Update to 3.12.8

Security fix for CVE-2024-9287

Fixes: rhbz#2321656

00251-change-user-install-location.patch

@@ -30,7 +30,7 @@ Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
  3 files changed, 71 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/site.py b/Lib/site.py
-index 924cfbecec..e2871ecc89 100644
+index aed254ad50..568dbdb945 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
 @@ -398,8 +398,15 @@ def getsitepackages(prefixes=None):
@@ -51,7 +51,7 @@ index 924cfbecec..e2871ecc89 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index 122d441bd1..2d354a11da 100644
+index 517b13acaf..f85ab25d27 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
 @@ -104,6 +104,11 @@
@@ -86,7 +86,7 @@ index 122d441bd1..2d354a11da 100644
  _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
                  'scripts', 'data')
  
-@@ -263,11 +281,40 @@ def _extend_dict(target_dict, other_dict):
+@@ -261,11 +279,40 @@ def _extend_dict(target_dict, other_dict):
          target_dict[key] = value
  
  
@@ -119,7 +119,7 @@ index 122d441bd1..2d354a11da 100644
 +    # we only change the defaults here, so explicit --prefix will take precedence
 +    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +    if (scheme == 'posix_prefix' and
-+        _PREFIX == '/usr' and
++         get_config_vars('prefix')[0] == '/usr' and
 +        'RPM_BUILD_ROOT' not in os.environ):
 +            _extend_dict(vars, _config_vars_local())
 +    else:
@@ -129,10 +129,10 @@ index 122d441bd1..2d354a11da 100644
          # On Windows we want to substitute 'lib' for schemes rather
          # than the native value (without modifying vars, in case it
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index 1137c2032b..8fc2b84f52 100644
+index 3468d0ce02..ff31010427 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
-@@ -110,8 +110,19 @@ def test_get_path(self):
+@@ -119,8 +119,19 @@ def test_get_path(self):
          for scheme in _INSTALL_SCHEMES:
              for name in _INSTALL_SCHEMES[scheme]:
                  expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
@@ -153,7 +153,7 @@ index 1137c2032b..8fc2b84f52 100644
                      os.path.normpath(expected),
                  )
  
-@@ -344,7 +355,7 @@ def test_get_config_h_filename(self):
+@@ -353,7 +364,7 @@ def test_get_config_h_filename(self):
          self.assertTrue(os.path.isfile(config_h), config_h)
  
      def test_get_scheme_names(self):
@@ -162,7 +162,7 @@ index 1137c2032b..8fc2b84f52 100644
          if HAS_USER_BASE:
              wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
          self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
-@@ -356,6 +367,8 @@ def test_symlink(self): # Issue 7880
+@@ -365,6 +376,8 @@ def test_symlink(self): # Issue 7880
              cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
              self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
  

00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch

@@ -16,7 +16,7 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 2e4b860b97..3066b23ee1 100644
+index 75a56f7830..c2509fced1 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
 @@ -1100,39 +1100,6 @@ def noop(): pass

python3.12.spec

@@ -13,7 +13,7 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.7
+%global general_version %{pybasever}.8
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
@@ -71,7 +71,7 @@ License: Python-2.0.1
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 24.2
+%global pip_version 24.3.1
 %global setuptools_version 67.6.1
 %global wheel_version 0.40.0
 # All of those also include a list of indirect bundled libs:
@@ -79,8 +79,8 @@ License: Python-2.0.1
 #  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
 %global pip_bundled_provides %{expand:
 Provides: bundled(python3dist(cachecontrol)) = 0.14
-Provides: bundled(python3dist(certifi)) = 2024.7.4
-Provides: bundled(python3dist(distlib)) = 0.3.8
+Provides: bundled(python3dist(certifi)) = 2024.8.30
+Provides: bundled(python3dist(distlib)) = 0.3.9
 Provides: bundled(python3dist(distro)) = 1.9
 Provides: bundled(python3dist(idna)) = 3.7
 Provides: bundled(python3dist(msgpack)) = 1.0.8
@@ -93,9 +93,9 @@ Provides: bundled(python3dist(resolvelib)) = 1.0.1
 Provides: bundled(python3dist(rich)) = 13.7.1
 Provides: bundled(python3dist(setuptools)) = 70.3
 Provides: bundled(python3dist(tomli)) = 2.0.1
-Provides: bundled(python3dist(truststore)) = 0.9.1
+Provides: bundled(python3dist(truststore)) = 0.10
 Provides: bundled(python3dist(typing-extensions)) = 4.12.2
-Provides: bundled(python3dist(urllib3)) = 1.26.18
+Provides: bundled(python3dist(urllib3)) = 1.26.20
 }
 # setuptools
 # vendor.txt files not in .whl
@@ -336,7 +336,7 @@ Source11: idle3.appdata.xml
 
 # (Patches taken from github.com/fedora-python/cpython)
 
-# 00251 # cae5a6abc5df08239c85b83e4e250b6f2702e4f5
+# 00251 # 7f0caf37f83f1e591194e93fd0f8cefede49bba6
 # Change user install location
 #
 # Set values of base and platbase in sysconfig from /usr
@@ -1683,6 +1683,11 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Dec 03 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
+- Update to 3.12.8
+- Security fix for CVE-2024-9287
+- Fixes: rhbz#2321656
+
 * Tue Oct 01 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.7-1
 - Update to 3.12.7
 

sources

@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.7.tar.xz) = 4a363d3f852ad8f4fd1484aa4cec35494a3811be48ef67fadb2bdf2e2489ed07dc78fad6ab475257db503ddd64d39f9800f23a1c94b6bbd15b7f632cff0c90ae
-SHA512 (Python-3.12.7.tar.xz.asc) = 4d0a7a0da2c81888e93d8ff89ca2ed4bb85a7b0bd00f0d54a14e2c201affac2677ef3984d2b5aea253e624f6465548d9032eefdd9033c1eb3864d82cfd8d3df0
+SHA512 (Python-3.12.8.tar.xz) = 406ce1146c4c2c70d252df56bbe9e5970ef469395cbaa211a96af71f32de2cf7abd944906920cc18b4a470027e63a3f64bf7679fb4954b31bf4ca4baf24fa370
+SHA512 (Python-3.12.8.tar.xz.asc) = 19493499ddb80764aa105e100585d2ef872798dc30fdff2e31d158cd7fd65b69ca133c6d9d16eb974660eed6ba474a26a2af3acd13a90522cf50e142492bd9a6