14 changed files with 174 additions and 535 deletions
--- a/00001-rpath.patch
+++ b/00001-rpath.patch
@ -1,10 +1,10 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Wed, 13 Jan 2010 21:25:18 +0000
-Subject: 00001: Fixup distutils/unixccompiler.py to remove standard library
- path from rpath
+Subject: =?UTF-8?q?00001:=20Fixup=20distutils/unixccompiler.py=20to=20remo?=
+ =?UTF-8?q?ve=20standard=20library=20path=20from=20rpath=0AWas=20Patch0=20?=
+ =?UTF-8?q?in=20ivazquez'=20python3000=20specfile?=

-Was Patch0 in ivazquez' python3000 specfile
 ---
 Lib/distutils/unixccompiler.py | 9 +++++++++
 1 file changed, 9 insertions(+)
--- a/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
+++ b/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
@ -20,10 +20,10 @@ Co-authored-by: stratakis <cstratak@redhat.com>
 create mode 100644 Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst

 diff --git a/Makefile.pre.in b/Makefile.pre.in
-index ad29e1a0ca..79b07194bb 100644
+index 81d4d50f82..0bd3447638 100644
 --- a/Makefile.pre.in
 +++ b/Makefile.pre.in
-@@ -1458,7 +1458,7 @@ Python/frozen.o: $(FROZEN_FILES_OUT)
+@@ -1453,7 +1453,7 @@ Python/frozen.o: $(FROZEN_FILES_OUT)
 # an include guard, so we can't use a pipeline to transform its output.
 Include/pydtrace_probes.h: $(srcdir)/Include/pydtrace.d
 	$(MKDIR_P) Include
@ -32,7 +32,7 @@ index ad29e1a0ca..79b07194bb 100644
 	: sed in-place edit with POSIX-only tools
 	sed 's/PYTHON_/PyDTrace_/' $@ > $@.tmp
 	mv $@.tmp $@
-@@ -1468,7 +1468,7 @@ Python/import.o: $(srcdir)/Include/pydtrace.h
+@@ -1463,7 +1463,7 @@ Python/import.o: $(srcdir)/Include/pydtrace.h
 Modules/gcmodule.o: $(srcdir)/Include/pydtrace.h
 
 Python/pydtrace.o: $(srcdir)/Include/pydtrace.d $(DTRACE_DEPS)
--- a/00458-test_ssl-don-t-stop-threadedechoserver-on-oserror-in-connectionhandler.patch
+++ b/00458-test_ssl-don-t-stop-threadedechoserver-on-oserror-in-connectionhandler.patch
@ -0,0 +1,80 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 11 Nov 2024 15:26:10 +0100
+Subject: 00458: test_ssl: Don't stop ThreadedEchoServer on OSError in
+ ConnectionHandler
+
+If `read()` in the ConnectionHandler thread raises `OSError` (except `ConnectionError`),
+the ConnectionHandler shuts down the entire ThreadedEchoServer,
+preventing further connections.
+It also does that for `EPROTOTYPE` in `wrap_conn`.
+
+Make sure that the context manager *is* used, and remove the `server.stop()`
+calls from ConnectionHandler.
+
+Backported from 3.12+:
+https://github.com/python/cpython/pull/126503
+
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+---
+ Lib/test/test_ssl.py | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
+index 203351bd60..0b169c37d5 100644
+--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
+@@ -2516,7 +2516,6 @@ def wrap_conn(self):
+                 # See also http://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/
+                 if e.errno != errno.EPROTOTYPE and sys.platform != "darwin":
+                     self.running = False
+-                    self.server.stop()
+                     self.close()
+                 return False
+             else:
+@@ -2651,10 +2650,6 @@ def run(self):
+                     self.close()
+                     self.running = False
+ 
+-                    # normally, we'd just stop here, but for the test
+-                    # harness, we want to stop the server
+-                    self.server.stop()
+-
+     def __init__(self, certificate=None, ssl_version=None,
+                  certreqs=None, cacerts=None,
+                  chatty=True, connectionchatty=False, starttls_server=False,
+@@ -2688,21 +2683,33 @@ def __init__(self, certificate=None, ssl_version=None,
+         self.conn_errors = []
+         threading.Thread.__init__(self)
+         self.daemon = True
+        self._in_context = False
+ 
+     def __enter__(self):
+        if self._in_context:
+            raise ValueError('Re-entering ThreadedEchoServer context')
+        self._in_context = True
+         self.start(threading.Event())
+         self.flag.wait()
+         return self
+ 
+     def __exit__(self, *args):
+        assert self._in_context
+        self._in_context = False
+         self.stop()
+         self.join()
+ 
+     def start(self, flag=None):
+        if not self._in_context:
+            raise ValueError(
+                'ThreadedEchoServer must be used as a context manager')
+         self.flag = flag
+         threading.Thread.start(self)
+ 
+     def run(self):
+        if not self._in_context:
+            raise ValueError(
+                'ThreadedEchoServer must be used as a context manager')
+         self.sock.settimeout(1.0)
+         self.sock.listen(5)
+         self.active = True
--- a/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
+++ b/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
@ -1,196 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: yevgeny hong <hongyevgeny@gmail.com>
-Date: Tue, 26 Mar 2024 16:45:43 +0900
-Subject: 00462: Fix PySSL_SetError handling SSL_ERROR_SYSCALL
-
-Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
-SSL_read_ex(), but did not update handling of the return value.
-
-Change error handling so that the return value is not examined.
-OSError (not EOF) is now returned when retval is 0.
-
-This resolves the issue of failing tests when a system is
-stressed on OpenSSL 3.5.
-
-Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
-Co-authored-by: Petr Viktorin <encukou@gmail.com>
---
- Lib/test/test_ssl.py                          | 28 ++++++-----
- ...-02-18-09-50-31.gh-issue-115627.HGchj0.rst |  2 +
- Modules/_ssl.c                                | 48 +++++++------------
- 3 files changed, 35 insertions(+), 43 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-
-diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
-index aa8ce81db6..61cde99753 100644
--- a/Lib/test/test_ssl.py
-+++ b/Lib/test/test_ssl.py
-@@ -2635,16 +2635,18 @@ def run(self):
-                         self.write(msg.lower())
-                 except OSError as e:
-                     # handles SSLError and socket errors
-+                    if isinstance(e, ConnectionError):
-+                        # OpenSSL 1.1.1 sometimes raises
-+                        # ConnectionResetError when connection is not
-+                        # shut down gracefully.
-+                        if self.server.chatty and support.verbose:
-+                            print(f" Connection reset by peer: {self.addr}")
-+
-+                        self.close()
-+                        self.running = False
-+                        return
-                     if self.server.chatty and support.verbose:
-                        if isinstance(e, ConnectionError):
-                            # OpenSSL 1.1.1 sometimes raises
-                            # ConnectionResetError when connection is not
-                            # shut down gracefully.
-                            print(
-                                f" Connection reset by peer: {self.addr}"
-                            )
-                        else:
-                            handle_error("Test server failure:\n")
-+                        handle_error("Test server failure:\n")
-                     try:
-                         self.write(b"ERROR\n")
-                     except OSError:
-@@ -3339,8 +3341,8 @@ def test_wrong_cert_tls13(self):
-                                         suppress_ragged_eofs=False) as s:
-             s.connect((HOST, server.port))
-             with self.assertRaisesRegex(
-                ssl.SSLError,
-                'alert unknown ca|EOF occurred'
-+                OSError,
-+                'alert unknown ca|EOF occurred|TLSV1_ALERT_UNKNOWN_CA|closed by the remote host|Connection reset by peer'
-             ):
-                 # TLS 1.3 perform client cert exchange after handshake
-                 s.write(b'data')
-@@ -4612,8 +4614,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
-                 # test sometimes fails with EOF error. Test passes as long as
-                 # server aborts connection with an error.
-                 with self.assertRaisesRegex(
-                    ssl.SSLError,
-                    '(certificate required|EOF occurred)'
-+                    OSError,
-+                    'certificate required|EOF occurred|closed by the remote host|Connection reset by peer'
-                 ):
-                     # receive CertificateRequest
-                     data = s.recv(1024)
-diff --git a/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-new file mode 100644
-index 0000000000..75d926ab59
--- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-@@ -0,0 +1,2 @@
-+Fix the :mod:`ssl` module error handling of connection terminate by peer.
-+It now throws an OSError with the appropriate error code instead of an EOFError.
-diff --git a/Modules/_ssl.c b/Modules/_ssl.c
-index 9c2e8c391d..174e5dfce5 100644
--- a/Modules/_ssl.c
-+++ b/Modules/_ssl.c
-@@ -576,7 +576,7 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) {
- }
- 
- static PyObject *
-PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-+PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno)
- {
-     PyObject *type;
-     char *errstr = NULL;
-@@ -589,7 +589,6 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-     _sslmodulestate *state = get_state_sock(sslsock);
-     type = state->PySSLErrorObject;
- 
-    assert(ret <= 0);
-     e = ERR_peek_last_error();
- 
-     if (sslsock->ssl != NULL) {
-@@ -622,32 +621,21 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-         case SSL_ERROR_SYSCALL:
-         {
-             if (e == 0) {
-                PySocketSockObject *s = GET_SOCKET(sslsock);
-                if (ret == 0 || (((PyObject *)s) == Py_None)) {
-+                /* underlying BIO reported an I/O error */
-+                ERR_clear_error();
-+#ifdef MS_WINDOWS
-+                if (err.ws) {
-+                    return PyErr_SetFromWindowsErr(err.ws);
-+                }
-+#endif
-+                if (err.c) {
-+                    errno = err.c;
-+                    return PyErr_SetFromErrno(PyExc_OSError);
-+                }
-+                else {
-                     p = PY_SSL_ERROR_EOF;
-                     type = state->PySSLEOFErrorObject;
-                     errstr = "EOF occurred in violation of protocol";
-                } else if (s && ret == -1) {
-                    /* underlying BIO reported an I/O error */
-                    ERR_clear_error();
-#ifdef MS_WINDOWS
-                    if (err.ws) {
-                        return PyErr_SetFromWindowsErr(err.ws);
-                    }
-#endif
-                    if (err.c) {
-                        errno = err.c;
-                        return PyErr_SetFromErrno(PyExc_OSError);
-                    }
-                    else {
-                        p = PY_SSL_ERROR_EOF;
-                        type = state->PySSLEOFErrorObject;
-                        errstr = "EOF occurred in violation of protocol";
-                    }
-                } else { /* possible? */
-                    p = PY_SSL_ERROR_SYSCALL;
-                    type = state->PySSLSyscallErrorObject;
-                    errstr = "Some I/O error occurred";
-                 }
-             } else {
-                 if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
-@@ -1013,7 +1001,7 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
-              err.ssl == SSL_ERROR_WANT_WRITE);
-     Py_XDECREF(sock);
-     if (ret < 1)
-        return PySSL_SetError(self, ret, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     if (PySSL_ChainExceptions(self) < 0)
-         return NULL;
-     Py_RETURN_NONE;
-@@ -2434,7 +2422,7 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
- 
-     Py_XDECREF(sock);
-     if (retval == 0)
-        return PySSL_SetError(self, retval, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     if (PySSL_ChainExceptions(self) < 0)
-         return NULL;
-     return PyLong_FromSize_t(count);
-@@ -2464,7 +2452,7 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
-     self->err = err;
- 
-     if (count < 0)
-        return PySSL_SetError(self, count, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     else
-         return PyLong_FromLong(count);
- }
-@@ -2587,7 +2575,7 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
-              err.ssl == SSL_ERROR_WANT_WRITE);
- 
-     if (retval == 0) {
-        PySSL_SetError(self, retval, __FILE__, __LINE__);
-+        PySSL_SetError(self, __FILE__, __LINE__);
-         goto error;
-     }
-     if (self->exc_type != NULL)
-@@ -2713,7 +2701,7 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
-     }
-     if (ret < 0) {
-         Py_XDECREF(sock);
-        PySSL_SetError(self, ret, __FILE__, __LINE__);
-+        PySSL_SetError(self, __FILE__, __LINE__);
-         return NULL;
-     }
-     if (self->exc_type != NULL)
--- a/00474-cve-2025-15366.patch
+++ b/00474-cve-2025-15366.patch
@ -1,61 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Tue, 20 Jan 2026 14:45:42 -0600
-Subject: 00474: CVE-2025-15366
-
-gh-143921: Reject control characters in IMAP commands
-
-(cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
---
- Lib/imaplib.py                                              | 4 +++-
- Lib/test/test_imaplib.py                                    | 6 ++++++
- .../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 +
- 3 files changed, 10 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-
-diff --git a/Lib/imaplib.py b/Lib/imaplib.py
-index 20b86c35d3..bc7628d17a 100644
--- a/Lib/imaplib.py
-+++ b/Lib/imaplib.py
-@@ -132,7 +132,7 @@
- # We compile these in _mode_xxx.
- _Literal = br'.*{(?P<size>\d+)}$'
- _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
-
-+_control_chars = re.compile(b'[\x00-\x1F\x7F]')
- 
- 
- class IMAP4:
-@@ -994,6 +994,8 @@ def _command(self, name, *args):
-             if arg is None: continue
-             if isinstance(arg, str):
-                 arg = bytes(arg, self._encoding)
-+            if _control_chars.search(arg):
-+                raise ValueError("Control characters not allowed in commands")
-             data = data + b' ' + arg
- 
-         literal = self.literal
-diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py
-index 7665532d01..caf0884719 100644
--- a/Lib/test/test_imaplib.py
-+++ b/Lib/test/test_imaplib.py
-@@ -510,6 +510,12 @@ def test_login(self):
-         self.assertEqual(data[0], b'LOGIN completed')
-         self.assertEqual(client.state, 'AUTH')
- 
-+    def test_control_characters(self):
-+        client, _ = self._setup(SimpleIMAPHandler)
-+        for c0 in support.control_characters_c0():
-+            with self.assertRaises(ValueError):
-+                client.login(f'user{c0}', 'pass')
-+
-     def test_logout(self):
-         client, _ = self._setup(SimpleIMAPHandler)
-         typ, data = client.login('user', 'pass')
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-new file mode 100644
-index 0000000000..4e13fe92bc
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-@@ -0,0 +1 @@
-+Reject control characters in IMAP commands.
--- a/00475-cve-2025-15367.patch
+++ b/00475-cve-2025-15367.patch
@ -1,61 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Tue, 20 Jan 2026 14:46:32 -0600
-Subject: 00475: CVE-2025-15367
-
-gh-143923: Reject control characters in POP3 commands
-
-(cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
---
- Lib/poplib.py                                             | 2 ++
- Lib/test/test_poplib.py                                   | 8 ++++++++
- .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst        | 1 +
- 3 files changed, 11 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-
-diff --git a/Lib/poplib.py b/Lib/poplib.py
-index 0f8587317c..f563030f7f 100644
--- a/Lib/poplib.py
-+++ b/Lib/poplib.py
-@@ -122,6 +122,8 @@ def _putline(self, line):
-     def _putcmd(self, line):
-         if self._debugging: print('*cmd*', repr(line))
-         line = bytes(line, self.encoding)
-+        if re.search(b'[\x00-\x1F\x7F]', line):
-+            raise ValueError('Control characters not allowed in commands')
-         self._putline(line)
- 
- 
-diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
-index 49ba993197..b56bc3535e 100644
--- a/Lib/test/test_poplib.py
-+++ b/Lib/test/test_poplib.py
-@@ -12,6 +12,7 @@
- import unittest
- from unittest import TestCase, skipUnless
- from test import support as test_support
-+from test.support import control_characters_c0
- from test.support import hashlib_helper
- from test.support import socket_helper
- from test.support import threading_helper
-@@ -367,6 +368,13 @@ def test_quit(self):
-         self.assertIsNone(self.client.sock)
-         self.assertIsNone(self.client.file)
- 
-+    def test_control_characters(self):
-+        for c0 in control_characters_c0():
-+            with self.assertRaises(ValueError):
-+                self.client.user(f'user{c0}')
-+            with self.assertRaises(ValueError):
-+                self.client.pass_(f'{c0}pass')
-+
-     @requires_ssl
-     def test_stls_capa(self):
-         capa = self.client.capa()
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-new file mode 100644
-index 0000000000..3cde4df3e0
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-@@ -0,0 +1 @@
-+Reject control characters in POP3 commands.
--- a/00494-increase-the-timeout-of-test_large_content_length_truncated.patch
+++ b/00494-increase-the-timeout-of-test_large_content_length_truncated.patch
@ -1,23 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Karolina Surma <ksurma@redhat.com>
-Date: Fri, 14 Aug 2026 09:38:26 +0200
-Subject: 00494: Increase the timeout of test_large_content_length_truncated
-
-It has started to fail randomly when run on s390x architecture.
---
- Lib/test/test_httpservers.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
-index b0b09daab0..59434936b7 100644
--- a/Lib/test/test_httpservers.py
-+++ b/Lib/test/test_httpservers.py
-@@ -899,7 +899,7 @@ def test_large_content_length(self):
-             self.assertEqual(res.read(), b'%d %d' % (size, size) + self.linesep)
- 
-     def test_large_content_length_truncated(self):
-        with support.swap_attr(self.request_handler, 'timeout', 0.001):
-+        with support.swap_attr(self.request_handler, 'timeout', support.LOOPBACK_TIMEOUT):
-             for w in range(18, 65):
-                 size = 1 << w
-                 headers = {'Content-Length' : str(size)}
--- a/plan.fmf
+++ b/plan.fmf
@ -1,66 +0,0 @@
-execute:
-  how: tmt
-
-provision:
-  hardware:
-    memory: '>= 3 GB'
-
-environment:
-  pybasever: '3.11'
-
-discover:
-  - name: tests_python
-    how: shell
-    url: https://src.fedoraproject.org/tests/python.git
-    tests:
-    - name: smoke
-      path: /smoke
-      test: "VERSION=${pybasever} ./venv.sh"
-    - name: smoke_virtualenv
-      path: /smoke
-      test: "VERSION=${pybasever} METHOD=virtualenv ./venv.sh"
-    - name: debugsmoke
-      path: /smoke
-      test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} ./venv.sh"
-    - name: selftest
-      path: /selftest
-      test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh"
-    - name: debugtest
-      path: /selftest
-      test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes' ./parallel.sh"
-    - name: debugflags
-      path: /flags
-      test: "python${pybasever}d ./assertflags.py -O0"
-    - name: marshalparser
-      path: /marshalparser
-      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
-    - name: required_symbols
-      path: /required-symbols
-      test: "VERSION=${pybasever} ./check.sh"
-
-prepare:
-  - name: Install dependencies
-    how: install
-    package:
-    - gcc  # for extension building in venv and selftest
-    - gdb  # for test_gdb
-    - gcc-c++ # for test_cppext
-    - "python${pybasever}"  # the test subject
-    - "python${pybasever}-debug"  # for leak testing
-    - "python${pybasever}-devel"  # for extension building in venv and selftest
-    - "python${pybasever}-tkinter"  # for selftest
-    - "python${pybasever}-test"  # for selftest
-    - tox  # for venv tests
-    - virtualenv  # for virtualenv tests
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
-    - binutils  # for nm (symbol inspection)
-    - rpm  # for debugging
-    - dnf  # for upgrade and downgrade
-  - name: Update packages
-    how: shell
-    script: dnf upgrade -y
-  - name: rpm_qa
-    order: 100
-    how: shell
-    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt
--- a/python3.11.spec
+++ b/python3.11.spec
@ -13,11 +13,11 @@ URL: https://www.python.org/

 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.16
+%global general_version %{pybasever}.12
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1


@ -68,7 +68,7 @@ License: Python-2.0.1
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
 %global pip_version 24.0
-%global setuptools_version 79.0.1
+%global setuptools_version 65.5.0

 # Expensive optimizations (mainly, profile-guided optimizations)
 %bcond_without optimizations
@ -192,7 +192,8 @@ BuildRequires: bluez-libs-devel
 BuildRequires: bzip2
 BuildRequires: bzip2-devel
 BuildRequires: desktop-file-utils
-BuildRequires: expat-devel
+# See the runtime requirement in the -libs subpackage
+BuildRequires: expat-devel >= 2.6

 BuildRequires: findutils
 BuildRequires: gcc-c++
@ -219,6 +220,7 @@ BuildRequires: make
 BuildRequires: mpdecimal-devel
 BuildRequires: ncurses-devel

+BuildRequires: openssl-devel
 BuildRequires: pkgconfig
 BuildRequires: readline-devel
 BuildRequires: redhat-rpm-config >= 127
@ -231,10 +233,6 @@ BuildRequires: tix-devel
 BuildRequires: tk-devel < 1:9
 BuildRequires: tzdata

-# Support for OpenSSL 4 only landed in Python 3.15 for now
-# https://github.com/python/cpython/issues/146207
-BuildRequires: (openssl-devel < 1:4 or openssl3-devel)
-
 %if %{with valgrind}
 BuildRequires: valgrind-devel
 %endif
@ -251,9 +249,6 @@ BuildRequires: /usr/sbin/ifconfig
 %if %{with rpmwheels}
 BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel
 BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel
-%else
-# For %%python_wheel_inject_sbom
-BuildRequires: python-rpm-macros
 %endif

 %if %{without bootstrap}
@ -290,7 +285,6 @@ Source11: idle3.appdata.xml

 # 00001 # d06a8853cf4bae9e115f45e1d531d2dc152c5cc8
 # Fixup distutils/unixccompiler.py to remove standard library path from rpath
-#
 # Was Patch0 in ivazquez' python3000 specfile
 Patch1: 00001-rpath.patch

@ -338,40 +332,20 @@ Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-g
 # even when cross-compiling.
 Patch452: 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch

-# 00462 # c9db492d8924b2d1a0991e36f3c2b4f9c2ec8942
-# Fix PySSL_SetError handling SSL_ERROR_SYSCALL
+# 00458 # ee47b2530c18d1e0b414f5a0738ddce28e7510f4
+# test_ssl: Don't stop ThreadedEchoServer on OSError in ConnectionHandler
 #
-# Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
-# SSL_read_ex(), but did not update handling of the return value.
+# If `read()` in the ConnectionHandler thread raises `OSError` (except `ConnectionError`),
+# the ConnectionHandler shuts down the entire ThreadedEchoServer,
+# preventing further connections.
+# It also does that for `EPROTOTYPE` in `wrap_conn`.
 #
-# Change error handling so that the return value is not examined.
-# OSError (not EOF) is now returned when retval is 0.
+# Make sure that the context manager *is* used, and remove the `server.stop()`
+# calls from ConnectionHandler.
 #
-# This resolves the issue of failing tests when a system is
-# stressed on OpenSSL 3.5.
-Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
-
-# 00474 # 837ddca0372fa87ff9cee47142200caa21e77def
-# CVE-2025-15366
-#
-# gh-143921: Reject control characters in IMAP commands
-#
-# (cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
-Patch474: 00474-cve-2025-15366.patch
-
-# 00475 # 3748209a316662d4e85981ca1a7418547a1d25c6
-# CVE-2025-15367
-#
-# gh-143923: Reject control characters in POP3 commands
-#
-# (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
-Patch475: 00475-cve-2025-15367.patch
-
-# 00494 # 430aab133397ed44cc9ee621fd311e02fee317b5
-# Increase the timeout of test_large_content_length_truncated
-#
-# It has started to fail randomly when run on s390x architecture.
-Patch494: 00494-increase-the-timeout-of-test_large_content_length_truncated.patch
+# Backported from 3.12+:
+# https://github.com/python/cpython/pull/126503
+Patch458: 00458-test_ssl-don-t-stop-threadedechoserver-on-oserror-in-connectionhandler.patch

 # (New patches go here ^^^)
 #
@ -524,24 +498,12 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa})
 Requires: tzdata

 # The requirement on libexpat is generated, but we need to version it.
-# When built with a specific expat version, but installed with an older one,
-# we sometimes get:
+# When built with expat >= 2.6, but installed with older expat, we get:
 #   ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so:
-#   undefined symbol: XML_...
-# The pyexpat module has build-time checks for expat version to only use the
-# available symbols. However, there is no runtime protection, so when the module
-# is later installed with an older expat, it may error due to undefined symbols.
+#   undefined symbol: XML_SetReparseDeferralEnabled
 # This breaks many things, including python -m venv.
-# We avoid this problem by requiring at least the same version of expat that
-# was used during the build time.
 # Other subpackages (like -debug) also need this, but they all depend on -libs.
-# Since expat 2.7.4, the library has versioned symbols and this is no longer needed,
-# as the generated requirement will be in the form of libexpat.so.1(LIBEXPAT_2.7.2) etc.
-%global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/')
-%if v"%{expat_version}" < v"2.7.4"
-Requires: expat%{?_isa} >= %{expat_version}
-%endif
-
+Requires: expat >= 2.6

 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
@ -1102,11 +1064,6 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
    rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done

-%if %{without rpmwheels}
-# Inject SBOM into the installed wheels (if the macro is available)
-%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl}
-%endif
-
 # ======================================================
 # Checks for packaging issues
 # ======================================================
@ -1705,57 +1662,6 @@ CheckPython optimized
 # ======================================================

 %changelog
-* Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.11.16-1
- Update to Python 3.11.16
-
-* Thu Jul 30 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-7
- - Skip UDP Lite tests if it's not supported
- - Fixes FTBFS on Linux kernel 7.1 and newer
-
-* Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.15-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Thu Jul 02 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-5
- Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
-
-* Fri Apr 17 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.11.15-4
- Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE 2026-3644, CVE-2026-4224
-Resolves: rhbz#2457941, rhbz#2458221, rhbz#2458013, rhbz#2444704, rhbz#2448188, rhbz#2448204
-
-* Sat Apr 11 2026 Miro Hrončok <mhroncok@redhat.com> - 3.11.15-3
- Explicitly build with OpenSSL 3
-
-* Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.11.15-2
- Security fix for CVE-2026-4519 (rhbz#2449727)
-
-* Tue Mar 03 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.15-1
- Update to 3.11.15
-
-* Mon Feb 09 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.14-5
- Security fixes for CVE-2026-0865, CVE-2025-15366 and CVE-2025-15367
-
-* Fri Jan 16 2026 Lumír Balhar <lbalhar@redhat.com> - 3.11.14-4
- Security fix for CVE-2025-13836
-
-* Thu Jan 08 2026 Lumír Balhar <lbalhar@redhat.com> - 3.11.14-3
- Security fix for CVE-2025-12084
-
-* Tue Jan 06 2026 Karolina Surma <ksurma@redhat.com> - 3.11.14-2
- Require at least the same expat version as used during the build time
-
-* Fri Oct 10 2025 Karolina Surma <ksurma@redhat.com> - 3.11.14-1
- Update to 3.11.14
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.13-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Wed Jun 04 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-1
- Update to 3.11.13
-
-* Tue May 13 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.11.12-3
- Fix PySSL_SetError handling SSL_ERROR_SYSCALL
- This fixes random flakiness of test_ssl on stressed machines
-
 * Wed Apr 16 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.11.12-2
 - test_ssl: Don't stop ThreadedEchoServer on OSError in ConnectionHandler
 - Fixes: rhbz#2355052
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,22 +1,22 @@
 # exclude test XML data (not always valid) from XML validity check:
 xml:
    ignore:
-        - '/usr/lib*/python*/test/xmltestdata/*'
-        - '/usr/lib*/python*/test/xmltestdata/*/*'
+        - /usr/lib*/python*/test/xmltestdata/*
+        - /usr/lib*/python*/test/xmltestdata/*/*

 # exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
 badfuncs:
    allowed:
-        '/usr/lib*/python*/lib-dynload/_socket.*':
+        /usr/lib*/python*/lib-dynload/_socket.*:
            - inet_aton
            - inet_ntoa

 # exclude the debug build from annocheck entirely
 annocheck:
    ignore:
-        - '/usr/bin/python*d'
-        - '/usr/lib*/libpython*d.so.1.0'
-        - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so'
+        - /usr/bin/python*d
+        - /usr/lib*/libpython*d.so.1.0
+        - /usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so

 # don't report changed content of compiled files
 # that is expected with every toolchain update and not reproducible yet
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (Python-3.11.16.tar.xz) = f4e168d35596c2df080663d8e8b3472f03bace987d46b49b8410f2425ba193215b9880c7d03d4653ec31c83b72209d95866fc1cb6d666799145075b092f64a48
-SHA512 (Python-3.11.16.tar.xz.asc) = b31b3205e68951478fe76f4884a124ebb4955a711b6105754d4179acb48b16a5439ec8c35383a84787cd673fa1143f2f047c6d65944909b0f1a8e3c75a0e2efe
+SHA512 (Python-3.11.12.tar.xz) = 5c95900de73cd187f5d7a89a05314ef85f4d680308d0d5fff5e6ada81f8ecf030018bef0f1a819d007e8b6d01b52e50395572c2d1a56d2c164492e13a69a9926
+SHA512 (Python-3.11.12.tar.xz.asc) = cb1f82d44be6de67182747f8ad1054e85cca22753c0c86ff12b95ec7044c5c6c37f40a876e5707a6c422d58f483257b8ddbb3ea87893679f81b9299c48373f20
--- a/tests/.fmf/version
+++ b/tests/.fmf/version
--- a/tests/provision.fmf
+++ b/tests/provision.fmf
@ -0,0 +1,4 @@
+---
+standard-inventory-qcow2:
+  qemu:
+    m: 3G  # Amount of VM memory
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,56 @@
+---
+- hosts: localhost
+  tags:
+    - classic
+  tasks:
+    - dnf:
+        name: "*"
+        state: latest
+
+- hosts: localhost
+  roles:
+  - role: standard-test-basic
+    tags:
+    - classic
+    repositories:
+    - repo: "https://src.fedoraproject.org/tests/python.git"
+      dest: "python"
+    pybasever: "3.11"
+    tests:
+    - rpm_qa:
+        run: rpm -qa
+    - smoke:
+        dir: python/smoke
+        run: "VERSION={{ pybasever }} ./venv.sh"
+    - smoke_virtualenv:
+        dir: python/smoke
+        run: "VERSION={{ pybasever }} METHOD=virtualenv ./venv.sh"
+    - debugsmoke:
+        dir: python/smoke
+        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} ./venv.sh"
+    - selftest:
+        dir: python/selftest
+        run: "VERSION={{ pybasever }} X='-i test_check_probes' ./parallel.sh"
+    - debugtest:
+        dir: python/selftest
+        run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='-i test_check_probes' ./parallel.sh"
+    - debugflags:
+        dir: python/flags
+        run: "python{{ pybasever }}d ./assertflags.py -O0"
+    - marshalparser:
+        dir: python/marshalparser
+        run: "VERSION={{ pybasever }} SAMPLE=10 test_marshalparser_compatibility.sh"
+    required_packages:
+    - gcc  # for extension building in venv and selftest
+    - gcc-c++ # for test_cppext
+    - gdb  # for test_gdb
+    - "python{{ pybasever }}"  # the test subject
+    - "python{{ pybasever }}-debug"  # for leak testing
+    - "python{{ pybasever }}-devel"  # for extension building in venv and selftest
+    - "python{{ pybasever }}-tkinter"  # for selftest
+    - "python{{ pybasever }}-test"  # for selftest
+    - tox  # for venv tests
+    - virtualenv  # for virtualenv tests
+    - glibc-all-langpacks # for locale tests
+    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - rpm  # for debugging