00001-rpath.patch

@@ -1,10 +1,9 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Wed, 13 Jan 2010 21:25:18 +0000
-Subject: 00001: Fixup distutils/unixccompiler.py to remove standard library
+Subject: [PATCH] 00001: Fixup distutils/unixccompiler.py to remove standard
- path from rpath
+ library path from rpath Was Patch0 in ivazquez' python3000 specfile
 
-Was Patch0 in ivazquez' python3000 specfile
 ---
  Lib/distutils/unixccompiler.py | 9 +++++++++
  1 file changed, 9 insertions(+)

00251-change-user-install-location.patch

@@ -1,70 +1,42 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+From: Lumir Balhar <lbalhar@redhat.com>
 Date: Mon, 15 Feb 2021 12:19:27 +0100
-Subject: 00251: Change user install location
+Subject: [PATCH] 00251: Change user install location
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
-Set values of base and platbase in sysconfig from /usr
+Change the values of sysconfig's "posix_prefix" install scheme to /usr/local
-to /usr/local when RPM build is not detected
+when RPM build or venv/virtualenv is not detected,
-to make pip and similar tools install into separate location.
+to make pip, sysconfig and distutils install into an isolated location.
 
-Set values of prefix and exec_prefix in distutils install command
+The original values are saved as an additional "rpm_prefix" install scheme.
-to /usr/local if executable is /usr/bin/python* and RPM build
+
-is not detected to make distutils and pypa/distutils install into separate location.
+The site module adds the /usr/local paths to sys.path when site packages are
+enabled and RPM build is not detected.
 
 Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-Downstream only.
 
-We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
+Rewrote in Fedora 36+ to patch sysconfig instead of distutils,
-but we have identified serious problems with that approach,
+see https://discuss.python.org/t/pep-632-deprecate-distutils-module/5134/104
-see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
 
-pypa/distutils integration: https://github.com/pypa/distutils/pull/70
+Downstream only for now, waiting for https://bugs.python.org/issue43976
 
 Co-authored-by: Petr Viktorin <encukou@gmail.com>
 Co-authored-by: Miro Hrončok <miro@hroncok.cz>
 Co-authored-by: Michal Cyprian <m.cyprian@gmail.com>
 Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
 ---
- Lib/distutils/command/install.py |  8 ++++--
+ Lib/site.py                |  9 ++++++++-
- Lib/site.py                      |  9 +++++-
+ Lib/sysconfig.py           | 19 +++++++++++++++++++
- Lib/sysconfig.py                 | 49 +++++++++++++++++++++++++++++++-
+ Lib/test/test_sysconfig.py |  4 +++-
- Lib/test/test_sysconfig.py       | 17 +++++++++--
+ 3 files changed, 30 insertions(+), 2 deletions(-)
- 4 files changed, 77 insertions(+), 6 deletions(-)
 
-diff --git a/Lib/distutils/command/install.py b/Lib/distutils/command/install.py
-index 01d5331a63..79f70f0de4 100644
---- a/Lib/distutils/command/install.py
-+++ b/Lib/distutils/command/install.py
-@@ -159,6 +159,8 @@ class install(Command):
- 
-     negative_opt = {'no-compile' : 'compile'}
- 
-+    # Allow Fedora to add components to the prefix
-+    _prefix_addition = getattr(sysconfig, '_prefix_addition', '')
- 
-     def initialize_options(self):
-         """Initializes options."""
-@@ -441,8 +443,10 @@ def finalize_unix(self):
-                     raise DistutilsOptionError(
-                           "must not supply exec-prefix without prefix")
- 
--                self.prefix = os.path.normpath(sys.prefix)
--                self.exec_prefix = os.path.normpath(sys.exec_prefix)
-+                self.prefix = (
-+                    os.path.normpath(sys.prefix) + self._prefix_addition)
-+                self.exec_prefix = (
-+                    os.path.normpath(sys.exec_prefix) + self._prefix_addition)
- 
-             else:
-                 if self.exec_prefix is None:
 diff --git a/Lib/site.py b/Lib/site.py
-index 2904e44cff..1c9bfa7713 100644
+index b11cd48e69..63ddd5b21b 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
-@@ -387,8 +387,15 @@ def getsitepackages(prefixes=None):
+@@ -377,8 +377,15 @@ def getsitepackages(prefixes=None):
      return sitepackages
  
  def addsitepackages(known_paths, prefixes=None):
@@ -82,109 +54,40 @@ index 2904e44cff..1c9bfa7713 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index ebe3711827..55af57b335 100644
+index e21b7303fe..37b04452bc 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
-@@ -103,6 +103,11 @@
+@@ -103,6 +103,25 @@
  else:
      _INSTALL_SCHEMES['venv'] = _INSTALL_SCHEMES['posix_venv']
  
-+# For a brief period of time in the Fedora 36 life cycle,
++# backup the original posix_prefix as rpm_prefix
-+# this installation scheme existed and was documented in the release notes.
++# RPM packages use it and we need to be able to read it even when changed
-+# For backwards compatibility, we keep it here (at least on 3.10 and 3.11).
 +_INSTALL_SCHEMES['rpm_prefix'] = _INSTALL_SCHEMES['posix_prefix']
 +
- 
- # NOTE: site.py has copy of this function.
- # Sync it when modify this function.
-@@ -162,6 +167,19 @@ def joinuser(*args):
-             },
-     }
- 
-+# This is used by distutils.command.install in the stdlib
-+# as well as pypa/distutils (e.g. bundled in setuptools).
-+# The self.prefix value is set to sys.prefix + /local/
-+# if neither RPM build nor virtual environment is
-+# detected to make distutils install packages
-+# into the separate location.
-+# https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +if (not (hasattr(sys, 'real_prefix') or
 +    sys.prefix != sys.base_prefix) and
 +    'RPM_BUILD_ROOT' not in os.environ):
-+    _prefix_addition = '/local'
++        _INSTALL_SCHEMES['posix_prefix'] = {
-+
++            'stdlib': '{installed_base}/{platlibdir}/python{py_version_short}',
-+
++            'platstdlib': '{platbase}/{platlibdir}/python{py_version_short}',
- _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
++            'purelib': '{base}/local/lib/python{py_version_short}/site-packages',
-                 'scripts', 'data')
++            'platlib': '{platbase}/local/{platlibdir}/python{py_version_short}/site-packages',
++            'include':
++                '{installed_base}/include/python{py_version_short}{abiflags}',
++            'platinclude':
++                '{installed_platbase}/include/python{py_version_short}{abiflags}',
++            'scripts': '{base}/local/bin',
++            'data': '{base}/local',
++        }
  
-@@ -258,11 +276,40 @@ def _extend_dict(target_dict, other_dict):
+ # NOTE: site.py has copy of this function.
-         target_dict[key] = value
+ # Sync it when modify this function.
- 
- 
-+_CONFIG_VARS_LOCAL = None
-+
-+
-+def _config_vars_local():
-+    # This function returns the config vars with prefixes amended to /usr/local
-+    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-+    global _CONFIG_VARS_LOCAL
-+    if _CONFIG_VARS_LOCAL is None:
-+        _CONFIG_VARS_LOCAL = dict(get_config_vars())
-+        _CONFIG_VARS_LOCAL['base'] = '/usr/local'
-+        _CONFIG_VARS_LOCAL['platbase'] = '/usr/local'
-+    return _CONFIG_VARS_LOCAL
-+
-+
- def _expand_vars(scheme, vars):
-     res = {}
-     if vars is None:
-         vars = {}
--    _extend_dict(vars, get_config_vars())
-+
-+    # when we are not in a virtual environment or an RPM build
-+    # we change '/usr' to '/usr/local'
-+    # to avoid surprises, we explicitly check for the /usr/ prefix
-+    # Python virtual environments have different prefixes
-+    # we only do this for posix_prefix, not to mangle the venv scheme
-+    # posix_prefix is used by sudo pip install
-+    # we only change the defaults here, so explicit --prefix will take precedence
-+    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-+    if (scheme == 'posix_prefix' and
-+        _PREFIX == '/usr' and
-+        'RPM_BUILD_ROOT' not in os.environ):
-+            _extend_dict(vars, _config_vars_local())
-+    else:
-+        _extend_dict(vars, get_config_vars())
-+
-     if os.name == 'nt':
-         # On Windows we want to substitute 'lib' for schemes rather
-         # than the native value (without modifying vars, in case it
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index d3bb0d25ca..f39bbf67ea 100644
+index f2b93706b2..cc58f47cdb 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
-@@ -111,8 +111,19 @@ def test_get_path(self):
+@@ -333,7 +333,7 @@ def test_get_config_h_filename(self):
-         for scheme in _INSTALL_SCHEMES:
-             for name in _INSTALL_SCHEMES[scheme]:
-                 expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
-+                tested = get_path(name, scheme)
-+                # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-+                if tested.startswith('/usr/local'):
-+                    # /usr/local should only be used in posix_prefix
-+                    self.assertEqual(scheme, 'posix_prefix')
-+                    # Fedora CI runs tests for venv and virtualenv that check for other prefixes
-+                    self.assertEqual(sys.prefix, '/usr')
-+                    # When building the RPM of Python, %check runs this with RPM_BUILD_ROOT set
-+                    # Fedora CI runs this with RPM_BUILD_ROOT unset
-+                    self.assertNotIn('RPM_BUILD_ROOT', os.environ)
-+                    tested = tested.replace('/usr/local', '/usr')
-                 self.assertEqual(
--                    os.path.normpath(get_path(name, scheme)),
-+                    os.path.normpath(tested),
-                     os.path.normpath(expected),
-                 )
- 
-@@ -345,7 +356,7 @@ def test_get_config_h_filename(self):
          self.assertTrue(os.path.isfile(config_h), config_h)
  
      def test_get_scheme_names(self):
@@ -193,7 +96,7 @@ index d3bb0d25ca..f39bbf67ea 100644
          if HAS_USER_BASE:
              wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
          self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
-@@ -357,6 +368,8 @@ def test_symlink(self): # Issue 7880
+@@ -345,6 +345,8 @@ def test_symlink(self): # Issue 7880
              cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
              self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
  

00328-pyc-timestamp-invalidation-mode.patch

@@ -0,0 +1,54 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Thu, 11 Jul 2019 13:44:13 +0200
+Subject: [PATCH] 00328: Restore pyc to TIMESTAMP invalidation mode as default
+ in rpmbuild
+
+Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
+%changelog date. This makes Python default to the CHECKED_HASH pyc
+invalidation mode, bringing more reproducible builds traded for an import
+performance decrease. To avoid that, we don't default to CHECKED_HASH
+when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
+
+See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
+Downstream only: only used when building RPM packages
+Ideally, we should talk to upstream and explain why we don't want this
+---
+ Lib/py_compile.py           | 3 ++-
+ Lib/test/test_py_compile.py | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/py_compile.py b/Lib/py_compile.py
+index 388614e51b..db52725016 100644
+--- a/Lib/py_compile.py
++++ b/Lib/py_compile.py
+@@ -70,7 +70,8 @@ class PycInvalidationMode(enum.Enum):
+ 
+ 
+ def _get_default_invalidation_mode():
+-    if os.environ.get('SOURCE_DATE_EPOCH'):
++    if (os.environ.get('SOURCE_DATE_EPOCH') and not
++            os.environ.get('RPM_BUILD_ROOT')):
+         return PycInvalidationMode.CHECKED_HASH
+     else:
+         return PycInvalidationMode.TIMESTAMP
+diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
+index 794d6436b6..322e072b61 100644
+--- a/Lib/test/test_py_compile.py
++++ b/Lib/test/test_py_compile.py
+@@ -19,6 +19,7 @@ def without_source_date_epoch(fxn):
+     def wrapper(*args, **kwargs):
+         with os_helper.EnvironmentVarGuard() as env:
+             env.unset('SOURCE_DATE_EPOCH')
++            env.unset('RPM_BUILD_ROOT')
+             return fxn(*args, **kwargs)
+     return wrapper
+ 
+@@ -29,6 +30,7 @@ def with_source_date_epoch(fxn):
+     def wrapper(*args, **kwargs):
+         with os_helper.EnvironmentVarGuard() as env:
+             env['SOURCE_DATE_EPOCH'] = '123456789'
++            env.unset('RPM_BUILD_ROOT')
+             return fxn(*args, **kwargs)
+     return wrapper
+ 

00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch

@@ -1,103 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
-Date: Tue, 7 Dec 2021 14:41:59 +0100
-Subject: 00371: Revert "bpo-1596321: Fix threading._shutdown() for the main
- thread (GH-28549) (GH-28589)"
-
-This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
-introduced regression causing FreeIPA's tests to fail.
-
-For more info see:
-https://bodhi.fedoraproject.org/updates/FEDORA-2021-e152ce5f31
-https://github.com/GrahamDumpleton/mod_wsgi/issues/730
----
- Lib/test/test_threading.py | 33 ---------------------------------
- Lib/threading.py           | 25 ++++++++-----------------
- 2 files changed, 8 insertions(+), 50 deletions(-)
-
-diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index ec6a319486..1dbb9d0baa 100644
---- a/Lib/test/test_threading.py
-+++ b/Lib/test/test_threading.py
-@@ -1045,39 +1045,6 @@ def test_debug_deprecation(self):
-                b'is deprecated and will be removed in Python 3.12')
-         self.assertIn(msg, err)
- 
--    def test_import_from_another_thread(self):
--        # bpo-1596321: If the threading module is first import from a thread
--        # different than the main thread, threading._shutdown() must handle
--        # this case without logging an error at Python exit.
--        code = textwrap.dedent('''
--            import _thread
--            import sys
--
--            event = _thread.allocate_lock()
--            event.acquire()
--
--            def import_threading():
--                import threading
--                event.release()
--
--            if 'threading' in sys.modules:
--                raise Exception('threading is already imported')
--
--            _thread.start_new_thread(import_threading, ())
--
--            # wait until the threading module is imported
--            event.acquire()
--            event.release()
--
--            if 'threading' not in sys.modules:
--                raise Exception('threading is not imported')
--
--            # don't wait until the thread completes
--        ''')
--        rc, out, err = assert_python_ok("-c", code)
--        self.assertEqual(out, b'')
--        self.assertEqual(err, b'')
--
- 
- class ThreadJoinOnShutdown(BaseTestCase):
- 
-diff --git a/Lib/threading.py b/Lib/threading.py
-index 29b8ec7465..2145f5a6dc 100644
---- a/Lib/threading.py
-+++ b/Lib/threading.py
-@@ -1553,29 +1553,20 @@ def _shutdown():
- 
-     global _SHUTTING_DOWN
-     _SHUTTING_DOWN = True
-+    # Main thread
-+    tlock = _main_thread._tstate_lock
-+    # The main thread isn't finished yet, so its thread state lock can't have
-+    # been released.
-+    assert tlock is not None
-+    assert tlock.locked()
-+    tlock.release()
-+    _main_thread._stop()
- 
-     # Call registered threading atexit functions before threads are joined.
-     # Order is reversed, similar to atexit.
-     for atexit_call in reversed(_threading_atexits):
-         atexit_call()
- 
--    # Main thread
--    if _main_thread.ident == get_ident():
--        tlock = _main_thread._tstate_lock
--        # The main thread isn't finished yet, so its thread state lock can't
--        # have been released.
--        assert tlock is not None
--        assert tlock.locked()
--        tlock.release()
--        _main_thread._stop()
--    else:
--        # bpo-1596321: _shutdown() must be called in the main thread.
--        # If the threading module was not imported by the main thread,
--        # _main_thread is the thread which imported the threading module.
--        # In this case, ignore _main_thread, similar behavior than for threads
--        # spawned by C libraries or using _thread.start_new_thread().
--        pass
--
-     # Join all non-deamon threads
-     while True:
-         with _shutdown_locks_lock:

00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch

@@ -1,51 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Mon, 31 Mar 2025 20:29:04 +0200
-Subject: 00452: Properly apply exported CFLAGS for dtrace/systemtap builds
-
-When using --with-dtrace the resulting object file could be missing
-specific CFLAGS exported by the build system due to the systemtap
-script using specific defaults.
-
-Exporting the CC and CFLAGS variables before the dtrace invocation
-allows us to properly apply CFLAGS exported by the build system
-even when cross-compiling.
-
-Co-authored-by: stratakis <cstratak@redhat.com>
----
- Makefile.pre.in                                               | 4 ++--
- .../next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst | 2 ++
- 2 files changed, 4 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-
-diff --git a/Makefile.pre.in b/Makefile.pre.in
-index ad29e1a0ca..79b07194bb 100644
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -1458,7 +1458,7 @@ Python/frozen.o: $(FROZEN_FILES_OUT)
- # an include guard, so we can't use a pipeline to transform its output.
- Include/pydtrace_probes.h: $(srcdir)/Include/pydtrace.d
- 	$(MKDIR_P) Include
--	$(DTRACE) $(DFLAGS) -o $@ -h -s $<
-+	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -h -s $<
- 	: sed in-place edit with POSIX-only tools
- 	sed 's/PYTHON_/PyDTrace_/' $@ > $@.tmp
- 	mv $@.tmp $@
-@@ -1468,7 +1468,7 @@ Python/import.o: $(srcdir)/Include/pydtrace.h
- Modules/gcmodule.o: $(srcdir)/Include/pydtrace.h
- 
- Python/pydtrace.o: $(srcdir)/Include/pydtrace.d $(DTRACE_DEPS)
--	$(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
-+	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
- 
- Objects/typeobject.o: Objects/typeslots.inc
- 
-diff --git a/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-new file mode 100644
-index 0000000000..a287e0b228
---- /dev/null
-+++ b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-@@ -0,0 +1,2 @@
-+The DTrace build now properly passes the ``CC`` and ``CFLAGS`` variables
-+to the ``dtrace`` command when utilizing SystemTap on Linux.

00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch

@@ -1,196 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: yevgeny hong <hongyevgeny@gmail.com>
-Date: Tue, 26 Mar 2024 16:45:43 +0900
-Subject: 00462: Fix PySSL_SetError handling SSL_ERROR_SYSCALL
-
-Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
-SSL_read_ex(), but did not update handling of the return value.
-
-Change error handling so that the return value is not examined.
-OSError (not EOF) is now returned when retval is 0.
-
-This resolves the issue of failing tests when a system is
-stressed on OpenSSL 3.5.
-
-Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
-Co-authored-by: Petr Viktorin <encukou@gmail.com>
----
- Lib/test/test_ssl.py                          | 28 ++++++-----
- ...-02-18-09-50-31.gh-issue-115627.HGchj0.rst |  2 +
- Modules/_ssl.c                                | 48 +++++++------------
- 3 files changed, 35 insertions(+), 43 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-
-diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
-index aa8ce81db6..61cde99753 100644
---- a/Lib/test/test_ssl.py
-+++ b/Lib/test/test_ssl.py
-@@ -2635,16 +2635,18 @@ def run(self):
-                         self.write(msg.lower())
-                 except OSError as e:
-                     # handles SSLError and socket errors
-+                    if isinstance(e, ConnectionError):
-+                        # OpenSSL 1.1.1 sometimes raises
-+                        # ConnectionResetError when connection is not
-+                        # shut down gracefully.
-+                        if self.server.chatty and support.verbose:
-+                            print(f" Connection reset by peer: {self.addr}")
-+
-+                        self.close()
-+                        self.running = False
-+                        return
-                     if self.server.chatty and support.verbose:
--                        if isinstance(e, ConnectionError):
--                            # OpenSSL 1.1.1 sometimes raises
--                            # ConnectionResetError when connection is not
--                            # shut down gracefully.
--                            print(
--                                f" Connection reset by peer: {self.addr}"
--                            )
--                        else:
--                            handle_error("Test server failure:\n")
-+                        handle_error("Test server failure:\n")
-                     try:
-                         self.write(b"ERROR\n")
-                     except OSError:
-@@ -3339,8 +3341,8 @@ def test_wrong_cert_tls13(self):
-                                         suppress_ragged_eofs=False) as s:
-             s.connect((HOST, server.port))
-             with self.assertRaisesRegex(
--                ssl.SSLError,
--                'alert unknown ca|EOF occurred'
-+                OSError,
-+                'alert unknown ca|EOF occurred|TLSV1_ALERT_UNKNOWN_CA|closed by the remote host|Connection reset by peer'
-             ):
-                 # TLS 1.3 perform client cert exchange after handshake
-                 s.write(b'data')
-@@ -4612,8 +4614,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
-                 # test sometimes fails with EOF error. Test passes as long as
-                 # server aborts connection with an error.
-                 with self.assertRaisesRegex(
--                    ssl.SSLError,
--                    '(certificate required|EOF occurred)'
-+                    OSError,
-+                    'certificate required|EOF occurred|closed by the remote host|Connection reset by peer'
-                 ):
-                     # receive CertificateRequest
-                     data = s.recv(1024)
-diff --git a/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-new file mode 100644
-index 0000000000..75d926ab59
---- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-@@ -0,0 +1,2 @@
-+Fix the :mod:`ssl` module error handling of connection terminate by peer.
-+It now throws an OSError with the appropriate error code instead of an EOFError.
-diff --git a/Modules/_ssl.c b/Modules/_ssl.c
-index 9c2e8c391d..174e5dfce5 100644
---- a/Modules/_ssl.c
-+++ b/Modules/_ssl.c
-@@ -576,7 +576,7 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) {
- }
- 
- static PyObject *
--PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-+PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno)
- {
-     PyObject *type;
-     char *errstr = NULL;
-@@ -589,7 +589,6 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-     _sslmodulestate *state = get_state_sock(sslsock);
-     type = state->PySSLErrorObject;
- 
--    assert(ret <= 0);
-     e = ERR_peek_last_error();
- 
-     if (sslsock->ssl != NULL) {
-@@ -622,32 +621,21 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-         case SSL_ERROR_SYSCALL:
-         {
-             if (e == 0) {
--                PySocketSockObject *s = GET_SOCKET(sslsock);
--                if (ret == 0 || (((PyObject *)s) == Py_None)) {
-+                /* underlying BIO reported an I/O error */
-+                ERR_clear_error();
-+#ifdef MS_WINDOWS
-+                if (err.ws) {
-+                    return PyErr_SetFromWindowsErr(err.ws);
-+                }
-+#endif
-+                if (err.c) {
-+                    errno = err.c;
-+                    return PyErr_SetFromErrno(PyExc_OSError);
-+                }
-+                else {
-                     p = PY_SSL_ERROR_EOF;
-                     type = state->PySSLEOFErrorObject;
-                     errstr = "EOF occurred in violation of protocol";
--                } else if (s && ret == -1) {
--                    /* underlying BIO reported an I/O error */
--                    ERR_clear_error();
--#ifdef MS_WINDOWS
--                    if (err.ws) {
--                        return PyErr_SetFromWindowsErr(err.ws);
--                    }
--#endif
--                    if (err.c) {
--                        errno = err.c;
--                        return PyErr_SetFromErrno(PyExc_OSError);
--                    }
--                    else {
--                        p = PY_SSL_ERROR_EOF;
--                        type = state->PySSLEOFErrorObject;
--                        errstr = "EOF occurred in violation of protocol";
--                    }
--                } else { /* possible? */
--                    p = PY_SSL_ERROR_SYSCALL;
--                    type = state->PySSLSyscallErrorObject;
--                    errstr = "Some I/O error occurred";
-                 }
-             } else {
-                 if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
-@@ -1013,7 +1001,7 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
-              err.ssl == SSL_ERROR_WANT_WRITE);
-     Py_XDECREF(sock);
-     if (ret < 1)
--        return PySSL_SetError(self, ret, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     if (PySSL_ChainExceptions(self) < 0)
-         return NULL;
-     Py_RETURN_NONE;
-@@ -2434,7 +2422,7 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
- 
-     Py_XDECREF(sock);
-     if (retval == 0)
--        return PySSL_SetError(self, retval, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     if (PySSL_ChainExceptions(self) < 0)
-         return NULL;
-     return PyLong_FromSize_t(count);
-@@ -2464,7 +2452,7 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
-     self->err = err;
- 
-     if (count < 0)
--        return PySSL_SetError(self, count, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     else
-         return PyLong_FromLong(count);
- }
-@@ -2587,7 +2575,7 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
-              err.ssl == SSL_ERROR_WANT_WRITE);
- 
-     if (retval == 0) {
--        PySSL_SetError(self, retval, __FILE__, __LINE__);
-+        PySSL_SetError(self, __FILE__, __LINE__);
-         goto error;
-     }
-     if (self->exc_type != NULL)
-@@ -2713,7 +2701,7 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
-     }
-     if (ret < 0) {
-         Py_XDECREF(sock);
--        PySSL_SetError(self, ret, __FILE__, __LINE__);
-+        PySSL_SetError(self, __FILE__, __LINE__);
-         return NULL;
-     }
-     if (self->exc_type != NULL)

00474-cve-2025-15366.patch

@@ -1,61 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Tue, 20 Jan 2026 14:45:42 -0600
-Subject: 00474: CVE-2025-15366
-
-gh-143921: Reject control characters in IMAP commands
-
-(cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
----
- Lib/imaplib.py                                              | 4 +++-
- Lib/test/test_imaplib.py                                    | 6 ++++++
- .../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 +
- 3 files changed, 10 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-
-diff --git a/Lib/imaplib.py b/Lib/imaplib.py
-index 20b86c35d3..bc7628d17a 100644
---- a/Lib/imaplib.py
-+++ b/Lib/imaplib.py
-@@ -132,7 +132,7 @@
- # We compile these in _mode_xxx.
- _Literal = br'.*{(?P<size>\d+)}$'
- _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
--
-+_control_chars = re.compile(b'[\x00-\x1F\x7F]')
- 
- 
- class IMAP4:
-@@ -994,6 +994,8 @@ def _command(self, name, *args):
-             if arg is None: continue
-             if isinstance(arg, str):
-                 arg = bytes(arg, self._encoding)
-+            if _control_chars.search(arg):
-+                raise ValueError("Control characters not allowed in commands")
-             data = data + b' ' + arg
- 
-         literal = self.literal
-diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py
-index 7665532d01..caf0884719 100644
---- a/Lib/test/test_imaplib.py
-+++ b/Lib/test/test_imaplib.py
-@@ -510,6 +510,12 @@ def test_login(self):
-         self.assertEqual(data[0], b'LOGIN completed')
-         self.assertEqual(client.state, 'AUTH')
- 
-+    def test_control_characters(self):
-+        client, _ = self._setup(SimpleIMAPHandler)
-+        for c0 in support.control_characters_c0():
-+            with self.assertRaises(ValueError):
-+                client.login(f'user{c0}', 'pass')
-+
-     def test_logout(self):
-         client, _ = self._setup(SimpleIMAPHandler)
-         typ, data = client.login('user', 'pass')
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-new file mode 100644
-index 0000000000..4e13fe92bc
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-@@ -0,0 +1 @@
-+Reject control characters in IMAP commands.

00475-cve-2025-15367.patch

@@ -1,61 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Tue, 20 Jan 2026 14:46:32 -0600
-Subject: 00475: CVE-2025-15367
-
-gh-143923: Reject control characters in POP3 commands
-
-(cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
----
- Lib/poplib.py                                             | 2 ++
- Lib/test/test_poplib.py                                   | 8 ++++++++
- .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst        | 1 +
- 3 files changed, 11 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-
-diff --git a/Lib/poplib.py b/Lib/poplib.py
-index 0f8587317c..f563030f7f 100644
---- a/Lib/poplib.py
-+++ b/Lib/poplib.py
-@@ -122,6 +122,8 @@ def _putline(self, line):
-     def _putcmd(self, line):
-         if self._debugging: print('*cmd*', repr(line))
-         line = bytes(line, self.encoding)
-+        if re.search(b'[\x00-\x1F\x7F]', line):
-+            raise ValueError('Control characters not allowed in commands')
-         self._putline(line)
- 
- 
-diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
-index 49ba993197..b56bc3535e 100644
---- a/Lib/test/test_poplib.py
-+++ b/Lib/test/test_poplib.py
-@@ -12,6 +12,7 @@
- import unittest
- from unittest import TestCase, skipUnless
- from test import support as test_support
-+from test.support import control_characters_c0
- from test.support import hashlib_helper
- from test.support import socket_helper
- from test.support import threading_helper
-@@ -367,6 +368,13 @@ def test_quit(self):
-         self.assertIsNone(self.client.sock)
-         self.assertIsNone(self.client.file)
- 
-+    def test_control_characters(self):
-+        for c0 in control_characters_c0():
-+            with self.assertRaises(ValueError):
-+                self.client.user(f'user{c0}')
-+            with self.assertRaises(ValueError):
-+                self.client.pass_(f'{c0}pass')
-+
-     @requires_ssl
-     def test_stls_capa(self):
-         capa = self.client.capa()
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-new file mode 100644
-index 0000000000..3cde4df3e0
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-@@ -0,0 +1 @@
-+Reject control characters in POP3 commands.

00494-increase-the-timeout-of-test_large_content_length_truncated.patch

@@ -1,23 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Karolina Surma <ksurma@redhat.com>
-Date: Fri, 14 Aug 2026 09:38:26 +0200
-Subject: 00494: Increase the timeout of test_large_content_length_truncated
-
-It has started to fail randomly when run on s390x architecture.
----
- Lib/test/test_httpservers.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
-index b0b09daab0..59434936b7 100644
---- a/Lib/test/test_httpservers.py
-+++ b/Lib/test/test_httpservers.py
-@@ -899,7 +899,7 @@ def test_large_content_length(self):
-             self.assertEqual(res.read(), b'%d %d' % (size, size) + self.linesep)
- 
-     def test_large_content_length_truncated(self):
--        with support.swap_attr(self.request_handler, 'timeout', 0.001):
-+        with support.swap_attr(self.request_handler, 'timeout', support.LOOPBACK_TIMEOUT):
-             for w in range(18, 65):
-                 size = 1 << w
-                 headers = {'Content-Length' : str(size)}

check-pyc-timestamps.py

@@ -16,12 +16,14 @@ LEVELS = (None, 1, 2)
 # list of globs of test and other files that we expect not to have bytecode
 not_compiled = [
     '/usr/bin/*',
-    '*/test/*/bad_coding.py',
+    '*/test/bad_coding.py',
-    '*/test/*/bad_coding2.py',
+    '*/test/bad_coding2.py',
-    '*/test/*/badsyntax_*.py',
+    '*/test/badsyntax_*.py',
-    '*/lib2to3/tests/data/*.py',
+    '*/lib2to3/tests/data/bom.py',
-    '*/lib2to3/tests/data/*/*.py',
+    '*/lib2to3/tests/data/crlf.py',
-    '*/lib2to3/tests/data/*/*/*.py',
+    '*/lib2to3/tests/data/different_encoding.py',
+    '*/lib2to3/tests/data/false_encoding.py',
+    '*/lib2to3/tests/data/py2_test_grammar.py',
     '*.debug-gdb.py',
 ]
 

plan.fmf

@@ -1,66 +0,0 @@
-execute:
-  how: tmt
-
-provision:
-  hardware:
-    memory: '>= 3 GB'
-
-environment:
-  pybasever: '3.11'
-
-discover:
-  - name: tests_python
-    how: shell
-    url: https://src.fedoraproject.org/tests/python.git
-    tests:
-    - name: smoke
-      path: /smoke
-      test: "VERSION=${pybasever} ./venv.sh"
-    - name: smoke_virtualenv
-      path: /smoke
-      test: "VERSION=${pybasever} METHOD=virtualenv ./venv.sh"
-    - name: debugsmoke
-      path: /smoke
-      test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} ./venv.sh"
-    - name: selftest
-      path: /selftest
-      test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh"
-    - name: debugtest
-      path: /selftest
-      test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes' ./parallel.sh"
-    - name: debugflags
-      path: /flags
-      test: "python${pybasever}d ./assertflags.py -O0"
-    - name: marshalparser
-      path: /marshalparser
-      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
-    - name: required_symbols
-      path: /required-symbols
-      test: "VERSION=${pybasever} ./check.sh"
-
-prepare:
-  - name: Install dependencies
-    how: install
-    package:
-    - gcc  # for extension building in venv and selftest
-    - gdb  # for test_gdb
-    - gcc-c++ # for test_cppext
-    - "python${pybasever}"  # the test subject
-    - "python${pybasever}-debug"  # for leak testing
-    - "python${pybasever}-devel"  # for extension building in venv and selftest
-    - "python${pybasever}-tkinter"  # for selftest
-    - "python${pybasever}-test"  # for selftest
-    - tox  # for venv tests
-    - virtualenv  # for virtualenv tests
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
-    - binutils  # for nm (symbol inspection)
-    - rpm  # for debugging
-    - dnf  # for upgrade and downgrade
-  - name: Update packages
-    how: shell
-    script: dnf upgrade -y
-  - name: rpm_qa
-    order: 100
-    how: shell
-    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt

python3.11.rpmlintrc

@@ -0,0 +1,95 @@
+# KNOWN BUGS:
+# https://bugzilla.redhat.com/show_bug.cgi?id=1489816
+addFilter(r'crypto-policy-non-compliance-openssl')
+
+
+# TESTS:
+addFilter(r'(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+/test')
+
+
+# OTHER DELIBERATES:
+# chroot function
+addFilter(r'missing-call-to-chdir-with-chroot')
+
+# intentionally unversioned and selfobsoleted
+addFilter(r'unversioned-explicit-obsoletes python')
+addFilter(r'unversioned Obsoletes: Obsoletes: python3\.\d+$')
+addFilter(r'self-obsoletion python3\.\d+ obsoletes python3\.\d+')
+
+# intentionally hardcoded
+addFilter(r'hardcoded-library-path in %{_prefix}/lib/(debug/%{_libdir}|python%{pybasever})')
+
+# we have non binary stuff, python files
+addFilter(r'only-non-binary-in-usr-lib')
+
+# some devel files that are deliberately needed
+addFilter(r'devel-file-in-non-devel-package /usr/include/python3\.\d+m?/pyconfig-(32|64)\.h')
+addFilter(r'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/distutils/tests/xxmodule\.c')
+
+# some bytecode is shipped without sources on purpose, as a space optimization
+# if this regex needs to be relaxed in the future, make sure it **does not** match pyc files in __pycache__
+addFilter(r'python-bytecode-without-source /usr/lib(64)?/python3\.\d+/(encodings|pydoc_data)/[^/]+.pyc')
+
+# SORRY, NOT SORRY:
+# manual pages
+addFilter(r'no-manual-page-for-binary (idle|pydoc|pyvenv|2to3|python3?-debug|pathfix|msgfmt|pygettext)')
+addFilter(r'no-manual-page-for-binary python3?.*-config$')
+addFilter(r'no-manual-page-for-binary python3\.\d+dm?$')
+
+# missing documentation from subpackages
+addFilter(r'^python3(\.\d+)?-(debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation')
+
+# platform python is obsoleted, but not provided
+addFilter(r'obsolete-not-provided platform-python')
+
+# we have extra tokens at the end of %endif/%else directives, we consider them useful
+addFilter(r'extra tokens at the end of %(endif|else) directive')
+
+
+# RPMLINT IMPERFECTIONS
+# https://github.com/rpm-software-management/rpmlint/issues/123
+addFilter(r'python-bytecode-wrong-magic-value .* expected 33\d\d \(3\.7\), found 3393')
+# https://github.com/rpm-software-management/rpmlint/pull/133
+addFilter(r'python-bytecode-wrong-magic-value .* expected 33\d\d \(3\.7\), found 3394')
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1550562
+# https://github.com/rpm-software-management/rpmlint/issues/128
+addFilter(r'python-bytecode-inconsistent-mtime .* 1970')
+
+# we provide python(abi) manually to be sure. createrepo will merge this with the automatic
+addFilter(r'python3(\.\d+)?\.[^:-]+: (E|W): useless-provides python\(abi\)')
+
+# debugsource
+addFilter(r'^python3(\.\d+)?-debugsource\.[^:]+: (E|W): no-documentation')
+
+# debuginfo
+addFilter(r'^python3(\.\d+)?-debuginfo\.[^:]+: (E|W): useless-provides debuginfo\(build-id\)')
+
+# this is OK for F28+
+addFilter(r'library-without-ldconfig-post')
+
+# debug package contains devel and non-devel files
+addFilter(r'python3(\.\d+)?-debug\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package')
+
+# this goes to other subpackage, hence not actually dangling, the read error is bogus
+addFilter(r'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc python-3\.\d+(-embed)?\.pc')
+addFilter(r'read-error /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc \[Errno 2\]')
+
+# the python-unversioned-command package contains dangling symlinks by design
+addFilter(r'^python-unversioned-command\.[^:]+: (E|W): dangling-relative-symlink '
+          r'(/usr/bin/python \./python3|/usr/share/man/man1/python\.1\S* ./python3\.1\S*)$')
+
+# we need this macro to evaluate, even if the line starts with #
+addFilter(r'macro-in-comment %\{_pyconfig(32|64)_h\}')
+
+# Python modules don't need to be linked against libc
+# Since 3.8 they are no longer linked against libpython3.8.so.1.0
+addFilter(r'(E|W): library-not-linked-against-libc /usr/lib(64)?/python3\.\d+/lib-dynload/')
+addFilter(r'(E|W): shared-lib-without-dependency-information /usr/lib(64)?/python3\.\d+/lib-dynload/')
+
+# specfile-errors are listed twice, once with reason and once without
+# we filter out the empty ones
+addFilter(r'\bpython3(\.\d+)?\.(src|spec): (E|W): specfile-error\s+$')
+
+# SPELLING ERRORS
+addFilter(r'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest) ')

python3.11.spec

@@ -13,12 +13,12 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.16
+%global general_version %{pybasever}.0
-#global prerel ...
+%global prerel b3
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
-License: Python-2.0.1
+License: Python
 
 
 # ==================================
@@ -67,8 +67,8 @@ License: Python-2.0.1
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 24.0
+%global pip_version 22.0.4
-%global setuptools_version 79.0.1
+%global setuptools_version 58.1.0
 
 # Expensive optimizations (mainly, profile-guided optimizations)
 %bcond_without optimizations
@@ -175,12 +175,6 @@ Obsoletes: python%{pybasever}%{?1:-%{1}}\
 %define unversioned_obsoletes_of_python3_X_if_main() %{nil}
 %endif
 
-# Opt-out from https://fedoraproject.org/wiki/Changes/fno-omit-frame-pointer
-# Python is slower with frame pointers, but we expect to remove this in Python 3.12+
-# See https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/6TQYCHMX4FZLF27U5BCEC7IFV6XNBKJP/
-# Tracking bugzilla: https://bugzilla.redhat.com/2158729
-%undefine _include_frame_pointers
-
 # =======================
 # Build-time requirements
 # =======================
@@ -205,20 +199,17 @@ BuildRequires: glibc-devel
 BuildRequires: gmp-devel
 BuildRequires: gnupg2
 BuildRequires: libappstream-glib
-%if %{undefined rhel}
-BuildRequires: libb2-devel
-%endif
 BuildRequires: libffi-devel
 BuildRequires: libnsl2-devel
 BuildRequires: libtirpc-devel
 BuildRequires: libGL-devel
 BuildRequires: libuuid-devel
-BuildRequires: libxcrypt-devel
 BuildRequires: libX11-devel
 BuildRequires: make
 BuildRequires: mpdecimal-devel
 BuildRequires: ncurses-devel
 
+BuildRequires: openssl-devel
 BuildRequires: pkgconfig
 BuildRequires: readline-devel
 BuildRequires: redhat-rpm-config >= 127
@@ -226,15 +217,11 @@ BuildRequires: sqlite-devel
 BuildRequires: gdb
 
 BuildRequires: tar
-BuildRequires: tcl-devel < 1:9
+BuildRequires: tcl-devel
 BuildRequires: tix-devel
-BuildRequires: tk-devel < 1:9
+BuildRequires: tk-devel
 BuildRequires: tzdata
 
-# Support for OpenSSL 4 only landed in Python 3.15 for now
-# https://github.com/python/cpython/issues/146207
-BuildRequires: (openssl-devel < 1:4 or openssl3-devel)
-
 %if %{with valgrind}
 BuildRequires: valgrind-devel
 %endif
@@ -242,7 +229,6 @@ BuildRequires: valgrind-devel
 BuildRequires: xz-devel
 BuildRequires: zlib-devel
 
-BuildRequires: systemtap-sdt-devel
 BuildRequires: /usr/bin/dtrace
 
 # workaround http://bugs.python.org/issue19804 (test_uuid requires ifconfig)
@@ -251,9 +237,6 @@ BuildRequires: /usr/sbin/ifconfig
 %if %{with rpmwheels}
 BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel
 BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel
-%else
-# For %%python_wheel_inject_sbom
-BuildRequires: python-rpm-macros
 %endif
 
 %if %{without bootstrap}
@@ -290,88 +273,42 @@ Source11: idle3.appdata.xml
 
 # 00001 # d06a8853cf4bae9e115f45e1d531d2dc152c5cc8
 # Fixup distutils/unixccompiler.py to remove standard library path from rpath
-#
 # Was Patch0 in ivazquez' python3000 specfile
 Patch1: 00001-rpath.patch
 
-# 00251 # af0f1ba72e01cb93371ff21fb7ca889daa43fa7a
+# 00251 # 178b2099a8eb7c487f1a32c3f055be6c154c0116
 # Change user install location
 #
-# Set values of base and platbase in sysconfig from /usr
+# Change the values of sysconfig's "posix_prefix" install scheme to /usr/local
-# to /usr/local when RPM build is not detected
+# when RPM build or venv/virtualenv is not detected,
-# to make pip and similar tools install into separate location.
+# to make pip, sysconfig and distutils install into an isolated location.
 #
-# Set values of prefix and exec_prefix in distutils install command
+# The original values are saved as an additional "rpm_prefix" install scheme.
-# to /usr/local if executable is /usr/bin/python* and RPM build
+#
-# is not detected to make distutils and pypa/distutils install into separate location.
+# The site module adds the /usr/local paths to sys.path when site packages are
+# enabled and RPM build is not detected.
 #
 # Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-# Downstream only.
 #
-# We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
+# Rewrote in Fedora 36+ to patch sysconfig instead of distutils,
-# but we have identified serious problems with that approach,
+# see https://discuss.python.org/t/pep-632-deprecate-distutils-module/5134/104
-# see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
 #
-# pypa/distutils integration: https://github.com/pypa/distutils/pull/70
+# Downstream only for now, waiting for https://bugs.python.org/issue43976
 Patch251: 00251-change-user-install-location.patch
 
-# 00371 # c1754d9c2750f89cb702e1b63a99201f5f7cff00
+# 00328 # 318e500c98f5e59eb1f23e0fcd32db69b9bd17e1
-# Revert "bpo-1596321: Fix threading._shutdown() for the main thread (GH-28549) (GH-28589)"
+# Restore pyc to TIMESTAMP invalidation mode as default in rpmbuild
 #
-# This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
+# Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
-# introduced regression causing FreeIPA's tests to fail.
+# %%changelog date. This makes Python default to the CHECKED_HASH pyc
+# invalidation mode, bringing more reproducible builds traded for an import
+# performance decrease. To avoid that, we don't default to CHECKED_HASH
+# when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
 #
-# For more info see:
+# See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
-# https://bodhi.fedoraproject.org/updates/FEDORA-2021-e152ce5f31
+# Downstream only: only used when building RPM packages
-# https://github.com/GrahamDumpleton/mod_wsgi/issues/730
+# Ideally, we should talk to upstream and explain why we don't want this
-Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+Patch328: 00328-pyc-timestamp-invalidation-mode.patch
-
-# 00452 # eb11d070c5af7d1b5e47f4e02186152d08eaf793
-# Properly apply exported CFLAGS for dtrace/systemtap builds
-#
-# When using --with-dtrace the resulting object file could be missing
-# specific CFLAGS exported by the build system due to the systemtap
-# script using specific defaults.
-#
-# Exporting the CC and CFLAGS variables before the dtrace invocation
-# allows us to properly apply CFLAGS exported by the build system
-# even when cross-compiling.
-Patch452: 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
-
-# 00462 # c9db492d8924b2d1a0991e36f3c2b4f9c2ec8942
-# Fix PySSL_SetError handling SSL_ERROR_SYSCALL
-#
-# Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
-# SSL_read_ex(), but did not update handling of the return value.
-#
-# Change error handling so that the return value is not examined.
-# OSError (not EOF) is now returned when retval is 0.
-#
-# This resolves the issue of failing tests when a system is
-# stressed on OpenSSL 3.5.
-Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
-
-# 00474 # 837ddca0372fa87ff9cee47142200caa21e77def
-# CVE-2025-15366
-#
-# gh-143921: Reject control characters in IMAP commands
-#
-# (cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
-Patch474: 00474-cve-2025-15366.patch
-
-# 00475 # 3748209a316662d4e85981ca1a7418547a1d25c6
-# CVE-2025-15367
-#
-# gh-143923: Reject control characters in POP3 commands
-#
-# (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
-Patch475: 00475-cve-2025-15367.patch
-
-# 00494 # 430aab133397ed44cc9ee621fd311e02fee317b5
-# Increase the timeout of test_large_content_length_truncated
-#
-# It has started to fail randomly when run on s390x architecture.
-Patch494: 00494-increase-the-timeout-of-test_large_content_length_truncated.patch
 
 # (New patches go here ^^^)
 #
@@ -492,8 +429,6 @@ This package contains /usr/bin/python - the "python" command that runs Python 3.
 
 %package -n %{pkgname}-libs
 Summary:        Python runtime libraries
-# Bundled libb2 is CC0, covered by grandfathering exception
-License:        Python-2.0.1 AND CC0-1.0
 
 %if %{with rpmwheels}
 Requires: %{python_wheel_pkg_prefix}-setuptools-wheel
@@ -505,10 +440,6 @@ Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
 
 %unversioned_obsoletes_of_python3_X_if_main libs
 
-# Bundled internal headers are used even when building with system libb2
-# last updated by https://github.com/python/cpython/pull/6286
-Provides: bundled(libb2) = 0.98.1
-
 # There are files in the standard library that have python shebang.
 # We've filtered the automatic requirement out so libs are installable without
 # the main package. This however makes it pulled in by default.
@@ -523,26 +454,6 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa})
 # The zoneinfo module needs tzdata
 Requires: tzdata
 
-# The requirement on libexpat is generated, but we need to version it.
-# When built with a specific expat version, but installed with an older one,
-# we sometimes get:
-#   ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so:
-#   undefined symbol: XML_...
-# The pyexpat module has build-time checks for expat version to only use the
-# available symbols. However, there is no runtime protection, so when the module
-# is later installed with an older expat, it may error due to undefined symbols.
-# This breaks many things, including python -m venv.
-# We avoid this problem by requiring at least the same version of expat that
-# was used during the build time.
-# Other subpackages (like -debug) also need this, but they all depend on -libs.
-# Since expat 2.7.4, the library has versioned symbols and this is no longer needed,
-# as the generated requirement will be in the form of libexpat.so.1(LIBEXPAT_2.7.2) etc.
-%global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/')
-%if v"%{expat_version}" < v"2.7.4"
-Requires: expat%{?_isa} >= %{expat_version}
-%endif
-
-
 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
 - the majority of the Python standard library
@@ -558,11 +469,7 @@ Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 # But we want them when packages BuildRequire python3-devel
 Requires: (python-rpm-macros if rpm-build)
 Requires: (python3-rpm-macros if rpm-build)
-# We omit this dependency on RHEL to avoid pulling the macros to AppStream:
+Requires: (pyproject-rpm-macros if rpm-build)
-# RHEL users can use the minimal implementation of %%pyproject_buildrequires
-# from pyproject-srpm-macros instead.
-# On Fedora, we keep this to avoid one additional round of %%generate_buildrequires.
-%{!?rhel:Requires: (pyproject-rpm-macros if rpm-build)}
 
 %unversioned_obsoletes_of_python3_X_if_main devel
 
@@ -754,15 +661,14 @@ topdir=$(pwd)
 # Standard library built here will still use the %%build_...flags,
 # Fedora packages utilizing %%py3_build will use them as well
 # https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
-# https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
+export CFLAGS="%{extension_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
-export CFLAGS="%{extension_cflags}"
 export CFLAGS_NODIST="%{build_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
-export CXXFLAGS="%{extension_cxxflags}"
+export CXXFLAGS="%{extension_cxxflags} -D_GNU_SOURCE -fPIC -fwrapv"
 export CPPFLAGS="$(pkg-config --cflags-only-I libffi)"
-export OPT="%{extension_cflags}"
+export OPT="%{extension_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
 export LINKCC="gcc"
 export CFLAGS="$CFLAGS $(pkg-config --cflags openssl)"
-export LDFLAGS="%{extension_ldflags} $(pkg-config --libs-only-L openssl)"
+export LDFLAGS="%{extension_ldflags} -g $(pkg-config --libs-only-L openssl)"
 export LDFLAGS_NODIST="%{build_ldflags} -g $(pkg-config --libs-only-L openssl)"
 
 # We can build several different configurations of Python: regular and debug.
@@ -1026,25 +932,15 @@ find . -name "*~" -exec rm -f {} \;
 # Python CMD line options:
 # -s - don't add user site directory to sys.path
 # -B - don't write .pyc files on import
-# Clamp the source mtime first, see https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes
-# The clamp_source_mtime module is only guaranteed to exist on Fedoras that enabled this option:
-%if 0%{?clamp_mtime_to_source_date_epoch}
-LD_LIBRARY_PATH="%{buildroot}%{dynload_dir}/:%{buildroot}%{_libdir}" \
-PYTHONPATH="%{_rpmconfigdir}/redhat" \
-%{buildroot}%{_bindir}/python%{pybasever} -s -B -m clamp_source_mtime %{buildroot}%{pylibdir}
-%endif
 # compileall CMD line options:
 # -f - force rebuild even if timestamps are up to date
 # -o - optimization levels to run compilation with
 # -s - part of path to left-strip from path to source file (buildroot)
 # -p - path to add as prefix to path to source file (/ to make it absolute)
 # --hardlink-dupes - hardlink different optimization level pycs together if identical (saves space)
-# --invalidation-mode - we prefer the timestamp invalidation mode for performance reasons
-# -x - skip test modules with SyntaxErrors (taken from the Makefile)
 LD_LIBRARY_PATH="%{buildroot}%{dynload_dir}/:%{buildroot}%{_libdir}" \
 %{buildroot}%{_bindir}/python%{pybasever} -s -B -m compileall \
--f %{_smp_mflags} -o 0 -o 1 -o 2 -s %{buildroot} -p / %{buildroot} --hardlink-dupes --invalidation-mode=timestamp \
+-f %{_smp_mflags} -o 0 -o 1 -o 2 -s %{buildroot} -p / %{buildroot} --hardlink-dupes || :
--x 'bad_coding|badsyntax|site-packages|lib2to3/tests/data'
 
 # Turn this BRP off, it is done by compileall2 --hardlink-dupes above
 %global __brp_python_hardlink %{nil}
@@ -1102,11 +998,6 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
     rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done
 
-%if %{without rpmwheels}
-# Inject SBOM into the installed wheels (if the macro is available)
-%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl}
-%endif
-
 # ======================================================
 # Checks for packaging issues
 # ======================================================
@@ -1168,25 +1059,16 @@ CheckPython() {
   # test_freeze_simple_script is skipped, because it fails when bundled wheels
   #  are removed in Fedora.
   #  upstream report: https://bugs.python.org/issue45783
-  # test_check_probes is failing since it was introduced in 3.12.0rc1,
-  # the test is skipped until it is fixed in upstream.
-  # see: https://github.com/python/cpython/issues/104280#issuecomment-1669249980
-  # test_sendfile_close_peer_in_the_middle_of_receiving:
-  #  https://github.com/python/cpython/issues/120226
 
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
     -wW --slowest -j0 --timeout=1800 \
     -i test_freeze_simple_script \
-    -i test_check_probes \
     %if %{with bootstrap}
     -x test_distutils \
     %endif
     %ifarch %{mips64}
     -x test_ctypes \
     %endif
-    %ifarch ppc64le
-    -i test_sendfile_close_peer_in_the_middle_of_receiving \
-    %endif
 
   echo FINISHED: CHECKING OF PYTHON FOR CONFIGURATION: $ConfName
 
@@ -1426,7 +1308,6 @@ CheckPython optimized
 %{pylibdir}/multiprocessing
 
 %dir %{pylibdir}/re/
-%dir %{pylibdir}/re/__pycache__/
 %{pylibdir}/re/*.py
 %{pylibdir}/re/__pycache__/*%{bytecode_suffixes}
 
@@ -1436,7 +1317,6 @@ CheckPython optimized
 %{pylibdir}/sqlite3/__pycache__/*%{bytecode_suffixes}
 
 %dir %{pylibdir}/tomllib/
-%dir %{pylibdir}/tomllib/__pycache__/
 %{pylibdir}/tomllib/*.py
 %{pylibdir}/tomllib/__pycache__/*%{bytecode_suffixes}
 %exclude %{pylibdir}/turtle.py
@@ -1446,8 +1326,7 @@ CheckPython optimized
 %{pylibdir}/xml
 %{pylibdir}/zoneinfo
 
-%dir %{pylibdir}/__phello__/
+%dir %{pylibdir}/__phello__
-%dir %{pylibdir}/__phello__/__pycache__/
 %{pylibdir}/__phello__/__init__.py
 %{pylibdir}/__phello__/spam.py
 %{pylibdir}/__phello__/__pycache__/*%{bytecode_suffixes}
@@ -1545,7 +1424,6 @@ CheckPython optimized
 %{dynload_dir}/_ctypes_test.%{SOABI_optimized}.so
 %{dynload_dir}/_testbuffer.%{SOABI_optimized}.so
 %{dynload_dir}/_testcapi.%{SOABI_optimized}.so
-%{dynload_dir}/_testclinic.%{SOABI_optimized}.so
 %{dynload_dir}/_testimportmultiple.%{SOABI_optimized}.so
 %{dynload_dir}/_testinternalcapi.%{SOABI_optimized}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_optimized}.so
@@ -1674,7 +1552,6 @@ CheckPython optimized
 %{dynload_dir}/_ctypes_test.%{SOABI_debug}.so
 %{dynload_dir}/_testbuffer.%{SOABI_debug}.so
 %{dynload_dir}/_testcapi.%{SOABI_debug}.so
-%{dynload_dir}/_testclinic.%{SOABI_debug}.so
 %{dynload_dir}/_testimportmultiple.%{SOABI_debug}.so
 %{dynload_dir}/_testinternalcapi.%{SOABI_debug}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_debug}.so
@@ -1705,217 +1582,6 @@ CheckPython optimized
 # ======================================================
 
 %changelog
-* Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.11.16-1
-- Update to Python 3.11.16
-
-* Thu Jul 30 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-7
- - Skip UDP Lite tests if it's not supported
- - Fixes FTBFS on Linux kernel 7.1 and newer
-
-* Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.15-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Thu Jul 02 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-5
-- Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
-
-* Fri Apr 17 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.11.15-4
-- Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644, CVE-2026-4224
-Resolves: rhbz#2457941, rhbz#2458221, rhbz#2458013, rhbz#2444704, rhbz#2448188, rhbz#2448204
-
-* Sat Apr 11 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-3
-- Explicitly build with OpenSSL 3
-
-* Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.11.15-2
-- Security fix for CVE-2026-4519 (rhbz#2449727)
-
-* Tue Mar 03 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.15-1
-- Update to 3.11.15
-
-* Mon Feb 09 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.14-5
-- Security fixes for CVE-2026-0865, CVE-2025-15366 and CVE-2025-15367
-
-* Fri Jan 16 2026 Lumír Balhar <lbalhar@redhat.com> - 3.11.14-4
-- Security fix for CVE-2025-13836
-
-* Thu Jan 08 2026 Lumír Balhar <lbalhar@redhat.com> - 3.11.14-3
-- Security fix for CVE-2025-12084
-
-* Tue Jan 06 2026 Karolina Surma <ksurma@redhat.com> - 3.11.14-2
-- Require at least the same expat version as used during the build time
-
-* Fri Oct 10 2025 Karolina Surma <ksurma@redhat.com> - 3.11.14-1
-- Update to 3.11.14
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.13-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Wed Jun 04 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-1
-- Update to 3.11.13
-
-* Tue May 13 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.11.12-3
-- Fix PySSL_SetError handling SSL_ERROR_SYSCALL
-- This fixes random flakiness of test_ssl on stressed machines
-
-* Wed Apr 16 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.11.12-2
-- test_ssl: Don't stop ThreadedEchoServer on OSError in ConnectionHandler
-- Fixes: rhbz#2355052
-
-* Wed Apr 09 2025 Miro Hrončok <mhroncok@redhat.com> - 3.11.12-1
-- Update to 3.11.12
-
-* Mon Mar 31 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.11.11-6
-- Properly apply exported CFLAGS for dtrace/systemtap builds
-- Fixes: rhbz#2356302
-
-* Mon Feb 10 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.11.11-5
-- Security fix for CVE-2025-0938
-- Fixes: rhbz#2343272
-
-* Thu Feb 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.11.11-4
-- Rebuilt with mpdecimal 4.0.0
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.11.11-3
-- Add explicit BR: libxcrypt-devel
-
-* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.11-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Dec 03 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.11-1
-- Update to 3.11.11
-- Fixes: rhbz#2321655
-
-* Mon Sep 09 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.10-1
-- Update to 3.11.10
-
-* Fri Aug 23 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-6
-- Security fix for CVE-2024-8088
-- Fixes: rhbz#2307460
-
-* Thu Aug 15 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-5
-- Security fix for CVE-2024-4032 (rhbz#2293391)
-- Security fix for CVE-2024-6923 (rhbz#2303158)
-
-* Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.9-4
-- Require systemtap-sdt-devel for sys/sdt.h
-
-* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.9-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Wed Apr 17 2024 Miro Hrončok <mhroncok@redhat.com> - 3.11.9-2
-- Require expat >= 2.6 to prevent errors when creating venvs with older expat
-
-* Tue Apr 09 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.9-1
-- Update to 3.11.9
-
-* Wed Feb 28 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.8-2
-- Fix tests for XMLPullParser with Expat 2.6.0
-
-* Wed Feb 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.8-1
-- Update to 3.11.8
-
-* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.7-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.7-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Dec 18 2023 Lumír Balhar <lbalhar@redhat.com> - 3.11.7-2
-- Security fix for CVE-2023-27043 (rhbz#2196188)
-
-* Wed Dec 06 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.7-1
-- Update to 3.11.7
-- Own stray directories in /usr/lib64/python3.11
-- Fixes: rhbz#2252144
-
-* Tue Oct 03 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 3.11.6-2
-- Use bundled libb2 in RHEL builds
-
-* Tue Oct 03 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.6-1
-- Update to 3.11.6
-
-* Mon Aug 28 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.5-1
-- Update to 3.11.5
-
-* Wed Aug 02 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.4-4
-- Remove extra distro-applied CFLAGS passed to user built C extensions
-- https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
-
-* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.4-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.11.4-2
-- Rebuilt for Python 3.12
-
-* Wed Jun 07 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.4-1
-- Update to 3.11.4
-
-* Wed May 24 2023 Lumír Balhar <lbalhar@redhat.com> - 3.11.3-2
-- Fix for CVE-2023-24329
-
-* Wed Apr 05 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.3-1
-- Update to 3.11.3
-
-* Wed Feb 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.2-1
-- Update to 3.11.2
-
-* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.1-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Fri Jan 06 2023 Miro Hrončok <mhroncok@redhat.com> - 3.11.1-3
-- Fix `asyncio` subprocess losing `stderr` and `stdout` output
-- Remove any deprecation warnings in asyncio.get_event_loop()
-
-* Mon Dec 19 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.1-2
-- No longer patch the default bytecode cache invalidation policy
-
-* Wed Dec 07 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.1-1
-- Update to 3.11.1
-
-* Mon Oct 24 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0-1
-- Update to 3.11.0
-
-* Tue Sep 13 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0~rc2-1
-- Update to 3.11.0rc2
-
-* Tue Aug 09 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0~rc1-2
-- Don't use custom installation schemes
-- Fixes rhbz#2026979
-- Fixes rhbz#2097183
-
-* Mon Aug 08 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.0~rc1-1
-- Update to 3.11.0rc1
-
-* Tue Jul 26 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.0~b5-1
-- Update to 3.11.0b5
-
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.0~b4-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Mon Jul 11 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0~b4-1
-- Update to 3.11.0b4
-
-* Fri Jul 08 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0~b3-8
-- Finish bootstrap of the re module speed regression fix
-
-* Fri Jul 08 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0~b3-7
-- Fix speed regression in the re module which prevented chromium from building
-
-* Fri Jun 24 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.0~b3-6
-- Clear and reset sqlite3 statements properly in cursor iternext (fixes rhbz#2099049)
-- Revert a problematic fix of threading._shutdown() again (fixes rhbz#2100282)
-
-* Tue Jun 21 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0~b3-5
-- Build Python with the optimized Blake2 library libb2
-
-* Tue Jun 21 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0~b3-4
-- Make C++ version of _Py_CAST work with 0/NULL
-
-* Mon Jun 13 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.0~b3-3
-- Finish bootstrapping for Python 3.11 mass rebuild
-
-* Mon Jun 13 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.0~b3-2
-- Initial bootstrap for Python 3.11 mass rebuild
-
 * Wed Jun 01 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11.0~b3-1
 - Update to 3.11.0b3
 

rpminspect.yaml

@@ -1,22 +1,13 @@
 # exclude test XML data (not always valid) from XML validity check:
 xml:
     ignore:
-        - '/usr/lib*/python*/test/xmltestdata/*'
+        - /usr/lib*/python*/test/xmltestdata/*
-        - '/usr/lib*/python*/test/xmltestdata/*/*'
+        - /usr/lib*/python*/test/xmltestdata/*/*
 
 # exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
 badfuncs:
-    allowed:
-        '/usr/lib*/python*/lib-dynload/_socket.*':
-            - inet_aton
-            - inet_ntoa
-
-# exclude the debug build from annocheck entirely
-annocheck:
     ignore:
-        - '/usr/bin/python*d'
+        - /usr/lib*/python*/lib-dynload/_socket.*
-        - '/usr/lib*/libpython*d.so.1.0'
-        - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so'
 
 # don't report changed content of compiled files
 # that is expected with every toolchain update and not reproducible yet

rpmlint.toml

@@ -1,106 +0,0 @@
-Filters = [
-
-    # KNOWN BUGS:
-    # https://bugzilla.redhat.com/show_bug.cgi?id=1489816
-    'crypto-policy-non-compliance-openssl',
-
-
-    # TESTS:
-    '(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+/test',
-
-
-    # OTHER DELIBERATES:
-    # chroot function
-    'missing-call-to-chdir-with-chroot',
-
-    # gethostbyname function calls gethostbyname
-    '(E|W): binary-or-shlib-calls-gethostbyname /usr/lib(64)?/python3\.\d+/lib-dynload/_socket\.',
-
-    # intentionally unversioned and selfobsoleted
-    'unversioned-explicit-obsoletes python',
-    'unversioned Obsoletes: Obsoletes: python3\.\d+$',
-    'self-obsoletion python3\.\d+(-\S+)? obsoletes python3\.\d+(-\S+)?',
-
-    # intentionally hardcoded
-    'hardcoded-library-path in %{_prefix}/lib/(debug/%{_libdir}|python%{pybasever})',
-
-    # we have non binary stuff, python files
-    'only-non-binary-in-usr-lib',
-
-    # some devel files that are deliberately needed
-    'devel-file-in-non-devel-package /usr/include/python3\.\d+m?/pyconfig-(32|64)\.h',
-    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/distutils/tests/xxmodule\.c',
-    # ...or are used as test data
-    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/test',
-
-    # some bytecode is shipped without sources on purpose, as a space optimization
-    # if this regex needs to be relaxed in the future, make sure it **does not** match pyc files in __pycache__
-    'python-bytecode-without-source /usr/lib(64)?/python3\.\d+/(encodings|pydoc_data)/[^/]+.pyc',
-
-    # DUPLICATE FILES
-    # test data are often duplicated
-    '(E|W): files-duplicate /usr/lib(64)?/python3\.\d+/(test|__phello__)/',
-    # duplicated inits or mains are also common
-    '(E|W): files-duplicate .+__init__\.py.+__init__\.py',
-    '(E|W): files-duplicate .+__main__\.py.+__main__\.py',
-    # files in the debugsource package
-    '(E|W): files-duplicate /usr/src/debug',
-    # general waste report
-    '(E|W): files-duplicated-waste',
-
-    # SORRY, NOT SORRY:
-    # manual pages
-    'no-manual-page-for-binary (idle|pydoc|pyvenv|2to3|python3?-debug|pathfix|msgfmt|pygettext)',
-    'no-manual-page-for-binary python3?.*-config$',
-    'no-manual-page-for-binary python3\.\d+dm?$',
-
-    # missing documentation from subpackages
-    '^python3(\.\d+)?-(debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation',
-
-    # platform python is obsoleted, but not provided
-    'obsolete-not-provided platform-python',
-
-    # we have extra tokens at the end of %endif/%else directives, we consider them useful
-    'extra tokens at the end of %(endif|else) directive',
-
-
-    # RPMLINT IMPERFECTIONS
-    # https://github.com/rpm-software-management/rpmlint/issues/780
-    '/usr/lib/debug',
-
-    # we provide python(abi) manually to be sure. createrepo will merge this with the automatic
-    'python3(\.\d+)?\.[^:-]+: (E|W): useless-provides python\(abi\)',
-
-    # debugsource and debuginfo have no docs
-    '^python3(\.\d+)?-debug(source|info)\.[^:]+: (E|W): no-documentation',
-
-    # this is OK for F28+
-    'library-without-ldconfig-post',
-
-    # debug package contains devel and non-devel files
-    'python3(\.\d+)?-debug\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package',
-
-    # this goes to other subpackage, hence not actually dangling
-    'dangling-relative-symlink /usr/bin/python python3',
-    'dangling-relative-symlink /usr/share/man/man1/python\.1\.gz python3\.1\.gz',
-    'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc python-3\.\d+(-embed)?\.pc',
-
-    # the python-unversioned-command package contains dangling symlinks by design
-    '^python-unversioned-command\.[^:]+: (E|W): dangling-relative-symlink (/usr/bin/python \./python3|/usr/share/man/man1/python\.1\S* ./python3\.1\S*)$',
-
-    # we need this macro to evaluate, even if the line starts with #
-    'macro-in-comment %\{_pyconfig(32|64)_h\}',
-
-    # Python modules don't need to be linked against libc
-    # Since 3.8 they are no longer linked against libpython3.8.so.1.0
-    '(E|W): library-not-linked-against-libc /usr/lib(64)?/python3\.\d+/lib-dynload/',
-    '(E|W): shared-lib(rary)?-without-dependency-information /usr/lib(64)?/python3\.\d+/lib-dynload/',
-
-    # specfile-errors are listed twice, once with reason and once without
-    # we filter out the empty ones
-    '\bpython3(\.\d+)?\.(src|spec): (E|W): specfile-error\s+$',
-
-    # SPELLING ERRORS
-    'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest) ',
-
-]

sources

@@ -1,2 +1,2 @@
-SHA512 (Python-3.11.16.tar.xz) = f4e168d35596c2df080663d8e8b3472f03bace987d46b49b8410f2425ba193215b9880c7d03d4653ec31c83b72209d95866fc1cb6d666799145075b092f64a48
+SHA512 (Python-3.11.0b3.tar.xz) = 53c379311acc9d8ec645caea44f4b83b29fcbdacb7114eb7aac5a2f0229402eddb245abc8bd6665077e9c82ba0a821cc55ae7494d0667b84675248025e872498
-SHA512 (Python-3.11.16.tar.xz.asc) = b31b3205e68951478fe76f4884a124ebb4955a711b6105754d4179acb48b16a5439ec8c35383a84787cd673fa1143f2f047c6d65944909b0f1a8e3c75a0e2efe
+SHA512 (Python-3.11.0b3.tar.xz.asc) = b51a02e47de73f4998effd15eb99d356ef69cd69521f208f50de1b8acf69d5cf9c8a2f774ec8bc5e0e75534fe59efe019cffcff39bc525aa4641dc9b47efb5ef

tests/provision.fmf

@@ -0,0 +1,4 @@
+---
+standard-inventory-qcow2:
+  qemu:
+    m: 3G  # Amount of VM memory

tests/tests.yml

@@ -0,0 +1,42 @@
+---
+- hosts: localhost
+  tags:
+    - classic
+  tasks:
+    - dnf:
+        name: "*"
+        state: latest
+
+- hosts: localhost
+  roles:
+  - role: standard-test-basic
+    tags:
+    - classic
+    repositories:
+    - repo: "https://src.fedoraproject.org/tests/python.git"
+      dest: "python"
+    tests:
+    - rpm_qa:
+        run: rpm -qa
+    - smoke:
+        dir: python/smoke
+        run: VERSION=3.11 CYTHON=false ./venv.sh
+    - smoke_virtualenv:
+        dir: python/smoke
+        run: VERSION=3.11 CYTHON=false METHOD=virtualenv ./venv.sh
+    - selftest:
+        dir: python/selftest
+        run: VERSION=3.11 X="" ./parallel.sh
+    - marshalparser:
+        dir: python/marshalparser
+        run: VERSION=3.11 SAMPLE=10 test_marshalparser_compatibility.sh
+    required_packages:
+    - gcc  # for extension building in venv and selftest
+    - gcc-c++ # for test_cppext
+    - gdb  # for test_gdb
+    - python3.11  # the test subject
+    - tox  # for venv tests
+    - virtualenv  # for virtualenv tests
+    - glibc-all-langpacks # for locale tests
+    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - rpm  # for debugging