(
 -                                f" Connection reset by peer: {self.addr}"
 -                            )
 -                        else:
 -                            handle_error("Test server failure:\n")
 +                        handle_error("Test server failure:\n")
                     try:
                         self.write(b"ERROR\n")
                     except OSError:
@@ -3298,23 +3300,16 @@ def test_wrong_cert_tls13(self):
              client_context.wrap_socket(socket.socket(),
                                         server_hostname=hostname,
                                         suppress_ragged_eofs=False) as s:
 -            # TLS 1.3 perform client cert exchange after handshake
             s.connect((HOST, server.port))
 -            try:
 +            with self.assertRaisesRegex(
 +                OSError,
 +                'alert unknown ca|EOF occurred|TLSV1_ALERT_UNKNOWN_CA|closed by the remote host|Connection reset by peer'
 +            ):
 +                # TLS 1.3 perform client cert exchange after handshake
                 s.write(b'data')
                 s.read(1000)
                 s.write(b'should have failed already')
                 s.read(1000)
 -            except ssl.SSLError as e:
 -                if support.verbose:
 -                    sys.stdout.write("\nSSLError is %r\n" % e)
 -            except OSError as e:
 -                if e.errno != errno.ECONNRESET:
 -                    raise
 -                if support.verbose:
 -                    sys.stdout.write("\nsocket.error is %r\n" % e)
 -            else:
 -                self.fail("Use of invalid cert should have failed!")
     def test_rude_shutdown(self):
         """A brutal shutdown of an SSL server should raise an OSError
@@ -4560,8 +4555,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
                 # test sometimes fails with EOF error. Test passes as long as
                 # server aborts connection with an error.
                 with self.assertRaisesRegex(
 -                    ssl.SSLError,
 -                    '(certificate required|EOF occurred)'
 +                    OSError,
 +                    'certificate required|EOF occurred|closed by the remote host|Connection reset by peer'
                 ):
                     # receive CertificateRequest
                     data = s.recv(1024)
 diff --git a/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
 new file mode 100644
 index 0000000000..75d926ab59
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
@@ -0,0 +1,2 @@
 +Fix the :mod:`ssl` module error handling of connection terminate by peer.
 +It now throws an OSError with the appropriate error code instead of an EOFError.
 diff --git a/Modules/_ssl.c b/Modules/_ssl.c
 index af770c7f18..7b3cf61474 100644
 --- a/Modules/_ssl.c
 +++ b/Modules/_ssl.c
@@ -582,7 +582,7 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) {
 }
 static PyObject *
 -PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
 +PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno)
 {
     PyObject *type;
     char *errstr = NULL;
@@ -595,7 +595,6 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
     _sslmodulestate *state = get_state_sock(sslsock);
     type = state->PySSLErrorObject;
 -    assert(ret <= 0);
     e = ERR_peek_last_error();
     if (sslsock->ssl != NULL) {
@@ -628,32 +627,21 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
         case SSL_ERROR_SYSCALL:
         {
             if (e == 0) {
 -                PySocketSockObject *s = GET_SOCKET(sslsock);
 -                if (ret == 0 || (((PyObject *)s) == Py_None)) {
 +                /* underlying BIO reported an I/O error */
 +                ERR_clear_error();
 +#ifdef MS_WINDOWS
 +                if (err.ws) {
 +                    return PyErr_SetFromWindowsErr(err.ws);
 +                }
 +#endif
 +                if (err.c) {
 +                    errno = err.c;
 +                    return PyErr_SetFromErrno(PyExc_OSError);
 +                }
 +                else {
                     p = PY_SSL_ERROR_EOF;
                     type = state->PySSLEOFErrorObject;
                     errstr = "EOF occurred in violation of protocol";
 -                } else if (s && ret == -1) {
 -                    /* underlying BIO reported an I/O error */
 -                    ERR_clear_error();
 -#ifdef MS_WINDOWS
 -                    if (err.ws) {
 -                        return PyErr_SetFromWindowsErr(err.ws);
 -                    }
 -#endif
 -                    if (err.c) {
 -                        errno = err.c;
 -                        return PyErr_SetFromErrno(PyExc_OSError);
 -                    }
 -                    else {
 -                        p = PY_SSL_ERROR_EOF;
 -                        type = state->PySSLEOFErrorObject;
 -                        errstr = "EOF occurred in violation of protocol";
 -                    }
 -                } else { /* possible? */
 -                    p = PY_SSL_ERROR_SYSCALL;
 -                    type = state->PySSLSyscallErrorObject;
 -                    errstr = "Some I/O error occurred";
                 }
             } else {
                 if (ERR_GET_LIB(e) == ERR_LIB_SYS) {
@@ -1014,7 +1002,7 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
              err.ssl == SSL_ERROR_WANT_WRITE);
     Py_XDECREF(sock);
     if (ret < 1)
 -        return PySSL_SetError(self, ret, __FILE__, __LINE__);
 +        return PySSL_SetError(self, __FILE__, __LINE__);
     if (PySSL_ChainExceptions(self) < 0)
         return NULL;
     Py_RETURN_NONE;
@@ -2433,7 +2421,7 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
     Py_XDECREF(sock);
     if (retval == 0)
 -        return PySSL_SetError(self, retval, __FILE__, __LINE__);
 +        return PySSL_SetError(self, __FILE__, __LINE__);
     if (PySSL_ChainExceptions(self) < 0)
         return NULL;
     return PyLong_FromSize_t(count);
@@ -2463,7 +2451,7 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
     self->err = err;
     if (count < 0)
 -        return PySSL_SetError(self, count, __FILE__, __LINE__);
 +        return PySSL_SetError(self, __FILE__, __LINE__);
     else
         return PyLong_FromLong(count);
 }
@@ -2585,7 +2573,7 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
              err.ssl == SSL_ERROR_WANT_WRITE);
     if (retval == 0) {
 -        PySSL_SetError(self, retval, __FILE__, __LINE__);
 +        PySSL_SetError(self, __FILE__, __LINE__);
         goto error;
     }
     if (self->exc_type != NULL)
@@ -2709,7 +2697,7 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
     }
     if (ret < 0) {
         Py_XDECREF(sock);
 -        PySSL_SetError(self, ret, __FILE__, __LINE__);
 +        PySSL_SetError(self, __FILE__, __LINE__);
         return NULL;
     }
     if (self->exc_type != NULL)
--- a/00474-cve-2025-15366.patch
+++ b/00474-cve-2025-15366.patch
@ -1,61 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Seth Michael Larson <seth@python.org>
 Date: Tue, 20 Jan 2026 14:45:42 -0600
 Subject: 00474: CVE-2025-15366
 gh-143921: Reject control characters in IMAP commands
 (cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
 ---
 Lib/imaplib.py                                              | 4 +++-
 Lib/test/test_imaplib.py                                    | 6 ++++++
 .../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 +
 3 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
 diff --git a/Lib/imaplib.py b/Lib/imaplib.py
 index 54122f985b..9ab8e43bbf 100644
 --- a/Lib/imaplib.py
 +++ b/Lib/imaplib.py
@@ -132,7 +132,7 @@
 # We compile these in _mode_xxx.
 _Literal = br'.*{(?P<size>\d+)}$'
 _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
 -
 +_control_chars = re.compile(b'[\x00-\x1F\x7F]')
 class IMAP4:
@@ -994,6 +994,8 @@ def _command(self, name, *args):
             if arg is None: continue
             if isinstance(arg, str):
                 arg = bytes(arg, self._encoding)
 +            if _control_chars.search(arg):
 +                raise ValueError("Control characters not allowed in commands")
             data = data + b' ' + arg
         literal = self.literal
 diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py
 index f817707743..9ce59b3040 100644
 --- a/Lib/test/test_imaplib.py
 +++ b/Lib/test/test_imaplib.py
@@ -505,6 +505,12 @@ def test_login(self):
         self.assertEqual(data[0], b'LOGIN completed')
         self.assertEqual(client.state, 'AUTH')
 +    def test_control_characters(self):
 +        client, _ = self._setup(SimpleIMAPHandler)
 +        for c0 in support.control_characters_c0():
 +            with self.assertRaises(ValueError):
 +                client.login(f'user{c0}', 'pass')
 +
     def test_logout(self):
         client, _ = self._setup(SimpleIMAPHandler)
         typ, data = client.login('user', 'pass')
 diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
 new file mode 100644
 index 0000000000..4e13fe92bc
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
@@ -0,0 +1 @@
 +Reject control characters in IMAP commands.
--- a/00475-cve-2025-15367.patch
+++ b/00475-cve-2025-15367.patch
@ -1,61 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Seth Michael Larson <seth@python.org>
 Date: Tue, 20 Jan 2026 14:46:32 -0600
 Subject: 00475: CVE-2025-15367
 gh-143923: Reject control characters in POP3 commands
 (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
 ---
 Lib/poplib.py                                             | 2 ++
 Lib/test/test_poplib.py                                   | 8 ++++++++
 .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst        | 1 +
 3 files changed, 11 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
 diff --git a/Lib/poplib.py b/Lib/poplib.py
 index 0f8587317c..f563030f7f 100644
 --- a/Lib/poplib.py
 +++ b/Lib/poplib.py
@@ -122,6 +122,8 @@ def _putline(self, line):
     def _putcmd(self, line):
         if self._debugging: print('*cmd*', repr(line))
         line = bytes(line, self.encoding)
 +        if re.search(b'[\x00-\x1F\x7F]', line):
 +            raise ValueError('Control characters not allowed in commands')
         self._putline(line)
 diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
 index 1220ca32ef..2655e366fd 100644
 --- a/Lib/test/test_poplib.py
 +++ b/Lib/test/test_poplib.py
@@ -12,6 +12,7 @@
 import unittest
 from unittest import TestCase, skipUnless
 from test import support as test_support
 +from test.support import control_characters_c0
 from test.support import hashlib_helper
 from test.support import socket_helper
 from test.support import threading_helper
@@ -365,6 +366,13 @@ def test_quit(self):
         self.assertIsNone(self.client.sock)
         self.assertIsNone(self.client.file)
 +    def test_control_characters(self):
 +        for c0 in control_characters_c0():
 +            with self.assertRaises(ValueError):
 +                self.client.user(f'user{c0}')
 +            with self.assertRaises(ValueError):
 +                self.client.pass_(f'{c0}pass')
 +
     @requires_ssl
     def test_stls_capa(self):
         capa = self.client.capa()
 diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
 new file mode 100644
 index 0000000000..3cde4df3e0
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
@@ -0,0 +1 @@
 +Reject control characters in POP3 commands.
--- a/00494-increase-the-timeout-of-test_large_content_length_truncated.patch
+++ b/00494-increase-the-timeout-of-test_large_content_length_truncated.patch
@ -1,23 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Karolina Surma <ksurma@redhat.com>
 Date: Fri, 14 Aug 2026 09:38:26 +0200
 Subject: 00494: Increase the timeout of test_large_content_length_truncated
 It has started to fail randomly when run on s390x architecture.
 ---
 Lib/test/test_httpservers.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
 index 5eb3c82fbd..aa8ad1c323 100644
 --- a/Lib/test/test_httpservers.py
 +++ b/Lib/test/test_httpservers.py
@@ -872,7 +872,7 @@ def test_large_content_length(self):
             self.assertEqual(res.read(), b'%d %d' % (size, size) + self.linesep)
     def test_large_content_length_truncated(self):
 -        with support.swap_attr(self.request_handler, 'timeout', 0.001):
 +        with support.swap_attr(self.request_handler, 'timeout', support.LOOPBACK_TIMEOUT):
             for w in range(18, 65):
                 size = 1 << w
                 headers = {'Content-Length' : str(size)}
--- a/check-pyc-timestamps.py
+++ b/check-pyc-timestamps.py
@ -19,9 +19,11 @@ not_compiled = [
    '*/test/bad_coding.py',
    '*/test/bad_coding2.py',
    '*/test/badsyntax_*.py',
-    '*/lib2to3/tests/data/*.py',
+    '*/lib2to3/tests/data/bom.py',
-    '*/lib2to3/tests/data/*/*.py',
+    '*/lib2to3/tests/data/crlf.py',
-    '*/lib2to3/tests/data/*/*/*.py',
+    '*/lib2to3/tests/data/different_encoding.py',
    '*/lib2to3/tests/data/false_encoding.py',
    '*/lib2to3/tests/data/py2_test_grammar.py',
    '*.debug-gdb.py',
 ]
--- a/pgp_keys.asc
+++ b/pgp_keys.asc
@ -0,0 +1,109 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 mQINBFq+ToQBEADRYvIVtbK6owynD3j3nxwpW2KEk/p+aDvtXmc2SR2dBcZ8sFW2
 R5vEsG8d3/D3wgv5pcL3KfNNXQYUnXVbobrFUUWQYc79qIsE3MgiPf5NVOtwKPUR
 i5g9YJgKvpBxkQfqp3LYGm9ZBtwo3DVLA3yn7KsazCmAgTNFJYw7ku1XxgmIzY6K
 5J30DfbJiqDqj4f9GslCCCCH3qiPnuLG/HUyVLHMpbWlaiy9NI0GcaLxjJewHj9w
 W2D2lydkxe5JGo7egUkV3ILcuLVSVKA35SKY27dYqfuyqp9tAzaRbjDYjsYdHA6G
 BqrNrKBn/GwlFDPrVdcvN3ZSY2wMLTxWE3Axc/FweuHxFnou/80FwX7F3JD+oEQ6
 rofmcxOBCC7J98I7HZAhP9jBn88XIS2hztbLq8d6rZJZRtcz0k61VR0ddO+TrFmf
 9rMYCPgCckRtVxeFIVIabrN1IzKynLFeo040h8hSGswd6YKDOVwjJY6Oa6EmVefZ
 a8QSt4+M65RSzH6SEPY008F3nJUAK6MEkzTak+tFltZNrVWu8p2xd1j9nmxAwEhZ
 /lgbxLqzYgaUWmfyHeZ8yVA0MhHzdiAL8nVUEdG3KecIq0RWCJLGLWWIjd6KAJl1
 yAmhRYKK/sjPDsL3elHsFACfZbyx3o5GGQNlas1FYoPLWbaNGaJtgFTF2QARAQAB
 tCtQYWJsbyBHYWxpbmRvIFNhbGdhZG8gPHBhYmxvZ3NhbEBnbWFpbC5jb20+iQJO
 BBMBCgA4FiEEoDXIwZIZuoIezqhrZOYo+NaEaW0FAlq+ToQCGwMFCwkIBwMFFQoJ
 CAsFFgIDAQACHgECF4AACgkQZOYo+NaEaW2bmA/+PXIap2udLoUVOHxnsIBdqYwp
 sv1Aj5lfIJmNhmxPbHShwp1Jg+w4urxe+2Dj5ofKVlIo1i83bQkvnKJMDXDVuc/K
 P6zqhBJ3rT4Q3qx2mzX8bIfQoJ2JHuH4lkP+I7doDcHHRyeNASyk72VdQmU4twNw
 Ibn8nSNV6ThKHdoPYzVnO2rZUFcGIqH5HNsvR+B7cc1MBCHsgURYwSVhSePIFGlZ
 iasdBD6QQkDSe4QWi7AcJFWFElw4kbOKJWxAWsrEk+tMXJVGRjnmL289EmPCx/vx
 BqKy7Mse0yWCSRR3vB+O6TB1S5SgEyEgqlYsfGNv1qf/rfRD4KkyCbNU3LhY1Aim
 vJP4pDW+KFxTk2Ks8vrx8gOSd2aFqPeO/pFDrpsF7PD62XwsfoXu4xc5V0Giw7r1
 Nai0nax7kOrldNF8TbbtRjW0jmoC7wLIDujAkwDIOroZ0CXA3N4HVHdSbrHm/urX
 nyxJXupXAQNwGx64JCBcbF2fp3Kvu1VAXBEFnd01KaopthHcbG5pA50Kl2Vhe+98
 OdezUX42fHkQpQkB7HgtXfm6W1bw6YRBamrNvs1OoHBYmUjlECpe566IIu25Hc8s
 x3qA+6eca7iqizyLG+WyMT8ZIYTWGAS59jxwR4esqGczbbZPSAPHFwLbGv7Wr0Rd
 TPu5B0FcKpDkTd4IxQW5Ag0EWr5O2gEQAMjLe4CtbSfofmJrz5wfNkMVsZ81Gbqe
 MoYd3dtkJnQYERUj8flzBj3ucaxGJ+Cuf7ybh3naPopKvEI1q0vkcgCDqrEgXK//
 jKJbP28uPSMGhOG28q4PbamG55gy5FtM3ezzAxPWWKe9qBpV65GMmFy7eBQx2iJs
 yiDIOOQQ4kraS+cTqNFimEXAGLCOQRNLcwIZzwAAHoW7HEpNUfVwaBD9kMlbo1ND
 I60IKcNrNcmcmRxhJqfxjj8YBMwcKHO6GBE3AVpaE/+UO9zyr4TH+0YuQUgxKlPW
 Dkg5XlkDo0S1GyLY5e9ckIDIlkTdDa2pOkoE2yB5MQCEga3YiHrKUVTTWaxn9XVJ
 6x5ZjUF6bgSWGkrG5dUqSYoO1iDMuNVjtiujNyf/rvfj5cNxS7/lgxchhQKZHZXL
 WVqxlneeVJ6s0P4+ROVG9ga2Sve7aUJ6wXIewZwulBcV2sE/W/DgxHgLBi53CUQt
 vEzFzKvo48GnDqL5VYjA7l0HMYHd4GksCLi8E8U6Cgj+imXiM8voL7pHRZfs8mY8
 udR+UT4e1Scl2MYP2qBJ9/17B/X52B3s1EZdqI/r+hfOyqrhPs+dbAN0mtMPn68+
 nrvY1+nscvrSYEP6ZBlc9Hp2mgJdb6IcTvINXBEeLRjgc3pjViva443pkiFp9Axm
 ecOckMKP3uSlABEBAAGJBGwEGAEKACAWIQSgNcjBkhm6gh7OqGtk5ij41oRpbQUC
 Wr5O2gIbAgJACRBk5ij41oRpbcF0IAQZAQoAHRYhBM/cokWxBDzypfl4Zf/odAQW
 i9hHBQJavk7aAAoJEP/odAQWi9hHr7YP/RCLre1CmOoWYpAtoa1yVCeYMDV6eQgL
 B488/BEZHQE1zbrYy16XkhORob3JF/kUMjmJW7XaFF8FrWvRcdj/xaUGbOOEulKg
 v+8zWfswYQRiZ4/JlwER4vRLi6fTE89MVER6Fkj2ASD4D2cifY+EztD4flV3sq3s
 vIogGFaN9IvdrdeptOVGXs1RmAyoTsiS2mKQ6xsGh8B9ZAm55W8fBOGiSzLX21Xk
 Ofdw53BrFQxn3cu/JgIKpdeZxgukcvEAI62B6X+YL6Na4j0eqEGLzsNtU1+xeJlo
 WtVvmRwnRHGSxF6fzIZ3mk/p/aFiXAEq/xITCTY6tDv7x7pFE/RpdlJZyNJ+R5Y4
 SQiuDsylxNCa/4G5EB6q+7iVYtbEQ9MnZg2phowEE42tlj0rz8/rvDK3LH3xibot
 KHIodCWKlWByxH99u2PuHUQ0c1oCVBUE1KkruMpvI236DpU/dvdq4JLSg/fWrys/
 VIjqLZgsIE5g/KO9XqngWHkLcBLh4CNAmHJ8Iia+s+/rfgsejQWB5uJb6eYg2JjB
 4WP1EI0rULM6fdrCNB+MJ36wE2Lnb4bfT0phOMgjjH5/Ki7ZCbkxkOsBs4SRjiS+
 weCsmpAtMqodWY/Cnw9pWSA/qLSRD5/mKeb9SO6OZ/OPfAatwnGHsvZ2sAueC6rR
 04W5BfXZWrnJUXQP/id/EKE1Ksp5fKoxSCbkKTCig+Sf5Afwe36yFN+niZBqzn5b
 BgL/HIKaZM97oDHersPPANeEgS+JVlBf95iKIYnQbZP43FLVbvOuaINhBIVtFO54
 2Y7EYwl41kP7ILDElVy36KAmdQyBAfrjnZiRA70xShOxApLug1L0lxhR3YfmLwNi
 RJ0V6KnYDKf0pfdhO9VFyFFWUojX1usn2SmSsXNizsNtvRqHXzPnX0rbJzZ9+N4O
 9k1nxygYFG/2R/jGonVmTjRzcAHrAkNJETMWXMA7/8wRMDwluz8j+cCldey9x8Vk
 JwgLGnZSbQtVpcFAnm5r/36Gt+9wc1VWMyrUrVr6Z679aqAbG7PMaeR5h5ygMj1k
 VqRTYAUPSk1f8bZKRssQkQwEbp9dVIjm9SsR8VT7/tB+UuB85dABxgHfv3psJRT+
 tL8g9V7kSZqQfcLNGmvEVvr2Zl9NtxwXtsFM2OBprxCenwb+e9Ppm1LjfJG/NE72
 mAnOERfDaiLt4bqNo36Ei5sGCJ4Fx61phzNBXzkdRNM47i8J5UZRKFkE91c99BVM
 HKUaY61NRK24fR0zP98ftDU82YFw0VRFJpTeBrO5ivN1MlQxUPzUWxKxMxO+20wa
 UOXroEw11Tb4SRLGOla1pCl6lCUPJRy9IzadPDgTr/OTMkob/snt/XLdnV5/uQIN
 BFq+TvoBEAC8Oy1g6pPWBbrCMhIq7VWY2fjylJ1fwg5BPXkOKVK1dsGYO4QD7oW9
 L0aSqcFSNFGF9Cl0Ri4TFXZC3hnG4HeSXUWApuKdBLn21H3jba36Ay1oGcGfdm0v
 Zght4c6BlMVBpGCw2wIkJbUNEy6InMM+O8CCbbaH3iJkJ4141P7pODHignx5AmZI
 conMui4YOhC+IXQXynVEv1Juk7erB1Nh1RcRvsA4lb44HWx49lIwe85ejOmoZ0O3
 6f9NJRer6bV0+rHWmg4IV5Q9h/Gn4IhEDZxA0DZl1RQI7dMgaMbIFbXGq7Kgzstz
 EUnOoy29hXodxVmwIsMrAiQUYtwJ9hW+ESsw47+W2iPHVgviGWl7r/SgcgMYmf6m
 5kiTBtwU7BQPS9G3zwwP2Rm3AA/6g39Q+tQKjOwi1I8+GZsY2On44Zly7BreBNg5
 4gJgdAGcMOYU9etr050clH3UpTYcAEtX++ahtOKhJgLIPNcIAQNlnifqvU0VYpgw
 R4YpZ7hgg+AVDzC73PIM0lFI0XiDuqChbxE+K1jmLXWe5iJF0dzgVTwP+PmsifNZ
 Wg3+YxSsS+hDMPQ2xPiQN49gT4JJDHcDuyhHyCGYgyMiVJCsku9KrkubbfVRivyN
 ZF2Zfo3f+nbrRxsftz0yjAq8byCvb0V0XOpt4pJ/ddlug9ytRxALNwARAQABiQI2
 BBgBCgAgFiEEoDXIwZIZuoIezqhrZOYo+NaEaW0FAlq+TvoCGwwACgkQZOYo+NaE
 aW3urA//UQ/cKQ7HvWjcLphzQOZc+6m5YL0wxvZkSjemU7mqjZdpacteIvRAoers
 EqXHc208liIBtNfRzoreXdcXNzie65xXkrRnWoHVH/fTWy4lOnHr2CMXLeHjUgg/
 M6PYi8+sARm05YFB8nsYhlhx3IdLhcfeVVbJedQKO0yL3CK1okT30DUVq5Lq6X/K
 DC6AxuJR3D6UMSoT0WLaoX8qbhAp88qLynInfBVL18d97h916WPLTPeP0eHwhwND
 bYtKDCMDuKQ9XX5+QsNH0RmbxlX274LHrUMMvkLKxcfCBvP+iuqrBeIuoeVzXYJZ
 j7ZJtEH79bW44eecl/CY/STFYgSQ2XGTp2BI2q60wAmtKlNhwxY5ena0FgyFl6Tm
 5OBHW/Pwo+ndQJGfbrCyWkTgRay9c8er3gl3GQYIBH6X0kCiG7h/Epj0b5CHOPU5
 hCw0kEB8MB4poTIjeiY+Q01472/lQ68CL3DX158hR5d3XaPSIxAN+qFsfB1o316p
 yjxhfK1MD/IfrOgjlggPPnc/KmLkCzpgdwKcZwLCdZq9hYBvF1Zs34HbaVMYbWTK
 uxLowtXGU43vatCXXqmPOvl4/g4tZD6rysJDgOrHQnEHzT+Napn07s0BRC0IbbNn
 FynUrkr5KMSuRz7Hg7xMApENOrb0nqdHSUJ914ZpuMIS6RhJgGu5Ag0EWr5PIAEQ
 ALfh9vPD2B+miHDTMADI8aRZ7g9tnzynZYkk3+2sCiiusetsQQ+HIPJ/ASEJB7On
 ane9dyT/LTRhrK9qaxgVMimk2COXB/xyh7Mnw7nJgFU0aRSbtX0vbvQz2suSzrQ6
 9mPKzan28JGoClqB0bw1vwf3VjjxHV2dgD57CmqFPv7kAC/2a56dE+etzXattZAL
 +2JWTpmfQ0ePRRadtBm0VahQhnU8x0+jvAVrEawqpVW83ozYFyW/0WInM2J7jHgQ
 16OosY4lj5L/DxpVxaArhRFoRfWPXfC37iE8Mou/I95isvPQIhp1wTo4jG0KM02B
 oIVbp/QRNBQ6WtpOzvJs1gqQiJJTfqbKJXQ3NDEY9crpVS83HJ+Zv99PNsyNkFjG
 QpU84U3ZhsI4ygjdY45mpZueqI1RVcRQdu8Hgvoo/78Q/Sir6gMGop3mVdVo2guI
 kFcJrXh0Xk3ech4aVqrmKx/mPXGwOAQU0DAul4RW3fKg1QxQE7Tlw3+95Ee/+q5j
 HARL0uDbCJpRO8Sl8NDEuL32n/2Ot6kQeCSHrU7KJRYAkTxkKvr8zNow7hFhHFPE
 SnHvTnskI6noh0VY6NwMhmLvhm0wKkRxZPzUNc3sgLvbK1NymIZ9aKCZamzhZrmG
 vnblEz/OSLwGUua465H3hM1vvBQiartj7+6ZqWIkSmBPABEBAAGJAjYEGAEKACAW
 IQSgNcjBkhm6gh7OqGtk5ij41oRpbQUCWr5PIAIbIAAKCRBk5ij41oRpbWmeEACG
 +axtDC8UoNp9ORiYwEWLzZWDuugE+ah7DYYGD4Vs633FXVZW3SgM/bFtJ/0Lg8CF
 74jI4LMHyIjDzEjcoItwnhBLix+kUoJTvrY58GPydwekLuw1p4KXLqtRs4fsZbNQ
 YTknl4jYtRWoxO98x7tun7Gq2gqmJkIB2uj630fKz5cBk6p6oDFKjzyrHe+V7BiK
 3okQPaD4x7hq8OnTy7lOy92ZZAqztS4tNEb4DkYW1MpuwsJ7hbBZitc1siI+FVVb
 GjVVGZz6ssXoW67Tz8+VxdWJxNLXlv27eMcj4sme5S0th/YYNA5fRRv6zuzqZAru
 YNGLpYYU7JLvZJ+3lCwa5j5ycOGBF0GvsGs6gj6h+CHkjR/BgzAgWC+GgUgslt6q
 aH04rWtV6rVz+Y91LcrX5P6OM4anmXD3Gp3kl35AypXb4KyASF19+11RUziD4Z7q
 wQEWfbwOltNyZv2lD8s2jPr7P02axWRQUbZAEhxRmvOQev/FZPyCF6gqUo/HxRbQ
 y3bzmnipyHSv1DlXNfCFCHvN8kGyZnRWARqIKRg+j9ediJgOUqlLhg6KmrTVxd5v
 3Dfv52PW2UODDTM20s3cQGuX/UswzMRwPI/+P44iCMwEKdm7duM/5oisZT9Vhy7g
 P15MreFZLcZvUVgjqgy0u57cstyGK1Bo9e2sFcK2fA==
 =6Zb4
 -----END PGP PUBLIC KEY BLOCK-----
--- a/pgp_keys_combined.asc
+++ b/pgp_keys_combined.asc
--- a/plan.fmf
+++ b/plan.fmf
@ -1,65 +0,0 @@
 execute:
  how: tmt
 provision:
  hardware:
    memory: '>= 3 GB'
 environment:
  pybasever: '3.10'
 discover:
  - name: tests_python
    how: shell
    url: https://src.fedoraproject.org/tests/python.git
    tests:
    - name: smoke
      path: /smoke
      test: "VERSION=${pybasever} ./venv.sh"
    - name: smoke_virtualenv
      path: /smoke
      test: "VERSION=${pybasever} METHOD=virtualenv ./venv.sh"
    - name: debugsmoke
      path: /smoke
      test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} ./venv.sh"
    - name: selftest
      path: /selftest
      test: "VERSION=${pybasever} X='' ./parallel.sh"
    - name: debugtest
      path: /selftest
      test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='' ./parallel.sh"
    - name: debugflags
      path: /flags
      test: "python${pybasever}d ./assertflags.py -O0"
    - name: marshalparser
      path: /marshalparser
      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
    - name: required_symbols
      path: /required-symbols
      test: "VERSION=${pybasever} ./check.sh"
 prepare:
  - name: Install dependencies
    how: install
    package:
    - gcc  # for extension building in venv and selftest
    - gdb  # for test_gdb
    - "python${pybasever}"  # the test subject
    - "python${pybasever}-debug"  # for leak testing
    - "python${pybasever}-devel"  # for extension building in venv and selftest
    - "python${pybasever}-tkinter"  # for selftest
    - "python${pybasever}-test"  # for selftest
    - tox  # for venv tests
    - virtualenv  # for virtualenv tests
    - glibc-all-langpacks # for locale tests
    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
    - binutils  # for nm (symbol inspection)
    - rpm  # for debugging
    - dnf  # for upgrade and downgrade
  - name: Update packages
    how: shell
    script: dnf upgrade -y
  - name: rpm_qa
    order: 100
    how: shell
    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt
--- a/python3.10.rpmlintrc
+++ b/python3.10.rpmlintrc
@ -0,0 +1,95 @@
 # KNOWN BUGS:
 # https://bugzilla.redhat.com/show_bug.cgi?id=1489816
 addFilter(r'crypto-policy-non-compliance-openssl')
 # TESTS:
 addFilter(r'(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+/test')
 # OTHER DELIBERATES:
 # chroot function
 addFilter(r'missing-call-to-chdir-with-chroot')
 # intentionally unversioned and selfobsoleted
 addFilter(r'unversioned-explicit-obsoletes python')
 addFilter(r'unversioned Obsoletes: Obsoletes: python3\.\d+$')
 addFilter(r'self-obsoletion python3\.\d+ obsoletes python3\.\d+')
 # intentionally hardcoded
 addFilter(r'hardcoded-library-path in %{_prefix}/lib/(debug/%{_libdir}|python%{pybasever})')
 # we have non binary stuff, python files
 addFilter(r'only-non-binary-in-usr-lib')
 # some devel files that are deliberately needed
 addFilter(r'devel-file-in-non-devel-package /usr/include/python3\.\d+m?/pyconfig-(32|64)\.h')
 addFilter(r'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/distutils/tests/xxmodule\.c')
 # some bytecode is shipped without sources on purpose, as a space optimization
 # if this regex needs to be relaxed in the future, make sure it **does not** match pyc files in __pycache__
 addFilter(r'python-bytecode-without-source /usr/lib(64)?/python3\.\d+/(encodings|pydoc_data)/[^/]+.pyc')
 # SORRY, NOT SORRY:
 # manual pages
 addFilter(r'no-manual-page-for-binary (idle|pydoc|pyvenv|2to3|python3?-debug|pathfix|msgfmt|pygettext)')
 addFilter(r'no-manual-page-for-binary python3?.*-config$')
 addFilter(r'no-manual-page-for-binary python3\.\d+dm?$')
 # missing documentation from subpackages
 addFilter(r'^python3(\.\d+)?-(debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation')
 # platform python is obsoleted, but not provided
 addFilter(r'obsolete-not-provided platform-python')
 # we have extra tokens at the end of %endif/%else directives, we consider them useful
 addFilter(r'extra tokens at the end of %(endif|else) directive')
 # RPMLINT IMPERFECTIONS
 # https://github.com/rpm-software-management/rpmlint/issues/123
 addFilter(r'python-bytecode-wrong-magic-value .* expected 33\d\d \(3\.7\), found 3393')
 # https://github.com/rpm-software-management/rpmlint/pull/133
 addFilter(r'python-bytecode-wrong-magic-value .* expected 33\d\d \(3\.7\), found 3394')
 # https://bugzilla.redhat.com/show_bug.cgi?id=1550562
 # https://github.com/rpm-software-management/rpmlint/issues/128
 addFilter(r'python-bytecode-inconsistent-mtime .* 1970')
 # we provide python(abi) manually to be sure. createrepo will merge this with the automatic
 addFilter(r'python3(\.\d+)?\.[^:-]+: (E|W): useless-provides python\(abi\)')
 # debugsource
 addFilter(r'^python3(\.\d+)?-debugsource\.[^:]+: (E|W): no-documentation')
 # debuginfo
 addFilter(r'^python3(\.\d+)?-debuginfo\.[^:]+: (E|W): useless-provides debuginfo\(build-id\)')
 # this is OK for F28+
 addFilter(r'library-without-ldconfig-post')
 # debug package contains devel and non-devel files
 addFilter(r'python3(\.\d+)?-debug\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package')
 # this goes to other subpackage, hence not actually dangling, the read error is bogus
 addFilter(r'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc python-3\.\d+(-embed)?\.pc')
 addFilter(r'read-error /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc \[Errno 2\]')
 # the python-unversioned-command package contains dangling symlinks by design
 addFilter(r'^python-unversioned-command\.[^:]+: (E|W): dangling-relative-symlink '
          r'(/usr/bin/python \./python3|/usr/share/man/man1/python\.1\S* ./python3\.1\S*)$')
 # we need this macro to evaluate, even if the line starts with #
 addFilter(r'macro-in-comment %\{_pyconfig(32|64)_h\}')
 # Python modules don't need to be linked against libc
 # Since 3.8 they are no longer linked against libpython3.8.so.1.0
 addFilter(r'(E|W): library-not-linked-against-libc /usr/lib(64)?/python3\.\d+/lib-dynload/')
 addFilter(r'(E|W): shared-lib-without-dependency-information /usr/lib(64)?/python3\.\d+/lib-dynload/')
 # specfile-errors are listed twice, once with reason and once without
 # we filter out the empty ones
 addFilter(r'\bpython3(\.\d+)?\.(src|spec): (E|W): specfile-error\s+$')
 # SPELLING ERRORS
 addFilter(r'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest) ')
--- a/python3.10.spec
+++ b/python3.10.spec
@ -13,12 +13,12 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.21
+%global general_version %{pybasever}.8
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 3%{?dist}
-License: Python-2.0.1
+License: Python
 # ==================================
@ -67,8 +67,8 @@ License: Python-2.0.1
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 23.0.1
+%global pip_version 22.2.2
-%global setuptools_version 79.0.1
+%global setuptools_version 63.2.0
 # Expensive optimizations (mainly, profile-guided optimizations)
 %bcond_without optimizations
@ -175,12 +175,6 @@ Obsoletes: python%{pybasever}%{?1:-%{1}}\
 %define unversioned_obsoletes_of_python3_X_if_main() %{nil}
 %endif
 # Opt-out from https://fedoraproject.org/wiki/Changes/fno-omit-frame-pointer
 # Python is slower with frame pointers, but we expect to remove this in Python 3.12+
 # See https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/6TQYCHMX4FZLF27U5BCEC7IFV6XNBKJP/
 # Tracking bugzilla: https://bugzilla.redhat.com/2158729
 %undefine _include_frame_pointers
 # =======================
 # Build-time requirements
 # =======================
@ -210,12 +204,12 @@ BuildRequires: libnsl2-devel
 BuildRequires: libtirpc-devel
 BuildRequires: libGL-devel
 BuildRequires: libuuid-devel
 BuildRequires: libxcrypt-devel
 BuildRequires: libX11-devel
 BuildRequires: make
 BuildRequires: mpdecimal-devel
 BuildRequires: ncurses-devel
 BuildRequires: openssl-devel
 BuildRequires: pkgconfig
 BuildRequires: readline-devel
 BuildRequires: redhat-rpm-config >= 127
@ -223,15 +217,11 @@ BuildRequires: sqlite-devel
 BuildRequires: gdb
 BuildRequires: tar
-BuildRequires: tcl-devel < 1:9
+BuildRequires: tcl-devel
 BuildRequires: tix-devel
-BuildRequires: tk-devel < 1:9
+BuildRequires: tk-devel
 BuildRequires: tzdata
 # Support for OpenSSL 4 only landed in Python 3.15 for now
 # https://github.com/python/cpython/issues/146207
 BuildRequires: (openssl-devel < 1:4 or openssl3-devel)
 %if %{with valgrind}
 BuildRequires: valgrind-devel
 %endif
@ -239,18 +229,14 @@ BuildRequires: valgrind-devel
 BuildRequires: xz-devel
 BuildRequires: zlib-devel
 BuildRequires: systemtap-sdt-devel
 BuildRequires: /usr/bin/dtrace
 # workaround http://bugs.python.org/issue19804 (test_uuid requires ifconfig)
 BuildRequires: /usr/sbin/ifconfig
 %if %{with rpmwheels}
-BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel
+BuildRequires: python-setuptools-wheel
-BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel
+BuildRequires: python-pip-wheel
 %else
 # For %%python_wheel_inject_sbom
 BuildRequires: python-rpm-macros
 %endif
 %if %{without bootstrap}
@ -269,13 +255,8 @@ BuildRequires: python3-rpm-generators
 Source0: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz
 Source1: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz.asc
-# The release manager for Python 3.10 is pablogsal,
+# The release manager for Python 3.10 is pablogsal
-# but Python 3.10.14 was signed by Łukasz Langa.
+Source2: https://keybase.io/pablogsal/pgp_keys.asc
 # pgp_keys_combined.asc contains keys of both release managers.
 # Upstream issue: https://github.com/python/cpython/issues/117053
 # https://keybase.io/pablogsal/pgp_keys.asc
 # https://keybase.io/ambv/pgp_keys.asc
 Source2: pgp_keys_combined.asc
 # A simple script to check timestamps of bytecode files
 # Run in check section with Python that is currently being built
@ -292,31 +273,40 @@ Source11: idle3.appdata.xml
 # 00001 # d06a8853cf4bae9e115f45e1d531d2dc152c5cc8
 # Fixup distutils/unixccompiler.py to remove standard library path from rpath
 #
 # Was Patch0 in ivazquez' python3000 specfile
 Patch1: 00001-rpath.patch
-# 00251 # 8448a0d6edd44d0818b8c02dc603b769b5363e5b
+# 00251 # 08a62456431df182dfad18ad75838f769aca2d08
 # Change user install location
 #
 # Set values of base and platbase in sysconfig from /usr
 # to /usr/local when RPM build is not detected
 # to make pip and similar tools install into separate location.
 #
 # Set values of prefix and exec_prefix in distutils install command
 # to /usr/local if executable is /usr/bin/python* and RPM build
-# is not detected to make distutils and pypa/distutils install into separate location.
+# is not detected to make pip and distutils install into separate location.
 #
 # Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-# Downstream only.
+# Downstream only: Reworked in Fedora 36+ to follow https://bugs.python.org/issue43976
 #
 # We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
 # but we have identified serious problems with that approach,
 # see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
 #
 # pypa/distutils integration: https://github.com/pypa/distutils/pull/70
 #
 # Also set sysconfig._PIP_USE_SYSCONFIG = False, to force pip-upgraded-pip
 # to respect this patched distutils install command.
 # See https://bugzilla.redhat.com/show_bug.cgi?id=2014513
 Patch251: 00251-change-user-install-location.patch
 # 00328 # 318e500c98f5e59eb1f23e0fcd32db69b9bd17e1
 # Restore pyc to TIMESTAMP invalidation mode as default in rpmbuild
 #
 # Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
 # %%changelog date. This makes Python default to the CHECKED_HASH pyc
 # invalidation mode, bringing more reproducible builds traded for an import
 # performance decrease. To avoid that, we don't default to CHECKED_HASH
 # when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
 #
 # See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
 # Downstream only: only used when building RPM packages
 # Ideally, we should talk to upstream and explain why we don't want this
 Patch328: 00328-pyc-timestamp-invalidation-mode.patch
 # 00371 # c1754d9c2750f89cb702e1b63a99201f5f7cff00
 # Revert "bpo-1596321: Fix threading._shutdown() for the main thread (GH-28549) (GH-28589)"
 #
@ -328,52 +318,34 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
-# 00452 # eb11d070c5af7d1b5e47f4e02186152d08eaf793
+# 00391 # e6d12d8fca6afad3a56dc076c220f213b723a28e
-# Properly apply exported CFLAGS for dtrace/systemtap builds
+# Don't use Linux abstract sockets for multiprocessing
 #
-# When using --with-dtrace the resulting object file could be missing
+# Linux abstract sockets are insecure as they lack any form of filesystem
-# specific CFLAGS exported by the build system due to the systemtap
+# permissions so their use allows anyone on the system to inject code into
-# script using specific defaults.
+# the process.
 #
-# Exporting the CC and CFLAGS variables before the dtrace invocation
+# This removes the default preference for abstract sockets in
-# allows us to properly apply CFLAGS exported by the build system
+# multiprocessing introduced in Python 3.9+ via
-# even when cross-compiling.
+# https://github.com/python/cpython/pull/18866 while fixing
-Patch452: 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
+# https://github.com/python/cpython/issues/84031.
 #
 # Explicit use of an abstract socket by a user now generates a
 # RuntimeWarning.  If we choose to keep this warning, it should be
 # backported to the 3.7 and 3.8 branches.
 #
 #
 # Automerge-Triggered-By: GH:gpshead
 Patch391: 00391-don-t-use-linux-abstract-sockets-for-multiprocessing.patch
-# 00462 # f0db87ee65704fa5545ea25f2cca8c43fc639fab
+# 00393 # 353b3ca7b9e0884839cd6dea28c9bafd9f878571
-# Fix PySSL_SetError handling SSL_ERROR_SYSCALL
+# IDLE - fix buggy macosx patch
 #
-# Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
+# GH-97530 fixed IDLE tests possibly crashing on a Mac without a GUI.
-# SSL_read_ex(), but did not update handling of the return value.
+# But it resulted in IDLE not starting in 3.10.8, 3.12.0a1, and
-#
+# Microsoft Python 3.10.2288.0 when test/* is not installed.
-# Change error handling so that the return value is not examined.
+# After this patch, test.* is only imported when testing on Mac.
-# OSError (not EOF) is now returned when retval is 0.
+Patch393: 00393-idle---fix-buggy-macosx-patch.patch
 #
 # This resolves the issue of failing tests when a system is
 # stressed on OpenSSL 3.5.
 Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
 # 00474 # 837ddca0372fa87ff9cee47142200caa21e77def
 # CVE-2025-15366
 #
 # gh-143921: Reject control characters in IMAP commands
 #
 # (cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
 Patch474: 00474-cve-2025-15366.patch
 # 00475 # 3748209a316662d4e85981ca1a7418547a1d25c6
 # CVE-2025-15367
 #
 # gh-143923: Reject control characters in POP3 commands
 #
 # (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
 Patch475: 00475-cve-2025-15367.patch
 # 00494 # 430aab133397ed44cc9ee621fd311e02fee317b5
 # Increase the timeout of test_large_content_length_truncated
 #
 # It has started to fail randomly when run on s390x architecture.
 Patch494: 00494-increase-the-timeout-of-test_large_content_length_truncated.patch
 # (New patches go here ^^^)
 #
@ -497,8 +469,8 @@ This package contains /usr/bin/python - the "python" command that runs Python 3.
 Summary:        Python runtime libraries
 %if %{with rpmwheels}
-Requires: %{python_wheel_pkg_prefix}-setuptools-wheel
+Requires: python-setuptools-wheel
-Requires: %{python_wheel_pkg_prefix}-pip-wheel
+Requires: python-pip-wheel
 %else
 Provides: bundled(python3dist(pip)) = %{pip_version}
 Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
@ -520,30 +492,6 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa})
 # The zoneinfo module needs tzdata
 Requires: tzdata
 # The requirement on libexpat is generated, but we need to version it.
 # When built with a specific expat version, but installed with an older one,
 # we sometimes get:
 #   ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so:
 #   undefined symbol: XML_...
 # The pyexpat module has build-time checks for expat version to only use the
 # available symbols. However, there is no runtime protection, so when the module
 # is later installed with an older expat, it may error due to undefined symbols.
 # This breaks many things, including python -m venv.
 # We avoid this problem by requiring at least the same version of expat that
 # was used during the build time.
 # Other subpackages (like -debug) also need this, but they all depend on -libs.
 # Since expat 2.7.4, the library has versioned symbols and this is no longer needed,
 # as the generated requirement will be in the form of libexpat.so.1(LIBEXPAT_2.7.2) etc.
 %global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/')
 %if v"%{expat_version}" < v"2.7.4"
 Requires: expat%{?_isa} >= %{expat_version}
 %endif
 # Since patch 251 changed from distutils to sysconfig, pip needed to be adapted
 # The previous versions could cause serious bugs during `sudo pip install --upgrade ...`
 # Better safe than sorry
 Conflicts: %{pkgname}-pip < 21.2.3-3
 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
@ -558,10 +506,8 @@ Requires: %{pkgname} = %{version}-%{release}
 Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 # The RPM related dependencies bring nothing to a non-RPM Python developer
 # But we want them when packages BuildRequire python3-devel
-# 3.10-9 macros started to set $RPM_BUILD_ROOT when expanding macros like %%python3_sitearch,
+Requires: (python-rpm-macros if rpm-build)
-# which is necessary since patch 251 changed from distutils to sysconfig
+Requires: (python3-rpm-macros if rpm-build)
 Requires: (python-rpm-macros >= 3.10-9 if rpm-build)
 Requires: (python3-rpm-macros >= 3.10-9 if rpm-build)
 Requires: (pyproject-rpm-macros if rpm-build)
 %unversioned_obsoletes_of_python3_X_if_main devel
@ -571,9 +517,6 @@ Requires: (pyproject-rpm-macros if rpm-build)
 Recommends: %{pkgname}-pip
 %endif
 # tox users are likely to need the devel subpackage
 Supplements: tox
 %if %{without bootstrap}
 Requires: (python3-rpm-generators if rpm-build)
 %endif
@ -687,7 +630,6 @@ The debug runtime additionally supports debug builds of C-API extensions
 (with the "d" ABI flag) for debugging issues in those extensions.
 %endif # with debug_build
 # ======================================================
 # The prep phase of the build:
 # ======================================================
@ -755,15 +697,14 @@ topdir=$(pwd)
 # Standard library built here will still use the %%build_...flags,
 # Fedora packages utilizing %%py3_build will use them as well
 # https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
-# https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
+export CFLAGS="%{extension_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
 export CFLAGS="%{extension_cflags}"
 export CFLAGS_NODIST="%{build_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
-export CXXFLAGS="%{extension_cxxflags}"
+export CXXFLAGS="%{extension_cxxflags} -D_GNU_SOURCE -fPIC -fwrapv"
 export CPPFLAGS="$(pkg-config --cflags-only-I libffi)"
-export OPT="%{extension_cflags}"
+export OPT="%{extension_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
 export LINKCC="gcc"
 export CFLAGS="$CFLAGS $(pkg-config --cflags openssl)"
-export LDFLAGS="%{extension_ldflags} $(pkg-config --libs-only-L openssl)"
+export LDFLAGS="%{extension_ldflags} -g $(pkg-config --libs-only-L openssl)"
 export LDFLAGS_NODIST="%{build_ldflags} -g $(pkg-config --libs-only-L openssl)"
 # We can build several different configurations of Python: regular and debug.
@ -802,7 +743,7 @@ BuildPython() {
  --with-ssl-default-suites=openssl \
  --without-static-libpython \
 %if %{with rpmwheels}
-  --with-wheel-pkg-dir=%{python_wheel_dir} \
+  --with-wheel-pkg-dir=%{_datadir}/python-wheels \
 %endif
 %if %{with valgrind}
  --with-valgrind \
@ -1027,25 +968,15 @@ find . -name "*~" -exec rm -f {} \;
 # Python CMD line options:
 # -s - don't add user site directory to sys.path
 # -B - don't write .pyc files on import
 # Clamp the source mtime first, see https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes
 # The clamp_source_mtime module is only guaranteed to exist on Fedoras that enabled this option:
 %if 0%{?clamp_mtime_to_source_date_epoch}
 LD_LIBRARY_PATH="%{buildroot}%{dynload_dir}/:%{buildroot}%{_libdir}" \
 PYTHONPATH="%{_rpmconfigdir}/redhat" \
 %{buildroot}%{_bindir}/python%{pybasever} -s -B -m clamp_source_mtime %{buildroot}%{pylibdir}
 %endif
 # compileall CMD line options:
 # -f - force rebuild even if timestamps are up to date
 # -o - optimization levels to run compilation with
 # -s - part of path to left-strip from path to source file (buildroot)
 # -p - path to add as prefix to path to source file (/ to make it absolute)
 # --hardlink-dupes - hardlink different optimization level pycs together if identical (saves space)
 # --invalidation-mode - we prefer the timestamp invalidation mode for performance reasons
 # -x - skip test modules with SyntaxErrors (taken from the Makefile)
 LD_LIBRARY_PATH="%{buildroot}%{dynload_dir}/:%{buildroot}%{_libdir}" \
 %{buildroot}%{_bindir}/python%{pybasever} -s -B -m compileall \
-f %{_smp_mflags} -o 0 -o 1 -o 2 -s %{buildroot} -p / %{buildroot} --hardlink-dupes --invalidation-mode=timestamp \
+-f %{_smp_mflags} -o 0 -o 1 -o 2 -s %{buildroot} -p / %{buildroot} --hardlink-dupes || :
 -x 'bad_coding|badsyntax|site-packages|lib2to3/tests/data'
 # Turn this BRP off, it is done by compileall2 --hardlink-dupes above
 %global __brp_python_hardlink %{nil}
@ -1103,11 +1034,6 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
    rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done
 %if %{without rpmwheels}
 # Inject SBOM into the installed wheels (if the macro is available)
 %{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl}
 %endif
 # ======================================================
 # Checks for packaging issues
 # ======================================================
@ -1166,8 +1092,6 @@ CheckPython() {
  # test_distutils
  #   distutils.tests.test_bdist_rpm tests fail when bootstraping the Python
  #   package: rpmbuild requires /usr/bin/pythonX.Y to be installed
  # test_sendfile_close_peer_in_the_middle_of_receiving:
  #  https://github.com/python/cpython/issues/120226
  LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
    -wW --slowest -j0 --timeout=1800 \
    %if %{with bootstrap}
@ -1176,9 +1100,6 @@ CheckPython() {
    %ifarch %{mips64}
    -x test_ctypes \
    %endif
    %ifarch ppc64le
    -i test_sendfile_close_peer_in_the_middle_of_receiving \
    %endif
  echo FINISHED: CHECKING OF PYTHON FOR CONFIGURATION: $ConfName
@ -1519,7 +1440,6 @@ CheckPython optimized
 %{dynload_dir}/_ctypes_test.%{SOABI_optimized}.so
 %{dynload_dir}/_testbuffer.%{SOABI_optimized}.so
 %{dynload_dir}/_testcapi.%{SOABI_optimized}.so
 %{dynload_dir}/_testclinic.%{SOABI_optimized}.so
 %{dynload_dir}/_testimportmultiple.%{SOABI_optimized}.so
 %{dynload_dir}/_testinternalcapi.%{SOABI_optimized}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_optimized}.so
@ -1647,7 +1567,6 @@ CheckPython optimized
 %{dynload_dir}/_ctypes_test.%{SOABI_debug}.so
 %{dynload_dir}/_testbuffer.%{SOABI_debug}.so
 %{dynload_dir}/_testcapi.%{SOABI_debug}.so
 %{dynload_dir}/_testclinic.%{SOABI_debug}.so
 %{dynload_dir}/_testimportmultiple.%{SOABI_debug}.so
 %{dynload_dir}/_testinternalcapi.%{SOABI_debug}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_debug}.so
@ -1678,142 +1597,6 @@ CheckPython optimized
 # ======================================================
 %changelog
 * Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.10.21-1
 - Update to Python 3.10.21
 * Thu Jul 30 2026 Miro Hrončok <mhroncok@redhat.com> - 3.10.20-4
 - Skip UDP Lite tests if it's not supported
 - Fixes FTBFS on Linux kernel 7.1 and newer
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.20-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 * Sat Apr 11 2026 Miro Hrončok <mhroncok@redhat.com> - 3.10.20-2
 - Explicitly build with OpenSSL 3
 - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
 * Tue Mar 03 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.20-1
 - Update to 3.10.20
 * Mon Feb 09 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.19-4
 - Security fixes for CVE-2026-0865, CVE-2025-15366 and CVE-2025-15367
 * Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.19-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
 * Tue Jan 06 2026 Karolina Surma <ksurma@redhat.com> - 3.10.19-2
 - Require at least the same expat version as used during the build time
 * Fri Oct 10 2025 Karolina Surma <ksurma@redhat.com> - 3.10.19-1
 - Update to Python 3.10.19
 * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.18-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 * Wed Jun 04 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.18-1
 - Update to 3.10.18
 * Tue May 13 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.10.17-3
 - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
 - This fixes random flakiness of test_ssl on stressed machines
 * Wed Apr 16 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.10.17-2
 - test_ssl: Don't stop ThreadedEchoServer on OSError in ConnectionHandler
 - Fixes: rhbz#2355052
 * Wed Apr 09 2025 Miro Hrončok <mhroncok@redhat.com> - 3.10.17-1
 - Update to 3.10.17
 * Mon Mar 31 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.10.16-6
 - Properly apply exported CFLAGS for dtrace/systemtap builds
 - Fixes: rhbz#2356303
 * Mon Feb 10 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.10.16-5
 - Security fix for CVE-2025-0938
 - Fixes: rhbz#2343276
 * Thu Feb 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.10.16-4
 - Rebuilt with mpdecimal 4.0.0
 * Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.10.16-3
 - Add explicit BR: libxcrypt-devel
 * Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.16-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 * Wed Dec 04 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.10.16-1
 - Update to 3.10.16
 - Security fix for CVE-2024-9287
 Resolves: rhbz#2321654
 * Wed Sep 11 2024 Miro Hrončok <mhroncok@redhat.com> - 3.10.15-2
 - Fix ThreadedVSOCKSocketStreamTest
 * Mon Sep 09 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.15-1
 - Update to 3.10.15
 * Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.10.14-4
 - Require systemtap-sdt-devel for sys/sdt.h
 * Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.14-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 * Wed Apr 17 2024 Miro Hrončok <mhroncok@redhat.com> - 3.10.14-2
 - Require expat >= 2.6 to prevent errors when creating venvs with older expat
 * Wed Mar 20 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.14-1
 - Update to 3.10.14
 * Wed Feb 28 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.10.13-6
 - Fix tests for XMLPullParser with Expat 2.6.0
 * Mon Jan 29 2024 Karolina Surma <ksurma@redhat.com> - 3.10.13-5
 - Fix test_zlib when building with zlib-ng-compat
 * Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.13-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.13-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Mon Dec 18 2023 Lumír Balhar <lbalhar@redhat.com> - 3.10.13-2
 - Security fix for CVE-2023-27043 (rhbz#2196187)
 * Mon Aug 28 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.13-1
 - Update to 3.10.13
 * Wed Aug 02 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.10.12-3
 - Remove extra distro-applied CFLAGS passed to user built C extensions
 - https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
 * Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.12-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 * Thu Jun 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.12-1
 - Update to 3.10.12
 * Mon May 29 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.10.11-2
 - Fix for CVE-2023-24329
 Resolves: rhbz#2174010
 * Wed Apr 05 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.11-1
 - Update to 3.10.11
 * Wed Feb 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.10-1
 - Update to 3.10.10
 * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.9-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 * Wed Dec 21 2022 Miro Hrončok <mhroncok@redhat.com> - 3.10.9-3
 - No longer patch the default bytecode cache invalidation policy
 * Tue Dec 20 2022 Miro Hrončok <mhroncok@redhat.com> - 3.10.9-2
 - Supplement tox from the devel package
 * Wed Dec 07 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.9-1
 - Update to 3.10.9
 * Mon Nov 14 2022 Miro Hrončok <mhroncok@redhat.com> - 3.10.8-3
 - Make IDLE work without python3-test installed
 - Fixes rhbz#2142602
@ -1829,20 +1612,9 @@ Resolves: rhbz#2138709
 - Update to 3.10.7
 - Contains security fix for CVE-2020-10735
 * Mon Aug 22 2022 Miro Hrončok <mhroncok@redhat.com> - 3.10.6-2
 - Don't use custom installation schemes
 - Fixes rhbz#2026979
 - Fixes rhbz#2097183
 * Tue Aug 02 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.6-1
 - Update to 3.10.6
 * Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.5-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 * Mon Jun 13 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.5-3
 - Rebuilt for Python 3.11
 * Thu Jun 09 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.10.5-2
 - Security fix for CVE-2015-20107
 Resolves: rhbz#2075390
@ -1859,13 +1631,6 @@ Resolves: rhbz#2075390
 * Fri Mar 18 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.3-1
 - Update to 3.10.3
 * Tue Feb 01 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.2-3
 - Backport AC_C_CHAR_UNSIGNED/__CHAR_UNSIGNED__ removal
 - Fixes: rhbz#2043555
 * Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 * Mon Jan 17 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.2-1
 - Update to 3.10.2
@ -1874,23 +1639,14 @@ Resolves: rhbz#2075390
 - Fixes: rhbz#2030621
 - Fixes: rhbz#2034962
-* Sat Jan 08 2022 Miro Hrončok <mhroncok@redhat.com> - 3.10.1-2
+* Thu Dec 09 2021 Miro Hrončok <mhroncok@redhat.com> - 3.10.1-2
- Rebuilt for https://fedoraproject.org/wiki/Changes/LIBFFI34
+- Instruct pip to use distutils
 - Instruct pypa/distutils to add /local/ addition to prefix
 - Fixes rhbz#2014513
 * Tue Dec 07 2021 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.1-1
 - Update to 3.10.1
 * Fri Nov 12 2021 Björn Esser <besser82@fedoraproject.org> - 3.10.0-4
 - Rebuild(libnsl2)
 * Tue Nov 09 2021 Lumír Balhar <lbalhar@redhat.com> - 3.10.0-3
 - Update patch 251 to include specific install scheme for virtualenv
 * Tue Oct 05 2021 Miro Hrončok <mhroncok@redhat.com> - 3.10.0-2
 - Change the values of sysconfig's "posix_prefix" install scheme to /usr/local
  when RPM build or venv/virtualenv is not detected,
  instead of patching distutils
 * Mon Oct 04 2021 Miro Hrončok <mhroncok@redhat.com> - 3.10.0-1
 - Update to 3.10.0 final
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,22 +1,13 @@
 # exclude test XML data (not always valid) from XML validity check:
 xml:
    ignore:
-        - '/usr/lib*/python*/test/xmltestdata/*'
+        - /usr/lib*/python*/test/xmltestdata/*
-        - '/usr/lib*/python*/test/xmltestdata/*/*'
+        - /usr/lib*/python*/test/xmltestdata/*/*
 # exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
 badfuncs:
    allowed:
        '/usr/lib*/python*/lib-dynload/_socket.*':
            - inet_aton
            - inet_ntoa
 # exclude the debug build from annocheck entirely
 annocheck:
    ignore:
-        - '/usr/bin/python*d'
+        - /usr/lib*/python*/lib-dynload/_socket.*
        - '/usr/lib*/libpython*d.so.1.0'
        - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so'
 # don't report changed content of compiled files
 # that is expected with every toolchain update and not reproducible yet
--- a/rpmlint.toml
+++ b/rpmlint.toml
@ -1,106 +0,0 @@
 Filters = [
    # KNOWN BUGS:
    # https://bugzilla.redhat.com/show_bug.cgi?id=1489816
    'crypto-policy-non-compliance-openssl',
    # TESTS:
    '(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+/test',
    # OTHER DELIBERATES:
    # chroot function
    'missing-call-to-chdir-with-chroot',
    # gethostbyname function calls gethostbyname
    '(E|W): binary-or-shlib-calls-gethostbyname /usr/lib(64)?/python3\.\d+/lib-dynload/_socket\.',
    # intentionally unversioned and selfobsoleted
    'unversioned-explicit-obsoletes python',
    'unversioned Obsoletes: Obsoletes: python3\.\d+$',
    'self-obsoletion python3\.\d+(-\S+)? obsoletes python3\.\d+(-\S+)?',
    # intentionally hardcoded
    'hardcoded-library-path in %{_prefix}/lib/(debug/%{_libdir}|python%{pybasever})',
    # we have non binary stuff, python files
    'only-non-binary-in-usr-lib',
    # some devel files that are deliberately needed
    'devel-file-in-non-devel-package /usr/include/python3\.\d+m?/pyconfig-(32|64)\.h',
    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/distutils/tests/xxmodule\.c',
    # ...or are used as test data
    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/test',
    # some bytecode is shipped without sources on purpose, as a space optimization
    # if this regex needs to be relaxed in the future, make sure it **does not** match pyc files in __pycache__
    'python-bytecode-without-source /usr/lib(64)?/python3\.\d+/(encodings|pydoc_data)/[^/]+.pyc',
    # DUPLICATE FILES
    # test data are often duplicated
    '(E|W): files-duplicate /usr/lib(64)?/python3\.\d+/(test|__phello__)/',
    # duplicated inits or mains are also common
    '(E|W): files-duplicate .+__init__\.py.+__init__\.py',
    '(E|W): files-duplicate .+__main__\.py.+__main__\.py',
    # files in the debugsource package
    '(E|W): files-duplicate /usr/src/debug',
    # general waste report
    '(E|W): files-duplicated-waste',
    # SORRY, NOT SORRY:
    # manual pages
    'no-manual-page-for-binary (idle|pydoc|pyvenv|2to3|python3?-debug|pathfix|msgfmt|pygettext)',
    'no-manual-page-for-binary python3?.*-config$',
    'no-manual-page-for-binary python3\.\d+dm?$',
    # missing documentation from subpackages
    '^python3(\.\d+)?-(debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation',
    # platform python is obsoleted, but not provided
    'obsolete-not-provided platform-python',
    # we have extra tokens at the end of %endif/%else directives, we consider them useful
    'extra tokens at the end of %(endif|else) directive',
    # RPMLINT IMPERFECTIONS
    # https://github.com/rpm-software-management/rpmlint/issues/780
    '/usr/lib/debug',
    # we provide python(abi) manually to be sure. createrepo will merge this with the automatic
    'python3(\.\d+)?\.[^:-]+: (E|W): useless-provides python\(abi\)',
    # debugsource and debuginfo have no docs
    '^python3(\.\d+)?-debug(source|info)\.[^:]+: (E|W): no-documentation',
    # this is OK for F28+
    'library-without-ldconfig-post',
    # debug package contains devel and non-devel files
    'python3(\.\d+)?-debug\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package',
    # this goes to other subpackage, hence not actually dangling
    'dangling-relative-symlink /usr/bin/python python3',
    'dangling-relative-symlink /usr/share/man/man1/python\.1\.gz python3\.1\.gz',
    'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc python-3\.\d+(-embed)?\.pc',
    # the python-unversioned-command package contains dangling symlinks by design
    '^python-unversioned-command\.[^:]+: (E|W): dangling-relative-symlink (/usr/bin/python \./python3|/usr/share/man/man1/python\.1\S* ./python3\.1\S*)$',
    # we need this macro to evaluate, even if the line starts with #
    'macro-in-comment %\{_pyconfig(32|64)_h\}',
    # Python modules don't need to be linked against libc
    # Since 3.8 they are no longer linked against libpython3.8.so.1.0
    '(E|W): library-not-linked-against-libc /usr/lib(64)?/python3\.\d+/lib-dynload/',
    '(E|W): shared-lib(rary)?-without-dependency-information /usr/lib(64)?/python3\.\d+/lib-dynload/',
    # specfile-errors are listed twice, once with reason and once without
    # we filter out the empty ones
    '\bpython3(\.\d+)?\.(src|spec): (E|W): specfile-error\s+$',
    # SPELLING ERRORS
    'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest) ',
 ]
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (Python-3.10.21.tar.xz) = 6f6de7c5e4c0457f2d189ed5d111c83fb8775e19123afe4f9fd0ae2b93f3fa2bbb7ad849ade6bb5227d4a6a3d63abc8e167fbe5fb54fa715660c89fd6274daee
+SHA512 (Python-3.10.8.tar.xz) = 40e3e77d79618c81d6fc57c5d119b99c2959dcf932f40aad6b26f2ec39c5e713e6ff298f7597b4fad2ab94680db3732483b5ca0a45e6ae58c14580b3ea44cb0f
-SHA512 (Python-3.10.21.tar.xz.asc) = 72d6aeaa0f51e527f82392cf1f969b0ad50a48fe10e8b7e5feb6117718223d00757f7b375b3ac82e257571d5a61f8162e9dd59b81fcf8f2a441c6deb42be71cb
+SHA512 (Python-3.10.8.tar.xz.asc) = 0c2ef09d898257ba5e9ec7c5bb224a7e50e5ebca96843b4d9e25be6cdd2f17144772aafc92280af20c21491e3c8cedc697414688ece613c93b28ff7ecddcf93f
--- a/tests/.fmf/version
+++ b/tests/.fmf/version
--- a/tests/provision.fmf
+++ b/tests/provision.fmf
@ -0,0 +1,4 @@
 ---
 standard-inventory-qcow2:
  qemu:
    m: 3G  # Amount of VM memory
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,54 @@
 ---
 - hosts: localhost
  tags:
    - classic
  tasks:
    - dnf:
        name: "*"
        state: latest
 - hosts: localhost
  roles:
  - role: standard-test-basic
    tags:
    - classic
    repositories:
    - repo: "https://src.fedoraproject.org/tests/python.git"
      dest: "python"
    tests:
    - rpm_qa:
        run: rpm -qa
    - smoke:
        dir: python/smoke
        run: VERSION=3.10 ./venv.sh
    - smoke_virtualenv:
        dir: python/smoke
        run: VERSION=3.10 METHOD=virtualenv ./venv.sh
    - debugsmoke:
        dir: python/smoke
        run: PYTHON=python3-debug TOX=false VERSION=3.10 ./venv.sh
    - selftest:
        dir: python/selftest
        run: VERSION=3.10 X="" ./parallel.sh
    - debugtest:
        dir: python/selftest
        run: VERSION=3.10 PYTHON=python3-debug X="" ./parallel.sh
    - debugflags:
        dir: python/flags
        run: python3-debug ./assertflags.py -O0
    - marshalparser:
        dir: python/marshalparser
        run: VERSION=3.10 SAMPLE=10 test_marshalparser_compatibility.sh
    required_packages:
    - gcc  # for extension building in venv and selftest
    - gdb  # for test_gdb
    - python3.10  # the test subject
    - python3-debug  # for leak testing
    - python3-devel  # for extension building in venv and selftest
    - python3-tkinter  # for selftest
    - python3-test  # for selftest
    - tox  # for venv tests
    - virtualenv  # for virtualenv tests
    - glibc-all-langpacks # for locale tests
    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
    - rpm  # for debugging
Author	SHA1	Message	Date
Miro Hrončok	e3252eefc8	Make IDLE work without python3-test installed	2022-11-14 16:25:09 +01:00
Lumir Balhar	99563953da	Fix CVE-2022-42919	2022-11-09 12:09:08 +01:00
Miro Hrončok	89d9f92697	Update to 3.10.8 Patch 382 was merged upstream.	2022-10-12 15:58:11 +02:00
Miro Hrončok	511bdb75bd	Update to 3.10.7, with security fix for CVE-2020-10735	2022-09-07 16:29:08 +02:00
Tomáš Hrnčiar	8a53c5ea64	Update to 3.10.6	2022-08-02 15:31:52 +02:00
Charalampos Stratakis	479c2b397f	Security fix for CVE-2015-20107 Resolves: rhbz#2075390	2022-06-09 21:59:36 +02:00
Tomáš Hrnčiar	1cba7ca6d7	Update to 3.10.5	2022-06-07 13:36:29 +02:00
Miro Hrončok	5b70ab91fe	Don't hardcode %{ABIFLAGS_debug}	2022-06-01 14:24:11 +02:00
Miro Hrončok	fd2542f9c3	Don't exclude files that don't exist When built without debug_build, RPM warns: File not found: /builddir/build/BUILDROOT/python3.11-3.11.0~b2-1.fc37.x86_64/usr/lib64/python3.11/_sysconfigdata_d_linux_x86_64-linux-gnu.py File not found: /builddir/build/BUILDROOT/python3.11-3.11.0~b2-1.fc37.x86_64/usr/lib64/python3.11/__pycache__/_sysconfigdata_d_linux_x86_64-linux-gnu.cpython-311*.pyc This might become an error in some distant future.	2022-06-01 14:24:11 +02:00
Tomas Orsava	ba94183739	Move _sysconfigdata_d_linux*.py to the debug subpackage	2022-06-01 14:24:11 +02:00
Tomas Orsava	6928c91eb9	Remove an rpmlintrc rule that was only relevant to flatpackages	2022-06-01 14:24:11 +02:00
Tomas Orsava	68d2217237	Do not Recommend python*-pip if this is not the main_python Because we do not ship pip for alternative stacks (outside of `venv`).	2022-06-01 14:24:11 +02:00
Tomas Orsava	9aecf247bb	Add new bcond for python_abi_provides_for_alt_pythons By default enabled on EL, disabled on Fedora	2022-06-01 14:24:11 +02:00
Tomas Orsava	3463fb44bf	Obsolete python3.X-foo from individual subpackages e.g. python3-devel now Obsoletes python3.X-devel We are contemplating splitting alternative Pythons into subpackages, so we need to obsolete each of them from the main Python version. Related: rhbz#2063227	2022-06-01 14:24:11 +02:00
Tomas Orsava	a7b4c9c13d	Let there not be flatpackage Remove the flatpackage bcond entirely	2022-06-01 14:23:43 +02:00
Tomas Orsava	7a9076d0e1	Build Python 3.11 with subpackages (by disabling the flatpackage bcond) No change in not providing `python(abi)` for alternative Python versions Resolves: rhbz#2063227	2022-05-14 08:44:32 +00:00
Tomáš Hrnčiar	dfe2d475a9	Update to 3.10.4	2022-03-25 08:18:30 +01:00
Tomáš Hrnčiar	bc7ab932a7	Update to 3.10.3	2022-03-18 09:49:27 +01:00
Tomáš Hrnčiar	41c4f95a61	Update to 3.10.2	2022-01-17 11:26:38 +01:00
Miro Hrončok	2b285dee4e	Backport fixes for two Python 3.10.1 regressions Fixes https://bugzilla.redhat.com/2030621 Fixes https://bugzilla.redhat.com/2034962	2022-01-12 18:19:55 +01:00
Miro Hrončok	7c6eb17d2b	Instruct pypa/distutils to add /local/ addition to prefix	2021-12-09 11:26:00 +01:00
Miro Hrončok	b7b2fa452d	Fedora < 36 only: Instruct pip to use distutils Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2014513	2021-12-09 11:23:00 +01:00
Tomáš Hrnčiar	f7c55a4f2f	Update to 3.10.1	2021-12-08 07:45:59 +01:00
Miro Hrončok	dd94826d72	Fedora CI: Also test virtualenv	2021-12-07 15:50:02 +01:00
Miro Hrončok	0cd2202156	Cosmetic CI config change: Use the new tox package name	2021-12-07 15:49:48 +01:00
Tomáš Hrnčiar	d2a365c76d	Enable test_frozentable test_frozentable was disabled due to error in Python 3.10.0a6. This is now fixed so test can be enabled again.	2021-10-07 13:57:42 +02:00
`@ -1,2 +1,2 @@`
	`SHA512 (Python-3.10.21.tar.xz) = 6f6de7c5e4c0457f2d189ed5d111c83fb8775e19123afe4f9fd0ae2b93f3fa2bbb7ad849ade6bb5227d4a6a3d63abc8e167fbe5fb54fa715660c89fd6274daee`	`SHA512 (Python-3.10.8.tar.xz) = 40e3e77d79618c81d6fc57c5d119b99c2959dcf932f40aad6b26f2ec39c5e713e6ff298f7597b4fad2ab94680db3732483b5ca0a45e6ae58c14580b3ea44cb0f`
	`SHA512 (Python-3.10.21.tar.xz.asc) = 72d6aeaa0f51e527f82392cf1f969b0ad50a48fe10e8b7e5feb6117718223d00757f7b375b3ac82e257571d5a61f8162e9dd59b81fcf8f2a441c6deb42be71cb`	`SHA512 (Python-3.10.8.tar.xz.asc) = 0c2ef09d898257ba5e9ec7c5bb224a7e50e5ebca96843b4d9e25be6cdd2f17144772aafc92280af20c21491e3c8cedc697414688ece613c93b28ff7ecddcf93f`