From d399ce220e2dff42bb79f36ff4e6a8b1e8fccc31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Wed, 16 Nov 2022 01:15:24 +0100
Subject: [PATCH 01/93] Use bundled wheels, pip in Fedora 35 is too old

---
 python3.12.spec | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 17ab696..248184a 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -73,7 +73,7 @@ ExcludeArch: %{arm}
 
 # Whether to use RPM build wheels from the python-{pip,setuptools}-wheel package
 # Uses upstream bundled prebuilt wheels otherwise
-%bcond_without rpmwheels
+%bcond_with rpmwheels
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
@@ -451,8 +451,52 @@ Summary:        Python runtime libraries
 Requires: %{python_wheel_pkg_prefix}-setuptools-wheel >= 59.6.0-3
 Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 21.3.1-4
 %else
+# Versions of bundled libs are based on:
+# https://github.com/pypa/pip/blob/22.3.1/src/pip/_vendor/vendor.txt
+# https://github.com/pypa/setuptools/blob/v65.5.0/pkg_resources/_vendor/vendored.txt
+# https://github.com/pypa/setuptools/blob/v65.5.0/setuptools/_vendor/vendored.txt
 Provides: bundled(python3dist(pip)) = %{pip_version}
+Provides: bundled(python3dist(cachecontrol)) = 0.12.11
+Provides: bundled(python3dist(certifi)) = 2022.9.24
+Provides: bundled(python3dist(chardet)) = 5
+Provides: bundled(python3dist(colorama)) = 0.4.5
+Provides: bundled(python3dist(distlib)) = 0.3.6
+Provides: bundled(python3dist(distro)) = 1.7
+Provides: bundled(python3dist(idna)) = 3.4
+Provides: bundled(python3dist(msgpack)) = 1.0.4
+Provides: bundled(python3dist(packaging)) = 21.3
+Provides: bundled(python3dist(pep517)) = 0.13
+Provides: bundled(python3dist(platformdirs)) = 2.5.2
+Provides: bundled(python3dist(pygments)) = 2.13
+Provides: bundled(python3dist(pyparsing)) = 3.0.9
+Provides: bundled(python3dist(requests)) = 2.28.1
+Provides: bundled(python3dist(resolvelib)) = 0.8.1
+Provides: bundled(python3dist(rich)) = 12.5.1
+Provides: bundled(python3dist(setuptools)) = 44
+Provides: bundled(python3dist(six)) = 1.16
+Provides: bundled(python3dist(tenacity)) = 8.1
+Provides: bundled(python3dist(tomli)) = 2.0.1
+Provides: bundled(python3dist(typing-extensions)) = 4.4
+Provides: bundled(python3dist(urllib3)) = 1.26.12
+Provides: bundled(python3dist(webencodings)) = 0.5.1
+
 Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
+Provides: bundled(python3dist(appdirs)) = 1.4.3
+Provides: bundled(python3dist(importlib-metadata)) = 4.11.1
+Provides: bundled(python3dist(importlib-resources)) = 5.4
+Provides: bundled(python3dist(jaraco-text)) = 3.7
+Provides: bundled(python3dist(more-itertools)) = 8.8
+Provides: bundled(python3dist(ordered-set)) = 3.1.1
+Provides: bundled(python3dist(packaging)) = 21.3
+Provides: bundled(python3dist(pyparsing)) = 3.0.9
+Provides: bundled(python3dist(tomli)) = 2.0.1
+Provides: bundled(python3dist(typing-extensions)) = 4.0.1
+Provides: bundled(python3dist(zipp)) = 3.7
+
+# Combined from python-setuptools-65.5.0-1.fc38 and python-pip-22.3.1-1.fc38
+# The license tag of pip is a superset of the license tag of setuptools
+# See the specs for license breakdown
+License: Python-2.0.1 AND MIT AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause) 
 %endif
 
 %unversioned_obsoletes_of_python3_X_if_main libs

From 6324efea7a2f3a986a67cef41188f1bcbe3883eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Thu, 10 Nov 2022 15:57:28 +0100
Subject: [PATCH 02/93] %check: Run tests with %{_smp_mflags} instead of -j0

-j0 means: Run tests in parallel, automatic number of workers, according to CPU count
%{_smp_mflags} means: -j%{_smp_build_ncpus} where %{_smp_build_ncpus} is the CPU count by default

Hence, this makes no difference unless %{_smp_build_ncpus} is manually clamped.
In that case, we now respect the wishes of the builder/packager/etc.
---
 python3.12.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 17ab696..e889b76 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -1070,7 +1070,7 @@ CheckPython() {
   #  we don't ship it in the RPM package.
 
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
-    -wW --slowest -j0 --timeout=1800 \
+    -wW --slowest %{_smp_mflags} --timeout=1800 \
     -i test_freeze_simple_script \
     %ifarch %{mips64}
     -x test_ctypes \

From 88efa1916c24ea3f512aab82f8645ac48e93f144 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 7 Dec 2022 12:12:34 +0100
Subject: [PATCH 03/93] Update to 3.12.0a3

---
 00251-change-user-install-location.patch |  2 +-
 python3.12.spec                          | 12 +++++++++++-
 sources                                  |  4 ++--
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index 77eedd9..55f45c3 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -51,7 +51,7 @@ index 69670d9d7f..104cb93899 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index 73c25684db..d43ce7f1a2 100644
+index c61100a6da..30143e577e 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
 @@ -104,6 +104,11 @@
diff --git a/python3.12.spec b/python3.12.spec
index e889b76..c0979c1 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,7 +14,7 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel a2
+%global prerel a3
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
@@ -1323,6 +1323,11 @@ CheckPython optimized
 
 %{pylibdir}/urllib
 %{pylibdir}/xml
+
+%dir %{pylibdir}/zipfile/
+%{pylibdir}/zipfile/*.py
+%{pylibdir}/zipfile/__pycache__/*%{bytecode_suffixes}
+
 %{pylibdir}/zoneinfo
 
 %dir %{pylibdir}/__phello__
@@ -1418,6 +1423,7 @@ CheckPython optimized
 %{dynload_dir}/_ctypes_test.%{SOABI_optimized}.so
 %{dynload_dir}/_testbuffer.%{SOABI_optimized}.so
 %{dynload_dir}/_testcapi.%{SOABI_optimized}.so
+%{dynload_dir}/_testclinic.%{SOABI_optimized}.so
 %{dynload_dir}/_testimportmultiple.%{SOABI_optimized}.so
 %{dynload_dir}/_testinternalcapi.%{SOABI_optimized}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_optimized}.so
@@ -1544,6 +1550,7 @@ CheckPython optimized
 %{dynload_dir}/_ctypes_test.%{SOABI_debug}.so
 %{dynload_dir}/_testbuffer.%{SOABI_debug}.so
 %{dynload_dir}/_testcapi.%{SOABI_debug}.so
+%{dynload_dir}/_testclinic.%{SOABI_debug}.so
 %{dynload_dir}/_testimportmultiple.%{SOABI_debug}.so
 %{dynload_dir}/_testinternalcapi.%{SOABI_debug}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_debug}.so
@@ -1576,6 +1583,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Dec 07 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a3-1
+- Update to 3.12.0a3
+
 * Tue Nov 15 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a2-1
 - Update to 3.12.0a2
 - Fixes: rhbz#2133847
diff --git a/sources b/sources
index 1a88164..c9ea423 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0a2.tar.xz) = 0f830fdb514078c5403727b31fd81912382eca4decb52ae9bfb0f00b8a007be9f8e29bad349034ec97e2229f60fe0baae417227413350485d747d31f4567d5c1
-SHA512 (Python-3.12.0a2.tar.xz.asc) = f0c22e071c68d648c8cf2823647f0c807db41b81b94b8100b50d2049a47f19475a4323c5ac488eb5a3798f942978054f358090c1e460804232bb46093fb3fd55
+SHA512 (Python-3.12.0a3.tar.xz) = 82d88adda53a1e5c16fc7165ac0d55f3828bae9249d361fbf7237d8826bd5acd941befb9b2c74f815a251b216d377f416831fbd233f1bfef31c2cab73b6554d1
+SHA512 (Python-3.12.0a3.tar.xz.asc) = e25a42982f3cab6e38ef7a4f5bfd71ad25811f52dffeffbb827ee9f48bf45003edad14ffdd3289bfda113a34b7ef818d04a413d0da7e8ca52d0c47f9b4475dbb

From 1f1415ae57de4cc725759722abd6ec64fbcdcb12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Mon, 19 Dec 2022 12:00:14 +0100
Subject: [PATCH 04/93] No longer patch the default bytecode cache invalidation
 policy

That is, drop patch 328.

Fixes https://bugzilla.redhat.com/2133850

See also https://src.fedoraproject.org/rpms/python-rpm-macros/pull-request/154

This is part of https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes
---
 00328-pyc-timestamp-invalidation-mode.patch | 54 ---------------------
 check-pyc-timestamps.py                     |  8 ++-
 python3.12.spec                             | 31 ++++++------
 3 files changed, 18 insertions(+), 75 deletions(-)
 delete mode 100644 00328-pyc-timestamp-invalidation-mode.patch

diff --git a/00328-pyc-timestamp-invalidation-mode.patch b/00328-pyc-timestamp-invalidation-mode.patch
deleted file mode 100644
index e8f3ad6..0000000
--- a/00328-pyc-timestamp-invalidation-mode.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
-Date: Thu, 11 Jul 2019 13:44:13 +0200
-Subject: [PATCH] 00328: Restore pyc to TIMESTAMP invalidation mode as default
- in rpmbuild
-
-Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
-%changelog date. This makes Python default to the CHECKED_HASH pyc
-invalidation mode, bringing more reproducible builds traded for an import
-performance decrease. To avoid that, we don't default to CHECKED_HASH
-when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
-
-See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
-Downstream only: only used when building RPM packages
-Ideally, we should talk to upstream and explain why we don't want this
----
- Lib/py_compile.py           | 3 ++-
- Lib/test/test_py_compile.py | 2 ++
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/Lib/py_compile.py b/Lib/py_compile.py
-index 388614e51b..db52725016 100644
---- a/Lib/py_compile.py
-+++ b/Lib/py_compile.py
-@@ -70,7 +70,8 @@ class PycInvalidationMode(enum.Enum):
- 
- 
- def _get_default_invalidation_mode():
--    if os.environ.get('SOURCE_DATE_EPOCH'):
-+    if (os.environ.get('SOURCE_DATE_EPOCH') and not
-+            os.environ.get('RPM_BUILD_ROOT')):
-         return PycInvalidationMode.CHECKED_HASH
-     else:
-         return PycInvalidationMode.TIMESTAMP
-diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
-index 5e0a44ad96..ac14a6a54c 100644
---- a/Lib/test/test_py_compile.py
-+++ b/Lib/test/test_py_compile.py
-@@ -19,6 +19,7 @@ def without_source_date_epoch(fxn):
-     def wrapper(*args, **kwargs):
-         with os_helper.EnvironmentVarGuard() as env:
-             env.unset('SOURCE_DATE_EPOCH')
-+            env.unset('RPM_BUILD_ROOT')
-             return fxn(*args, **kwargs)
-     return wrapper
- 
-@@ -29,6 +30,7 @@ def with_source_date_epoch(fxn):
-     def wrapper(*args, **kwargs):
-         with os_helper.EnvironmentVarGuard() as env:
-             env['SOURCE_DATE_EPOCH'] = '123456789'
-+            env.unset('RPM_BUILD_ROOT')
-             return fxn(*args, **kwargs)
-     return wrapper
- 
diff --git a/check-pyc-timestamps.py b/check-pyc-timestamps.py
index f91984e..c2b7430 100644
--- a/check-pyc-timestamps.py
+++ b/check-pyc-timestamps.py
@@ -19,11 +19,9 @@ not_compiled = [
     '*/test/bad_coding.py',
     '*/test/bad_coding2.py',
     '*/test/badsyntax_*.py',
-    '*/test_lib2to3/data/bom.py',
-    '*/test_lib2to3/data/crlf.py',
-    '*/test_lib2to3/data/different_encoding.py',
-    '*/test_lib2to3/data/false_encoding.py',
-    '*/test_lib2to3/data/py2_test_grammar.py',
+    '*/test_lib2to3/data/*.py',
+    '*/test_lib2to3/data/*/*.py',
+    '*/test_lib2to3/data/*/*/*.py',
     '*.debug-gdb.py',
 ]
 
diff --git a/python3.12.spec b/python3.12.spec
index c0979c1..7bc2ac7 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel a3
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 # Getting this build in Koji on 32bit ARM is frustrating due to technical problems
@@ -302,20 +302,6 @@ Source11: idle3.appdata.xml
 # pypa/distutils integration: https://github.com/pypa/distutils/pull/70
 Patch251: 00251-change-user-install-location.patch
 
-# 00328 # 318e500c98f5e59eb1f23e0fcd32db69b9bd17e1
-# Restore pyc to TIMESTAMP invalidation mode as default in rpmbuild
-#
-# Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
-# %%changelog date. This makes Python default to the CHECKED_HASH pyc
-# invalidation mode, bringing more reproducible builds traded for an import
-# performance decrease. To avoid that, we don't default to CHECKED_HASH
-# when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
-#
-# See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
-# Downstream only: only used when building RPM packages
-# Ideally, we should talk to upstream and explain why we don't want this
-Patch328: 00328-pyc-timestamp-invalidation-mode.patch
-
 # 00371 # 1fc313929648e9b543542de09f59c55e175ac45a
 # Revert "bpo-1596321: Fix threading._shutdown() for the main thread (GH-28549) (GH-28589)"
 #
@@ -945,15 +931,25 @@ find . -name "*~" -exec rm -f {} \;
 # Python CMD line options:
 # -s - don't add user site directory to sys.path
 # -B - don't write .pyc files on import
+# Clamp the source mtime first, see https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes
+# The clamp_source_mtime module is only guaranteed to exist on Fedoras that enabled this option:
+%if 0%{?clamp_mtime_to_source_date_epoch}
+LD_LIBRARY_PATH="%{buildroot}%{dynload_dir}/:%{buildroot}%{_libdir}" \
+PYTHONPATH="%{_rpmconfigdir}/redhat" \
+%{buildroot}%{_bindir}/python%{pybasever} -s -B -m clamp_source_mtime %{buildroot}%{pylibdir}
+%endif
 # compileall CMD line options:
 # -f - force rebuild even if timestamps are up to date
 # -o - optimization levels to run compilation with
 # -s - part of path to left-strip from path to source file (buildroot)
 # -p - path to add as prefix to path to source file (/ to make it absolute)
 # --hardlink-dupes - hardlink different optimization level pycs together if identical (saves space)
+# --invalidation-mode - we prefer the timestamp invalidation mode for performance reasons
+# -x - skip test modules with SyntaxErrors (taken from the Makefile)
 LD_LIBRARY_PATH="%{buildroot}%{dynload_dir}/:%{buildroot}%{_libdir}" \
 %{buildroot}%{_bindir}/python%{pybasever} -s -B -m compileall \
--f %{_smp_mflags} -o 0 -o 1 -o 2 -s %{buildroot} -p / %{buildroot} --hardlink-dupes || :
+-f %{_smp_mflags} -o 0 -o 1 -o 2 -s %{buildroot} -p / %{buildroot} --hardlink-dupes --invalidation-mode=timestamp \
+-x 'bad_coding|badsyntax|site-packages|test/test_lib2to3/data'
 
 # Turn this BRP off, it is done by compileall2 --hardlink-dupes above
 %global __brp_python_hardlink %{nil}
@@ -1583,6 +1579,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon Dec 19 2022 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~a3-2
+- No longer patch the default bytecode cache invalidation policy
+
 * Wed Dec 07 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a3-1
 - Update to 3.12.0a3
 

From d0514d9a61793b87fbf317ca303af53b1f3a684d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 11 Jan 2023 10:52:12 +0100
Subject: [PATCH 05/93] Update to 3.12.0a4

---
 00251-change-user-install-location.patch                  | 2 +-
 ...-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch | 8 ++++----
 python3.12.spec                                           | 7 +++++--
 sources                                                   | 4 ++--
 4 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index 55f45c3..6293499 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -30,7 +30,7 @@ Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
  3 files changed, 71 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/site.py b/Lib/site.py
-index 69670d9d7f..104cb93899 100644
+index 7faf1c6f6a..e2ace71d18 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
 @@ -377,8 +377,15 @@ def getsitepackages(prefixes=None):
diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index ce0cd62..7d243df 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -16,10 +16,10 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 13ba5068ae..8bf97c5542 100644
+index 31bf46311a..5beebd3e96 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
-@@ -1002,39 +1002,6 @@ def noop(): pass
+@@ -1015,39 +1015,6 @@ def noop(): pass
              threading.Thread(target=noop).start()
              # Thread.join() is not called
  
@@ -60,10 +60,10 @@ index 13ba5068ae..8bf97c5542 100644
  class ThreadJoinOnShutdown(BaseTestCase):
  
 diff --git a/Lib/threading.py b/Lib/threading.py
-index 723bd58bf5..0bdf0b7336 100644
+index df273870fa..eba297776d 100644
 --- a/Lib/threading.py
 +++ b/Lib/threading.py
-@@ -1563,29 +1563,20 @@ def _shutdown():
+@@ -1565,29 +1565,20 @@ def _shutdown():
  
      global _SHUTTING_DOWN
      _SHUTTING_DOWN = True
diff --git a/python3.12.spec b/python3.12.spec
index 7bc2ac7..d08d630 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,10 +14,10 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel a3
+%global prerel a4
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 # Getting this build in Koji on 32bit ARM is frustrating due to technical problems
@@ -1579,6 +1579,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Jan 11 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a4-1
+- Update to 3.12.0a4
+
 * Mon Dec 19 2022 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~a3-2
 - No longer patch the default bytecode cache invalidation policy
 
diff --git a/sources b/sources
index c9ea423..7f29785 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0a3.tar.xz) = 82d88adda53a1e5c16fc7165ac0d55f3828bae9249d361fbf7237d8826bd5acd941befb9b2c74f815a251b216d377f416831fbd233f1bfef31c2cab73b6554d1
-SHA512 (Python-3.12.0a3.tar.xz.asc) = e25a42982f3cab6e38ef7a4f5bfd71ad25811f52dffeffbb827ee9f48bf45003edad14ffdd3289bfda113a34b7ef818d04a413d0da7e8ca52d0c47f9b4475dbb
+SHA512 (Python-3.12.0a4.tar.xz) = 19a98939077004259868cc5e6901d8fbf0ae90ad579700d6993f6b82990b1b4eb92efa5c8b5b7b50cfc46e311cb5c45f83251223a623fe1ade5da45ef2ca5dce
+SHA512 (Python-3.12.0a4.tar.xz.asc) = b74a1bf0d5e4f402b6e5164cd140457ed0b172b2bfe61be1642fe053b71092b8bae1f5281e03516a6fba24319c78cd2505494cfada2416b766f4c602c1284d2a

From e190ec477f94ebe02482559428e3eac1921aabee Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 20 Jan 2023 18:45:19 +0000
Subject: [PATCH 06/93] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index d08d630..a159027 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel a4
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 # Getting this build in Koji on 32bit ARM is frustrating due to technical problems
@@ -1579,6 +1579,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0~a4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
 * Wed Jan 11 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a4-1
 - Update to 3.12.0a4
 

From 4aa8fa2b5a00f472f8bf6a119324b0a8c2fff14b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Fri, 6 Jan 2023 14:11:17 +0100
Subject: [PATCH 07/93] Don't require pyproject-rpm-macros on RHEL

See also https://src.fedoraproject.org/rpms/pyproject-rpm-macros/pull-request/345
---
 python3.12.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index a159027..dca0b6f 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -472,7 +472,11 @@ Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 # But we want them when packages BuildRequire python3-devel
 Requires: (python-rpm-macros if rpm-build)
 Requires: (python3-rpm-macros if rpm-build)
-Requires: (pyproject-rpm-macros if rpm-build)
+# We omit this dependency on RHEL to avoid pulling the macros to AppStream:
+# RHEL users can use the minimal implementation of %%pyproject_buildrequires
+# from pyproject-srpm-macros instead.
+# On Fedora, we keep this to avoid one additional round of %%generate_buildrequires.
+%{!?rhel:Requires: (pyproject-rpm-macros if rpm-build)}
 
 %unversioned_obsoletes_of_python3_X_if_main devel
 

From 440cc12f146534ec9be59f1a0213ddcd31259ffa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 8 Feb 2023 15:59:17 +0100
Subject: [PATCH 08/93] Update to 3.12.0a5

---
 python3.12.spec | 11 ++++++++---
 sources         |  4 ++--
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index dca0b6f..427db2c 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,10 +14,10 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel a4
+%global prerel a5
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 # Getting this build in Koji on 32bit ARM is frustrating due to technical problems
@@ -77,7 +77,7 @@ ExcludeArch: %{arm}
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 22.3.1
+%global pip_version 23.0
 %global setuptools_version 65.5.0
 
 # Expensive optimizations (mainly, profile-guided optimizations)
@@ -1428,6 +1428,7 @@ CheckPython optimized
 %{dynload_dir}/_testinternalcapi.%{SOABI_optimized}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_optimized}.so
 %{dynload_dir}/_testsinglephase.%{SOABI_optimized}.so
+%{dynload_dir}/_xxinterpchannels.%{SOABI_optimized}.so
 %{dynload_dir}/_xxtestfuzz.%{SOABI_optimized}.so
 
 # We don't bother splitting the debug build out into further subpackages:
@@ -1555,6 +1556,7 @@ CheckPython optimized
 %{dynload_dir}/_testinternalcapi.%{SOABI_debug}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_debug}.so
 %{dynload_dir}/_testsinglephase.%{SOABI_debug}.so
+%{dynload_dir}/_xxinterpchannels.%{SOABI_debug}.so
 %{dynload_dir}/_xxtestfuzz.%{SOABI_debug}.so
 
 %{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py
@@ -1583,6 +1585,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Feb 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a5-1
+- Update to 3.12.0a5
+
 * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0~a4-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 
diff --git a/sources b/sources
index 7f29785..9c4fe7d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0a4.tar.xz) = 19a98939077004259868cc5e6901d8fbf0ae90ad579700d6993f6b82990b1b4eb92efa5c8b5b7b50cfc46e311cb5c45f83251223a623fe1ade5da45ef2ca5dce
-SHA512 (Python-3.12.0a4.tar.xz.asc) = b74a1bf0d5e4f402b6e5164cd140457ed0b172b2bfe61be1642fe053b71092b8bae1f5281e03516a6fba24319c78cd2505494cfada2416b766f4c602c1284d2a
+SHA512 (Python-3.12.0a5.tar.xz) = 090d205a3cbfce1ea4c1ca5950d24db64e6f8aceb2f6458f17b996071ce6ddf80e60ed3e293b89f242df705e1dec6069ccc3e46f24f5d4e22819d7d54743a27a
+SHA512 (Python-3.12.0a5.tar.xz.asc) = 626ccafcb390e3987494f1c3fecf094047afbb255a65948fd1a1c8568cbd9c58be8e7e50e64b20873645428db7b363166984d075a3674daa9771b4be6fb46439

From 204e750d2e37ea1dd1d90c2da3b63b6f771b0f26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Sat, 11 Feb 2023 22:30:50 +0100
Subject: [PATCH 09/93] CI: Disable Cython checks on the smoke test for now

Even Cython from git HEAD does not support 3.12.0a5 yet.
---
 tests/tests.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index 08bde3b..4f7e7d4 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -21,13 +21,13 @@
         run: rpm -qa
     - smoke:
         dir: python/smoke
-        run: "VERSION={{ pybasever }} ./venv.sh"
+        run: "VERSION={{ pybasever }} CYTHON=false ./venv.sh"
     - smoke_virtualenv:
         dir: python/smoke
-        run: "VERSION={{ pybasever }} METHOD=virtualenv ./venv.sh"
+        run: "VERSION={{ pybasever }} METHOD=virtualenv CYTHON=false ./venv.sh"
     - debugsmoke:
         dir: python/smoke
-        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} ./venv.sh"
+        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} CYTHON=false ./venv.sh"
     - selftest:
         dir: python/selftest
         run: "VERSION={{ pybasever }} X='' ./parallel.sh"

From 1e78502d6d5acbba0d5198ead8d95c989366e6be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 8 Mar 2023 07:36:52 +0100
Subject: [PATCH 10/93] Update to 3.12.0a6

---
 ...down-for-the-main-thread-gh-28549-gh-28589.patch |  2 +-
 python3.12.spec                                     | 13 +++++++------
 sources                                             |  4 ++--
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 7d243df..61b7f3a 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -16,7 +16,7 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 31bf46311a..5beebd3e96 100644
+index a39a267b40..1b9c85c826 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
 @@ -1015,39 +1015,6 @@ def noop(): pass
diff --git a/python3.12.spec b/python3.12.spec
index 427db2c..2f33a76 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,7 +14,7 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel a5
+%global prerel a6
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
@@ -77,7 +77,7 @@ ExcludeArch: %{arm}
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 23.0
+%global pip_version 23.0.1
 %global setuptools_version 65.5.0
 
 # Expensive optimizations (mainly, profile-guided optimizations)
@@ -1169,9 +1169,8 @@ CheckPython optimized
 %{dynload_dir}/_blake2.%{SOABI_optimized}.so
 %{dynload_dir}/_md5.%{SOABI_optimized}.so
 %{dynload_dir}/_sha1.%{SOABI_optimized}.so
-%{dynload_dir}/_sha256.%{SOABI_optimized}.so
+%{dynload_dir}/_sha2.%{SOABI_optimized}.so
 %{dynload_dir}/_sha3.%{SOABI_optimized}.so
-%{dynload_dir}/_sha512.%{SOABI_optimized}.so
 
 %{dynload_dir}/_asyncio.%{SOABI_optimized}.so
 %{dynload_dir}/_bisect.%{SOABI_optimized}.so
@@ -1453,9 +1452,8 @@ CheckPython optimized
 %{dynload_dir}/_blake2.%{SOABI_debug}.so
 %{dynload_dir}/_md5.%{SOABI_debug}.so
 %{dynload_dir}/_sha1.%{SOABI_debug}.so
-%{dynload_dir}/_sha256.%{SOABI_debug}.so
+%{dynload_dir}/_sha2.%{SOABI_debug}.so
 %{dynload_dir}/_sha3.%{SOABI_debug}.so
-%{dynload_dir}/_sha512.%{SOABI_debug}.so
 
 %{dynload_dir}/_asyncio.%{SOABI_debug}.so
 %{dynload_dir}/_bisect.%{SOABI_debug}.so
@@ -1585,6 +1583,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Mar 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a6-1
+- Update to 3.12.0a6
+
 * Wed Feb 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a5-1
 - Update to 3.12.0a5
 
diff --git a/sources b/sources
index 9c4fe7d..395b2d2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0a5.tar.xz) = 090d205a3cbfce1ea4c1ca5950d24db64e6f8aceb2f6458f17b996071ce6ddf80e60ed3e293b89f242df705e1dec6069ccc3e46f24f5d4e22819d7d54743a27a
-SHA512 (Python-3.12.0a5.tar.xz.asc) = 626ccafcb390e3987494f1c3fecf094047afbb255a65948fd1a1c8568cbd9c58be8e7e50e64b20873645428db7b363166984d075a3674daa9771b4be6fb46439
+SHA512 (Python-3.12.0a6.tar.xz) = f1f4fa5982ff37765fc657a99c0a3277935587b6073c0f6c9e0d1fdbc79c63f3dff9b2e296e72bfa1b6a0ebcbcb13801d6e6599c13230e8c0256c13ac2754488
+SHA512 (Python-3.12.0a6.tar.xz.asc) = 9e72be00a9b99a4d01c60b9b3af718b39ff7a1e68b5a8d5215f5797ac133f84f6382dc7339da5ed2e5be706fa5abaedc54b461b50a679e051e96189987be4cc5

From 7e80f75262e5edfe825faed52614c8b3d3c9bb51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Thu, 23 Mar 2023 17:56:50 +0100
Subject: [PATCH 11/93] Increase the test timeout in %check

We see test failures lately mostly on ppc64le
due to test_compile taking more than 30 minutes.
---
 python3.12.spec | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 2f33a76..e24f583 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel a6
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 # Getting this build in Koji on 32bit ARM is frustrating due to technical problems
@@ -1064,13 +1064,13 @@ CheckPython() {
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.pythoninfo
 
   # Run the upstream test suite
-  # --timeout=1800: kill test running for longer than 30 minutes
+  # --timeout=2700: kill test running for longer than 45 minutes
   # test_freeze_simple_script is skipped, because it fails without bundled libs.
   #  the freeze tool is only usable from the source checkout anyway,
   #  we don't ship it in the RPM package.
 
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
-    -wW --slowest %{_smp_mflags} --timeout=1800 \
+    -wW --slowest %{_smp_mflags} --timeout=2700 \
     -i test_freeze_simple_script \
     %ifarch %{mips64}
     -x test_ctypes \
@@ -1583,6 +1583,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Mar 23 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~a6-2
+- Increase the test timeout during package build
+
 * Wed Mar 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a6-1
 - Update to 3.12.0a6
 

From 3f1a71ddff7fa00d8fbbd6d97386170cf6dfacf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 5 Apr 2023 09:24:42 +0200
Subject: [PATCH 12/93] Update to 3.12.0a7

---
 00251-change-user-install-location.patch | 4 ++--
 python3.12.spec                          | 9 ++++++---
 sources                                  | 4 ++--
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index 6293499..1622e53 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -30,7 +30,7 @@ Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
  3 files changed, 71 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/site.py b/Lib/site.py
-index 7faf1c6f6a..e2ace71d18 100644
+index 672fa7b000..0a9c5be53e 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
 @@ -377,8 +377,15 @@ def getsitepackages(prefixes=None):
@@ -51,7 +51,7 @@ index 7faf1c6f6a..e2ace71d18 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index c61100a6da..30143e577e 100644
+index 122d441bd1..2d354a11da 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
 @@ -104,6 +104,11 @@
diff --git a/python3.12.spec b/python3.12.spec
index e24f583..1654a41 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,10 +14,10 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel a6
+%global prerel a7
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 # Getting this build in Koji on 32bit ARM is frustrating due to technical problems
@@ -1361,7 +1361,7 @@ CheckPython optimized
 %{_includedir}/python%{LDVERSION_optimized}/*.h
 %{_includedir}/python%{LDVERSION_optimized}/internal/
 %{_includedir}/python%{LDVERSION_optimized}/cpython/
-%doc Misc/README.valgrind Misc/valgrind-python.supp Misc/gdbinit
+%doc Misc/README.valgrind Misc/valgrind-python.supp
 
 %if %{with main_python}
 %{_bindir}/2to3
@@ -1583,6 +1583,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Apr 05 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a7-1
+- Update to 3.12.0a7
+
 * Thu Mar 23 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~a6-2
 - Increase the test timeout during package build
 
diff --git a/sources b/sources
index 395b2d2..574ea1b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0a6.tar.xz) = f1f4fa5982ff37765fc657a99c0a3277935587b6073c0f6c9e0d1fdbc79c63f3dff9b2e296e72bfa1b6a0ebcbcb13801d6e6599c13230e8c0256c13ac2754488
-SHA512 (Python-3.12.0a6.tar.xz.asc) = 9e72be00a9b99a4d01c60b9b3af718b39ff7a1e68b5a8d5215f5797ac133f84f6382dc7339da5ed2e5be706fa5abaedc54b461b50a679e051e96189987be4cc5
+SHA512 (Python-3.12.0a7.tar.xz) = 181e73215666a7deb4286a70f506d788adb0d13e3b688f3c4e061819bc59cbcedaf8aca0251d4e58791be8488f43ca0075176335bd1b3ff496b4ea2f14967d8b
+SHA512 (Python-3.12.0a7.tar.xz.asc) = 07c27bfb649755cfe505a902ff677e146ed1e8e19e7d5801d41c5926359b7d3f2ef73961c26f6cce6dd948355324330d4e9bae79e3661f87079b1adb5bf62355

From dd482b1c207943e04c04fc8825c6348ab7bd8513 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Mon, 22 May 2023 11:10:13 +0200
Subject: [PATCH 13/93] Remove ExcludeArch for arm, Fedora 36 went EOL

---
 python3.12.spec | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 1654a41..2ce711b 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -20,17 +20,6 @@ Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
 License: Python-2.0.1
 
-# Getting this build in Koji on 32bit ARM is frustrating due to technical problems
-# https://pagure.io/releng/issue/11095
-# Fedora 37+ dropped that architecture
-# https://fedoraproject.org/wiki/Changes/RetireARMv7
-# Upstream does not support it anyway
-# https://peps.python.org/pep-0011/
-# Hence, we exclude it starting with Python 3.12
-# https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/4QWRWUYQOLCVC5D5YHXFXFOGPEIIPYSJ/
-# Once Fedora 36 goes EOL, this line can be dropped.
-ExcludeArch: %{arm}
-
 
 # ==================================
 # Conditionals controlling the build

From 8bed4bf37320cb5b8dae662fc75bcb5645b0cd54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Tue, 23 May 2023 11:04:35 +0200
Subject: [PATCH 14/93] Update to 3.12.0b1

This update enables budled pip, because in Fedora we don't have the
latest version yet.
See: https://src.fedoraproject.org/rpms/python-pip/pull-request/123#comment-142984
---
 ...or-the-main-thread-gh-28549-gh-28589.patch |  2 +-
 ...rf-map-test-harness-gh-104811-104823.patch | 43 +++++++++++++++++++
 python3.12.spec                               | 37 ++++++++--------
 sources                                       |  4 +-
 4 files changed, 64 insertions(+), 22 deletions(-)
 create mode 100644 00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch

diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 61b7f3a..1120d00 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -16,7 +16,7 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index a39a267b40..1b9c85c826 100644
+index 97165264b3..7667ed37e8 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
 @@ -1015,39 +1015,6 @@ def noop(): pass
diff --git a/00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch b/00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch
new file mode 100644
index 0000000..a86d646
--- /dev/null
+++ b/00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch
@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Carl Meyer <carl@oddbird.net>
+Date: Tue, 23 May 2023 16:04:31 -0600
+Subject: [PATCH] 00398: fix stack overwrite on 32-bit in perf map test harness
+ (#104811)
+
+---
+ Modules/_testinternalcapi.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/Modules/_testinternalcapi.c b/Modules/_testinternalcapi.c
+index b91f7b620f..8267dbf677 100644
+--- a/Modules/_testinternalcapi.c
++++ b/Modules/_testinternalcapi.c
+@@ -762,19 +762,24 @@ clear_extension(PyObject *self, PyObject *args)
+ static PyObject *
+ write_perf_map_entry(PyObject *self, PyObject *args)
+ {
++    PyObject *code_addr_v;
+     const void *code_addr;
+     unsigned int code_size;
+     const char *entry_name;
+ 
+-    if (!PyArg_ParseTuple(args, "KIs", &code_addr, &code_size, &entry_name))
++    if (!PyArg_ParseTuple(args, "OIs", &code_addr_v, &code_size, &entry_name))
+         return NULL;
++    code_addr = PyLong_AsVoidPtr(code_addr_v);
++    if (code_addr == NULL) {
++        return NULL;
++    }
+ 
+     int ret = PyUnstable_WritePerfMapEntry(code_addr, code_size, entry_name);
+-    if (ret == -1) {
+-        PyErr_SetString(PyExc_OSError, "Failed to write performance map entry");
++    if (ret < 0) {
++        PyErr_SetFromErrno(PyExc_OSError);
+         return NULL;
+     }
+-    return Py_BuildValue("i", ret);
++    return PyLong_FromLong(ret);
+ }
+ 
+ static PyObject *
diff --git a/python3.12.spec b/python3.12.spec
index 2ce711b..c202746 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,7 +14,7 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel a7
+%global prerel b1
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
@@ -55,19 +55,18 @@ License: Python-2.0.1
 #
 # Procedure: https://fedoraproject.org/wiki/SIGs/Python/UpgradingPython
 #
-#   IMPORTANT: When bootstrapping, it's very likely the wheels for pip and
-#   setuptools are not available. Turn off the rpmwheels bcond until
-#   the two packages are built with wheels to get around the issue.
+#   IMPORTANT: When bootstrapping, it's very likely python-pip-wheel is
+#   not available. Turn off the rpmwheels bcond until
+#   python-pip is built with a wheel to get around the issue.
 %bcond_with bootstrap
 
-# Whether to use RPM build wheels from the python-{pip,setuptools}-wheel package
+# Whether to use RPM build wheels from the python-pip-wheel package
 # Uses upstream bundled prebuilt wheels otherwise
-%bcond_without rpmwheels
+%bcond_with rpmwheels
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 23.0.1
-%global setuptools_version 65.5.0
+%global pip_version 23.1.2
 
 # Expensive optimizations (mainly, profile-guided optimizations)
 %bcond_without optimizations
@@ -236,10 +235,9 @@ BuildRequires: /usr/bin/dtrace
 BuildRequires: /usr/sbin/ifconfig
 
 %if %{with rpmwheels}
-# Newer versions in Fedora 37 support Python 3.12
-# Versions in Fedora 36 were patched to add the support, in the versions listed bellow
-BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel >= 59.6.0-3
-BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel >= 21.3.1-4
+# Python 3.12 removed the deprecated imp module,
+# the first compatible version of pip is 23.1.2.
+BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
 %endif
 
 %if %{without bootstrap}
@@ -302,6 +300,10 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
+# 00398 # 3a2e73c1542a7204628783cef2186e4b8a385f79
+# fix stack overwrite on 32-bit in perf map test harness (#104811)
+Patch398: 00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -423,11 +425,9 @@ This package contains /usr/bin/python - the "python" command that runs Python 3.
 Summary:        Python runtime libraries
 
 %if %{with rpmwheels}
-Requires: %{python_wheel_pkg_prefix}-setuptools-wheel >= 59.6.0-3
-Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 21.3.1-4
+Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
 %else
 Provides: bundled(python3dist(pip)) = %{pip_version}
-Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
 %endif
 
 %unversioned_obsoletes_of_python3_X_if_main libs
@@ -600,7 +600,6 @@ The debug runtime additionally supports debug builds of C-API extensions
 
 %if %{with rpmwheels}
 rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
-rm Lib/ensurepip/_bundled/setuptools-%{setuptools_version}-py3-none-any.whl
 %endif
 
 # Remove all exe files to ensure we are not shipping prebuilt binaries
@@ -1140,7 +1139,6 @@ CheckPython optimized
 %else
 %dir %{pylibdir}/ensurepip/_bundled
 %{pylibdir}/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
-%{pylibdir}/ensurepip/_bundled/setuptools-%{setuptools_version}-py3-none-any.whl
 %endif
 
 %dir %{pylibdir}/concurrent/
@@ -1199,7 +1197,6 @@ CheckPython optimized
 %{dynload_dir}/_ssl.%{SOABI_optimized}.so
 %{dynload_dir}/_statistics.%{SOABI_optimized}.so
 %{dynload_dir}/_struct.%{SOABI_optimized}.so
-%{dynload_dir}/_typing.%{SOABI_optimized}.so
 %{dynload_dir}/array.%{SOABI_optimized}.so
 %{dynload_dir}/audioop.%{SOABI_optimized}.so
 %{dynload_dir}/binascii.%{SOABI_optimized}.so
@@ -1482,7 +1479,6 @@ CheckPython optimized
 %{dynload_dir}/_ssl.%{SOABI_debug}.so
 %{dynload_dir}/_statistics.%{SOABI_debug}.so
 %{dynload_dir}/_struct.%{SOABI_debug}.so
-%{dynload_dir}/_typing.%{SOABI_debug}.so
 %{dynload_dir}/array.%{SOABI_debug}.so
 %{dynload_dir}/audioop.%{SOABI_debug}.so
 %{dynload_dir}/binascii.%{SOABI_debug}.so
@@ -1572,6 +1568,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue May 23 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b1-1
+- Update to 3.12.0b1
+
 * Wed Apr 05 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a7-1
 - Update to 3.12.0a7
 
diff --git a/sources b/sources
index 574ea1b..df6fbfc 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0a7.tar.xz) = 181e73215666a7deb4286a70f506d788adb0d13e3b688f3c4e061819bc59cbcedaf8aca0251d4e58791be8488f43ca0075176335bd1b3ff496b4ea2f14967d8b
-SHA512 (Python-3.12.0a7.tar.xz.asc) = 07c27bfb649755cfe505a902ff677e146ed1e8e19e7d5801d41c5926359b7d3f2ef73961c26f6cce6dd948355324330d4e9bae79e3661f87079b1adb5bf62355
+SHA512 (Python-3.12.0b1.tar.xz) = 7d6d009f765ba48ef48e6b25cb1f043ba66979d66cb9141452862e84ae954611361d24178cce628d1892b75d306370a56fcb30a7c1715b0eedcfef5610f3e1ae
+SHA512 (Python-3.12.0b1.tar.xz.asc) = cea449f05ae66c28aeb4ffd99b5748ba4c09bfb2a6889a771744ea81ca2afc2420648d4ca92592d32ddb26660804e73912e6fb8d906674e9e1895ba613904b26

From 0c82a4ac9fe539d40f5ab64fdcb297e61b448ef8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Fri, 26 May 2023 15:54:59 +0200
Subject: [PATCH 15/93] Use wheels from RPMs, at least on Fedora 39+

---
 ...-get_config_var-wheel_pkg_dir-if-set.patch | 58 +++++++++++++++++++
 python3.12.spec                               | 34 ++++++++++-
 2 files changed, 90 insertions(+), 2 deletions(-)
 create mode 100644 00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch

diff --git a/00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch b/00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch
new file mode 100644
index 0000000..654b7e8
--- /dev/null
+++ b/00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch
@@ -0,0 +1,58 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Mon, 29 May 2023 15:51:16 +0200
+Subject: [PATCH] 00401: Tests: Use setuptools+wheel from
+ sysconfig.get_config_var('WHEEL_PKG_DIR') if set
+
+Proposed upstream https://github.com/python/cpython/pull/105056
+---
+ Lib/test/support/__init__.py | 21 +++++++++++++++++++++
+ Lib/test/test_cppext.py      |  4 ++--
+ 2 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
+index d555c53fee..adc3f5901d 100644
+--- a/Lib/test/support/__init__.py
++++ b/Lib/test/support/__init__.py
+@@ -2398,5 +2398,26 @@ def adjust_int_max_str_digits(max_digits):
+     finally:
+         sys.set_int_max_str_digits(current)
+ 
++
++@functools.cache
++def _findwheel(pkgname):
++    """Try to find a wheel with the package specified as pkgname.
++
++    If set, the wheels are searched for in WHEEL_PKG_DIR (see ensurepip).
++    Otherwise, they are searched for in the test directory.
++    """
++    wheel_dir = sysconfig.get_config_var('WHEEL_PKG_DIR') or TEST_HOME_DIR
++    filenames = os.listdir(wheel_dir)
++    filenames = sorted(filenames)  # sort this like ensurepip does it
++    for filename in filenames:
++        # filename is like 'pip-21.2.4-py3-none-any.whl'
++        if not filename.endswith(".whl"):
++            continue
++        prefix = pkgname + '-'
++        if filename.startswith(prefix):
++            return os.path.join(wheel_dir, filename)
++    raise FileNotFoundError(f"No wheel for {pkgname} found in {wheel_dir}")
++
++
+ #For recursion tests, easily exceeds default recursion limit
+ EXCEEDS_RECURSION_LIMIT = 5000
+diff --git a/Lib/test/test_cppext.py b/Lib/test/test_cppext.py
+index 4fb62d87e8..d124220dac 100644
+--- a/Lib/test/test_cppext.py
++++ b/Lib/test/test_cppext.py
+@@ -83,8 +83,8 @@ def run_cmd(operation, cmd):
+ 
+         cmd = [python, '-X', 'dev',
+                '-m', 'pip', 'install',
+-               support.findfile('setuptools-67.6.1-py3-none-any.whl'),
+-               support.findfile('wheel-0.40.0-py3-none-any.whl')]
++               support._findwheel('setuptools'),
++               support._findwheel('wheel')]
+         run_cmd('Install build dependencies', cmd)
+ 
+         # Build and install the C++ extension
diff --git a/python3.12.spec b/python3.12.spec
index c202746..f94d213 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel b1
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -60,13 +60,20 @@ License: Python-2.0.1
 #   python-pip is built with a wheel to get around the issue.
 %bcond_with bootstrap
 
-# Whether to use RPM build wheels from the python-pip-wheel package
+# Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages
 # Uses upstream bundled prebuilt wheels otherwise
+# Only F39+ has a pip new enough to work with Python 3.12
+%if 0%{?fedora} >= 39 || 0%{?rhel} >= 10
+%bcond_without rpmwheels
+%else
 %bcond_with rpmwheels
+%endif
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
 %global pip_version 23.1.2
+%global setuptools_version 67.6.1
+%global wheel_version 0.40.0
 
 # Expensive optimizations (mainly, profile-guided optimizations)
 %bcond_without optimizations
@@ -238,6 +245,10 @@ BuildRequires: /usr/sbin/ifconfig
 # Python 3.12 removed the deprecated imp module,
 # the first compatible version of pip is 23.1.2.
 BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
+%if %{with tests}
+BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel
+BuildRequires: %{python_wheel_pkg_prefix}-wheel-wheel
+%endif
 %endif
 
 %if %{without bootstrap}
@@ -304,6 +315,12 @@ Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-g
 # fix stack overwrite on 32-bit in perf map test harness (#104811)
 Patch398: 00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch
 
+# 00401 # 48310af24b090719553bf0e9c965d80524e0b40e
+# Tests: Use setuptools+wheel from sysconfig.get_config_var('WHEEL_PKG_DIR') if set
+#
+# Proposed upstream https://github.com/python/cpython/pull/105056
+Patch401: 00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -546,6 +563,14 @@ Summary: The self-test suite for the main python3 package
 Requires: %{pkgname} = %{version}-%{release}
 Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 
+%if %{with rpmwheels}
+Requires: %{python_wheel_pkg_prefix}-setuptools-wheel
+Requires: %{python_wheel_pkg_prefix}-wheel-wheel
+%else
+Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
+Provides: bundled(python3dist(wheel)) = %{wheel_version}
+%endif
+
 %unversioned_obsoletes_of_python3_X_if_main test
 
 %description -n %{pkgname}-test
@@ -600,6 +625,8 @@ The debug runtime additionally supports debug builds of C-API extensions
 
 %if %{with rpmwheels}
 rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
+rm Lib/test/setuptools-%{setuptools_version}-py3-none-any.whl
+rm Lib/test/wheel-%{wheel_version}-py3-none-any.whl
 %endif
 
 # Remove all exe files to ensure we are not shipping prebuilt binaries
@@ -1568,6 +1595,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon May 29 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~b1-2
+- Use wheels from RPMs, at least on Fedora 39+
+
 * Tue May 23 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b1-1
 - Update to 3.12.0b1
 

From 6073e4f0062e4076028a803e3427a942009c0714 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Tue, 30 May 2023 18:19:42 +0200
Subject: [PATCH 16/93] --without rpmwheels: Declare bundled() provides and a
 complex License tag

---
 python3.12.spec | 67 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)

diff --git a/python3.12.spec b/python3.12.spec
index f94d213..65af7b7 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -74,6 +74,57 @@ License: Python-2.0.1
 %global pip_version 23.1.2
 %global setuptools_version 67.6.1
 %global wheel_version 0.40.0
+# All of those also include a list of indirect bundled libs:
+# pip
+#  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
+%global pip_bundled_provides %{expand:
+Provides: bundled(python3dist(cachecontrol)) = 0.12.11
+Provides: bundled(python3dist(certifi)) = 2022.12.7
+Provides: bundled(python3dist(chardet)) = 5.1
+Provides: bundled(python3dist(colorama)) = 0.4.6
+Provides: bundled(python3dist(distlib)) = 0.3.6
+Provides: bundled(python3dist(distro)) = 1.8
+Provides: bundled(python3dist(idna)) = 3.4
+Provides: bundled(python3dist(msgpack)) = 1.0.5
+Provides: bundled(python3dist(packaging)) = 21.3
+Provides: bundled(python3dist(platformdirs)) = 3.2
+Provides: bundled(python3dist(pygments)) = 2.14
+Provides: bundled(python3dist(pyparsing)) = 3.0.9
+Provides: bundled(python3dist(pyproject-hooks)) = 1
+Provides: bundled(python3dist(requests)) = 2.28.2
+Provides: bundled(python3dist(resolvelib)) = 1.0.1
+Provides: bundled(python3dist(rich)) = 13.3.3
+Provides: bundled(python3dist(setuptools)) = 67.7.2
+Provides: bundled(python3dist(six)) = 1.16
+Provides: bundled(python3dist(tenacity)) = 8.2.2
+Provides: bundled(python3dist(tomli)) = 2.0.1
+Provides: bundled(python3dist(typing-extensions)) = 4.5
+Provides: bundled(python3dist(urllib3)) = 1.26.15
+Provides: bundled(python3dist(webencodings)) = 0.5.1
+}
+# setuptools
+# vendor.txt files not in .whl
+#  $ %%{_rpmconfigdir}/pythonbundles.py \
+#    <(curl -L https://github.com/pypa/setuptools/raw/v%%{setuptools_version}/setuptools/_vendor/vendored.txt) \
+#    <(curl -L https://github.com/pypa/setuptools/raw/v%%{setuptools_version}/pkg_resources/_vendor/vendored.txt)
+%global setuptools_bundled_provides %{expand:
+Provides: bundled(python3dist(importlib-metadata)) = 6
+Provides: bundled(python3dist(importlib-resources)) = 5.10.2
+Provides: bundled(python3dist(jaraco-text)) = 3.7
+Provides: bundled(python3dist(more-itertools)) = 8.8
+Provides: bundled(python3dist(ordered-set)) = 3.1.1
+Provides: bundled(python3dist(packaging)) = 23
+Provides: bundled(python3dist(platformdirs)) = 2.6.2
+Provides: bundled(python3dist(tomli)) = 2.0.1
+Provides: bundled(python3dist(typing-extensions)) = 4.0.1
+Provides: bundled(python3dist(typing-extensions)) = 4.4
+Provides: bundled(python3dist(zipp)) = 3.7
+}
+# wheel
+#  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheel-*.whl wheel/vendored/vendor.txt)
+%global wheel_bundled_provides %{expand:
+Provides: bundled(python3dist(packaging)) = 23
+}
 
 # Expensive optimizations (mainly, profile-guided optimizations)
 %bcond_without optimizations
@@ -445,6 +496,9 @@ Summary:        Python runtime libraries
 Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
 %else
 Provides: bundled(python3dist(pip)) = %{pip_version}
+%pip_bundled_provides
+# License manually combined form Python + pip
+License: Python-2.0.1 AND MIT AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
 %endif
 
 %unversioned_obsoletes_of_python3_X_if_main libs
@@ -568,7 +622,11 @@ Requires: %{python_wheel_pkg_prefix}-setuptools-wheel
 Requires: %{python_wheel_pkg_prefix}-wheel-wheel
 %else
 Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
+%setuptools_bundled_provides
 Provides: bundled(python3dist(wheel)) = %{wheel_version}
+%wheel_bundled_provides
+# License manually combined from Python + setuptools + wheel
+License: Python-2.0.1 AND MIT AND Apache-2.0 AND (Apache-2.0 OR BSD-2-Clause)
 %endif
 
 %unversioned_obsoletes_of_python3_X_if_main test
@@ -623,6 +681,14 @@ The debug runtime additionally supports debug builds of C-API extensions
 %gpgverify -k2 -s1 -d0
 %autosetup -S git_am -n Python-%{upstream_version}
 
+# Verify the second level of bundled provides is up to date
+# Arguably this should be done in %%check, but %%prep has a faster feedback loop
+# setuptools.whl does not contain the vendored.txt files
+if [ -f %{_rpmconfigdir}/pythonbundles.py ]; then
+  %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) --compare-with '%pip_bundled_provides'
+  %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheel-*.whl wheel/vendored/vendor.txt) --compare-with '%wheel_bundled_provides'
+fi
+
 %if %{with rpmwheels}
 rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
 rm Lib/test/setuptools-%{setuptools_version}-py3-none-any.whl
@@ -1597,6 +1663,7 @@ CheckPython optimized
 %changelog
 * Mon May 29 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~b1-2
 - Use wheels from RPMs, at least on Fedora 39+
+- On older Fedora releases, declare bundled() provides and a complex License tag
 
 * Tue May 23 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b1-1
 - Update to 3.12.0b1

From 036d63f211b141771562cc8312482d9fcb28bb5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 7 Jun 2023 08:39:56 +0200
Subject: [PATCH 17/93] Update to 3.12.0b2

---
 ...or-the-main-thread-gh-28549-gh-28589.patch | 10 ++---
 ...rf-map-test-harness-gh-104811-104823.patch | 43 -------------------
 python3.12.spec                               | 13 +++---
 sources                                       |  4 +-
 4 files changed, 13 insertions(+), 57 deletions(-)
 delete mode 100644 00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch

diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 1120d00..b5b3461 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -16,10 +16,10 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 97165264b3..7667ed37e8 100644
+index 9e4972ecb6..6f081d8f38 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
-@@ -1015,39 +1015,6 @@ def noop(): pass
+@@ -987,39 +987,6 @@ def noop(): pass
              threading.Thread(target=noop).start()
              # Thread.join() is not called
  
@@ -56,9 +56,9 @@ index 97165264b3..7667ed37e8 100644
 -        self.assertEqual(out, b'')
 -        self.assertEqual(err, b'')
 -
- 
- class ThreadJoinOnShutdown(BaseTestCase):
- 
+     def test_start_new_thread_at_exit(self):
+         code = """if 1:
+             import atexit
 diff --git a/Lib/threading.py b/Lib/threading.py
 index df273870fa..eba297776d 100644
 --- a/Lib/threading.py
diff --git a/00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch b/00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch
deleted file mode 100644
index a86d646..0000000
--- a/00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Carl Meyer <carl@oddbird.net>
-Date: Tue, 23 May 2023 16:04:31 -0600
-Subject: [PATCH] 00398: fix stack overwrite on 32-bit in perf map test harness
- (#104811)
-
----
- Modules/_testinternalcapi.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/Modules/_testinternalcapi.c b/Modules/_testinternalcapi.c
-index b91f7b620f..8267dbf677 100644
---- a/Modules/_testinternalcapi.c
-+++ b/Modules/_testinternalcapi.c
-@@ -762,19 +762,24 @@ clear_extension(PyObject *self, PyObject *args)
- static PyObject *
- write_perf_map_entry(PyObject *self, PyObject *args)
- {
-+    PyObject *code_addr_v;
-     const void *code_addr;
-     unsigned int code_size;
-     const char *entry_name;
- 
--    if (!PyArg_ParseTuple(args, "KIs", &code_addr, &code_size, &entry_name))
-+    if (!PyArg_ParseTuple(args, "OIs", &code_addr_v, &code_size, &entry_name))
-         return NULL;
-+    code_addr = PyLong_AsVoidPtr(code_addr_v);
-+    if (code_addr == NULL) {
-+        return NULL;
-+    }
- 
-     int ret = PyUnstable_WritePerfMapEntry(code_addr, code_size, entry_name);
--    if (ret == -1) {
--        PyErr_SetString(PyExc_OSError, "Failed to write performance map entry");
-+    if (ret < 0) {
-+        PyErr_SetFromErrno(PyExc_OSError);
-         return NULL;
-     }
--    return Py_BuildValue("i", ret);
-+    return PyLong_FromLong(ret);
- }
- 
- static PyObject *
diff --git a/python3.12.spec b/python3.12.spec
index 65af7b7..c78d8b5 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,10 +14,10 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel b1
+%global prerel b2
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -351,7 +351,7 @@ Source11: idle3.appdata.xml
 # pypa/distutils integration: https://github.com/pypa/distutils/pull/70
 Patch251: 00251-change-user-install-location.patch
 
-# 00371 # 1fc313929648e9b543542de09f59c55e175ac45a
+# 00371 # d917a50238c94c652bc30ae9061d65f60cc8accd
 # Revert "bpo-1596321: Fix threading._shutdown() for the main thread (GH-28549) (GH-28589)"
 #
 # This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
@@ -362,10 +362,6 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00398 # 3a2e73c1542a7204628783cef2186e4b8a385f79
-# fix stack overwrite on 32-bit in perf map test harness (#104811)
-Patch398: 00398-fix-stack-overwrite-on-32-bit-in-perf-map-test-harness-gh-104811-104823.patch
-
 # 00401 # 48310af24b090719553bf0e9c965d80524e0b40e
 # Tests: Use setuptools+wheel from sysconfig.get_config_var('WHEEL_PKG_DIR') if set
 #
@@ -1661,6 +1657,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Jun 07 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b2-1
+- Update to 3.12.0b2
+
 * Mon May 29 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~b1-2
 - Use wheels from RPMs, at least on Fedora 39+
 - On older Fedora releases, declare bundled() provides and a complex License tag
diff --git a/sources b/sources
index df6fbfc..60ad9b4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0b1.tar.xz) = 7d6d009f765ba48ef48e6b25cb1f043ba66979d66cb9141452862e84ae954611361d24178cce628d1892b75d306370a56fcb30a7c1715b0eedcfef5610f3e1ae
-SHA512 (Python-3.12.0b1.tar.xz.asc) = cea449f05ae66c28aeb4ffd99b5748ba4c09bfb2a6889a771744ea81ca2afc2420648d4ca92592d32ddb26660804e73912e6fb8d906674e9e1895ba613904b26
+SHA512 (Python-3.12.0b2.tar.xz) = 9bfac70f2ccc1f6798bc63a55d92f0b162e3a9077624a2e37448002ea310cb7b1da64ad2aceda795b45de91f60eb4d95dde85984900e54906d814625b42143b5
+SHA512 (Python-3.12.0b2.tar.xz.asc) = 22a1f2c3335bc428cfee0ce2e081aeed24474d3cd877fac1cc4cf92b4a2bee70f85aed0068a71600cddef9c8b46bbde257a92c57bd494ad820c0686ab7c8c0f0

From 8b139823bd71edf00dc7f3f90c726cb4d6e18f60 Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Tue, 13 Jun 2023 15:03:26 +0200
Subject: [PATCH 18/93] Bootstrap for Python 3.12

---
 python3.12.spec | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index c78d8b5..63211dc 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel b2
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -58,13 +58,13 @@ License: Python-2.0.1
 #   IMPORTANT: When bootstrapping, it's very likely python-pip-wheel is
 #   not available. Turn off the rpmwheels bcond until
 #   python-pip is built with a wheel to get around the issue.
-%bcond_with bootstrap
+%bcond_without bootstrap
 
 # Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages
 # Uses upstream bundled prebuilt wheels otherwise
 # Only F39+ has a pip new enough to work with Python 3.12
 %if 0%{?fedora} >= 39 || 0%{?rhel} >= 10
-%bcond_without rpmwheels
+%bcond_with rpmwheels
 %else
 %bcond_with rpmwheels
 %endif
@@ -127,10 +127,10 @@ Provides: bundled(python3dist(packaging)) = 23
 }
 
 # Expensive optimizations (mainly, profile-guided optimizations)
-%bcond_without optimizations
+%bcond_with optimizations
 
 # Run the test suite in %%check
-%bcond_without tests
+%bcond_with tests
 
 # Extra build for debugging the interpreter or C-API extensions
 # (the -debug subpackages)
@@ -1657,6 +1657,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.12.0~b2-2
+- Bootstrap for Python 3.12
+
 * Wed Jun 07 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b2-1
 - Update to 3.12.0b2
 

From 5b9ff3722cf770915723dd8827e82189fd6200bf Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Tue, 13 Jun 2023 17:23:48 +0200
Subject: [PATCH 19/93] Rebuilt for Python 3.12

---
 python3.12.spec | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 63211dc..f81b273 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel b2
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -58,13 +58,13 @@ License: Python-2.0.1
 #   IMPORTANT: When bootstrapping, it's very likely python-pip-wheel is
 #   not available. Turn off the rpmwheels bcond until
 #   python-pip is built with a wheel to get around the issue.
-%bcond_without bootstrap
+%bcond_with bootstrap
 
 # Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages
 # Uses upstream bundled prebuilt wheels otherwise
 # Only F39+ has a pip new enough to work with Python 3.12
 %if 0%{?fedora} >= 39 || 0%{?rhel} >= 10
-%bcond_with rpmwheels
+%bcond_without rpmwheels
 %else
 %bcond_with rpmwheels
 %endif
@@ -127,10 +127,10 @@ Provides: bundled(python3dist(packaging)) = 23
 }
 
 # Expensive optimizations (mainly, profile-guided optimizations)
-%bcond_with optimizations
+%bcond_without optimizations
 
 # Run the test suite in %%check
-%bcond_with tests
+%bcond_without tests
 
 # Extra build for debugging the interpreter or C-API extensions
 # (the -debug subpackages)
@@ -1657,6 +1657,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.12.0~b2-3
+- Rebuilt for Python 3.12
+
 * Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.12.0~b2-2
 - Bootstrap for Python 3.12
 

From 85226511803fd00491816dd6b167d3fbcf519662 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Tue, 20 Jun 2023 18:45:12 +0200
Subject: [PATCH 20/93] Update to 3.12.0b3

---
 ...-get_config_var-wheel_pkg_dir-if-set.patch | 58 -------------------
 python3.12.spec                               | 13 ++---
 sources                                       |  4 +-
 3 files changed, 7 insertions(+), 68 deletions(-)
 delete mode 100644 00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch

diff --git a/00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch b/00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch
deleted file mode 100644
index 654b7e8..0000000
--- a/00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
-Date: Mon, 29 May 2023 15:51:16 +0200
-Subject: [PATCH] 00401: Tests: Use setuptools+wheel from
- sysconfig.get_config_var('WHEEL_PKG_DIR') if set
-
-Proposed upstream https://github.com/python/cpython/pull/105056
----
- Lib/test/support/__init__.py | 21 +++++++++++++++++++++
- Lib/test/test_cppext.py      |  4 ++--
- 2 files changed, 23 insertions(+), 2 deletions(-)
-
-diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index d555c53fee..adc3f5901d 100644
---- a/Lib/test/support/__init__.py
-+++ b/Lib/test/support/__init__.py
-@@ -2398,5 +2398,26 @@ def adjust_int_max_str_digits(max_digits):
-     finally:
-         sys.set_int_max_str_digits(current)
- 
-+
-+@functools.cache
-+def _findwheel(pkgname):
-+    """Try to find a wheel with the package specified as pkgname.
-+
-+    If set, the wheels are searched for in WHEEL_PKG_DIR (see ensurepip).
-+    Otherwise, they are searched for in the test directory.
-+    """
-+    wheel_dir = sysconfig.get_config_var('WHEEL_PKG_DIR') or TEST_HOME_DIR
-+    filenames = os.listdir(wheel_dir)
-+    filenames = sorted(filenames)  # sort this like ensurepip does it
-+    for filename in filenames:
-+        # filename is like 'pip-21.2.4-py3-none-any.whl'
-+        if not filename.endswith(".whl"):
-+            continue
-+        prefix = pkgname + '-'
-+        if filename.startswith(prefix):
-+            return os.path.join(wheel_dir, filename)
-+    raise FileNotFoundError(f"No wheel for {pkgname} found in {wheel_dir}")
-+
-+
- #For recursion tests, easily exceeds default recursion limit
- EXCEEDS_RECURSION_LIMIT = 5000
-diff --git a/Lib/test/test_cppext.py b/Lib/test/test_cppext.py
-index 4fb62d87e8..d124220dac 100644
---- a/Lib/test/test_cppext.py
-+++ b/Lib/test/test_cppext.py
-@@ -83,8 +83,8 @@ def run_cmd(operation, cmd):
- 
-         cmd = [python, '-X', 'dev',
-                '-m', 'pip', 'install',
--               support.findfile('setuptools-67.6.1-py3-none-any.whl'),
--               support.findfile('wheel-0.40.0-py3-none-any.whl')]
-+               support._findwheel('setuptools'),
-+               support._findwheel('wheel')]
-         run_cmd('Install build dependencies', cmd)
- 
-         # Build and install the C++ extension
diff --git a/python3.12.spec b/python3.12.spec
index f81b273..ae939ab 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,10 +14,10 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel b2
+%global prerel b3
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -362,12 +362,6 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00401 # 48310af24b090719553bf0e9c965d80524e0b40e
-# Tests: Use setuptools+wheel from sysconfig.get_config_var('WHEEL_PKG_DIR') if set
-#
-# Proposed upstream https://github.com/python/cpython/pull/105056
-Patch401: 00401-tests-use-setuptools-wheel-from-sysconfig-get_config_var-wheel_pkg_dir-if-set.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1657,6 +1651,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Jun 20 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b3-1
+- Update to 3.12.0b3
+
 * Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.12.0~b2-3
 - Rebuilt for Python 3.12
 
diff --git a/sources b/sources
index 60ad9b4..ec8436c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0b2.tar.xz) = 9bfac70f2ccc1f6798bc63a55d92f0b162e3a9077624a2e37448002ea310cb7b1da64ad2aceda795b45de91f60eb4d95dde85984900e54906d814625b42143b5
-SHA512 (Python-3.12.0b2.tar.xz.asc) = 22a1f2c3335bc428cfee0ce2e081aeed24474d3cd877fac1cc4cf92b4a2bee70f85aed0068a71600cddef9c8b46bbde257a92c57bd494ad820c0686ab7c8c0f0
+SHA512 (Python-3.12.0b3.tar.xz) = 2d83285ea09445da25204285937366b20793b12223f5a0979276633213773d14de6dbb6a311629b755962804d8521b30cf9fe032f447608b6df7af721a18ba0c
+SHA512 (Python-3.12.0b3.tar.xz.asc) = ab0d91f3c2fc001fe924f71182526d543a3c9e65238954bb954c58d03171a6cb3640a15570d2d7b889c6251fd876790121cd36bcc29a901f53d17f5f4f8f6f4e

From 2d8f88843066541e22a4ebe3f1335e1369940a2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 21 Jun 2023 10:04:34 +0200
Subject: [PATCH 21/93] Backport upstream patch to add PyType_GetDict()
 function

---
 00402-add-pytype_getdict.patch | 126 +++++++++++++++++++++++++++++++++
 python3.12.spec                |  12 +++-
 2 files changed, 137 insertions(+), 1 deletion(-)
 create mode 100644 00402-add-pytype_getdict.patch

diff --git a/00402-add-pytype_getdict.patch b/00402-add-pytype_getdict.patch
new file mode 100644
index 0000000..661c4fb
--- /dev/null
+++ b/00402-add-pytype_getdict.patch
@@ -0,0 +1,126 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Eric Snow <ericsnowcurrently@gmail.com>
+Date: Wed, 21 Jun 2023 09:51:01 +0200
+Subject: [PATCH] 00402: Add PyType_GetDict()
+
+This patch should make pyqt6 build with Python 3.12.
+For more info see: https://github.com/python/cpython/pull/105747
+---
+ Doc/c-api/type.rst                              | 16 ++++++++++++++++
+ Doc/c-api/typeobj.rst                           | 17 +++++++++++++++--
+ Include/cpython/object.h                        |  1 +
+ ...23-06-13-14-24-55.gh-issue-105227.HDL9aF.rst |  5 +++++
+ Objects/typeobject.c                            |  7 +++++++
+ 5 files changed, 44 insertions(+), 2 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/C API/2023-06-13-14-24-55.gh-issue-105227.HDL9aF.rst
+
+diff --git a/Doc/c-api/type.rst b/Doc/c-api/type.rst
+index c99c7ef93a..8f883f5299 100644
+--- a/Doc/c-api/type.rst
++++ b/Doc/c-api/type.rst
+@@ -50,6 +50,22 @@ Type Objects
+       The return type is now ``unsigned long`` rather than ``long``.
+ 
+ 
++.. c:function:: PyObject* PyType_GetDict(PyTypeObject* type)
++
++   Return the type object's internal namespace, which is otherwise only
++   exposed via a read-only proxy (``cls.__dict__``).  This is a
++   replacement for accessing :c:member:`~PyTypeObject.tp_dict` directly.
++   The returned dictionary must be treated as read-only.
++
++   This function isn't intended for general use.  It's meant for
++   specific embedding and language-binding cases, where direct access
++   to the dict is necessary and indirect access (e.g. via the proxy)
++   isn't adequate.  Extension modules may continue to use ``tp_dict``,
++   directly or indirectly, when setting up their own types.
++
++   .. versionadded:: 3.12
++
++
+ .. c:function:: void PyType_Modified(PyTypeObject *type)
+ 
+    Invalidate the internal lookup cache for the type and all of its
+diff --git a/Doc/c-api/typeobj.rst b/Doc/c-api/typeobj.rst
+index c6e783acdf..46015bc108 100644
+--- a/Doc/c-api/typeobj.rst
++++ b/Doc/c-api/typeobj.rst
+@@ -110,7 +110,7 @@ Quick Reference
+    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
+    | :c:member:`~PyTypeObject.tp_base`              | :c:type:`PyTypeObject` *          | __base__          |   |   | X |   |
+    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
+-   | :c:member:`~PyTypeObject.tp_dict`              | :c:type:`PyObject` *              | __dict__          |   |   | ? |   |
++   | <<:c:member:`~PyTypeObject.tp_dict`>>          | :c:type:`PyObject` *              | __dict__          |   |   | ? |   |
+    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
+    | :c:member:`~PyTypeObject.tp_descr_get`         | :c:type:`descrgetfunc`            | __get__           |   |   |   | X |
+    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
+@@ -157,6 +157,9 @@ Quick Reference
+    **<>**: Names in angle brackets should be initially set to ``NULL`` and
+    treated as read-only.
+ 
++   **<<>>**: Names in double angle brackets should be initially set to
++   ``NULL`` and treated as read-only after initialization.
++
+    **[]**: Names in square brackets are for internal use only.
+ 
+    **<R>** (as a prefix) means the field is required (must be non-``NULL``).
+@@ -1717,7 +1720,17 @@ and :c:type:`PyType_Type` effectively act as defaults.)
+    called; it may also be initialized to a dictionary containing initial attributes
+    for the type.  Once :c:func:`PyType_Ready` has initialized the type, extra
+    attributes for the type may be added to this dictionary only if they don't
+-   correspond to overloaded operations (like :meth:`__add__`).
++   correspond to overloaded operations (like :meth:`__add__`).  Once
++   initialization for the type has finished, this field should be
++   treated as read-only.
++
++   .. versionchanged:: 3.12
++
++      Internals detail: For the static builtin types this is always ``NULL``.
++      Instead, the dict for each is stored on ``PyInterpreterState``.
++      If needed, use :c:func:`PyType_GetDict` to get the corresponding
++      dict for those types.  This is not normally necessary,
++      and certainly not for user-defined type objects.
+ 
+    **Inheritance:**
+ 
+diff --git a/Include/cpython/object.h b/Include/cpython/object.h
+index d8eff69103..c5d0851a4b 100644
+--- a/Include/cpython/object.h
++++ b/Include/cpython/object.h
+@@ -283,6 +283,7 @@ PyAPI_FUNC(PyTypeObject *) _PyType_CalculateMetaclass(PyTypeObject *, PyObject *
+ PyAPI_FUNC(PyObject *) _PyType_GetDocFromInternalDoc(const char *, const char *);
+ PyAPI_FUNC(PyObject *) _PyType_GetTextSignatureFromInternalDoc(const char *, const char *);
+ PyAPI_FUNC(PyObject *) PyType_GetModuleByDef(PyTypeObject *, PyModuleDef *);
++PyAPI_FUNC(PyObject *) PyType_GetDict(PyTypeObject *);
+ 
+ PyAPI_FUNC(int) PyObject_Print(PyObject *, FILE *, int);
+ PyAPI_FUNC(void) _Py_BreakPoint(void);
+diff --git a/Misc/NEWS.d/next/C API/2023-06-13-14-24-55.gh-issue-105227.HDL9aF.rst b/Misc/NEWS.d/next/C API/2023-06-13-14-24-55.gh-issue-105227.HDL9aF.rst
+new file mode 100644
+index 0000000000..6e0e5396f6
+--- /dev/null
++++ b/Misc/NEWS.d/next/C API/2023-06-13-14-24-55.gh-issue-105227.HDL9aF.rst	
+@@ -0,0 +1,5 @@
++The new :c:func:`PyType_GetDict` provides the dictionary for the given type
++object that is normally exposed by ``cls.__dict__``.  Normally it's
++sufficient to use :c:member:`~PyTypeObject.tp_dict`, but for the static
++builtin types ``tp_dict`` is now always ``NULL``.  ``PyType_GetDict()``
++provides the correct dict object instead.
+diff --git a/Objects/typeobject.c b/Objects/typeobject.c
+index bf33bde257..0deec50d63 100644
+--- a/Objects/typeobject.c
++++ b/Objects/typeobject.c
+@@ -238,6 +238,13 @@ _PyType_GetDict(PyTypeObject *self)
+     return lookup_tp_dict(self);
+ }
+ 
++PyObject *
++PyType_GetDict(PyTypeObject *self)
++{
++    PyObject *dict = lookup_tp_dict(self);
++    return _Py_XNewRef(dict);
++}
++
+ static inline void
+ set_tp_dict(PyTypeObject *self, PyObject *dict)
+ {
diff --git a/python3.12.spec b/python3.12.spec
index ae939ab..e0a0083 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel b3
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -362,6 +362,13 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
+# 00402 # ecae89d5edb8d253925dce12c3c56d1a6da198f3
+# Add PyType_GetDict()
+#
+# This patch should make pyqt6 build with Python 3.12.
+# For more info see: https://github.com/python/cpython/pull/105747
+Patch402: 00402-add-pytype_getdict.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1651,6 +1658,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Jun 21 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b3-2
+- Backport upstream patch to add PyType_GetDict() function
+
 * Tue Jun 20 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b3-1
 - Update to 3.12.0b3
 

From bc99d88db7c098a0901dc9ba76344472599f4c3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Wed, 12 Jul 2023 06:58:31 +0200
Subject: [PATCH 22/93] Update to 3.12.0b4

Patch 402 is part of this release.
---
 00402-add-pytype_getdict.patch | 126 ---------------------------------
 python3.12.spec                |  14 ++--
 sources                        |   4 +-
 3 files changed, 7 insertions(+), 137 deletions(-)
 delete mode 100644 00402-add-pytype_getdict.patch

diff --git a/00402-add-pytype_getdict.patch b/00402-add-pytype_getdict.patch
deleted file mode 100644
index 661c4fb..0000000
--- a/00402-add-pytype_getdict.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Eric Snow <ericsnowcurrently@gmail.com>
-Date: Wed, 21 Jun 2023 09:51:01 +0200
-Subject: [PATCH] 00402: Add PyType_GetDict()
-
-This patch should make pyqt6 build with Python 3.12.
-For more info see: https://github.com/python/cpython/pull/105747
----
- Doc/c-api/type.rst                              | 16 ++++++++++++++++
- Doc/c-api/typeobj.rst                           | 17 +++++++++++++++--
- Include/cpython/object.h                        |  1 +
- ...23-06-13-14-24-55.gh-issue-105227.HDL9aF.rst |  5 +++++
- Objects/typeobject.c                            |  7 +++++++
- 5 files changed, 44 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/C API/2023-06-13-14-24-55.gh-issue-105227.HDL9aF.rst
-
-diff --git a/Doc/c-api/type.rst b/Doc/c-api/type.rst
-index c99c7ef93a..8f883f5299 100644
---- a/Doc/c-api/type.rst
-+++ b/Doc/c-api/type.rst
-@@ -50,6 +50,22 @@ Type Objects
-       The return type is now ``unsigned long`` rather than ``long``.
- 
- 
-+.. c:function:: PyObject* PyType_GetDict(PyTypeObject* type)
-+
-+   Return the type object's internal namespace, which is otherwise only
-+   exposed via a read-only proxy (``cls.__dict__``).  This is a
-+   replacement for accessing :c:member:`~PyTypeObject.tp_dict` directly.
-+   The returned dictionary must be treated as read-only.
-+
-+   This function isn't intended for general use.  It's meant for
-+   specific embedding and language-binding cases, where direct access
-+   to the dict is necessary and indirect access (e.g. via the proxy)
-+   isn't adequate.  Extension modules may continue to use ``tp_dict``,
-+   directly or indirectly, when setting up their own types.
-+
-+   .. versionadded:: 3.12
-+
-+
- .. c:function:: void PyType_Modified(PyTypeObject *type)
- 
-    Invalidate the internal lookup cache for the type and all of its
-diff --git a/Doc/c-api/typeobj.rst b/Doc/c-api/typeobj.rst
-index c6e783acdf..46015bc108 100644
---- a/Doc/c-api/typeobj.rst
-+++ b/Doc/c-api/typeobj.rst
-@@ -110,7 +110,7 @@ Quick Reference
-    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
-    | :c:member:`~PyTypeObject.tp_base`              | :c:type:`PyTypeObject` *          | __base__          |   |   | X |   |
-    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
--   | :c:member:`~PyTypeObject.tp_dict`              | :c:type:`PyObject` *              | __dict__          |   |   | ? |   |
-+   | <<:c:member:`~PyTypeObject.tp_dict`>>          | :c:type:`PyObject` *              | __dict__          |   |   | ? |   |
-    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
-    | :c:member:`~PyTypeObject.tp_descr_get`         | :c:type:`descrgetfunc`            | __get__           |   |   |   | X |
-    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
-@@ -157,6 +157,9 @@ Quick Reference
-    **<>**: Names in angle brackets should be initially set to ``NULL`` and
-    treated as read-only.
- 
-+   **<<>>**: Names in double angle brackets should be initially set to
-+   ``NULL`` and treated as read-only after initialization.
-+
-    **[]**: Names in square brackets are for internal use only.
- 
-    **<R>** (as a prefix) means the field is required (must be non-``NULL``).
-@@ -1717,7 +1720,17 @@ and :c:type:`PyType_Type` effectively act as defaults.)
-    called; it may also be initialized to a dictionary containing initial attributes
-    for the type.  Once :c:func:`PyType_Ready` has initialized the type, extra
-    attributes for the type may be added to this dictionary only if they don't
--   correspond to overloaded operations (like :meth:`__add__`).
-+   correspond to overloaded operations (like :meth:`__add__`).  Once
-+   initialization for the type has finished, this field should be
-+   treated as read-only.
-+
-+   .. versionchanged:: 3.12
-+
-+      Internals detail: For the static builtin types this is always ``NULL``.
-+      Instead, the dict for each is stored on ``PyInterpreterState``.
-+      If needed, use :c:func:`PyType_GetDict` to get the corresponding
-+      dict for those types.  This is not normally necessary,
-+      and certainly not for user-defined type objects.
- 
-    **Inheritance:**
- 
-diff --git a/Include/cpython/object.h b/Include/cpython/object.h
-index d8eff69103..c5d0851a4b 100644
---- a/Include/cpython/object.h
-+++ b/Include/cpython/object.h
-@@ -283,6 +283,7 @@ PyAPI_FUNC(PyTypeObject *) _PyType_CalculateMetaclass(PyTypeObject *, PyObject *
- PyAPI_FUNC(PyObject *) _PyType_GetDocFromInternalDoc(const char *, const char *);
- PyAPI_FUNC(PyObject *) _PyType_GetTextSignatureFromInternalDoc(const char *, const char *);
- PyAPI_FUNC(PyObject *) PyType_GetModuleByDef(PyTypeObject *, PyModuleDef *);
-+PyAPI_FUNC(PyObject *) PyType_GetDict(PyTypeObject *);
- 
- PyAPI_FUNC(int) PyObject_Print(PyObject *, FILE *, int);
- PyAPI_FUNC(void) _Py_BreakPoint(void);
-diff --git a/Misc/NEWS.d/next/C API/2023-06-13-14-24-55.gh-issue-105227.HDL9aF.rst b/Misc/NEWS.d/next/C API/2023-06-13-14-24-55.gh-issue-105227.HDL9aF.rst
-new file mode 100644
-index 0000000000..6e0e5396f6
---- /dev/null
-+++ b/Misc/NEWS.d/next/C API/2023-06-13-14-24-55.gh-issue-105227.HDL9aF.rst	
-@@ -0,0 +1,5 @@
-+The new :c:func:`PyType_GetDict` provides the dictionary for the given type
-+object that is normally exposed by ``cls.__dict__``.  Normally it's
-+sufficient to use :c:member:`~PyTypeObject.tp_dict`, but for the static
-+builtin types ``tp_dict`` is now always ``NULL``.  ``PyType_GetDict()``
-+provides the correct dict object instead.
-diff --git a/Objects/typeobject.c b/Objects/typeobject.c
-index bf33bde257..0deec50d63 100644
---- a/Objects/typeobject.c
-+++ b/Objects/typeobject.c
-@@ -238,6 +238,13 @@ _PyType_GetDict(PyTypeObject *self)
-     return lookup_tp_dict(self);
- }
- 
-+PyObject *
-+PyType_GetDict(PyTypeObject *self)
-+{
-+    PyObject *dict = lookup_tp_dict(self);
-+    return _Py_XNewRef(dict);
-+}
-+
- static inline void
- set_tp_dict(PyTypeObject *self, PyObject *dict)
- {
diff --git a/python3.12.spec b/python3.12.spec
index e0a0083..7998f07 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,10 +14,10 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel b3
+%global prerel b4
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -362,13 +362,6 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00402 # ecae89d5edb8d253925dce12c3c56d1a6da198f3
-# Add PyType_GetDict()
-#
-# This patch should make pyqt6 build with Python 3.12.
-# For more info see: https://github.com/python/cpython/pull/105747
-Patch402: 00402-add-pytype_getdict.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1658,6 +1651,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Jul 12 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~b4-1
+- Update to 3.12.0b4
+
 * Wed Jun 21 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b3-2
 - Backport upstream patch to add PyType_GetDict() function
 
diff --git a/sources b/sources
index ec8436c..fd50c0a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0b3.tar.xz) = 2d83285ea09445da25204285937366b20793b12223f5a0979276633213773d14de6dbb6a311629b755962804d8521b30cf9fe032f447608b6df7af721a18ba0c
-SHA512 (Python-3.12.0b3.tar.xz.asc) = ab0d91f3c2fc001fe924f71182526d543a3c9e65238954bb954c58d03171a6cb3640a15570d2d7b889c6251fd876790121cd36bcc29a901f53d17f5f4f8f6f4e
+SHA512 (Python-3.12.0b4.tar.xz) = 942a47d12c51e13939c815de908e766b818e4862c536153ae94b8032b5263b0cc23bda9a75fe60f48ee400a4ce405e2583da684847623cf552c20efcbc663469
+SHA512 (Python-3.12.0b4.tar.xz.asc) = ab2684cc4044bf39c8064ec7d41dc2d04f01c9bccf5404ec1fffbce89a3a831b4d7dac3613ef892988a16839aeb13cbc03a085fae5c086ee19d3bfb925dff6c0

From 88668cf1f4c30395bd48e21b55a423f13b560da0 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 21 Jul 2023 15:42:31 +0000
Subject: [PATCH 23/93] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 7998f07..c435d13 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel b4
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -1651,6 +1651,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0~b4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
 * Wed Jul 12 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~b4-1
 - Update to 3.12.0b4
 

From 1f830e372bc5d86f1eaad9fcc3e7b6f98677cfe8 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Mon, 22 May 2023 19:23:07 +0200
Subject: [PATCH 24/93] Remove extra distro-applied CFLAGS passed to user-built
 C extensions

Only -fexceptions and -fcf-protection are preserved for binary
compatibility with user-built python C extension.

https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
---
 python3.12.spec | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index c435d13..0b363ab 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 %global prerel b4
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -739,14 +739,15 @@ topdir=$(pwd)
 # Standard library built here will still use the %%build_...flags,
 # Fedora packages utilizing %%py3_build will use them as well
 # https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
-export CFLAGS="%{extension_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
+# https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
+export CFLAGS="%{extension_cflags}"
 export CFLAGS_NODIST="%{build_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
-export CXXFLAGS="%{extension_cxxflags} -D_GNU_SOURCE -fPIC -fwrapv"
+export CXXFLAGS="%{extension_cxxflags}"
 export CPPFLAGS="$(pkg-config --cflags-only-I libffi)"
-export OPT="%{extension_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
+export OPT="%{extension_cflags}"
 export LINKCC="gcc"
 export CFLAGS="$CFLAGS $(pkg-config --cflags openssl)"
-export LDFLAGS="%{extension_ldflags} -g $(pkg-config --libs-only-L openssl)"
+export LDFLAGS="%{extension_ldflags} $(pkg-config --libs-only-L openssl)"
 export LDFLAGS_NODIST="%{build_ldflags} -g $(pkg-config --libs-only-L openssl)"
 
 # We can build several different configurations of Python: regular and debug.
@@ -1651,6 +1652,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Aug 02 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.12.0~b4-3
+- Remove extra distro-applied CFLAGS passed to user built C extensions
+- https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
+
 * Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0~b4-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 

From 0483fca31ab44621e5c9f4505c9c16341959b0c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Mon, 7 Aug 2023 09:11:47 +0200
Subject: [PATCH 25/93] Update to 3.12.0rc1

---
 python3.12.spec | 33 +++++++++++++++++++++------------
 sources         |  4 ++--
 2 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 0b363ab..a0e91de 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,10 +14,10 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel b4
+%global prerel rc1
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -71,7 +71,7 @@ License: Python-2.0.1
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 23.1.2
+%global pip_version 23.2.1
 %global setuptools_version 67.6.1
 %global wheel_version 0.40.0
 # All of those also include a list of indirect bundled libs:
@@ -79,7 +79,7 @@ License: Python-2.0.1
 #  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
 %global pip_bundled_provides %{expand:
 Provides: bundled(python3dist(cachecontrol)) = 0.12.11
-Provides: bundled(python3dist(certifi)) = 2022.12.7
+Provides: bundled(python3dist(certifi)) = 2023.5.7
 Provides: bundled(python3dist(chardet)) = 5.1
 Provides: bundled(python3dist(colorama)) = 0.4.6
 Provides: bundled(python3dist(distlib)) = 0.3.6
@@ -87,19 +87,19 @@ Provides: bundled(python3dist(distro)) = 1.8
 Provides: bundled(python3dist(idna)) = 3.4
 Provides: bundled(python3dist(msgpack)) = 1.0.5
 Provides: bundled(python3dist(packaging)) = 21.3
-Provides: bundled(python3dist(platformdirs)) = 3.2
-Provides: bundled(python3dist(pygments)) = 2.14
-Provides: bundled(python3dist(pyparsing)) = 3.0.9
+Provides: bundled(python3dist(platformdirs)) = 3.8.1
+Provides: bundled(python3dist(pygments)) = 2.15.1
+Provides: bundled(python3dist(pyparsing)) = 3.1
 Provides: bundled(python3dist(pyproject-hooks)) = 1
-Provides: bundled(python3dist(requests)) = 2.28.2
+Provides: bundled(python3dist(requests)) = 2.31
 Provides: bundled(python3dist(resolvelib)) = 1.0.1
-Provides: bundled(python3dist(rich)) = 13.3.3
-Provides: bundled(python3dist(setuptools)) = 67.7.2
+Provides: bundled(python3dist(rich)) = 13.4.2
+Provides: bundled(python3dist(setuptools)) = 68
 Provides: bundled(python3dist(six)) = 1.16
 Provides: bundled(python3dist(tenacity)) = 8.2.2
 Provides: bundled(python3dist(tomli)) = 2.0.1
-Provides: bundled(python3dist(typing-extensions)) = 4.5
-Provides: bundled(python3dist(urllib3)) = 1.26.15
+Provides: bundled(python3dist(typing-extensions)) = 4.7.1
+Provides: bundled(python3dist(urllib3)) = 1.26.16
 Provides: bundled(python3dist(webencodings)) = 0.5.1
 }
 # setuptools
@@ -1140,10 +1140,14 @@ CheckPython() {
   # test_freeze_simple_script is skipped, because it fails without bundled libs.
   #  the freeze tool is only usable from the source checkout anyway,
   #  we don't ship it in the RPM package.
+  # test_check_probes is failing since it was introduced in 3.12.0rc1,
+  # the test is skipped until it is fixed in upstream.
+  # see: https://github.com/python/cpython/issues/104280#issuecomment-1669249980
 
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
     -wW --slowest %{_smp_mflags} --timeout=2700 \
     -i test_freeze_simple_script \
+    -i test_check_probes \
     %ifarch %{mips64}
     -x test_ctypes \
     %endif
@@ -1396,6 +1400,8 @@ CheckPython optimized
 %dir %{pylibdir}/zipfile/
 %{pylibdir}/zipfile/*.py
 %{pylibdir}/zipfile/__pycache__/*%{bytecode_suffixes}
+%{pylibdir}/zipfile/_path/*.py
+%{pylibdir}/zipfile/_path/__pycache__/*%{bytecode_suffixes}
 
 %{pylibdir}/zoneinfo
 
@@ -1652,6 +1658,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon Aug 07 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~rc1-1
+- Update to 3.12.0rc1
+
 * Wed Aug 02 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.12.0~b4-3
 - Remove extra distro-applied CFLAGS passed to user built C extensions
 - https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
diff --git a/sources b/sources
index fd50c0a..241fcf6 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0b4.tar.xz) = 942a47d12c51e13939c815de908e766b818e4862c536153ae94b8032b5263b0cc23bda9a75fe60f48ee400a4ce405e2583da684847623cf552c20efcbc663469
-SHA512 (Python-3.12.0b4.tar.xz.asc) = ab2684cc4044bf39c8064ec7d41dc2d04f01c9bccf5404ec1fffbce89a3a831b4d7dac3613ef892988a16839aeb13cbc03a085fae5c086ee19d3bfb925dff6c0
+SHA512 (Python-3.12.0rc1.tar.xz) = 67c38317e34aa1c4ced831cf50f74de21f9e40ce708397be3682d0c1012c3e0b2617d77525dc6c3246725dfc11b5448792adc0ef2e3741e818776bc5fba0c50d
+SHA512 (Python-3.12.0rc1.tar.xz.asc) = 319ce9c5d935dcbb5ea12468c5127b4541c1b8af443aef210bdd26030fc3eee062639601fd72e70428cc18179fafb33ad2527a0c262650c4da678544fd06d0b9

From 67ba754f51bfee0739a49e4febf632b1d56f6e59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Tue, 29 Aug 2023 13:54:08 +0000
Subject: [PATCH 26/93] Temporarily skip test_check_probes in CI tests

See: https://github.com/python/cpython/issues/104280#issuecomment-1669249980
---
 tests/tests.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index 4f7e7d4..28e8476 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -30,10 +30,10 @@
         run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} CYTHON=false ./venv.sh"
     - selftest:
         dir: python/selftest
-        run: "VERSION={{ pybasever }} X='' ./parallel.sh"
+        run: "VERSION={{ pybasever }} X='-i test_check_probes' ./parallel.sh"
     - debugtest:
         dir: python/selftest
-        run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='' ./parallel.sh"
+        run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='-i test_check_probes' ./parallel.sh"
     - debugflags:
         dir: python/flags
         run: "python{{ pybasever }}d ./assertflags.py -O0"

From 614cafc40073fcdd4df1543d966efe651d7de3ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 6 Sep 2023 14:15:23 +0200
Subject: [PATCH 27/93] Update to 3.12.0rc2

---
 python3.12.spec | 5 ++++-
 sources         | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index a0e91de..86b91e7 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,7 +14,7 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel rc1
+%global prerel rc2
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
@@ -1658,6 +1658,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Sep 06 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~rc2-1
+- Update to 3.12.0rc2
+
 * Mon Aug 07 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~rc1-1
 - Update to 3.12.0rc1
 
diff --git a/sources b/sources
index 241fcf6..7155d07 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0rc1.tar.xz) = 67c38317e34aa1c4ced831cf50f74de21f9e40ce708397be3682d0c1012c3e0b2617d77525dc6c3246725dfc11b5448792adc0ef2e3741e818776bc5fba0c50d
-SHA512 (Python-3.12.0rc1.tar.xz.asc) = 319ce9c5d935dcbb5ea12468c5127b4541c1b8af443aef210bdd26030fc3eee062639601fd72e70428cc18179fafb33ad2527a0c262650c4da678544fd06d0b9
+SHA512 (Python-3.12.0rc2.tar.xz) = 102fbce1db186e95df586eeb56e7a3c2c9dee388670aef9c9caf4eb652cad528291601186c8dee5653f064b2f606ccac37bcb81d5afe77853db768bc4291f8a4
+SHA512 (Python-3.12.0rc2.tar.xz.asc) = e5cd0952fe20f7b5022be3bc057eb83ae64304640f0761bbf08382be733ed7e6ed75c113b844e827903634c701641644298f26e2d6624857760eda1908382428

From fb0049bb7a4354474dc572ee241b6f6a47e256e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Tue, 19 Sep 2023 23:20:46 +0200
Subject: [PATCH 28/93] Update to 3.12.0rc3

---
 python3.12.spec | 5 ++++-
 sources         | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 86b91e7..dd8c09c 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,7 +14,7 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel rc2
+%global prerel rc3
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
@@ -1658,6 +1658,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Sep 19 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~rc3-1
+- Update to 3.12.0rc3
+
 * Wed Sep 06 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~rc2-1
 - Update to 3.12.0rc2
 
diff --git a/sources b/sources
index 7155d07..fdda1c3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0rc2.tar.xz) = 102fbce1db186e95df586eeb56e7a3c2c9dee388670aef9c9caf4eb652cad528291601186c8dee5653f064b2f606ccac37bcb81d5afe77853db768bc4291f8a4
-SHA512 (Python-3.12.0rc2.tar.xz.asc) = e5cd0952fe20f7b5022be3bc057eb83ae64304640f0761bbf08382be733ed7e6ed75c113b844e827903634c701641644298f26e2d6624857760eda1908382428
+SHA512 (Python-3.12.0rc3.tar.xz) = a256147099add2da96f7dc97f965ec342317c0c021f4702ed38718e64d90a28356a266cd2786c10baab6d07bd9dc111f1c1d66ca7dc92e93674e339e990a8a83
+SHA512 (Python-3.12.0rc3.tar.xz.asc) = 224d4402b96d6f5938d0eec83a3e494e25b4d883f9466c653788b86fc4ce5ab26ac8d9891f7aa20a6bd4766a5bc47fbe19afbc27db9148071b6b215bbdcc32f6

From 187d5c28b8aca141db09477f8b34805b148e68ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Mon, 2 Oct 2023 18:40:13 +0200
Subject: [PATCH 29/93] Update to 3.12.0 final

---
 python3.12.spec | 5 ++++-
 sources         | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index dd8c09c..a38beb4 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -14,7 +14,7 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 %global general_version %{pybasever}.0
-%global prerel rc3
+#global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
@@ -1658,6 +1658,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon Oct 02 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0-1
+- Update to 3.12.0 final
+
 * Tue Sep 19 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~rc3-1
 - Update to 3.12.0rc3
 
diff --git a/sources b/sources
index fdda1c3..241a3d5 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0rc3.tar.xz) = a256147099add2da96f7dc97f965ec342317c0c021f4702ed38718e64d90a28356a266cd2786c10baab6d07bd9dc111f1c1d66ca7dc92e93674e339e990a8a83
-SHA512 (Python-3.12.0rc3.tar.xz.asc) = 224d4402b96d6f5938d0eec83a3e494e25b4d883f9466c653788b86fc4ce5ab26ac8d9891f7aa20a6bd4766a5bc47fbe19afbc27db9148071b6b215bbdcc32f6
+SHA512 (Python-3.12.0.tar.xz) = 4d5353151fd1dad80fe96bd2a668cec27287a0dad85086239597166f8189d4edf6c4800ed14f39c8e54816076fec13ba405d6bfa1123ad2dada8cf85c60025e6
+SHA512 (Python-3.12.0.tar.xz.asc) = 2c457f51cd4269deb2c644b35da1c617d1b1d53a6093da77b967f4e5661bc3400c70808aab4f619d9035fd33e656653f992d308c683e26f1505929a3a59b4ce2

From 261b6e48d6d546799c4251b54ff75654a7978c5d Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Thu, 7 Sep 2023 22:51:19 -0400
Subject: [PATCH 30/93] Use bundled libb2 in RHEL builds

Standalone libb2 is unwanted in RHEL.
---
 python3.12.spec | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index a38beb4..003ef8a 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -255,7 +255,9 @@ BuildRequires: glibc-devel
 BuildRequires: gmp-devel
 BuildRequires: gnupg2
 BuildRequires: libappstream-glib
+%if %{undefined rhel}
 BuildRequires: libb2-devel
+%endif
 BuildRequires: libffi-devel
 BuildRequires: libnsl2-devel
 BuildRequires: libtirpc-devel
@@ -484,15 +486,21 @@ Summary:        Python runtime libraries
 
 %if %{with rpmwheels}
 Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
+# Bundled libb2 is CC0, covered by grandfathering exception
+License: Python-2.0.1 AND CC0-1.0
 %else
 Provides: bundled(python3dist(pip)) = %{pip_version}
 %pip_bundled_provides
 # License manually combined form Python + pip
-License: Python-2.0.1 AND MIT AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
+License: Python-2.0.1 AND CC0-1.0 AND MIT AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
 %endif
 
 %unversioned_obsoletes_of_python3_X_if_main libs
 
+# Bundled internal headers are used even when building with system libb2
+# last updated by https://github.com/python/cpython/pull/6286
+Provides: bundled(libb2) = 0.98.1
+
 # There are files in the standard library that have python shebang.
 # We've filtered the automatic requirement out so libs are installable without
 # the main package. This however makes it pulled in by default.
@@ -1658,6 +1666,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Oct 05 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 3.12.0-2
+- Use bundled libb2 in RHEL builds
+
 * Mon Oct 02 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0-1
 - Update to 3.12.0 final
 

From c41c6b28ff8a240232680c528048f19c629fff34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Wed, 18 Oct 2023 11:23:30 +0200
Subject: [PATCH 31/93] CI: Run smoke test with cython

---
 tests/tests.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/tests.yml b/tests/tests.yml
index 28e8476..cc1e061 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -21,13 +21,13 @@
         run: rpm -qa
     - smoke:
         dir: python/smoke
-        run: "VERSION={{ pybasever }} CYTHON=false ./venv.sh"
+        run: "VERSION={{ pybasever }} ./venv.sh"
     - smoke_virtualenv:
         dir: python/smoke
-        run: "VERSION={{ pybasever }} METHOD=virtualenv CYTHON=false ./venv.sh"
+        run: "VERSION={{ pybasever }} METHOD=virtualenv ./venv.sh"
     - debugsmoke:
         dir: python/smoke
-        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} CYTHON=false ./venv.sh"
+        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} ./venv.sh"
     - selftest:
         dir: python/selftest
         run: "VERSION={{ pybasever }} X='-i test_check_probes' ./parallel.sh"

From cc458c9fb3719827b264e85ba48742f431a3817c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Fri, 8 Dec 2023 10:04:15 +0100
Subject: [PATCH 32/93] Update to 3.12.1

---
 ...-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch | 8 ++++----
 check-pyc-timestamps.py                                   | 6 ++++--
 python3.12.spec                                           | 7 +++++--
 sources                                                   | 4 ++--
 4 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index b5b3461..5603025 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -16,10 +16,10 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 9e4972ecb6..6f081d8f38 100644
+index 756d5e329f..5d09775efc 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
-@@ -987,39 +987,6 @@ def noop(): pass
+@@ -1007,39 +1007,6 @@ def noop(): pass
              threading.Thread(target=noop).start()
              # Thread.join() is not called
  
@@ -60,10 +60,10 @@ index 9e4972ecb6..6f081d8f38 100644
          code = """if 1:
              import atexit
 diff --git a/Lib/threading.py b/Lib/threading.py
-index df273870fa..eba297776d 100644
+index 8dcaf8ca6a..ed0b0f4632 100644
 --- a/Lib/threading.py
 +++ b/Lib/threading.py
-@@ -1565,29 +1565,20 @@ def _shutdown():
+@@ -1586,29 +1586,20 @@ def _shutdown():
  
      global _SHUTTING_DOWN
      _SHUTTING_DOWN = True
diff --git a/check-pyc-timestamps.py b/check-pyc-timestamps.py
index c2b7430..8378c3e 100644
--- a/check-pyc-timestamps.py
+++ b/check-pyc-timestamps.py
@@ -16,9 +16,11 @@ LEVELS = (None, 1, 2)
 # list of globs of test and other files that we expect not to have bytecode
 not_compiled = [
     '/usr/bin/*',
-    '*/test/bad_coding.py',
-    '*/test/bad_coding2.py',
     '*/test/badsyntax_*.py',
+    '*/tokenizedata/bad_coding.py',
+    '*/tokenizedata/bad_coding2.py',
+    '*/tokenizedata/badsyntax_*.py',
+    '*/test_future_stmt/badsyntax_*.py',
     '*/test_lib2to3/data/*.py',
     '*/test_lib2to3/data/*/*.py',
     '*/test_lib2to3/data/*/*/*.py',
diff --git a/python3.12.spec b/python3.12.spec
index 003ef8a..3b5dd66 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.0
+%global general_version %{pybasever}.1
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -1666,6 +1666,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Dec 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.1-1
+- Update to 3.12.1
+
 * Thu Oct 05 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 3.12.0-2
 - Use bundled libb2 in RHEL builds
 
diff --git a/sources b/sources
index 241a3d5..b9328ce 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.0.tar.xz) = 4d5353151fd1dad80fe96bd2a668cec27287a0dad85086239597166f8189d4edf6c4800ed14f39c8e54816076fec13ba405d6bfa1123ad2dada8cf85c60025e6
-SHA512 (Python-3.12.0.tar.xz.asc) = 2c457f51cd4269deb2c644b35da1c617d1b1d53a6093da77b967f4e5661bc3400c70808aab4f619d9035fd33e656653f992d308c683e26f1505929a3a59b4ce2
+SHA512 (Python-3.12.1.tar.xz) = 44cf06b89ade692d87ca3105d8e3de5c7ce3f5fb318690fff513cf56f909ff5e0d0f6a0b22ae270b12e1fe3051b1bde3ec786506ec87c810b1d02e92e45dff07
+SHA512 (Python-3.12.1.tar.xz.asc) = 1c85237b5921fbf940ded4e038d99c8d02682fcb357b5de761eb5bebf94142b308a11654fc6312129663727e2ce1f546fbb5a5a3747d7dc02fc7dced9cb968fd

From 3c67985ace337c7627a2487b770188c3c0f22d80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Tue, 5 Dec 2023 12:00:52 +0100
Subject: [PATCH 33/93] Own stray directories in /usr/lib64/python3.12

Fixes https://bugzilla.redhat.com/2252143
---
 python3.12.spec | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 3b5dd66..c2c04a4 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -1388,6 +1388,7 @@ CheckPython optimized
 %{pylibdir}/multiprocessing
 
 %dir %{pylibdir}/re/
+%dir %{pylibdir}/re/__pycache__/
 %{pylibdir}/re/*.py
 %{pylibdir}/re/__pycache__/*%{bytecode_suffixes}
 
@@ -1397,6 +1398,7 @@ CheckPython optimized
 %{pylibdir}/sqlite3/__pycache__/*%{bytecode_suffixes}
 
 %dir %{pylibdir}/tomllib/
+%dir %{pylibdir}/tomllib/__pycache__/
 %{pylibdir}/tomllib/*.py
 %{pylibdir}/tomllib/__pycache__/*%{bytecode_suffixes}
 %exclude %{pylibdir}/turtle.py
@@ -1406,14 +1408,18 @@ CheckPython optimized
 %{pylibdir}/xml
 
 %dir %{pylibdir}/zipfile/
+%dir %{pylibdir}/zipfile/__pycache__/
 %{pylibdir}/zipfile/*.py
 %{pylibdir}/zipfile/__pycache__/*%{bytecode_suffixes}
+%dir %{pylibdir}/zipfile/_path/
+%dir %{pylibdir}/zipfile/_path/__pycache__/
 %{pylibdir}/zipfile/_path/*.py
 %{pylibdir}/zipfile/_path/__pycache__/*%{bytecode_suffixes}
 
 %{pylibdir}/zoneinfo
 
-%dir %{pylibdir}/__phello__
+%dir %{pylibdir}/__phello__/
+%dir %{pylibdir}/__phello__/__pycache__/
 %{pylibdir}/__phello__/__init__.py
 %{pylibdir}/__phello__/spam.py
 %{pylibdir}/__phello__/__pycache__/*%{bytecode_suffixes}
@@ -1668,6 +1674,8 @@ CheckPython optimized
 %changelog
 * Fri Dec 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.1-1
 - Update to 3.12.1
+- Own stray directories in /usr/lib64/python3.12
+- Fixes: rhbz#2252143
 
 * Thu Oct 05 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 3.12.0-2
 - Use bundled libb2 in RHEL builds

From 7a094a057183ba49527fcac7e9e5c863f74bc55a Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Mon, 18 Dec 2023 13:17:51 +0100
Subject: [PATCH 34/93] Security fix for CVE-2023-27043 (rhbz#2196190)

---
 ...-addresses-in-email-parseaddr-111116.patch | 483 ++++++++++++++++++
 python3.12.spec                               |  14 +-
 2 files changed, 496 insertions(+), 1 deletion(-)
 create mode 100644 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch

diff --git a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
new file mode 100644
index 0000000..e77ddd8
--- /dev/null
+++ b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
@@ -0,0 +1,483 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Fri, 15 Dec 2023 16:10:40 +0100
+Subject: [PATCH] 00415: [CVE-2023-27043] gh-102988: Reject malformed addresses
+ in email.parseaddr() (#111116)
+
+Detect email address parsing errors and return empty tuple to
+indicate the parsing error (old API). Add an optional 'strict'
+parameter to getaddresses() and parseaddr() functions. Patch by
+Thomas Dwyer.
+
+Co-Authored-By: Thomas Dwyer <github@tomd.tel>
+---
+ Doc/library/email.utils.rst                   |  19 +-
+ Lib/email/utils.py                            | 151 +++++++++++++-
+ Lib/test/test_email/test_email.py             | 187 +++++++++++++++++-
+ ...-10-20-15-28-08.gh-issue-102988.dStNO7.rst |   8 +
+ 4 files changed, 344 insertions(+), 21 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
+
+diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
+index 345b64001c..d693a9bc39 100644
+--- a/Doc/library/email.utils.rst
++++ b/Doc/library/email.utils.rst
+@@ -58,13 +58,18 @@ of the new API.
+    begins with angle brackets, they are stripped off.
+ 
+ 
+-.. function:: parseaddr(address)
++.. function:: parseaddr(address, *, strict=True)
+ 
+    Parse address -- which should be the value of some address-containing field such
+    as :mailheader:`To` or :mailheader:`Cc` -- into its constituent *realname* and
+    *email address* parts.  Returns a tuple of that information, unless the parse
+    fails, in which case a 2-tuple of ``('', '')`` is returned.
+ 
++   If *strict* is true, use a strict parser which rejects malformed inputs.
++
++   .. versionchanged:: 3.13
++      Add *strict* optional parameter and reject malformed inputs by default.
++
+ 
+ .. function:: formataddr(pair, charset='utf-8')
+ 
+@@ -82,12 +87,15 @@ of the new API.
+       Added the *charset* option.
+ 
+ 
+-.. function:: getaddresses(fieldvalues)
++.. function:: getaddresses(fieldvalues, *, strict=True)
+ 
+    This method returns a list of 2-tuples of the form returned by ``parseaddr()``.
+    *fieldvalues* is a sequence of header field values as might be returned by
+-   :meth:`Message.get_all <email.message.Message.get_all>`.  Here's a simple
+-   example that gets all the recipients of a message::
++   :meth:`Message.get_all <email.message.Message.get_all>`.
++
++   If *strict* is true, use a strict parser which rejects malformed inputs.
++
++   Here's a simple example that gets all the recipients of a message::
+ 
+       from email.utils import getaddresses
+ 
+@@ -97,6 +105,9 @@ of the new API.
+       resent_ccs = msg.get_all('resent-cc', [])
+       all_recipients = getaddresses(tos + ccs + resent_tos + resent_ccs)
+ 
++   .. versionchanged:: 3.13
++      Add *strict* optional parameter and reject malformed inputs by default.
++
+ 
+ .. function:: parsedate(date)
+ 
+diff --git a/Lib/email/utils.py b/Lib/email/utils.py
+index 81da5394ea..43c3627fca 100644
+--- a/Lib/email/utils.py
++++ b/Lib/email/utils.py
+@@ -48,6 +48,7 @@
+ specialsre = re.compile(r'[][\\()<>@,:;".]')
+ escapesre = re.compile(r'[\\"]')
+ 
++
+ def _has_surrogates(s):
+     """Return True if s contains surrogate-escaped binary data."""
+     # This check is based on the fact that unless there are surrogates, utf8
+@@ -106,12 +107,127 @@ def formataddr(pair, charset='utf-8'):
+     return address
+ 
+ 
++def _iter_escaped_chars(addr):
++    pos = 0
++    escape = False
++    for pos, ch in enumerate(addr):
++        if escape:
++            yield (pos, '\\' + ch)
++            escape = False
++        elif ch == '\\':
++            escape = True
++        else:
++            yield (pos, ch)
++    if escape:
++        yield (pos, '\\')
+ 
+-def getaddresses(fieldvalues):
+-    """Return a list of (REALNAME, EMAIL) for each fieldvalue."""
+-    all = COMMASPACE.join(str(v) for v in fieldvalues)
+-    a = _AddressList(all)
+-    return a.addresslist
++
++def _strip_quoted_realnames(addr):
++    """Strip real names between quotes."""
++    if '"' not in addr:
++        # Fast path
++        return addr
++
++    start = 0
++    open_pos = None
++    result = []
++    for pos, ch in _iter_escaped_chars(addr):
++        if ch == '"':
++            if open_pos is None:
++                open_pos = pos
++            else:
++                if start != open_pos:
++                    result.append(addr[start:open_pos])
++                start = pos + 1
++                open_pos = None
++
++    if start < len(addr):
++        result.append(addr[start:])
++
++    return ''.join(result)
++
++
++supports_strict_parsing = True
++
++def getaddresses(fieldvalues, *, strict=True):
++    """Return a list of (REALNAME, EMAIL) or ('','') for each fieldvalue.
++
++    When parsing fails for a fieldvalue, a 2-tuple of ('', '') is returned in
++    its place.
++
++    If strict is true, use a strict parser which rejects malformed inputs.
++    """
++
++    # If strict is true, if the resulting list of parsed addresses is greater
++    # than the number of fieldvalues in the input list, a parsing error has
++    # occurred and consequently a list containing a single empty 2-tuple [('',
++    # '')] is returned in its place. This is done to avoid invalid output.
++    #
++    # Malformed input: getaddresses(['alice@example.com <bob@example.com>'])
++    # Invalid output: [('', 'alice@example.com'), ('', 'bob@example.com')]
++    # Safe output: [('', '')]
++
++    if not strict:
++        all = COMMASPACE.join(str(v) for v in fieldvalues)
++        a = _AddressList(all)
++        return a.addresslist
++
++    fieldvalues = [str(v) for v in fieldvalues]
++    fieldvalues = _pre_parse_validation(fieldvalues)
++    addr = COMMASPACE.join(fieldvalues)
++    a = _AddressList(addr)
++    result = _post_parse_validation(a.addresslist)
++
++    # Treat output as invalid if the number of addresses is not equal to the
++    # expected number of addresses.
++    n = 0
++    for v in fieldvalues:
++        # When a comma is used in the Real Name part it is not a deliminator.
++        # So strip those out before counting the commas.
++        v = _strip_quoted_realnames(v)
++        # Expected number of addresses: 1 + number of commas
++        n += 1 + v.count(',')
++    if len(result) != n:
++        return [('', '')]
++
++    return result
++
++
++def _check_parenthesis(addr):
++    # Ignore parenthesis in quoted real names.
++    addr = _strip_quoted_realnames(addr)
++
++    opens = 0
++    for pos, ch in _iter_escaped_chars(addr):
++        if ch == '(':
++            opens += 1
++        elif ch == ')':
++            opens -= 1
++            if opens < 0:
++                return False
++    return (opens == 0)
++
++
++def _pre_parse_validation(email_header_fields):
++    accepted_values = []
++    for v in email_header_fields:
++        if not _check_parenthesis(v):
++            v = "('', '')"
++        accepted_values.append(v)
++
++    return accepted_values
++
++
++def _post_parse_validation(parsed_email_header_tuples):
++    accepted_values = []
++    # The parser would have parsed a correctly formatted domain-literal
++    # The existence of an [ after parsing indicates a parsing failure
++    for v in parsed_email_header_tuples:
++        if '[' in v[1]:
++            v = ('', '')
++        accepted_values.append(v)
++
++    return accepted_values
+ 
+ 
+ def _format_timetuple_and_zone(timetuple, zone):
+@@ -205,16 +321,33 @@ def parsedate_to_datetime(data):
+             tzinfo=datetime.timezone(datetime.timedelta(seconds=tz)))
+ 
+ 
+-def parseaddr(addr):
++def parseaddr(addr, *, strict=True):
+     """
+     Parse addr into its constituent realname and email address parts.
+ 
+     Return a tuple of realname and email address, unless the parse fails, in
+     which case return a 2-tuple of ('', '').
++
++    If strict is True, use a strict parser which rejects malformed inputs.
+     """
+-    addrs = _AddressList(addr).addresslist
+-    if not addrs:
+-        return '', ''
++    if not strict:
++        addrs = _AddressList(addr).addresslist
++        if not addrs:
++            return ('', '')
++        return addrs[0]
++
++    if isinstance(addr, list):
++        addr = addr[0]
++
++    if not isinstance(addr, str):
++        return ('', '')
++
++    addr = _pre_parse_validation([addr])[0]
++    addrs = _post_parse_validation(_AddressList(addr).addresslist)
++
++    if not addrs or len(addrs) > 1:
++        return ('', '')
++
+     return addrs[0]
+ 
+ 
+diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
+index 2a237095b9..4672b790d8 100644
+--- a/Lib/test/test_email/test_email.py
++++ b/Lib/test/test_email/test_email.py
+@@ -16,6 +16,7 @@
+ 
+ import email
+ import email.policy
++import email.utils
+ 
+ from email.charset import Charset
+ from email.generator import Generator, DecodedGenerator, BytesGenerator
+@@ -3337,15 +3338,137 @@ def test_getaddresses_comma_in_name(self):
+             ],
+         )
+ 
++    def test_parsing_errors(self):
++        """Test for parsing errors from CVE-2023-27043 and CVE-2019-16056"""
++        alice = 'alice@example.org'
++        bob = 'bob@example.com'
++        empty = ('', '')
++
++        # Test utils.getaddresses() and utils.parseaddr() on malformed email
++        # addresses: default behavior (strict=True) rejects malformed address,
++        # and strict=False which tolerates malformed address.
++        for invalid_separator, expected_non_strict in (
++            ('(', [(f'<{bob}>', alice)]),
++            (')', [('', alice), empty, ('', bob)]),
++            ('<', [('', alice), empty, ('', bob), empty]),
++            ('>', [('', alice), empty, ('', bob)]),
++            ('[', [('', f'{alice}[<{bob}>]')]),
++            (']', [('', alice), empty, ('', bob)]),
++            ('@', [empty, empty, ('', bob)]),
++            (';', [('', alice), empty, ('', bob)]),
++            (':', [('', alice), ('', bob)]),
++            ('.', [('', alice + '.'), ('', bob)]),
++            ('"', [('', alice), ('', f'<{bob}>')]),
++        ):
++            address = f'{alice}{invalid_separator}<{bob}>'
++            with self.subTest(address=address):
++                self.assertEqual(utils.getaddresses([address]),
++                                 [empty])
++                self.assertEqual(utils.getaddresses([address], strict=False),
++                                 expected_non_strict)
++
++                self.assertEqual(utils.parseaddr([address]),
++                                 empty)
++                self.assertEqual(utils.parseaddr([address], strict=False),
++                                 ('', address))
++
++        # Comma (',') is treated differently depending on strict parameter.
++        # Comma without quotes.
++        address = f'{alice},<{bob}>'
++        self.assertEqual(utils.getaddresses([address]),
++                         [('', alice), ('', bob)])
++        self.assertEqual(utils.getaddresses([address], strict=False),
++                         [('', alice), ('', bob)])
++        self.assertEqual(utils.parseaddr([address]),
++                         empty)
++        self.assertEqual(utils.parseaddr([address], strict=False),
++                         ('', address))
++
++        # Real name between quotes containing comma.
++        address = '"Alice, alice@example.org" <bob@example.com>'
++        expected_strict = ('Alice, alice@example.org', 'bob@example.com')
++        self.assertEqual(utils.getaddresses([address]), [expected_strict])
++        self.assertEqual(utils.getaddresses([address], strict=False), [expected_strict])
++        self.assertEqual(utils.parseaddr([address]), expected_strict)
++        self.assertEqual(utils.parseaddr([address], strict=False),
++                         ('', address))
++
++        # Valid parenthesis in comments.
++        address = 'alice@example.org (Alice)'
++        expected_strict = ('Alice', 'alice@example.org')
++        self.assertEqual(utils.getaddresses([address]), [expected_strict])
++        self.assertEqual(utils.getaddresses([address], strict=False), [expected_strict])
++        self.assertEqual(utils.parseaddr([address]), expected_strict)
++        self.assertEqual(utils.parseaddr([address], strict=False),
++                         ('', address))
++
++        # Invalid parenthesis in comments.
++        address = 'alice@example.org )Alice('
++        self.assertEqual(utils.getaddresses([address]), [empty])
++        self.assertEqual(utils.getaddresses([address], strict=False),
++                         [('', 'alice@example.org'), ('', ''), ('', 'Alice')])
++        self.assertEqual(utils.parseaddr([address]), empty)
++        self.assertEqual(utils.parseaddr([address], strict=False),
++                         ('', address))
++
++        # Two addresses with quotes separated by comma.
++        address = '"Jane Doe" <jane@example.net>, "John Doe" <john@example.net>'
++        self.assertEqual(utils.getaddresses([address]),
++                         [('Jane Doe', 'jane@example.net'),
++                          ('John Doe', 'john@example.net')])
++        self.assertEqual(utils.getaddresses([address], strict=False),
++                         [('Jane Doe', 'jane@example.net'),
++                          ('John Doe', 'john@example.net')])
++        self.assertEqual(utils.parseaddr([address]), empty)
++        self.assertEqual(utils.parseaddr([address], strict=False),
++                         ('', address))
++
++        # Test email.utils.supports_strict_parsing attribute
++        self.assertEqual(email.utils.supports_strict_parsing, True)
++
+     def test_getaddresses_nasty(self):
+-        eq = self.assertEqual
+-        eq(utils.getaddresses(['foo: ;']), [('', '')])
+-        eq(utils.getaddresses(
+-           ['[]*-- =~$']),
+-           [('', ''), ('', ''), ('', '*--')])
+-        eq(utils.getaddresses(
+-           ['foo: ;', '"Jason R. Mastaler" <jason@dom.ain>']),
+-           [('', ''), ('Jason R. Mastaler', 'jason@dom.ain')])
++        for addresses, expected in (
++            (['"Sürname, Firstname" <to@example.com>'],
++             [('Sürname, Firstname', 'to@example.com')]),
++
++            (['foo: ;'],
++             [('', '')]),
++
++            (['foo: ;', '"Jason R. Mastaler" <jason@dom.ain>'],
++             [('', ''), ('Jason R. Mastaler', 'jason@dom.ain')]),
++
++            ([r'Pete(A nice \) chap) <pete(his account)@silly.test(his host)>'],
++             [('Pete (A nice ) chap his account his host)', 'pete@silly.test')]),
++
++            (['(Empty list)(start)Undisclosed recipients  :(nobody(I know))'],
++             [('', '')]),
++
++            (['Mary <@machine.tld:mary@example.net>, , jdoe@test   . example'],
++             [('Mary', 'mary@example.net'), ('', ''), ('', 'jdoe@test.example')]),
++
++            (['John Doe <jdoe@machine(comment).  example>'],
++             [('John Doe (comment)', 'jdoe@machine.example')]),
++
++            (['"Mary Smith: Personal Account" <smith@home.example>'],
++             [('Mary Smith: Personal Account', 'smith@home.example')]),
++
++            (['Undisclosed recipients:;'],
++             [('', '')]),
++
++            ([r'<boss@nil.test>, "Giant; \"Big\" Box" <bob@example.net>'],
++             [('', 'boss@nil.test'), ('Giant; "Big" Box', 'bob@example.net')]),
++        ):
++            with self.subTest(addresses=addresses):
++                self.assertEqual(utils.getaddresses(addresses),
++                                 expected)
++                self.assertEqual(utils.getaddresses(addresses, strict=False),
++                                 expected)
++
++        addresses = ['[]*-- =~$']
++        self.assertEqual(utils.getaddresses(addresses),
++                         [('', '')])
++        self.assertEqual(utils.getaddresses(addresses, strict=False),
++                         [('', ''), ('', ''), ('', '*--')])
+ 
+     def test_getaddresses_embedded_comment(self):
+         """Test proper handling of a nested comment"""
+@@ -3536,6 +3659,54 @@ def test_mime_classes_policy_argument(self):
+                 m = cls(*constructor, policy=email.policy.default)
+                 self.assertIs(m.policy, email.policy.default)
+ 
++    def test_iter_escaped_chars(self):
++        self.assertEqual(list(utils._iter_escaped_chars(r'a\\b\"c\\"d')),
++                         [(0, 'a'),
++                          (2, '\\\\'),
++                          (3, 'b'),
++                          (5, '\\"'),
++                          (6, 'c'),
++                          (8, '\\\\'),
++                          (9, '"'),
++                          (10, 'd')])
++        self.assertEqual(list(utils._iter_escaped_chars('a\\')),
++                         [(0, 'a'), (1, '\\')])
++
++    def test_strip_quoted_realnames(self):
++        def check(addr, expected):
++            self.assertEqual(utils._strip_quoted_realnames(addr), expected)
++
++        check('"Jane Doe" <jane@example.net>, "John Doe" <john@example.net>',
++              ' <jane@example.net>,  <john@example.net>')
++        check(r'"Jane \"Doe\"." <jane@example.net>',
++              ' <jane@example.net>')
++
++        # special cases
++        check(r'before"name"after', 'beforeafter')
++        check(r'before"name"', 'before')
++        check(r'b"name"', 'b')  # single char
++        check(r'"name"after', 'after')
++        check(r'"name"a', 'a')  # single char
++        check(r'"name"', '')
++
++        # no change
++        for addr in (
++            'Jane Doe <jane@example.net>, John Doe <john@example.net>',
++            'lone " quote',
++        ):
++            self.assertEqual(utils._strip_quoted_realnames(addr), addr)
++
++
++    def test_check_parenthesis(self):
++        addr = 'alice@example.net'
++        self.assertTrue(utils._check_parenthesis(f'{addr} (Alice)'))
++        self.assertFalse(utils._check_parenthesis(f'{addr} )Alice('))
++        self.assertFalse(utils._check_parenthesis(f'{addr} (Alice))'))
++        self.assertFalse(utils._check_parenthesis(f'{addr} ((Alice)'))
++
++        # Ignore real name between quotes
++        self.assertTrue(utils._check_parenthesis(f'")Alice((" {addr}'))
++
+ 
+ # Test the iterator/generators
+ class TestIterators(TestEmailBase):
+diff --git a/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
+new file mode 100644
+index 0000000000..3d0e9e4078
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
+@@ -0,0 +1,8 @@
++:func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now
++return ``('', '')`` 2-tuples in more situations where invalid email
++addresses are encountered instead of potentially inaccurate values. Add
++optional *strict* parameter to these two functions: use ``strict=False`` to
++get the old behavior, accept malformed inputs.
++``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check
++if the *strict* paramater is available. Patch by Thomas Dwyer and Victor
++Stinner to improve the CVE-2023-27043 fix.
diff --git a/python3.12.spec b/python3.12.spec
index c2c04a4..384f033 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -364,6 +364,15 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
+# 00415 # 83e0fc3ec7bc38055c536f482578a10f6efcc08c
+# [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (#111116)
+#
+# Detect email address parsing errors and return empty tuple to
+# indicate the parsing error (old API). Add an optional 'strict'
+# parameter to getaddresses() and parseaddr() functions. Patch by
+# Thomas Dwyer.
+Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1672,6 +1681,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon Dec 18 2023 Lumír Balhar <lbalhar@redhat.com> - 3.12.1-2
+- Security fix for CVE-2023-27043 (rhbz#2196190)
+
 * Fri Dec 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.1-1
 - Update to 3.12.1
 - Own stray directories in /usr/lib64/python3.12

From 90929e6c2eae140ce937a679e88ee1caef0e1f77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Tue, 2 Jan 2024 10:29:28 +0100
Subject: [PATCH 35/93] Require python3-rpm-generators even when bootstrapping
 non-main Pythons

---
 python3.12.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 384f033..2c51485 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -310,6 +310,9 @@ BuildRequires: %{python_wheel_pkg_prefix}-wheel-wheel
 # upgrading the main python3 to a new Python version, this would pull in the
 # old version instead.
 BuildRequires: python%{pybasever}
+%endif
+
+%if %{without bootstrap} || %{without main_python}
 # for proper automatic provides
 BuildRequires: python3-rpm-generators
 %endif
@@ -555,7 +558,8 @@ Recommends: %{pkgname}-pip
 # tox users are likely to need the devel subpackage
 Supplements: tox
 
-%if %{without bootstrap}
+%if %{without bootstrap} || %{without main_python}
+# Generators run on the main Python 3 so we cannot require them when bootstrapping it
 Requires: (python3-rpm-generators if rpm-build)
 %endif
 

From c604248608132ce9154b26a56cc4e3bb069a6b85 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Mon, 22 Jan 2024 09:22:06 +0000
Subject: [PATCH 36/93] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 2c51485..18133c6 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -1685,6 +1685,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Mon Dec 18 2023 Lumír Balhar <lbalhar@redhat.com> - 3.12.1-2
 - Security fix for CVE-2023-27043 (rhbz#2196190)
 

From ff956d27be59b626d9e31c8c14ffee15eba53420 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 26 Jan 2024 13:32:50 +0000
Subject: [PATCH 37/93] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 18133c6..e9909b1 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: Python-2.0.1
 
 
@@ -1685,6 +1685,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.1-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 

From d3e4f800706a718223b6f77722fa4445bd28404b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 7 Feb 2024 14:54:16 +0100
Subject: [PATCH 38/93] Update to 3.12.2

---
 00251-change-user-install-location.patch      |  4 +-
 ...or-the-main-thread-gh-28549-gh-28589.patch |  8 ++--
 ...-addresses-in-email-parseaddr-111116.patch |  4 +-
 ...on-t-generate-sbom-in-make-regen-all.patch | 36 ++++++++++++++++++
 python3.12.spec                               | 38 +++++++++++++------
 sources                                       |  4 +-
 6 files changed, 72 insertions(+), 22 deletions(-)
 create mode 100644 00418-don-t-generate-sbom-in-make-regen-all.patch

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index 1622e53..dc29bca 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -30,10 +30,10 @@ Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
  3 files changed, 71 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/site.py b/Lib/site.py
-index 672fa7b000..0a9c5be53e 100644
+index 924b2460d9..51b5baca93 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
-@@ -377,8 +377,15 @@ def getsitepackages(prefixes=None):
+@@ -387,8 +387,15 @@ def getsitepackages(prefixes=None):
      return sitepackages
  
  def addsitepackages(known_paths, prefixes=None):
diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 5603025..7146a82 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -16,10 +16,10 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 756d5e329f..5d09775efc 100644
+index 00d9e591c7..3314319fec 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
-@@ -1007,39 +1007,6 @@ def noop(): pass
+@@ -1089,39 +1089,6 @@ def noop(): pass
              threading.Thread(target=noop).start()
              # Thread.join() is not called
  
@@ -60,10 +60,10 @@ index 756d5e329f..5d09775efc 100644
          code = """if 1:
              import atexit
 diff --git a/Lib/threading.py b/Lib/threading.py
-index 8dcaf8ca6a..ed0b0f4632 100644
+index 98cb43c697..ee647f8549 100644
 --- a/Lib/threading.py
 +++ b/Lib/threading.py
-@@ -1586,29 +1586,20 @@ def _shutdown():
+@@ -1585,29 +1585,20 @@ def _shutdown():
  
      global _SHUTTING_DOWN
      _SHUTTING_DOWN = True
diff --git a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
index e77ddd8..352fef8 100644
--- a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+++ b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
@@ -72,7 +72,7 @@ index 345b64001c..d693a9bc39 100644
  .. function:: parsedate(date)
  
 diff --git a/Lib/email/utils.py b/Lib/email/utils.py
-index 81da5394ea..43c3627fca 100644
+index aa949aa933..af2fb14754 100644
 --- a/Lib/email/utils.py
 +++ b/Lib/email/utils.py
 @@ -48,6 +48,7 @@
@@ -81,7 +81,7 @@ index 81da5394ea..43c3627fca 100644
  
 +
  def _has_surrogates(s):
-     """Return True if s contains surrogate-escaped binary data."""
+     """Return True if s may contain surrogate-escaped binary data."""
      # This check is based on the fact that unless there are surrogates, utf8
 @@ -106,12 +107,127 @@ def formataddr(pair, charset='utf-8'):
      return address
diff --git a/00418-don-t-generate-sbom-in-make-regen-all.patch b/00418-don-t-generate-sbom-in-make-regen-all.patch
new file mode 100644
index 0000000..d41da28
--- /dev/null
+++ b/00418-don-t-generate-sbom-in-make-regen-all.patch
@@ -0,0 +1,36 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Thu, 8 Feb 2024 15:53:26 +0100
+Subject: [PATCH] 00418: Don't generate sbom in make regen-all
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The script and make target, added in Python 3.12.2, assumes a fixed
+location of pip wheel and other bundled libraries, resulting in an
+error and failed build when not found.
+Reported upstream: https://github.com/python/cpython/issues/114240
+and https://github.com/python/cpython/issues/114244
+
+Co-Authored-By: Tomáš Hrnčiar <thrnciar@redhat.com>
+---
+ Makefile.pre.in | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index dd5e69f7ab..40097647b5 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -1320,9 +1320,10 @@ regen-limited-abi: all
+ regen-all: regen-cases regen-opcode regen-opcode-targets regen-typeslots \
+ 	regen-token regen-ast regen-keyword regen-sre regen-frozen \
+ 	regen-pegen-metaparser regen-pegen regen-test-frozenmain \
+-	regen-test-levenshtein regen-global-objects regen-sbom
++	regen-test-levenshtein regen-global-objects
+ 	@echo
+-	@echo "Note: make regen-stdlib-module-names and make regen-configure should be run manually"
++	@echo "Note: make regen-stdlib-module-names, make regen-configure and make regen-sbom "
++	@echo "should be run manually"
+ 
+ ############################################################################
+ # Special rules for object files
diff --git a/python3.12.spec b/python3.12.spec
index e9909b1..37254d2 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.1
+%global general_version %{pybasever}.2
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 4%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -71,18 +71,18 @@ License: Python-2.0.1
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 23.2.1
+%global pip_version 24.0
 %global setuptools_version 67.6.1
 %global wheel_version 0.40.0
 # All of those also include a list of indirect bundled libs:
 # pip
 #  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
 %global pip_bundled_provides %{expand:
-Provides: bundled(python3dist(cachecontrol)) = 0.12.11
-Provides: bundled(python3dist(certifi)) = 2023.5.7
+Provides: bundled(python3dist(cachecontrol)) = 0.13.1
+Provides: bundled(python3dist(certifi)) = 2023.7.22
 Provides: bundled(python3dist(chardet)) = 5.1
 Provides: bundled(python3dist(colorama)) = 0.4.6
-Provides: bundled(python3dist(distlib)) = 0.3.6
+Provides: bundled(python3dist(distlib)) = 0.3.8
 Provides: bundled(python3dist(distro)) = 1.8
 Provides: bundled(python3dist(idna)) = 3.4
 Provides: bundled(python3dist(msgpack)) = 1.0.5
@@ -98,8 +98,9 @@ Provides: bundled(python3dist(setuptools)) = 68
 Provides: bundled(python3dist(six)) = 1.16
 Provides: bundled(python3dist(tenacity)) = 8.2.2
 Provides: bundled(python3dist(tomli)) = 2.0.1
+Provides: bundled(python3dist(truststore)) = 0.8
 Provides: bundled(python3dist(typing-extensions)) = 4.7.1
-Provides: bundled(python3dist(urllib3)) = 1.26.16
+Provides: bundled(python3dist(urllib3)) = 1.26.17
 Provides: bundled(python3dist(webencodings)) = 0.5.1
 }
 # setuptools
@@ -121,7 +122,7 @@ Provides: bundled(python3dist(typing-extensions)) = 4.4
 Provides: bundled(python3dist(zipp)) = 3.7
 }
 # wheel
-#  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheel-*.whl wheel/vendored/vendor.txt)
+#  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheeldata/wheel-*.whl wheel/vendored/vendor.txt)
 %global wheel_bundled_provides %{expand:
 Provides: bundled(python3dist(packaging)) = 23
 }
@@ -367,7 +368,7 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00415 # 83e0fc3ec7bc38055c536f482578a10f6efcc08c
+# 00415 # 5b830b814be638d1a167802780b5f498a4a5e97c
 # [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (#111116)
 #
 # Detect email address parsing errors and return empty tuple to
@@ -376,6 +377,16 @@ Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-g
 # Thomas Dwyer.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 
+# 00418 # 153905265371131e1227ace0dfef34a5c5efde59
+# Don't generate sbom in make regen-all
+#
+# The script and make target, added in Python 3.12.2, assumes a fixed
+# location of pip wheel and other bundled libraries, resulting in an
+# error and failed build when not found.
+# Reported upstream: https://github.com/python/cpython/issues/114240
+# and https://github.com/python/cpython/issues/114244
+Patch418: 00418-don-t-generate-sbom-in-make-regen-all.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -697,13 +708,13 @@ The debug runtime additionally supports debug builds of C-API extensions
 # setuptools.whl does not contain the vendored.txt files
 if [ -f %{_rpmconfigdir}/pythonbundles.py ]; then
   %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) --compare-with '%pip_bundled_provides'
-  %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheel-*.whl wheel/vendored/vendor.txt) --compare-with '%wheel_bundled_provides'
+  %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheeldata/wheel-*.whl wheel/vendored/vendor.txt) --compare-with '%wheel_bundled_provides'
 fi
 
 %if %{with rpmwheels}
 rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
-rm Lib/test/setuptools-%{setuptools_version}-py3-none-any.whl
-rm Lib/test/wheel-%{wheel_version}-py3-none-any.whl
+rm Lib/test/wheeldata/setuptools-%{setuptools_version}-py3-none-any.whl
+rm Lib/test/wheeldata/wheel-%{wheel_version}-py3-none-any.whl
 %endif
 
 # Remove all exe files to ensure we are not shipping prebuilt binaries
@@ -1685,6 +1696,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Feb 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.2-1
+- Update to 3.12.2
+
 * Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.1-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 
diff --git a/sources b/sources
index b9328ce..2c3fe1d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.1.tar.xz) = 44cf06b89ade692d87ca3105d8e3de5c7ce3f5fb318690fff513cf56f909ff5e0d0f6a0b22ae270b12e1fe3051b1bde3ec786506ec87c810b1d02e92e45dff07
-SHA512 (Python-3.12.1.tar.xz.asc) = 1c85237b5921fbf940ded4e038d99c8d02682fcb357b5de761eb5bebf94142b308a11654fc6312129663727e2ce1f546fbb5a5a3747d7dc02fc7dced9cb968fd
+SHA512 (Python-3.12.2.tar.xz) = 2ccfae7b9f95d8e15ea85d3f66eea5f6a8fdcaffc0b405095fecb33efc0df50b831c1215542910ced948b54e6de1f7242b0b8b9afc5f89079451c552430d7d9f
+SHA512 (Python-3.12.2.tar.xz.asc) = fb477acb49864a662b1586db79e80fd8ebab85d4e5e14acd3bfb5afc3dbe8d6b9bf97eb518dfb77662e27040d400f451ed7575fe1264a6cc0d9feb06e4f2dc84

From c0ffafcda5c6195905ea663153ce11f1439ef90b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Wed, 21 Feb 2024 11:58:07 +0100
Subject: [PATCH 39/93] Fix tests for XMLPullParser with Expat 2.6.0

See also: https://bugzilla.redhat.com/2264859
---
 ...s-for-xmlpullparser-with-expat-2-6-0.patch | 107 ++++++++++++++++++
 python3.12.spec                               |  12 +-
 2 files changed, 118 insertions(+), 1 deletion(-)
 create mode 100644 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch

diff --git a/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch b/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
new file mode 100644
index 0000000..1c1e560
--- /dev/null
+++ b/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
@@ -0,0 +1,107 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Serhiy Storchaka <storchaka@gmail.com>
+Date: Sun, 11 Feb 2024 12:08:39 +0200
+Subject: [PATCH] 00422: gh-115133: Fix tests for XMLPullParser with Expat
+ 2.6.0
+
+Feeding the parser by too small chunks defers parsing to prevent
+CVE-2023-52425. Future versions of Expat may be more reactive.
+
+(cherry picked from commit 4a08e7b3431cd32a0daf22a33421cd3035343dc4)
+---
+ Lib/test/test_xml_etree.py                    | 58 ++++++++++++-------
+ ...-02-08-14-21-28.gh-issue-115133.ycl4ko.rst |  2 +
+ 2 files changed, 38 insertions(+), 22 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+
+diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
+index b50898f1d1..6fb888cb21 100644
+--- a/Lib/test/test_xml_etree.py
++++ b/Lib/test/test_xml_etree.py
+@@ -13,6 +13,7 @@
+ import operator
+ import os
+ import pickle
++import pyexpat
+ import sys
+ import textwrap
+ import types
+@@ -120,6 +121,10 @@
+ </foo>
+ """
+ 
++fails_with_expat_2_6_0 = (unittest.expectedFailure
++                        if pyexpat.version_info >= (2, 6, 0) else
++                        lambda test: test)
++
+ def checkwarnings(*filters, quiet=False):
+     def decorator(test):
+         def newtest(*args, **kwargs):
+@@ -1400,28 +1405,37 @@ def assert_event_tags(self, parser, expected, max_events=None):
+         self.assertEqual([(action, elem.tag) for action, elem in events],
+                          expected)
+ 
+-    def test_simple_xml(self):
+-        for chunk_size in (None, 1, 5):
+-            with self.subTest(chunk_size=chunk_size):
+-                parser = ET.XMLPullParser()
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser, "<!-- comment -->\n", chunk_size)
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser,
+-                           "<root>\n  <element key='value'>text</element",
+-                           chunk_size)
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser, ">\n", chunk_size)
+-                self.assert_event_tags(parser, [('end', 'element')])
+-                self._feed(parser, "<element>text</element>tail\n", chunk_size)
+-                self._feed(parser, "<empty-element/>\n", chunk_size)
+-                self.assert_event_tags(parser, [
+-                    ('end', 'element'),
+-                    ('end', 'empty-element'),
+-                    ])
+-                self._feed(parser, "</root>\n", chunk_size)
+-                self.assert_event_tags(parser, [('end', 'root')])
+-                self.assertIsNone(parser.close())
++    def test_simple_xml(self, chunk_size=None):
++        parser = ET.XMLPullParser()
++        self.assert_event_tags(parser, [])
++        self._feed(parser, "<!-- comment -->\n", chunk_size)
++        self.assert_event_tags(parser, [])
++        self._feed(parser,
++                   "<root>\n  <element key='value'>text</element",
++                   chunk_size)
++        self.assert_event_tags(parser, [])
++        self._feed(parser, ">\n", chunk_size)
++        self.assert_event_tags(parser, [('end', 'element')])
++        self._feed(parser, "<element>text</element>tail\n", chunk_size)
++        self._feed(parser, "<empty-element/>\n", chunk_size)
++        self.assert_event_tags(parser, [
++            ('end', 'element'),
++            ('end', 'empty-element'),
++            ])
++        self._feed(parser, "</root>\n", chunk_size)
++        self.assert_event_tags(parser, [('end', 'root')])
++        self.assertIsNone(parser.close())
++
++    @fails_with_expat_2_6_0
++    def test_simple_xml_chunk_1(self):
++        self.test_simple_xml(chunk_size=1)
++
++    @fails_with_expat_2_6_0
++    def test_simple_xml_chunk_5(self):
++        self.test_simple_xml(chunk_size=5)
++
++    def test_simple_xml_chunk_22(self):
++        self.test_simple_xml(chunk_size=22)
+ 
+     def test_feed_while_iterating(self):
+         parser = ET.XMLPullParser()
+diff --git a/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+new file mode 100644
+index 0000000000..6f1015235c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+@@ -0,0 +1,2 @@
++Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat
++2.6.0.
diff --git a/python3.12.spec b/python3.12.spec
index 37254d2..6d8f5be 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -387,6 +387,13 @@ Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-par
 # and https://github.com/python/cpython/issues/114244
 Patch418: 00418-don-t-generate-sbom-in-make-regen-all.patch
 
+# 00422 # a353cebef737c41420dc7ae2469dd657371b8881
+# gh-115133: Fix tests for XMLPullParser with Expat 2.6.0
+#
+# Feeding the parser by too small chunks defers parsing to prevent
+# CVE-2023-52425. Future versions of Expat may be more reactive.
+Patch422: 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1696,6 +1703,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Feb 21 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.2-2
+- Fix tests for XMLPullParser with Expat 2.6.0
+
 * Wed Feb 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.2-1
 - Update to 3.12.2
 

From 9c9178a72b29966aac702fbb3b4393951ca32d57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Wed, 13 Mar 2024 11:42:47 +0000
Subject: [PATCH 40/93] Move all test modules to the test subpackage

  - __phello__
  - _xxsubinterpreters
  - xxlimited
  - xxlimited_35
  - xxsubtype

Source: https://github.com/python/cpython/blob/v3.12.2/Tools/build/generate_stdlib_module_names.py#L23
---
 python3.12.spec | 38 +++++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 6d8f5be..90de5d1 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -1345,10 +1345,6 @@ CheckPython optimized
 %{dynload_dir}/termios.%{SOABI_optimized}.so
 %{dynload_dir}/unicodedata.%{SOABI_optimized}.so
 %{dynload_dir}/_uuid.%{SOABI_optimized}.so
-%{dynload_dir}/xxlimited.%{SOABI_optimized}.so
-%{dynload_dir}/xxlimited_35.%{SOABI_optimized}.so
-%{dynload_dir}/_xxsubinterpreters.%{SOABI_optimized}.so
-%{dynload_dir}/xxsubtype.%{SOABI_optimized}.so
 %{dynload_dir}/zlib.%{SOABI_optimized}.so
 %{dynload_dir}/_zoneinfo.%{SOABI_optimized}.so
 
@@ -1449,12 +1445,6 @@ CheckPython optimized
 
 %{pylibdir}/zoneinfo
 
-%dir %{pylibdir}/__phello__/
-%dir %{pylibdir}/__phello__/__pycache__/
-%{pylibdir}/__phello__/__init__.py
-%{pylibdir}/__phello__/spam.py
-%{pylibdir}/__phello__/__pycache__/*%{bytecode_suffixes}
-
 %if "%{_lib}" == "lib64"
 %attr(0755,root,root) %dir %{_prefix}/lib/python%{pybasever}
 %attr(0755,root,root) %dir %{_prefix}/lib/python%{pybasever}/site-packages
@@ -1549,7 +1539,17 @@ CheckPython optimized
 %{dynload_dir}/_testmultiphase.%{SOABI_optimized}.so
 %{dynload_dir}/_testsinglephase.%{SOABI_optimized}.so
 %{dynload_dir}/_xxinterpchannels.%{SOABI_optimized}.so
+%{dynload_dir}/_xxsubinterpreters.%{SOABI_optimized}.so
 %{dynload_dir}/_xxtestfuzz.%{SOABI_optimized}.so
+%{dynload_dir}/xxlimited.%{SOABI_optimized}.so
+%{dynload_dir}/xxlimited_35.%{SOABI_optimized}.so
+%{dynload_dir}/xxsubtype.%{SOABI_optimized}.so
+
+%dir %{pylibdir}/__phello__/
+%dir %{pylibdir}/__phello__/__pycache__/
+%{pylibdir}/__phello__/__init__.py
+%{pylibdir}/__phello__/spam.py
+%{pylibdir}/__phello__/__pycache__/*%{bytecode_suffixes}
 
 # We don't bother splitting the debug build out into further subpackages:
 # if you need it, you're probably a developer.
@@ -1635,10 +1635,6 @@ CheckPython optimized
 %{dynload_dir}/termios.%{SOABI_debug}.so
 %{dynload_dir}/unicodedata.%{SOABI_debug}.so
 %{dynload_dir}/_uuid.%{SOABI_debug}.so
-%{dynload_dir}/xxlimited.%{SOABI_debug}.so
-%{dynload_dir}/xxlimited_35.%{SOABI_debug}.so
-%{dynload_dir}/_xxsubinterpreters.%{SOABI_debug}.so
-%{dynload_dir}/xxsubtype.%{SOABI_debug}.so
 %{dynload_dir}/zlib.%{SOABI_debug}.so
 %{dynload_dir}/_zoneinfo.%{SOABI_debug}.so
 
@@ -1675,7 +1671,11 @@ CheckPython optimized
 %{dynload_dir}/_testmultiphase.%{SOABI_debug}.so
 %{dynload_dir}/_testsinglephase.%{SOABI_debug}.so
 %{dynload_dir}/_xxinterpchannels.%{SOABI_debug}.so
+%{dynload_dir}/_xxsubinterpreters.%{SOABI_debug}.so
 %{dynload_dir}/_xxtestfuzz.%{SOABI_debug}.so
+%{dynload_dir}/xxlimited.%{SOABI_debug}.so
+%{dynload_dir}/xxlimited_35.%{SOABI_debug}.so
+%{dynload_dir}/xxsubtype.%{SOABI_debug}.so
 
 %{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py
 %{pylibdir}/__pycache__/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}%{bytecode_suffixes}
@@ -1703,6 +1703,14 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Mar 21 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.2-3
+- Move all test modules to the python3-test package, namely:
+   - __phello__
+   - _xxsubinterpreters
+   - xxlimited
+   - xxlimited_35
+   - xxsubtype
+
 * Wed Feb 21 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.2-2
 - Fix tests for XMLPullParser with Expat 2.6.0
 

From 7b3b8ccc6d35745dce60836187157a866a8d38e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 10 Apr 2024 11:49:31 +0200
Subject: [PATCH 41/93] Update to 3.12.3

---
 00251-change-user-install-location.patch      |   6 +-
 ...or-the-main-thread-gh-28549-gh-28589.patch |   8 +-
 ...-addresses-in-email-parseaddr-111116.patch |   6 +-
 ...on-t-generate-sbom-in-make-regen-all.patch |  36 ------
 ...s-for-xmlpullparser-with-expat-2-6-0.patch | 107 ------------------
 ...st-wheeldata-when-it-s-actually-used.patch |  28 +++++
 python3.12.spec                               |  31 +++--
 sources                                       |   4 +-
 8 files changed, 53 insertions(+), 173 deletions(-)
 delete mode 100644 00418-don-t-generate-sbom-in-make-regen-all.patch
 delete mode 100644 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
 create mode 100644 00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index dc29bca..c3938ae 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -129,7 +129,7 @@ index 122d441bd1..2d354a11da 100644
          # On Windows we want to substitute 'lib' for schemes rather
          # than the native value (without modifying vars, in case it
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index b6dbf3d52c..4f06a7673c 100644
+index 1137c2032b..8fc2b84f52 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
 @@ -110,8 +110,19 @@ def test_get_path(self):
@@ -153,7 +153,7 @@ index b6dbf3d52c..4f06a7673c 100644
                      os.path.normpath(expected),
                  )
  
-@@ -335,7 +346,7 @@ def test_get_config_h_filename(self):
+@@ -344,7 +355,7 @@ def test_get_config_h_filename(self):
          self.assertTrue(os.path.isfile(config_h), config_h)
  
      def test_get_scheme_names(self):
@@ -162,7 +162,7 @@ index b6dbf3d52c..4f06a7673c 100644
          if HAS_USER_BASE:
              wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
          self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
-@@ -347,6 +358,8 @@ def test_symlink(self): # Issue 7880
+@@ -356,6 +367,8 @@ def test_symlink(self): # Issue 7880
              cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
              self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
  
diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 7146a82..2392a78 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -16,10 +16,10 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 00d9e591c7..3314319fec 100644
+index 2e4b860b97..3066b23ee1 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
-@@ -1089,39 +1089,6 @@ def noop(): pass
+@@ -1100,39 +1100,6 @@ def noop(): pass
              threading.Thread(target=noop).start()
              # Thread.join() is not called
  
@@ -56,9 +56,9 @@ index 00d9e591c7..3314319fec 100644
 -        self.assertEqual(out, b'')
 -        self.assertEqual(err, b'')
 -
-     def test_start_new_thread_at_exit(self):
+     def test_start_new_thread_at_finalization(self):
          code = """if 1:
-             import atexit
+             import _thread
 diff --git a/Lib/threading.py b/Lib/threading.py
 index 98cb43c697..ee647f8549 100644
 --- a/Lib/threading.py
diff --git a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
index 352fef8..192c8b7 100644
--- a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+++ b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
@@ -255,7 +255,7 @@ index aa949aa933..af2fb14754 100644
  
  
 diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
-index 2a237095b9..4672b790d8 100644
+index a373c53c7c..c616398eb1 100644
 --- a/Lib/test/test_email/test_email.py
 +++ b/Lib/test/test_email/test_email.py
 @@ -16,6 +16,7 @@
@@ -266,7 +266,7 @@ index 2a237095b9..4672b790d8 100644
  
  from email.charset import Charset
  from email.generator import Generator, DecodedGenerator, BytesGenerator
-@@ -3337,15 +3338,137 @@ def test_getaddresses_comma_in_name(self):
+@@ -3352,15 +3353,137 @@ def test_getaddresses_comma_in_name(self):
              ],
          )
  
@@ -412,7 +412,7 @@ index 2a237095b9..4672b790d8 100644
  
      def test_getaddresses_embedded_comment(self):
          """Test proper handling of a nested comment"""
-@@ -3536,6 +3659,54 @@ def test_mime_classes_policy_argument(self):
+@@ -3551,6 +3674,54 @@ def test_mime_classes_policy_argument(self):
                  m = cls(*constructor, policy=email.policy.default)
                  self.assertIs(m.policy, email.policy.default)
  
diff --git a/00418-don-t-generate-sbom-in-make-regen-all.patch b/00418-don-t-generate-sbom-in-make-regen-all.patch
deleted file mode 100644
index d41da28..0000000
--- a/00418-don-t-generate-sbom-in-make-regen-all.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Karolina Surma <ksurma@redhat.com>
-Date: Thu, 8 Feb 2024 15:53:26 +0100
-Subject: [PATCH] 00418: Don't generate sbom in make regen-all
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The script and make target, added in Python 3.12.2, assumes a fixed
-location of pip wheel and other bundled libraries, resulting in an
-error and failed build when not found.
-Reported upstream: https://github.com/python/cpython/issues/114240
-and https://github.com/python/cpython/issues/114244
-
-Co-Authored-By: Tomáš Hrnčiar <thrnciar@redhat.com>
----
- Makefile.pre.in | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/Makefile.pre.in b/Makefile.pre.in
-index dd5e69f7ab..40097647b5 100644
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -1320,9 +1320,10 @@ regen-limited-abi: all
- regen-all: regen-cases regen-opcode regen-opcode-targets regen-typeslots \
- 	regen-token regen-ast regen-keyword regen-sre regen-frozen \
- 	regen-pegen-metaparser regen-pegen regen-test-frozenmain \
--	regen-test-levenshtein regen-global-objects regen-sbom
-+	regen-test-levenshtein regen-global-objects
- 	@echo
--	@echo "Note: make regen-stdlib-module-names and make regen-configure should be run manually"
-+	@echo "Note: make regen-stdlib-module-names, make regen-configure and make regen-sbom "
-+	@echo "should be run manually"
- 
- ############################################################################
- # Special rules for object files
diff --git a/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch b/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
deleted file mode 100644
index 1c1e560..0000000
--- a/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Serhiy Storchaka <storchaka@gmail.com>
-Date: Sun, 11 Feb 2024 12:08:39 +0200
-Subject: [PATCH] 00422: gh-115133: Fix tests for XMLPullParser with Expat
- 2.6.0
-
-Feeding the parser by too small chunks defers parsing to prevent
-CVE-2023-52425. Future versions of Expat may be more reactive.
-
-(cherry picked from commit 4a08e7b3431cd32a0daf22a33421cd3035343dc4)
----
- Lib/test/test_xml_etree.py                    | 58 ++++++++++++-------
- ...-02-08-14-21-28.gh-issue-115133.ycl4ko.rst |  2 +
- 2 files changed, 38 insertions(+), 22 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
-
-diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
-index b50898f1d1..6fb888cb21 100644
---- a/Lib/test/test_xml_etree.py
-+++ b/Lib/test/test_xml_etree.py
-@@ -13,6 +13,7 @@
- import operator
- import os
- import pickle
-+import pyexpat
- import sys
- import textwrap
- import types
-@@ -120,6 +121,10 @@
- </foo>
- """
- 
-+fails_with_expat_2_6_0 = (unittest.expectedFailure
-+                        if pyexpat.version_info >= (2, 6, 0) else
-+                        lambda test: test)
-+
- def checkwarnings(*filters, quiet=False):
-     def decorator(test):
-         def newtest(*args, **kwargs):
-@@ -1400,28 +1405,37 @@ def assert_event_tags(self, parser, expected, max_events=None):
-         self.assertEqual([(action, elem.tag) for action, elem in events],
-                          expected)
- 
--    def test_simple_xml(self):
--        for chunk_size in (None, 1, 5):
--            with self.subTest(chunk_size=chunk_size):
--                parser = ET.XMLPullParser()
--                self.assert_event_tags(parser, [])
--                self._feed(parser, "<!-- comment -->\n", chunk_size)
--                self.assert_event_tags(parser, [])
--                self._feed(parser,
--                           "<root>\n  <element key='value'>text</element",
--                           chunk_size)
--                self.assert_event_tags(parser, [])
--                self._feed(parser, ">\n", chunk_size)
--                self.assert_event_tags(parser, [('end', 'element')])
--                self._feed(parser, "<element>text</element>tail\n", chunk_size)
--                self._feed(parser, "<empty-element/>\n", chunk_size)
--                self.assert_event_tags(parser, [
--                    ('end', 'element'),
--                    ('end', 'empty-element'),
--                    ])
--                self._feed(parser, "</root>\n", chunk_size)
--                self.assert_event_tags(parser, [('end', 'root')])
--                self.assertIsNone(parser.close())
-+    def test_simple_xml(self, chunk_size=None):
-+        parser = ET.XMLPullParser()
-+        self.assert_event_tags(parser, [])
-+        self._feed(parser, "<!-- comment -->\n", chunk_size)
-+        self.assert_event_tags(parser, [])
-+        self._feed(parser,
-+                   "<root>\n  <element key='value'>text</element",
-+                   chunk_size)
-+        self.assert_event_tags(parser, [])
-+        self._feed(parser, ">\n", chunk_size)
-+        self.assert_event_tags(parser, [('end', 'element')])
-+        self._feed(parser, "<element>text</element>tail\n", chunk_size)
-+        self._feed(parser, "<empty-element/>\n", chunk_size)
-+        self.assert_event_tags(parser, [
-+            ('end', 'element'),
-+            ('end', 'empty-element'),
-+            ])
-+        self._feed(parser, "</root>\n", chunk_size)
-+        self.assert_event_tags(parser, [('end', 'root')])
-+        self.assertIsNone(parser.close())
-+
-+    @fails_with_expat_2_6_0
-+    def test_simple_xml_chunk_1(self):
-+        self.test_simple_xml(chunk_size=1)
-+
-+    @fails_with_expat_2_6_0
-+    def test_simple_xml_chunk_5(self):
-+        self.test_simple_xml(chunk_size=5)
-+
-+    def test_simple_xml_chunk_22(self):
-+        self.test_simple_xml(chunk_size=22)
- 
-     def test_feed_while_iterating(self):
-         parser = ET.XMLPullParser()
-diff --git a/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
-new file mode 100644
-index 0000000000..6f1015235c
---- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
-@@ -0,0 +1,2 @@
-+Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat
-+2.6.0.
diff --git a/00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch b/00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch
new file mode 100644
index 0000000..ea2df3a
--- /dev/null
+++ b/00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch
@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Wed, 10 Apr 2024 15:35:04 +0200
+Subject: [PATCH] 00425: Only check for 'test/wheeldata' when it's actually
+ used
+
+We build Python in Fedora 39+ with option `--with-wheel-pkg-dir`
+pointing to a custom wheel directory and delete the contents of
+upstream's `test/wheeldata`. Don't include the directory in the test set
+if the wheels are used from a different location.
+---
+ Lib/test/test_tools/test_makefile.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Lib/test/test_tools/test_makefile.py b/Lib/test/test_tools/test_makefile.py
+index 17a1a6d0d3..9ce874033d 100644
+--- a/Lib/test/test_tools/test_makefile.py
++++ b/Lib/test/test_tools/test_makefile.py
+@@ -66,6 +66,9 @@ def test_makefile_test_folders(self):
+                 )
+                 used.append(relpath)
+ 
++        if sysconfig.get_config_var('WHEEL_PKG_DIR'):
++            test_dirs.remove('test/wheeldata')
++
+         # Check that there are no extra entries:
+         unique_test_dirs = set(test_dirs)
+         self.assertSetEqual(unique_test_dirs, set(used))
diff --git a/python3.12.spec b/python3.12.spec
index 90de5d1..f4d05b2 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.2
+%global general_version %{pybasever}.3
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -357,7 +357,7 @@ Source11: idle3.appdata.xml
 # pypa/distutils integration: https://github.com/pypa/distutils/pull/70
 Patch251: 00251-change-user-install-location.patch
 
-# 00371 # d917a50238c94c652bc30ae9061d65f60cc8accd
+# 00371 # 0e580d52dd79a1973e9b363ad7487e7b9334f2a2
 # Revert "bpo-1596321: Fix threading._shutdown() for the main thread (GH-28549) (GH-28589)"
 #
 # This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
@@ -377,22 +377,14 @@ Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-g
 # Thomas Dwyer.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 
-# 00418 # 153905265371131e1227ace0dfef34a5c5efde59
-# Don't generate sbom in make regen-all
+# 00425 # a563ac3076a00f0f48b3f94ff63d91d37cb4f1e9
+# Only check for 'test/wheeldata' when it's actually used
 #
-# The script and make target, added in Python 3.12.2, assumes a fixed
-# location of pip wheel and other bundled libraries, resulting in an
-# error and failed build when not found.
-# Reported upstream: https://github.com/python/cpython/issues/114240
-# and https://github.com/python/cpython/issues/114244
-Patch418: 00418-don-t-generate-sbom-in-make-regen-all.patch
-
-# 00422 # a353cebef737c41420dc7ae2469dd657371b8881
-# gh-115133: Fix tests for XMLPullParser with Expat 2.6.0
-#
-# Feeding the parser by too small chunks defers parsing to prevent
-# CVE-2023-52425. Future versions of Expat may be more reactive.
-Patch422: 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
+# We build Python in Fedora 39+ with option `--with-wheel-pkg-dir`
+# pointing to a custom wheel directory and delete the contents of
+# upstream's `test/wheeldata`. Don't include the directory in the test set
+# if the wheels are used from a different location.
+Patch425: 00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch
 
 # (New patches go here ^^^)
 #
@@ -1703,6 +1695,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Apr 10 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.3-1
+- Update to 3.12.3
+
 * Thu Mar 21 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.2-3
 - Move all test modules to the python3-test package, namely:
    - __phello__
diff --git a/sources b/sources
index 2c3fe1d..a31bb26 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.2.tar.xz) = 2ccfae7b9f95d8e15ea85d3f66eea5f6a8fdcaffc0b405095fecb33efc0df50b831c1215542910ced948b54e6de1f7242b0b8b9afc5f89079451c552430d7d9f
-SHA512 (Python-3.12.2.tar.xz.asc) = fb477acb49864a662b1586db79e80fd8ebab85d4e5e14acd3bfb5afc3dbe8d6b9bf97eb518dfb77662e27040d400f451ed7575fe1264a6cc0d9feb06e4f2dc84
+SHA512 (Python-3.12.3.tar.xz) = 4a2213b108e7f1f1525baa8348e68b2a2336d925e60d0a59f0225fc470768a2c8031edafc0b8243f94dbae18afda335ee5adf2785328c2218fd64cbb439f13a4
+SHA512 (Python-3.12.3.tar.xz.asc) = c291ec5b5e4f8deba867cc517624dd9a174745f04061ef737e58f3d52b9b30318264aec350e339fe88ccb493809ca1a90a378e86d86b8ec4a4f578b1a5843624

From 2f95a59112a928eb97130d2014f2b68cc8b48e9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Wed, 17 Apr 2024 22:58:28 +0000
Subject: [PATCH 42/93] Require expat >= 2.6 to prevent errors when creating
 venvs with older expat

The code in CPython uses XML_SetReparseDeferralEnabled when expat is >= 2.6 during the build.
However, when users upgrade Python independently on the expat package,
they may have expat 2.5 installed and see errors like:

    $ python3.1X -m venv venv
    Error: Command '['venv/bin/python3.1X', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

    $ venv/bin/python3.1X -m ensurepip --upgrade --default-pip
    Traceback (most recent call last):
      ...
      File "/tmp/.../pip-24.0-py3-none-any.whl/pip/_internal/commands/install.py", line 15, in <module>
        from pip._internal.cli.req_command import (
        ...<3 lines>...
        )
      File "/tmp/.../pip-24.0-py3-none-any.whl/pip/_internal/cli/req_command.py", line 21, in <module>
        from pip._internal.index.package_finder import PackageFinder
      File "/tmp/.../pip-24.0-py3-none-any.whl/pip/_internal/index/package_finder.py", line 30, in <module>
        from pip._internal.req import InstallRequirement
      File "/tmp/.../pip-24.0-py3-none-any.whl/pip/_internal/req/__init__.py", line 8, in <module>
        from .req_install import InstallRequirement
      File "/tmp/.../pip-24.0-py3-none-any.whl/pip/_internal/req/req_install.py", line 40, in <module>
        from pip._internal.operations.install.wheel import install_wheel
      File "/tmp/.../pip-24.0-py3-none-any.whl/pip/_internal/operations/install/wheel.py", line 39, in <module>
        from pip._vendor.distlib.scripts import ScriptMaker
      File "/tmp/.../pip-24.0-py3-none-any.whl/pip/_vendor/distlib/scripts.py", line 16, in <module>
        from .compat import sysconfig, detect_encoding, ZipFile
      File "/tmp/.../pip-24.0-py3-none-any.whl/pip/_vendor/distlib/compat.py", line 81, in <module>
        import xmlrpc.client as xmlrpclib
      File "/usr/lib64/python3.1X/xmlrpc/client.py", line 138, in <module>
        from xml.parsers import expat
      File "/usr/lib64/python3.1X/xml/parsers/expat.py", line 4, in <module>
        from pyexpat import *
    ImportError: /usr/lib64/python3.1X/lib-dynload/pyexpat.cpython-31X-x86_64-linux-gnu.so: undefined symbol: XML_SetReparseDeferralEnabled
    Traceback (most recent call last):
      ...
    subprocess.CalledProcessError: Command '['venv/bin/python3.1X', '-W', 'ignore::DeprecationWarning', '-c', '\nimport runpy\nimport sys\nsys.path = [\'/tmp/.../pip-24.0-py3-none-any.whl\'] + sys.path\nsys.argv[1:] = [\'install\', \'--no-cache-dir\', \'--no-index\', \'--find-links\', \'/tmp/...\', \'--upgrade\', \'pip\']\nrunpy.run_module("pip", run_name="__main__", alter_sys=True)\n']' returned non-zero exit status 1.

Thanks to Markus Falb for discovering this problem.

https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/7XHGWHBQDNFKNGSZTP44SSD6PQKZPG6C/
---
 python3.12.spec | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index f4d05b2..6d23850 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -243,7 +243,8 @@ BuildRequires: bluez-libs-devel
 BuildRequires: bzip2
 BuildRequires: bzip2-devel
 BuildRequires: desktop-file-utils
-BuildRequires: expat-devel
+# See the runtime requirement in the -libs subpackage
+BuildRequires: expat-devel >= 2.6
 
 BuildRequires: findutils
 BuildRequires: gcc-c++
@@ -537,6 +538,14 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa})
 # The zoneinfo module needs tzdata
 Requires: tzdata
 
+# The requirement on libexpat is generated, but we need to version it.
+# When built with expat >= 2.6, but installed with older expat, we get:
+#   ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so:
+#   undefined symbol: XML_SetReparseDeferralEnabled
+# This breaks many things, including python -m venv.
+# Other subpackages (like -debug) also need this, but they all depend on -libs.
+Requires: expat >= 2.6
+
 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
 - the majority of the Python standard library
@@ -1695,6 +1704,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Apr 17 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.3-2
+- Require expat >= 2.6 to prevent errors when creating venvs with older expat
+
 * Wed Apr 10 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.3-1
 - Update to 3.12.3
 

From a13c80a2a0d98ec0f301eb897411c32762e020de Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint@redhat.com>
Date: Thu, 6 Jun 2024 16:15:54 +0200
Subject: [PATCH 43/93] Build as non-main Python

---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 6d23850..68a16a2 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -1704,6 +1704,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Jun 06 2024 Python Maint <python-maint@redhat.com> - 3.12.3-3
+- Build as non-main Python
+
 * Wed Apr 17 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.3-2
 - Require expat >= 2.6 to prevent errors when creating venvs with older expat
 

From 7cb850e10cc74fd6280f7136a8bb3f10e110378a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Thu, 6 Jun 2024 06:51:00 +0000
Subject: [PATCH 44/93] Skip test_gdb for now

---
 python3.12.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/python3.12.spec b/python3.12.spec
index 68a16a2..13bbdb6 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -1183,11 +1183,13 @@ CheckPython() {
   # test_check_probes is failing since it was introduced in 3.12.0rc1,
   # the test is skipped until it is fixed in upstream.
   # see: https://github.com/python/cpython/issues/104280#issuecomment-1669249980
+  # test_gdb is skipped due to https://bugzilla.redhat.com/2275274#c11
 
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
     -wW --slowest %{_smp_mflags} --timeout=2700 \
     -i test_freeze_simple_script \
     -i test_check_probes \
+    -x test_gdb \
     %ifarch %{mips64}
     -x test_ctypes \
     %endif

From 69b24e3153a22dcad9dee780687689c9cdbe5656 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Fri, 7 Jun 2024 11:36:14 +0200
Subject: [PATCH 45/93] Update to 3.12.4

---
 00251-change-user-install-location.patch      |  4 +--
 ...-addresses-in-email-parseaddr-111116.patch |  4 +--
 ...st-wheeldata-when-it-s-actually-used.patch | 28 -------------------
 python3.12.spec                               | 16 ++++-------
 sources                                       |  4 +--
 5 files changed, 11 insertions(+), 45 deletions(-)
 delete mode 100644 00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index c3938ae..2f33b5a 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -30,10 +30,10 @@ Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
  3 files changed, 71 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/site.py b/Lib/site.py
-index 924b2460d9..51b5baca93 100644
+index 924cfbecec..e2871ecc89 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
-@@ -387,8 +387,15 @@ def getsitepackages(prefixes=None):
+@@ -398,8 +398,15 @@ def getsitepackages(prefixes=None):
      return sitepackages
  
  def addsitepackages(known_paths, prefixes=None):
diff --git a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
index 192c8b7..9fe79a6 100644
--- a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+++ b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
@@ -19,7 +19,7 @@ Co-Authored-By: Thomas Dwyer <github@tomd.tel>
  create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
 
 diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
-index 345b64001c..d693a9bc39 100644
+index 092bfa8146..6f0bed130b 100644
 --- a/Doc/library/email.utils.rst
 +++ b/Doc/library/email.utils.rst
 @@ -58,13 +58,18 @@ of the new API.
@@ -255,7 +255,7 @@ index aa949aa933..af2fb14754 100644
  
  
 diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
-index a373c53c7c..c616398eb1 100644
+index fc8d87974e..ef8aa0d53c 100644
 --- a/Lib/test/test_email/test_email.py
 +++ b/Lib/test/test_email/test_email.py
 @@ -16,6 +16,7 @@
diff --git a/00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch b/00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch
deleted file mode 100644
index ea2df3a..0000000
--- a/00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Karolina Surma <ksurma@redhat.com>
-Date: Wed, 10 Apr 2024 15:35:04 +0200
-Subject: [PATCH] 00425: Only check for 'test/wheeldata' when it's actually
- used
-
-We build Python in Fedora 39+ with option `--with-wheel-pkg-dir`
-pointing to a custom wheel directory and delete the contents of
-upstream's `test/wheeldata`. Don't include the directory in the test set
-if the wheels are used from a different location.
----
- Lib/test/test_tools/test_makefile.py | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/Lib/test/test_tools/test_makefile.py b/Lib/test/test_tools/test_makefile.py
-index 17a1a6d0d3..9ce874033d 100644
---- a/Lib/test/test_tools/test_makefile.py
-+++ b/Lib/test/test_tools/test_makefile.py
-@@ -66,6 +66,9 @@ def test_makefile_test_folders(self):
-                 )
-                 used.append(relpath)
- 
-+        if sysconfig.get_config_var('WHEEL_PKG_DIR'):
-+            test_dirs.remove('test/wheeldata')
-+
-         # Check that there are no extra entries:
-         unique_test_dirs = set(test_dirs)
-         self.assertSetEqual(unique_test_dirs, set(used))
diff --git a/python3.12.spec b/python3.12.spec
index 13bbdb6..c0a3b0f 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.3
+%global general_version %{pybasever}.4
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -378,15 +378,6 @@ Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-g
 # Thomas Dwyer.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 
-# 00425 # a563ac3076a00f0f48b3f94ff63d91d37cb4f1e9
-# Only check for 'test/wheeldata' when it's actually used
-#
-# We build Python in Fedora 39+ with option `--with-wheel-pkg-dir`
-# pointing to a custom wheel directory and delete the contents of
-# upstream's `test/wheeldata`. Don't include the directory in the test set
-# if the wheels are used from a different location.
-Patch425: 00425-only-check-for-test-wheeldata-when-it-s-actually-used.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1706,6 +1697,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Jun 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.4-1
+- Update to 3.12.4
+
 * Thu Jun 06 2024 Python Maint <python-maint@redhat.com> - 3.12.3-3
 - Build as non-main Python
 
diff --git a/sources b/sources
index a31bb26..114362d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.3.tar.xz) = 4a2213b108e7f1f1525baa8348e68b2a2336d925e60d0a59f0225fc470768a2c8031edafc0b8243f94dbae18afda335ee5adf2785328c2218fd64cbb439f13a4
-SHA512 (Python-3.12.3.tar.xz.asc) = c291ec5b5e4f8deba867cc517624dd9a174745f04061ef737e58f3d52b9b30318264aec350e339fe88ccb493809ca1a90a378e86d86b8ec4a4f578b1a5843624
+SHA512 (Python-3.12.4.tar.xz) = 750132ee6369196096130a924f4ddb78b9a55804133e5d136a70b9280928822974d1aa559d844486df02e89155fb0d8117871e1ac532abc18174309ca4b08369
+SHA512 (Python-3.12.4.tar.xz.asc) = 1102b17f395e0ec5de5368d04a4dceb8cc98dd408b68b53998071cf129eb9a6c259316a416128f1dfa37a739f86e599507502a98430348da2272442ce1b7059e

From f5bad4d55e9ee5f1a63a70a1374ceb310fbabd1c Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 19 Jul 2024 17:26:43 +0000
Subject: [PATCH 46/93] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index c0a3b0f..25e27b1 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -1697,6 +1697,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
 * Fri Jun 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.4-1
 - Update to 3.12.4
 

From f5fd37367b76f5445b7ee7a948b7706af956d695 Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Tue, 23 Jul 2024 13:25:43 +0200
Subject: [PATCH 47/93] Require systemtap-sdt-devel for sys/sdt.h

---
 python3.12.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 25e27b1..fbfa520 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -291,6 +291,7 @@ BuildRequires: valgrind-devel
 BuildRequires: xz-devel
 BuildRequires: zlib-devel
 
+BuildRequires: systemtap-sdt-devel
 BuildRequires: /usr/bin/dtrace
 
 # workaround http://bugs.python.org/issue19804 (test_uuid requires ifconfig)
@@ -1697,6 +1698,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.12.4-3
+- Require systemtap-sdt-devel for sys/sdt.h
+
 * Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.4-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 

From 6b761c505dd91790fc1477300784974e7b98503e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 7 Aug 2024 17:00:50 +0200
Subject: [PATCH 48/93] Update to 3.12.5

Fixes: rhbz#2303159
---
 ...or-the-main-thread-gh-28549-gh-28589.patch |  4 +-
 ...-addresses-in-email-parseaddr-111116.patch |  4 +-
 python3.12.spec                               | 44 +++++++++----------
 sources                                       |  4 +-
 4 files changed, 27 insertions(+), 29 deletions(-)

diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 2392a78..1a202f7 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -60,10 +60,10 @@ index 2e4b860b97..3066b23ee1 100644
          code = """if 1:
              import _thread
 diff --git a/Lib/threading.py b/Lib/threading.py
-index 98cb43c697..ee647f8549 100644
+index 0bba85d08a..b256e3273f 100644
 --- a/Lib/threading.py
 +++ b/Lib/threading.py
-@@ -1585,29 +1585,20 @@ def _shutdown():
+@@ -1587,29 +1587,20 @@ def _shutdown():
  
      global _SHUTTING_DOWN
      _SHUTTING_DOWN = True
diff --git a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
index 9fe79a6..4274663 100644
--- a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+++ b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
@@ -19,7 +19,7 @@ Co-Authored-By: Thomas Dwyer <github@tomd.tel>
  create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
 
 diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
-index 092bfa8146..6f0bed130b 100644
+index 6ba42491d6..6bd45200d8 100644
 --- a/Doc/library/email.utils.rst
 +++ b/Doc/library/email.utils.rst
 @@ -58,13 +58,18 @@ of the new API.
@@ -72,7 +72,7 @@ index 092bfa8146..6f0bed130b 100644
  .. function:: parsedate(date)
  
 diff --git a/Lib/email/utils.py b/Lib/email/utils.py
-index aa949aa933..af2fb14754 100644
+index 1de547a011..e53abc8b84 100644
 --- a/Lib/email/utils.py
 +++ b/Lib/email/utils.py
 @@ -48,6 +48,7 @@
diff --git a/python3.12.spec b/python3.12.spec
index fbfa520..b51ab1d 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.4
+%global general_version %{pybasever}.5
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -71,37 +71,31 @@ License: Python-2.0.1
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 24.0
+%global pip_version 24.2
 %global setuptools_version 67.6.1
 %global wheel_version 0.40.0
 # All of those also include a list of indirect bundled libs:
 # pip
 #  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
 %global pip_bundled_provides %{expand:
-Provides: bundled(python3dist(cachecontrol)) = 0.13.1
-Provides: bundled(python3dist(certifi)) = 2023.7.22
-Provides: bundled(python3dist(chardet)) = 5.1
-Provides: bundled(python3dist(colorama)) = 0.4.6
+Provides: bundled(python3dist(cachecontrol)) = 0.14
+Provides: bundled(python3dist(certifi)) = 2024.7.4
 Provides: bundled(python3dist(distlib)) = 0.3.8
-Provides: bundled(python3dist(distro)) = 1.8
-Provides: bundled(python3dist(idna)) = 3.4
-Provides: bundled(python3dist(msgpack)) = 1.0.5
-Provides: bundled(python3dist(packaging)) = 21.3
-Provides: bundled(python3dist(platformdirs)) = 3.8.1
-Provides: bundled(python3dist(pygments)) = 2.15.1
-Provides: bundled(python3dist(pyparsing)) = 3.1
+Provides: bundled(python3dist(distro)) = 1.9
+Provides: bundled(python3dist(idna)) = 3.7
+Provides: bundled(python3dist(msgpack)) = 1.0.8
+Provides: bundled(python3dist(packaging)) = 24.1
+Provides: bundled(python3dist(platformdirs)) = 4.2.2
+Provides: bundled(python3dist(pygments)) = 2.18
 Provides: bundled(python3dist(pyproject-hooks)) = 1
-Provides: bundled(python3dist(requests)) = 2.31
+Provides: bundled(python3dist(requests)) = 2.32.3
 Provides: bundled(python3dist(resolvelib)) = 1.0.1
-Provides: bundled(python3dist(rich)) = 13.4.2
-Provides: bundled(python3dist(setuptools)) = 68
-Provides: bundled(python3dist(six)) = 1.16
-Provides: bundled(python3dist(tenacity)) = 8.2.2
+Provides: bundled(python3dist(rich)) = 13.7.1
+Provides: bundled(python3dist(setuptools)) = 70.3
 Provides: bundled(python3dist(tomli)) = 2.0.1
-Provides: bundled(python3dist(truststore)) = 0.8
-Provides: bundled(python3dist(typing-extensions)) = 4.7.1
-Provides: bundled(python3dist(urllib3)) = 1.26.17
-Provides: bundled(python3dist(webencodings)) = 0.5.1
+Provides: bundled(python3dist(truststore)) = 0.9.1
+Provides: bundled(python3dist(typing-extensions)) = 4.12.2
+Provides: bundled(python3dist(urllib3)) = 1.26.18
 }
 # setuptools
 # vendor.txt files not in .whl
@@ -1698,6 +1692,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Aug 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.5-1
+- Update to 3.12.5
+- Fixes: rhbz#2303159 (email header injection)
+
 * Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.12.4-3
 - Require systemtap-sdt-devel for sys/sdt.h
 
diff --git a/sources b/sources
index 114362d..69c99d0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.4.tar.xz) = 750132ee6369196096130a924f4ddb78b9a55804133e5d136a70b9280928822974d1aa559d844486df02e89155fb0d8117871e1ac532abc18174309ca4b08369
-SHA512 (Python-3.12.4.tar.xz.asc) = 1102b17f395e0ec5de5368d04a4dceb8cc98dd408b68b53998071cf129eb9a6c259316a416128f1dfa37a739f86e599507502a98430348da2272442ce1b7059e
+SHA512 (Python-3.12.5.tar.xz) = 7a1c30d798434fe24697bc253f6010d75145e7650f66803328425c8525331b9fa6b63d12a652687582db205f8d4c8279c8f73c338168592481517b063351c921
+SHA512 (Python-3.12.5.tar.xz.asc) = 65ce92272a38cc6bf8bf56fa2a99a830cf5b33b811b1788508e7b6f8b5d3e93e0b143412f829271be40cbb4e7c154f84499239b3e8ab63b2ccf0a5a22d2f84ee

From 4a75a45976d73349adce5a4e3e01a7d52064a0a4 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Fri, 23 Aug 2024 14:58:55 +0200
Subject: [PATCH 49/93] Security fix for CVE-2024-8088

Fixes: rhbz#2307461
---
 ...22905-sanitize-names-in-zipfile-path.patch | 121 ++++++++++++++++++
 python3.12.spec                               |  10 +-
 2 files changed, 130 insertions(+), 1 deletion(-)
 create mode 100644 00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch

diff --git a/00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch b/00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
new file mode 100644
index 0000000..c0552ce
--- /dev/null
+++ b/00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
@@ -0,0 +1,121 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 12 Aug 2024 02:35:17 +0200
+Subject: [PATCH] 00436: [CVE-2024-8088] gh-122905: Sanitize names in
+ zipfile.Path.
+
+---
+ Lib/test/test_zipfile/_path/test_path.py      | 17 +++++
+ Lib/zipfile/_path/__init__.py                 | 64 ++++++++++++++++++-
+ ...-08-11-14-08-04.gh-issue-122905.7tDsxA.rst |  1 +
+ 3 files changed, 81 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
+
+diff --git a/Lib/test/test_zipfile/_path/test_path.py b/Lib/test/test_zipfile/_path/test_path.py
+index 06d5aab69b..90885dbbe3 100644
+--- a/Lib/test/test_zipfile/_path/test_path.py
++++ b/Lib/test/test_zipfile/_path/test_path.py
+@@ -577,3 +577,20 @@ def test_getinfo_missing(self, alpharep):
+         zipfile.Path(alpharep)
+         with self.assertRaises(KeyError):
+             alpharep.getinfo('does-not-exist')
++
++    def test_malformed_paths(self):
++        """
++        Path should handle malformed paths.
++        """
++        data = io.BytesIO()
++        zf = zipfile.ZipFile(data, "w")
++        zf.writestr("/one-slash.txt", b"content")
++        zf.writestr("//two-slash.txt", b"content")
++        zf.writestr("../parent.txt", b"content")
++        zf.filename = ''
++        root = zipfile.Path(zf)
++        assert list(map(str, root.iterdir())) == [
++            'one-slash.txt',
++            'two-slash.txt',
++            'parent.txt',
++        ]
+diff --git a/Lib/zipfile/_path/__init__.py b/Lib/zipfile/_path/__init__.py
+index 78c413563b..42f9fded21 100644
+--- a/Lib/zipfile/_path/__init__.py
++++ b/Lib/zipfile/_path/__init__.py
+@@ -83,7 +83,69 @@ def __setstate__(self, state):
+         super().__init__(*args, **kwargs)
+ 
+ 
+-class CompleteDirs(InitializedState, zipfile.ZipFile):
++class SanitizedNames:
++    """
++    ZipFile mix-in to ensure names are sanitized.
++    """
++
++    def namelist(self):
++        return list(map(self._sanitize, super().namelist()))
++
++    @staticmethod
++    def _sanitize(name):
++        r"""
++        Ensure a relative path with posix separators and no dot names.
++
++        Modeled after
++        https://github.com/python/cpython/blob/bcc1be39cb1d04ad9fc0bd1b9193d3972835a57c/Lib/zipfile/__init__.py#L1799-L1813
++        but provides consistent cross-platform behavior.
++
++        >>> san = SanitizedNames._sanitize
++        >>> san('/foo/bar')
++        'foo/bar'
++        >>> san('//foo.txt')
++        'foo.txt'
++        >>> san('foo/.././bar.txt')
++        'foo/bar.txt'
++        >>> san('foo../.bar.txt')
++        'foo../.bar.txt'
++        >>> san('\\foo\\bar.txt')
++        'foo/bar.txt'
++        >>> san('D:\\foo.txt')
++        'D/foo.txt'
++        >>> san('\\\\server\\share\\file.txt')
++        'server/share/file.txt'
++        >>> san('\\\\?\\GLOBALROOT\\Volume3')
++        '?/GLOBALROOT/Volume3'
++        >>> san('\\\\.\\PhysicalDrive1\\root')
++        'PhysicalDrive1/root'
++
++        Retain any trailing slash.
++        >>> san('abc/')
++        'abc/'
++
++        Raises a ValueError if the result is empty.
++        >>> san('../..')
++        Traceback (most recent call last):
++        ...
++        ValueError: Empty filename
++        """
++
++        def allowed(part):
++            return part and part not in {'..', '.'}
++
++        # Remove the drive letter.
++        # Don't use ntpath.splitdrive, because that also strips UNC paths
++        bare = re.sub('^([A-Z]):', r'\1', name, flags=re.IGNORECASE)
++        clean = bare.replace('\\', '/')
++        parts = clean.split('/')
++        joined = '/'.join(filter(allowed, parts))
++        if not joined:
++            raise ValueError("Empty filename")
++        return joined + '/' * name.endswith('/')
++
++
++class CompleteDirs(InitializedState, SanitizedNames, zipfile.ZipFile):
+     """
+     A ZipFile subclass that ensures that implied directories
+     are always included in the namelist.
+diff --git a/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
+new file mode 100644
+index 0000000000..1be44c906c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
+@@ -0,0 +1 @@
++:class:`zipfile.Path` objects now sanitize names from the zipfile.
diff --git a/python3.12.spec b/python3.12.spec
index b51ab1d..48f8bab 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -373,6 +373,10 @@ Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-g
 # Thomas Dwyer.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 
+# 00436 # c76cc2aa3a2c30375ade4859b732ada851cc89ed
+# [CVE-2024-8088] gh-122905: Sanitize names in zipfile.Path.
+Patch436: 00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1692,6 +1696,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Aug 23 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.5-2
+- Security fix for CVE-2024-8088
+- Fixes: rhbz#2307461
+
 * Wed Aug 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.5-1
 - Update to 3.12.5
 - Fixes: rhbz#2303159 (email header injection)

From b2d96079e910b91acf4a462d7fd5b5240cbe44ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Tue, 27 Aug 2024 13:28:39 +0000
Subject: [PATCH 50/93] Skip
 test_sendfile_close_peer_in_the_middle_of_receiving on ppc64le

Reported upstream https://github.com/python/cpython/issues/123384
Which was a duplicate of https://github.com/python/cpython/issues/120226

The test is fixed on the main branch, but skipping is easier than backporting.

The failure occurs with Kernel 6.10.x even when Python is built with an older Kernel.
By skipping the tests, we can ship a CVE fix.
---
 python3.12.spec | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/python3.12.spec b/python3.12.spec
index 48f8bab..618bc46 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -1174,6 +1174,8 @@ CheckPython() {
   # the test is skipped until it is fixed in upstream.
   # see: https://github.com/python/cpython/issues/104280#issuecomment-1669249980
   # test_gdb is skipped due to https://bugzilla.redhat.com/2275274#c11
+  # test_sendfile_close_peer_in_the_middle_of_receiving:
+  #  https://github.com/python/cpython/issues/120226
 
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
     -wW --slowest %{_smp_mflags} --timeout=2700 \
@@ -1183,6 +1185,9 @@ CheckPython() {
     %ifarch %{mips64}
     -x test_ctypes \
     %endif
+    %ifarch ppc64le
+    -i test_sendfile_close_peer_in_the_middle_of_receiving \
+    %endif
 
   echo FINISHED: CHECKING OF PYTHON FOR CONFIGURATION: $ConfName
 

From d4fd1f4b06f9787264c44b845695d4f4be9bb304 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Mon, 9 Sep 2024 10:09:30 +0200
Subject: [PATCH 51/93] Update to 3.12.6

Fixes: rhbz#2310090
---
 ...-addresses-in-email-parseaddr-111116.patch | 483 ------------------
 ...22905-sanitize-names-in-zipfile-path.patch | 121 -----
 python3.12.spec                               |  21 +-
 sources                                       |   4 +-
 4 files changed, 8 insertions(+), 621 deletions(-)
 delete mode 100644 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 delete mode 100644 00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch

diff --git a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
deleted file mode 100644
index 4274663..0000000
--- a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+++ /dev/null
@@ -1,483 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Victor Stinner <vstinner@python.org>
-Date: Fri, 15 Dec 2023 16:10:40 +0100
-Subject: [PATCH] 00415: [CVE-2023-27043] gh-102988: Reject malformed addresses
- in email.parseaddr() (#111116)
-
-Detect email address parsing errors and return empty tuple to
-indicate the parsing error (old API). Add an optional 'strict'
-parameter to getaddresses() and parseaddr() functions. Patch by
-Thomas Dwyer.
-
-Co-Authored-By: Thomas Dwyer <github@tomd.tel>
----
- Doc/library/email.utils.rst                   |  19 +-
- Lib/email/utils.py                            | 151 +++++++++++++-
- Lib/test/test_email/test_email.py             | 187 +++++++++++++++++-
- ...-10-20-15-28-08.gh-issue-102988.dStNO7.rst |   8 +
- 4 files changed, 344 insertions(+), 21 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
-
-diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
-index 6ba42491d6..6bd45200d8 100644
---- a/Doc/library/email.utils.rst
-+++ b/Doc/library/email.utils.rst
-@@ -58,13 +58,18 @@ of the new API.
-    begins with angle brackets, they are stripped off.
- 
- 
--.. function:: parseaddr(address)
-+.. function:: parseaddr(address, *, strict=True)
- 
-    Parse address -- which should be the value of some address-containing field such
-    as :mailheader:`To` or :mailheader:`Cc` -- into its constituent *realname* and
-    *email address* parts.  Returns a tuple of that information, unless the parse
-    fails, in which case a 2-tuple of ``('', '')`` is returned.
- 
-+   If *strict* is true, use a strict parser which rejects malformed inputs.
-+
-+   .. versionchanged:: 3.13
-+      Add *strict* optional parameter and reject malformed inputs by default.
-+
- 
- .. function:: formataddr(pair, charset='utf-8')
- 
-@@ -82,12 +87,15 @@ of the new API.
-       Added the *charset* option.
- 
- 
--.. function:: getaddresses(fieldvalues)
-+.. function:: getaddresses(fieldvalues, *, strict=True)
- 
-    This method returns a list of 2-tuples of the form returned by ``parseaddr()``.
-    *fieldvalues* is a sequence of header field values as might be returned by
--   :meth:`Message.get_all <email.message.Message.get_all>`.  Here's a simple
--   example that gets all the recipients of a message::
-+   :meth:`Message.get_all <email.message.Message.get_all>`.
-+
-+   If *strict* is true, use a strict parser which rejects malformed inputs.
-+
-+   Here's a simple example that gets all the recipients of a message::
- 
-       from email.utils import getaddresses
- 
-@@ -97,6 +105,9 @@ of the new API.
-       resent_ccs = msg.get_all('resent-cc', [])
-       all_recipients = getaddresses(tos + ccs + resent_tos + resent_ccs)
- 
-+   .. versionchanged:: 3.13
-+      Add *strict* optional parameter and reject malformed inputs by default.
-+
- 
- .. function:: parsedate(date)
- 
-diff --git a/Lib/email/utils.py b/Lib/email/utils.py
-index 1de547a011..e53abc8b84 100644
---- a/Lib/email/utils.py
-+++ b/Lib/email/utils.py
-@@ -48,6 +48,7 @@
- specialsre = re.compile(r'[][\\()<>@,:;".]')
- escapesre = re.compile(r'[\\"]')
- 
-+
- def _has_surrogates(s):
-     """Return True if s may contain surrogate-escaped binary data."""
-     # This check is based on the fact that unless there are surrogates, utf8
-@@ -106,12 +107,127 @@ def formataddr(pair, charset='utf-8'):
-     return address
- 
- 
-+def _iter_escaped_chars(addr):
-+    pos = 0
-+    escape = False
-+    for pos, ch in enumerate(addr):
-+        if escape:
-+            yield (pos, '\\' + ch)
-+            escape = False
-+        elif ch == '\\':
-+            escape = True
-+        else:
-+            yield (pos, ch)
-+    if escape:
-+        yield (pos, '\\')
- 
--def getaddresses(fieldvalues):
--    """Return a list of (REALNAME, EMAIL) for each fieldvalue."""
--    all = COMMASPACE.join(str(v) for v in fieldvalues)
--    a = _AddressList(all)
--    return a.addresslist
-+
-+def _strip_quoted_realnames(addr):
-+    """Strip real names between quotes."""
-+    if '"' not in addr:
-+        # Fast path
-+        return addr
-+
-+    start = 0
-+    open_pos = None
-+    result = []
-+    for pos, ch in _iter_escaped_chars(addr):
-+        if ch == '"':
-+            if open_pos is None:
-+                open_pos = pos
-+            else:
-+                if start != open_pos:
-+                    result.append(addr[start:open_pos])
-+                start = pos + 1
-+                open_pos = None
-+
-+    if start < len(addr):
-+        result.append(addr[start:])
-+
-+    return ''.join(result)
-+
-+
-+supports_strict_parsing = True
-+
-+def getaddresses(fieldvalues, *, strict=True):
-+    """Return a list of (REALNAME, EMAIL) or ('','') for each fieldvalue.
-+
-+    When parsing fails for a fieldvalue, a 2-tuple of ('', '') is returned in
-+    its place.
-+
-+    If strict is true, use a strict parser which rejects malformed inputs.
-+    """
-+
-+    # If strict is true, if the resulting list of parsed addresses is greater
-+    # than the number of fieldvalues in the input list, a parsing error has
-+    # occurred and consequently a list containing a single empty 2-tuple [('',
-+    # '')] is returned in its place. This is done to avoid invalid output.
-+    #
-+    # Malformed input: getaddresses(['alice@example.com <bob@example.com>'])
-+    # Invalid output: [('', 'alice@example.com'), ('', 'bob@example.com')]
-+    # Safe output: [('', '')]
-+
-+    if not strict:
-+        all = COMMASPACE.join(str(v) for v in fieldvalues)
-+        a = _AddressList(all)
-+        return a.addresslist
-+
-+    fieldvalues = [str(v) for v in fieldvalues]
-+    fieldvalues = _pre_parse_validation(fieldvalues)
-+    addr = COMMASPACE.join(fieldvalues)
-+    a = _AddressList(addr)
-+    result = _post_parse_validation(a.addresslist)
-+
-+    # Treat output as invalid if the number of addresses is not equal to the
-+    # expected number of addresses.
-+    n = 0
-+    for v in fieldvalues:
-+        # When a comma is used in the Real Name part it is not a deliminator.
-+        # So strip those out before counting the commas.
-+        v = _strip_quoted_realnames(v)
-+        # Expected number of addresses: 1 + number of commas
-+        n += 1 + v.count(',')
-+    if len(result) != n:
-+        return [('', '')]
-+
-+    return result
-+
-+
-+def _check_parenthesis(addr):
-+    # Ignore parenthesis in quoted real names.
-+    addr = _strip_quoted_realnames(addr)
-+
-+    opens = 0
-+    for pos, ch in _iter_escaped_chars(addr):
-+        if ch == '(':
-+            opens += 1
-+        elif ch == ')':
-+            opens -= 1
-+            if opens < 0:
-+                return False
-+    return (opens == 0)
-+
-+
-+def _pre_parse_validation(email_header_fields):
-+    accepted_values = []
-+    for v in email_header_fields:
-+        if not _check_parenthesis(v):
-+            v = "('', '')"
-+        accepted_values.append(v)
-+
-+    return accepted_values
-+
-+
-+def _post_parse_validation(parsed_email_header_tuples):
-+    accepted_values = []
-+    # The parser would have parsed a correctly formatted domain-literal
-+    # The existence of an [ after parsing indicates a parsing failure
-+    for v in parsed_email_header_tuples:
-+        if '[' in v[1]:
-+            v = ('', '')
-+        accepted_values.append(v)
-+
-+    return accepted_values
- 
- 
- def _format_timetuple_and_zone(timetuple, zone):
-@@ -205,16 +321,33 @@ def parsedate_to_datetime(data):
-             tzinfo=datetime.timezone(datetime.timedelta(seconds=tz)))
- 
- 
--def parseaddr(addr):
-+def parseaddr(addr, *, strict=True):
-     """
-     Parse addr into its constituent realname and email address parts.
- 
-     Return a tuple of realname and email address, unless the parse fails, in
-     which case return a 2-tuple of ('', '').
-+
-+    If strict is True, use a strict parser which rejects malformed inputs.
-     """
--    addrs = _AddressList(addr).addresslist
--    if not addrs:
--        return '', ''
-+    if not strict:
-+        addrs = _AddressList(addr).addresslist
-+        if not addrs:
-+            return ('', '')
-+        return addrs[0]
-+
-+    if isinstance(addr, list):
-+        addr = addr[0]
-+
-+    if not isinstance(addr, str):
-+        return ('', '')
-+
-+    addr = _pre_parse_validation([addr])[0]
-+    addrs = _post_parse_validation(_AddressList(addr).addresslist)
-+
-+    if not addrs or len(addrs) > 1:
-+        return ('', '')
-+
-     return addrs[0]
- 
- 
-diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
-index fc8d87974e..ef8aa0d53c 100644
---- a/Lib/test/test_email/test_email.py
-+++ b/Lib/test/test_email/test_email.py
-@@ -16,6 +16,7 @@
- 
- import email
- import email.policy
-+import email.utils
- 
- from email.charset import Charset
- from email.generator import Generator, DecodedGenerator, BytesGenerator
-@@ -3352,15 +3353,137 @@ def test_getaddresses_comma_in_name(self):
-             ],
-         )
- 
-+    def test_parsing_errors(self):
-+        """Test for parsing errors from CVE-2023-27043 and CVE-2019-16056"""
-+        alice = 'alice@example.org'
-+        bob = 'bob@example.com'
-+        empty = ('', '')
-+
-+        # Test utils.getaddresses() and utils.parseaddr() on malformed email
-+        # addresses: default behavior (strict=True) rejects malformed address,
-+        # and strict=False which tolerates malformed address.
-+        for invalid_separator, expected_non_strict in (
-+            ('(', [(f'<{bob}>', alice)]),
-+            (')', [('', alice), empty, ('', bob)]),
-+            ('<', [('', alice), empty, ('', bob), empty]),
-+            ('>', [('', alice), empty, ('', bob)]),
-+            ('[', [('', f'{alice}[<{bob}>]')]),
-+            (']', [('', alice), empty, ('', bob)]),
-+            ('@', [empty, empty, ('', bob)]),
-+            (';', [('', alice), empty, ('', bob)]),
-+            (':', [('', alice), ('', bob)]),
-+            ('.', [('', alice + '.'), ('', bob)]),
-+            ('"', [('', alice), ('', f'<{bob}>')]),
-+        ):
-+            address = f'{alice}{invalid_separator}<{bob}>'
-+            with self.subTest(address=address):
-+                self.assertEqual(utils.getaddresses([address]),
-+                                 [empty])
-+                self.assertEqual(utils.getaddresses([address], strict=False),
-+                                 expected_non_strict)
-+
-+                self.assertEqual(utils.parseaddr([address]),
-+                                 empty)
-+                self.assertEqual(utils.parseaddr([address], strict=False),
-+                                 ('', address))
-+
-+        # Comma (',') is treated differently depending on strict parameter.
-+        # Comma without quotes.
-+        address = f'{alice},<{bob}>'
-+        self.assertEqual(utils.getaddresses([address]),
-+                         [('', alice), ('', bob)])
-+        self.assertEqual(utils.getaddresses([address], strict=False),
-+                         [('', alice), ('', bob)])
-+        self.assertEqual(utils.parseaddr([address]),
-+                         empty)
-+        self.assertEqual(utils.parseaddr([address], strict=False),
-+                         ('', address))
-+
-+        # Real name between quotes containing comma.
-+        address = '"Alice, alice@example.org" <bob@example.com>'
-+        expected_strict = ('Alice, alice@example.org', 'bob@example.com')
-+        self.assertEqual(utils.getaddresses([address]), [expected_strict])
-+        self.assertEqual(utils.getaddresses([address], strict=False), [expected_strict])
-+        self.assertEqual(utils.parseaddr([address]), expected_strict)
-+        self.assertEqual(utils.parseaddr([address], strict=False),
-+                         ('', address))
-+
-+        # Valid parenthesis in comments.
-+        address = 'alice@example.org (Alice)'
-+        expected_strict = ('Alice', 'alice@example.org')
-+        self.assertEqual(utils.getaddresses([address]), [expected_strict])
-+        self.assertEqual(utils.getaddresses([address], strict=False), [expected_strict])
-+        self.assertEqual(utils.parseaddr([address]), expected_strict)
-+        self.assertEqual(utils.parseaddr([address], strict=False),
-+                         ('', address))
-+
-+        # Invalid parenthesis in comments.
-+        address = 'alice@example.org )Alice('
-+        self.assertEqual(utils.getaddresses([address]), [empty])
-+        self.assertEqual(utils.getaddresses([address], strict=False),
-+                         [('', 'alice@example.org'), ('', ''), ('', 'Alice')])
-+        self.assertEqual(utils.parseaddr([address]), empty)
-+        self.assertEqual(utils.parseaddr([address], strict=False),
-+                         ('', address))
-+
-+        # Two addresses with quotes separated by comma.
-+        address = '"Jane Doe" <jane@example.net>, "John Doe" <john@example.net>'
-+        self.assertEqual(utils.getaddresses([address]),
-+                         [('Jane Doe', 'jane@example.net'),
-+                          ('John Doe', 'john@example.net')])
-+        self.assertEqual(utils.getaddresses([address], strict=False),
-+                         [('Jane Doe', 'jane@example.net'),
-+                          ('John Doe', 'john@example.net')])
-+        self.assertEqual(utils.parseaddr([address]), empty)
-+        self.assertEqual(utils.parseaddr([address], strict=False),
-+                         ('', address))
-+
-+        # Test email.utils.supports_strict_parsing attribute
-+        self.assertEqual(email.utils.supports_strict_parsing, True)
-+
-     def test_getaddresses_nasty(self):
--        eq = self.assertEqual
--        eq(utils.getaddresses(['foo: ;']), [('', '')])
--        eq(utils.getaddresses(
--           ['[]*-- =~$']),
--           [('', ''), ('', ''), ('', '*--')])
--        eq(utils.getaddresses(
--           ['foo: ;', '"Jason R. Mastaler" <jason@dom.ain>']),
--           [('', ''), ('Jason R. Mastaler', 'jason@dom.ain')])
-+        for addresses, expected in (
-+            (['"Sürname, Firstname" <to@example.com>'],
-+             [('Sürname, Firstname', 'to@example.com')]),
-+
-+            (['foo: ;'],
-+             [('', '')]),
-+
-+            (['foo: ;', '"Jason R. Mastaler" <jason@dom.ain>'],
-+             [('', ''), ('Jason R. Mastaler', 'jason@dom.ain')]),
-+
-+            ([r'Pete(A nice \) chap) <pete(his account)@silly.test(his host)>'],
-+             [('Pete (A nice ) chap his account his host)', 'pete@silly.test')]),
-+
-+            (['(Empty list)(start)Undisclosed recipients  :(nobody(I know))'],
-+             [('', '')]),
-+
-+            (['Mary <@machine.tld:mary@example.net>, , jdoe@test   . example'],
-+             [('Mary', 'mary@example.net'), ('', ''), ('', 'jdoe@test.example')]),
-+
-+            (['John Doe <jdoe@machine(comment).  example>'],
-+             [('John Doe (comment)', 'jdoe@machine.example')]),
-+
-+            (['"Mary Smith: Personal Account" <smith@home.example>'],
-+             [('Mary Smith: Personal Account', 'smith@home.example')]),
-+
-+            (['Undisclosed recipients:;'],
-+             [('', '')]),
-+
-+            ([r'<boss@nil.test>, "Giant; \"Big\" Box" <bob@example.net>'],
-+             [('', 'boss@nil.test'), ('Giant; "Big" Box', 'bob@example.net')]),
-+        ):
-+            with self.subTest(addresses=addresses):
-+                self.assertEqual(utils.getaddresses(addresses),
-+                                 expected)
-+                self.assertEqual(utils.getaddresses(addresses, strict=False),
-+                                 expected)
-+
-+        addresses = ['[]*-- =~$']
-+        self.assertEqual(utils.getaddresses(addresses),
-+                         [('', '')])
-+        self.assertEqual(utils.getaddresses(addresses, strict=False),
-+                         [('', ''), ('', ''), ('', '*--')])
- 
-     def test_getaddresses_embedded_comment(self):
-         """Test proper handling of a nested comment"""
-@@ -3551,6 +3674,54 @@ def test_mime_classes_policy_argument(self):
-                 m = cls(*constructor, policy=email.policy.default)
-                 self.assertIs(m.policy, email.policy.default)
- 
-+    def test_iter_escaped_chars(self):
-+        self.assertEqual(list(utils._iter_escaped_chars(r'a\\b\"c\\"d')),
-+                         [(0, 'a'),
-+                          (2, '\\\\'),
-+                          (3, 'b'),
-+                          (5, '\\"'),
-+                          (6, 'c'),
-+                          (8, '\\\\'),
-+                          (9, '"'),
-+                          (10, 'd')])
-+        self.assertEqual(list(utils._iter_escaped_chars('a\\')),
-+                         [(0, 'a'), (1, '\\')])
-+
-+    def test_strip_quoted_realnames(self):
-+        def check(addr, expected):
-+            self.assertEqual(utils._strip_quoted_realnames(addr), expected)
-+
-+        check('"Jane Doe" <jane@example.net>, "John Doe" <john@example.net>',
-+              ' <jane@example.net>,  <john@example.net>')
-+        check(r'"Jane \"Doe\"." <jane@example.net>',
-+              ' <jane@example.net>')
-+
-+        # special cases
-+        check(r'before"name"after', 'beforeafter')
-+        check(r'before"name"', 'before')
-+        check(r'b"name"', 'b')  # single char
-+        check(r'"name"after', 'after')
-+        check(r'"name"a', 'a')  # single char
-+        check(r'"name"', '')
-+
-+        # no change
-+        for addr in (
-+            'Jane Doe <jane@example.net>, John Doe <john@example.net>',
-+            'lone " quote',
-+        ):
-+            self.assertEqual(utils._strip_quoted_realnames(addr), addr)
-+
-+
-+    def test_check_parenthesis(self):
-+        addr = 'alice@example.net'
-+        self.assertTrue(utils._check_parenthesis(f'{addr} (Alice)'))
-+        self.assertFalse(utils._check_parenthesis(f'{addr} )Alice('))
-+        self.assertFalse(utils._check_parenthesis(f'{addr} (Alice))'))
-+        self.assertFalse(utils._check_parenthesis(f'{addr} ((Alice)'))
-+
-+        # Ignore real name between quotes
-+        self.assertTrue(utils._check_parenthesis(f'")Alice((" {addr}'))
-+
- 
- # Test the iterator/generators
- class TestIterators(TestEmailBase):
-diff --git a/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
-new file mode 100644
-index 0000000000..3d0e9e4078
---- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
-@@ -0,0 +1,8 @@
-+:func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now
-+return ``('', '')`` 2-tuples in more situations where invalid email
-+addresses are encountered instead of potentially inaccurate values. Add
-+optional *strict* parameter to these two functions: use ``strict=False`` to
-+get the old behavior, accept malformed inputs.
-+``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check
-+if the *strict* paramater is available. Patch by Thomas Dwyer and Victor
-+Stinner to improve the CVE-2023-27043 fix.
diff --git a/00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch b/00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
deleted file mode 100644
index c0552ce..0000000
--- a/00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Mon, 12 Aug 2024 02:35:17 +0200
-Subject: [PATCH] 00436: [CVE-2024-8088] gh-122905: Sanitize names in
- zipfile.Path.
-
----
- Lib/test/test_zipfile/_path/test_path.py      | 17 +++++
- Lib/zipfile/_path/__init__.py                 | 64 ++++++++++++++++++-
- ...-08-11-14-08-04.gh-issue-122905.7tDsxA.rst |  1 +
- 3 files changed, 81 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
-
-diff --git a/Lib/test/test_zipfile/_path/test_path.py b/Lib/test/test_zipfile/_path/test_path.py
-index 06d5aab69b..90885dbbe3 100644
---- a/Lib/test/test_zipfile/_path/test_path.py
-+++ b/Lib/test/test_zipfile/_path/test_path.py
-@@ -577,3 +577,20 @@ def test_getinfo_missing(self, alpharep):
-         zipfile.Path(alpharep)
-         with self.assertRaises(KeyError):
-             alpharep.getinfo('does-not-exist')
-+
-+    def test_malformed_paths(self):
-+        """
-+        Path should handle malformed paths.
-+        """
-+        data = io.BytesIO()
-+        zf = zipfile.ZipFile(data, "w")
-+        zf.writestr("/one-slash.txt", b"content")
-+        zf.writestr("//two-slash.txt", b"content")
-+        zf.writestr("../parent.txt", b"content")
-+        zf.filename = ''
-+        root = zipfile.Path(zf)
-+        assert list(map(str, root.iterdir())) == [
-+            'one-slash.txt',
-+            'two-slash.txt',
-+            'parent.txt',
-+        ]
-diff --git a/Lib/zipfile/_path/__init__.py b/Lib/zipfile/_path/__init__.py
-index 78c413563b..42f9fded21 100644
---- a/Lib/zipfile/_path/__init__.py
-+++ b/Lib/zipfile/_path/__init__.py
-@@ -83,7 +83,69 @@ def __setstate__(self, state):
-         super().__init__(*args, **kwargs)
- 
- 
--class CompleteDirs(InitializedState, zipfile.ZipFile):
-+class SanitizedNames:
-+    """
-+    ZipFile mix-in to ensure names are sanitized.
-+    """
-+
-+    def namelist(self):
-+        return list(map(self._sanitize, super().namelist()))
-+
-+    @staticmethod
-+    def _sanitize(name):
-+        r"""
-+        Ensure a relative path with posix separators and no dot names.
-+
-+        Modeled after
-+        https://github.com/python/cpython/blob/bcc1be39cb1d04ad9fc0bd1b9193d3972835a57c/Lib/zipfile/__init__.py#L1799-L1813
-+        but provides consistent cross-platform behavior.
-+
-+        >>> san = SanitizedNames._sanitize
-+        >>> san('/foo/bar')
-+        'foo/bar'
-+        >>> san('//foo.txt')
-+        'foo.txt'
-+        >>> san('foo/.././bar.txt')
-+        'foo/bar.txt'
-+        >>> san('foo../.bar.txt')
-+        'foo../.bar.txt'
-+        >>> san('\\foo\\bar.txt')
-+        'foo/bar.txt'
-+        >>> san('D:\\foo.txt')
-+        'D/foo.txt'
-+        >>> san('\\\\server\\share\\file.txt')
-+        'server/share/file.txt'
-+        >>> san('\\\\?\\GLOBALROOT\\Volume3')
-+        '?/GLOBALROOT/Volume3'
-+        >>> san('\\\\.\\PhysicalDrive1\\root')
-+        'PhysicalDrive1/root'
-+
-+        Retain any trailing slash.
-+        >>> san('abc/')
-+        'abc/'
-+
-+        Raises a ValueError if the result is empty.
-+        >>> san('../..')
-+        Traceback (most recent call last):
-+        ...
-+        ValueError: Empty filename
-+        """
-+
-+        def allowed(part):
-+            return part and part not in {'..', '.'}
-+
-+        # Remove the drive letter.
-+        # Don't use ntpath.splitdrive, because that also strips UNC paths
-+        bare = re.sub('^([A-Z]):', r'\1', name, flags=re.IGNORECASE)
-+        clean = bare.replace('\\', '/')
-+        parts = clean.split('/')
-+        joined = '/'.join(filter(allowed, parts))
-+        if not joined:
-+            raise ValueError("Empty filename")
-+        return joined + '/' * name.endswith('/')
-+
-+
-+class CompleteDirs(InitializedState, SanitizedNames, zipfile.ZipFile):
-     """
-     A ZipFile subclass that ensures that implied directories
-     are always included in the namelist.
-diff --git a/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
-new file mode 100644
-index 0000000000..1be44c906c
---- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
-@@ -0,0 +1 @@
-+:class:`zipfile.Path` objects now sanitize names from the zipfile.
diff --git a/python3.12.spec b/python3.12.spec
index 618bc46..aba5d66 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.5
+%global general_version %{pybasever}.6
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -364,19 +364,6 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00415 # 5b830b814be638d1a167802780b5f498a4a5e97c
-# [CVE-2023-27043] gh-102988: Reject malformed addresses in email.parseaddr() (#111116)
-#
-# Detect email address parsing errors and return empty tuple to
-# indicate the parsing error (old API). Add an optional 'strict'
-# parameter to getaddresses() and parseaddr() functions. Patch by
-# Thomas Dwyer.
-Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
-
-# 00436 # c76cc2aa3a2c30375ade4859b732ada851cc89ed
-# [CVE-2024-8088] gh-122905: Sanitize names in zipfile.Path.
-Patch436: 00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1701,6 +1688,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon Sep 09 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.6-1
+- Update to 3.12.6
+- Fixes: rhbz#2310090
+
 * Fri Aug 23 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.5-2
 - Security fix for CVE-2024-8088
 - Fixes: rhbz#2307461
diff --git a/sources b/sources
index 69c99d0..da635c8 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.5.tar.xz) = 7a1c30d798434fe24697bc253f6010d75145e7650f66803328425c8525331b9fa6b63d12a652687582db205f8d4c8279c8f73c338168592481517b063351c921
-SHA512 (Python-3.12.5.tar.xz.asc) = 65ce92272a38cc6bf8bf56fa2a99a830cf5b33b811b1788508e7b6f8b5d3e93e0b143412f829271be40cbb4e7c154f84499239b3e8ab63b2ccf0a5a22d2f84ee
+SHA512 (Python-3.12.6.tar.xz) = e658b0d59b5cfdc591d626e8282b9945759f27ee6fbc8bcb8670737db32ffc11fb832dfed9b0e80188fb5f7f3f39fe6dd6191ab7736376453c9e248321e9b063
+SHA512 (Python-3.12.6.tar.xz.asc) = 91a15bb7e8dd26616a2cdabe69c3ee81668cc67cb55a88b2be20433d24c9f8ae41c8f93f67aff2fa5858cd5b94600409cd472bd437a2fd33153483734ecd863f

From 4a4efadd0a1a1344645edec7decd1fd6478cb82d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Mon, 9 Sep 2024 16:37:00 +0200
Subject: [PATCH 52/93] Revert "Skip
 test_sendfile_close_peer_in_the_middle_of_receiving on ppc64le"

This was fixed upstream in https://github.com/python/cpython/pull/123422

This reverts commit b2d96079e910b91acf4a462d7fd5b5240cbe44ac.
---
 python3.12.spec | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index aba5d66..5f9d673 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -1161,8 +1161,6 @@ CheckPython() {
   # the test is skipped until it is fixed in upstream.
   # see: https://github.com/python/cpython/issues/104280#issuecomment-1669249980
   # test_gdb is skipped due to https://bugzilla.redhat.com/2275274#c11
-  # test_sendfile_close_peer_in_the_middle_of_receiving:
-  #  https://github.com/python/cpython/issues/120226
 
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
     -wW --slowest %{_smp_mflags} --timeout=2700 \
@@ -1172,9 +1170,6 @@ CheckPython() {
     %ifarch %{mips64}
     -x test_ctypes \
     %endif
-    %ifarch ppc64le
-    -i test_sendfile_close_peer_in_the_middle_of_receiving \
-    %endif
 
   echo FINISHED: CHECKING OF PYTHON FOR CONFIGURATION: $ConfName
 

From 981784693be574244eba5f1a5960d168e705508a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Tue, 1 Oct 2024 17:40:22 +0200
Subject: [PATCH 53/93] Update to 3.12.7

---
 python3.12.spec | 5 ++++-
 sources         | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 5f9d673..56a5f59 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,7 +13,7 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.6
+%global general_version %{pybasever}.7
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
@@ -1683,6 +1683,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Oct 01 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.7-1
+- Update to 3.12.7
+
 * Mon Sep 09 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.6-1
 - Update to 3.12.6
 - Fixes: rhbz#2310090
diff --git a/sources b/sources
index da635c8..55b8d7d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.6.tar.xz) = e658b0d59b5cfdc591d626e8282b9945759f27ee6fbc8bcb8670737db32ffc11fb832dfed9b0e80188fb5f7f3f39fe6dd6191ab7736376453c9e248321e9b063
-SHA512 (Python-3.12.6.tar.xz.asc) = 91a15bb7e8dd26616a2cdabe69c3ee81668cc67cb55a88b2be20433d24c9f8ae41c8f93f67aff2fa5858cd5b94600409cd472bd437a2fd33153483734ecd863f
+SHA512 (Python-3.12.7.tar.xz) = 4a363d3f852ad8f4fd1484aa4cec35494a3811be48ef67fadb2bdf2e2489ed07dc78fad6ab475257db503ddd64d39f9800f23a1c94b6bbd15b7f632cff0c90ae
+SHA512 (Python-3.12.7.tar.xz.asc) = 4d0a7a0da2c81888e93d8ff89ca2ed4bb85a7b0bd00f0d54a14e2c201affac2677ef3984d2b5aea253e624f6465548d9032eefdd9033c1eb3864d82cfd8d3df0

From e24cfa720b85d0d91e76542cac3c8124b769ddab Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Wed, 4 Dec 2024 00:14:42 +0100
Subject: [PATCH 54/93] Update to 3.12.8

Security fix for CVE-2024-9287

Fixes: rhbz#2321656
---
 00251-change-user-install-location.patch      | 16 ++++++++--------
 ...or-the-main-thread-gh-28549-gh-28589.patch |  2 +-
 python3.12.spec                               | 19 ++++++++++++-------
 sources                                       |  4 ++--
 4 files changed, 23 insertions(+), 18 deletions(-)

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index 2f33b5a..b4068f7 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -30,7 +30,7 @@ Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
  3 files changed, 71 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/site.py b/Lib/site.py
-index 924cfbecec..e2871ecc89 100644
+index aed254ad50..568dbdb945 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
 @@ -398,8 +398,15 @@ def getsitepackages(prefixes=None):
@@ -51,7 +51,7 @@ index 924cfbecec..e2871ecc89 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index 122d441bd1..2d354a11da 100644
+index 517b13acaf..f85ab25d27 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
 @@ -104,6 +104,11 @@
@@ -86,7 +86,7 @@ index 122d441bd1..2d354a11da 100644
  _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
                  'scripts', 'data')
  
-@@ -263,11 +281,40 @@ def _extend_dict(target_dict, other_dict):
+@@ -261,11 +279,40 @@ def _extend_dict(target_dict, other_dict):
          target_dict[key] = value
  
  
@@ -119,7 +119,7 @@ index 122d441bd1..2d354a11da 100644
 +    # we only change the defaults here, so explicit --prefix will take precedence
 +    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +    if (scheme == 'posix_prefix' and
-+        _PREFIX == '/usr' and
++         get_config_vars('prefix')[0] == '/usr' and
 +        'RPM_BUILD_ROOT' not in os.environ):
 +            _extend_dict(vars, _config_vars_local())
 +    else:
@@ -129,10 +129,10 @@ index 122d441bd1..2d354a11da 100644
          # On Windows we want to substitute 'lib' for schemes rather
          # than the native value (without modifying vars, in case it
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index 1137c2032b..8fc2b84f52 100644
+index 3468d0ce02..ff31010427 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
-@@ -110,8 +110,19 @@ def test_get_path(self):
+@@ -119,8 +119,19 @@ def test_get_path(self):
          for scheme in _INSTALL_SCHEMES:
              for name in _INSTALL_SCHEMES[scheme]:
                  expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
@@ -153,7 +153,7 @@ index 1137c2032b..8fc2b84f52 100644
                      os.path.normpath(expected),
                  )
  
-@@ -344,7 +355,7 @@ def test_get_config_h_filename(self):
+@@ -353,7 +364,7 @@ def test_get_config_h_filename(self):
          self.assertTrue(os.path.isfile(config_h), config_h)
  
      def test_get_scheme_names(self):
@@ -162,7 +162,7 @@ index 1137c2032b..8fc2b84f52 100644
          if HAS_USER_BASE:
              wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
          self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
-@@ -356,6 +367,8 @@ def test_symlink(self): # Issue 7880
+@@ -365,6 +376,8 @@ def test_symlink(self): # Issue 7880
              cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
              self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
  
diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 1a202f7..1268e76 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -16,7 +16,7 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 2e4b860b97..3066b23ee1 100644
+index 75a56f7830..c2509fced1 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
 @@ -1100,39 +1100,6 @@ def noop(): pass
diff --git a/python3.12.spec b/python3.12.spec
index 56a5f59..c8f6fd8 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,7 +13,7 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.7
+%global general_version %{pybasever}.8
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
@@ -71,7 +71,7 @@ License: Python-2.0.1
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 24.2
+%global pip_version 24.3.1
 %global setuptools_version 67.6.1
 %global wheel_version 0.40.0
 # All of those also include a list of indirect bundled libs:
@@ -79,8 +79,8 @@ License: Python-2.0.1
 #  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
 %global pip_bundled_provides %{expand:
 Provides: bundled(python3dist(cachecontrol)) = 0.14
-Provides: bundled(python3dist(certifi)) = 2024.7.4
-Provides: bundled(python3dist(distlib)) = 0.3.8
+Provides: bundled(python3dist(certifi)) = 2024.8.30
+Provides: bundled(python3dist(distlib)) = 0.3.9
 Provides: bundled(python3dist(distro)) = 1.9
 Provides: bundled(python3dist(idna)) = 3.7
 Provides: bundled(python3dist(msgpack)) = 1.0.8
@@ -93,9 +93,9 @@ Provides: bundled(python3dist(resolvelib)) = 1.0.1
 Provides: bundled(python3dist(rich)) = 13.7.1
 Provides: bundled(python3dist(setuptools)) = 70.3
 Provides: bundled(python3dist(tomli)) = 2.0.1
-Provides: bundled(python3dist(truststore)) = 0.9.1
+Provides: bundled(python3dist(truststore)) = 0.10
 Provides: bundled(python3dist(typing-extensions)) = 4.12.2
-Provides: bundled(python3dist(urllib3)) = 1.26.18
+Provides: bundled(python3dist(urllib3)) = 1.26.20
 }
 # setuptools
 # vendor.txt files not in .whl
@@ -336,7 +336,7 @@ Source11: idle3.appdata.xml
 
 # (Patches taken from github.com/fedora-python/cpython)
 
-# 00251 # cae5a6abc5df08239c85b83e4e250b6f2702e4f5
+# 00251 # 7f0caf37f83f1e591194e93fd0f8cefede49bba6
 # Change user install location
 #
 # Set values of base and platbase in sysconfig from /usr
@@ -1683,6 +1683,11 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Dec 03 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
+- Update to 3.12.8
+- Security fix for CVE-2024-9287
+- Fixes: rhbz#2321656
+
 * Tue Oct 01 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.7-1
 - Update to 3.12.7
 
diff --git a/sources b/sources
index 55b8d7d..403c2c2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.7.tar.xz) = 4a363d3f852ad8f4fd1484aa4cec35494a3811be48ef67fadb2bdf2e2489ed07dc78fad6ab475257db503ddd64d39f9800f23a1c94b6bbd15b7f632cff0c90ae
-SHA512 (Python-3.12.7.tar.xz.asc) = 4d0a7a0da2c81888e93d8ff89ca2ed4bb85a7b0bd00f0d54a14e2c201affac2677ef3984d2b5aea253e624f6465548d9032eefdd9033c1eb3864d82cfd8d3df0
+SHA512 (Python-3.12.8.tar.xz) = 406ce1146c4c2c70d252df56bbe9e5970ef469395cbaa211a96af71f32de2cf7abd944906920cc18b4a470027e63a3f64bf7679fb4954b31bf4ca4baf24fa370
+SHA512 (Python-3.12.8.tar.xz.asc) = 19493499ddb80764aa105e100585d2ef872798dc30fdff2e31d158cd7fd65b69ca133c6d9d16eb974660eed6ba474a26a2af3acd13a90522cf50e142492bd9a6

From e84b7727f4910d71dd2e15d5dd3c4688dc7b2ff1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Thu, 5 Dec 2024 12:02:54 +0100
Subject: [PATCH 55/93] Optimize patch 251 a tiny bit

Before:

    $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()'
    2000 loops, best of 5: 157 usec per loop

    $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()'
    2000 loops, best of 5: 162 usec per loop

    $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()'
    1000 loops, best of 5: 146 usec per loop

After:

    $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()'
    5000 loops, best of 5: 75.9 usec per loop

    $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()'
    5000 loops, best of 5: 77.1 usec per loop

    $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()'
    5000 loops, best of 5: 76.2 usec per loop

The results are inconclusive on 3.12,
but we want the patch to be identical (if possible).

This can be shipped with the next update.
---
 00251-change-user-install-location.patch | 4 ++--
 python3.12.spec                          | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index b4068f7..dd7a07a 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -51,7 +51,7 @@ index aed254ad50..568dbdb945 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index 517b13acaf..f85ab25d27 100644
+index 517b13acaf..928d1a0541 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
 @@ -104,6 +104,11 @@
@@ -119,7 +119,7 @@ index 517b13acaf..f85ab25d27 100644
 +    # we only change the defaults here, so explicit --prefix will take precedence
 +    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +    if (scheme == 'posix_prefix' and
-+         get_config_vars('prefix')[0] == '/usr' and
++        sys.prefix == '/usr' and
 +        'RPM_BUILD_ROOT' not in os.environ):
 +            _extend_dict(vars, _config_vars_local())
 +    else:
diff --git a/python3.12.spec b/python3.12.spec
index c8f6fd8..d3fa09e 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -336,7 +336,7 @@ Source11: idle3.appdata.xml
 
 # (Patches taken from github.com/fedora-python/cpython)
 
-# 00251 # 7f0caf37f83f1e591194e93fd0f8cefede49bba6
+# 00251 # 6a4ec74157aa01f1ada9f29f30a371cd9e5369e8
 # Change user install location
 #
 # Set values of base and platbase in sysconfig from /usr

From 62fc5ae5edb2fc5c6b73f6e3dff4b00d5f428552 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Fri, 6 Dec 2024 20:14:08 +0100
Subject: [PATCH 56/93] Security fix for CVE-2024-12254

Fixes: rhbz#2330926
---
 ...elines-pauses-the-protocol-if-needed.patch | 62 +++++++++++++++++++
 python3.12.spec                               | 14 ++++-
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch

diff --git a/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch b/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch
new file mode 100644
index 0000000..70778f9
--- /dev/null
+++ b/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch
@@ -0,0 +1,62 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Fri, 6 Dec 2024 06:12:40 +0100
+Subject: [PATCH] 00445: CVE-2024-12254: Ensure
+ _SelectorSocketTransport.writelines pauses the protocol if needed
+
+Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed.
+
+Resolved upstream: https://github.com/python/cpython/issues/127655
+
+Co-authored-by: J. Nick Koston <nick@koston.org>
+Co-authored-by: Kumar Aditya <kumaraditya@python.org>
+---
+ Lib/asyncio/selector_events.py                       |  1 +
+ Lib/test/test_asyncio/test_selector_events.py        | 12 ++++++++++++
+ .../2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst   |  1 +
+ 3 files changed, 14 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
+
+diff --git a/Lib/asyncio/selector_events.py b/Lib/asyncio/selector_events.py
+index 790711f834..dd79ad18df 100644
+--- a/Lib/asyncio/selector_events.py
++++ b/Lib/asyncio/selector_events.py
+@@ -1183,6 +1183,7 @@ def writelines(self, list_of_data):
+         # If the entire buffer couldn't be written, register a write handler
+         if self._buffer:
+             self._loop._add_writer(self._sock_fd, self._write_ready)
++            self._maybe_pause_protocol()
+ 
+     def can_write_eof(self):
+         return True
+diff --git a/Lib/test/test_asyncio/test_selector_events.py b/Lib/test/test_asyncio/test_selector_events.py
+index 47693ea4d3..736c19796e 100644
+--- a/Lib/test/test_asyncio/test_selector_events.py
++++ b/Lib/test/test_asyncio/test_selector_events.py
+@@ -805,6 +805,18 @@ def test_writelines_send_partial(self):
+         self.assertTrue(self.sock.send.called)
+         self.assertTrue(self.loop.writers)
+ 
++    def test_writelines_pauses_protocol(self):
++        data = memoryview(b'data')
++        self.sock.send.return_value = 2
++        self.sock.send.fileno.return_value = 7
++
++        transport = self.socket_transport()
++        transport._high_water = 1
++        transport.writelines([data])
++        self.assertTrue(self.protocol.pause_writing.called)
++        self.assertTrue(self.sock.send.called)
++        self.assertTrue(self.loop.writers)
++
+     @unittest.skipUnless(selector_events._HAS_SENDMSG, 'no sendmsg')
+     def test_write_sendmsg_full(self):
+         data = memoryview(b'data')
+diff --git a/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
+new file mode 100644
+index 0000000000..76cfc58121
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
+@@ -0,0 +1 @@
++Fixed the :class:`!asyncio.selector_events._SelectorSocketTransport` transport not pausing writes for the protocol when the buffer reaches the high water mark when using :meth:`asyncio.WriteTransport.writelines`.
diff --git a/python3.12.spec b/python3.12.spec
index d3fa09e..f95636d 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -364,6 +364,14 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
+# 00445 # d1a32daddefad32ceb93155552858c0a0311b23e
+# CVE-2024-12254: Ensure _SelectorSocketTransport.writelines pauses the protocol if needed
+#
+# Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed.
+#
+# Resolved upstream: https://github.com/python/cpython/issues/127655
+Patch445: 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1683,6 +1691,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Dec 06 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-2
+- Security fix for CVE-2024-12254
+- Fixes: rhbz#2330926
+
 * Tue Dec 03 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
 - Update to 3.12.8
 - Security fix for CVE-2024-9287

From bc9c9750199250ea58c5662ccb982139025e1a3b Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 18 Jan 2025 21:08:49 +0000
Subject: [PATCH 57/93] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index f95636d..89e0fdd 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -1691,6 +1691,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
 * Fri Dec 06 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-2
 - Security fix for CVE-2024-12254
 - Fixes: rhbz#2330926

From c1f875abc3634c630b95635f13664048817895c8 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 23 Jan 2025 01:50:33 +0100
Subject: [PATCH 58/93] Remove redundant --with-system-ffi configure option

The option has been removed since Python 3.12

See: https://github.com/python/cpython/commit/25590eb5dee5176f3ac60916b19450f8198e7ffc
---
 python3.12.spec | 1 -
 1 file changed, 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 89e0fdd..54076fa 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -803,7 +803,6 @@ BuildPython() {
   --with-computed-gotos=%{computed_gotos_flag} \
   --with-dbmliborder=gdbm:ndbm:bdb \
   --with-system-expat \
-  --with-system-ffi \
   --with-system-libmpdec \
   --enable-loadable-sqlite-extensions \
   --with-dtrace \

From 14bc16980718d47128c25af68f33f1e249f0a36d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= <besser82@fedoraproject.org>
Date: Sat, 1 Feb 2025 19:57:00 +0100
Subject: [PATCH 59/93] Add explicit BR: libxcrypt-devel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Björn Esser <besser82@fedoraproject.org>
---
 python3.12.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 54076fa..60599c7 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: Python-2.0.1
 
 
@@ -259,6 +259,7 @@ BuildRequires: libnsl2-devel
 BuildRequires: libtirpc-devel
 BuildRequires: libGL-devel
 BuildRequires: libuuid-devel
+BuildRequires: libxcrypt-devel
 BuildRequires: libX11-devel
 BuildRequires: make
 BuildRequires: mpdecimal-devel
@@ -1690,6 +1691,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.12.8-4
+- Add explicit BR: libxcrypt-devel
+
 * Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.8-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 

From bfa6da811bac14ff9d546ed730957e5e03a1fc43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Fri, 31 Jan 2025 14:51:17 +0000
Subject: [PATCH 60/93] Ensure this package is built with Tk 8

- Fixes: rhbz#2337759
---
 python3.12.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 60599c7..54e1adf 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -274,9 +274,9 @@ BuildRequires: sqlite-devel
 BuildRequires: gdb
 
 BuildRequires: tar
-BuildRequires: tcl-devel
+BuildRequires: tcl-devel < 1:9
 BuildRequires: tix-devel
-BuildRequires: tk-devel
+BuildRequires: tk-devel < 1:9
 BuildRequires: tzdata
 
 %if %{with valgrind}

From 5c479251a5a932f44fbc689eab622825be7c54e3 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Tue, 4 Feb 2025 22:58:21 +0100
Subject: [PATCH 61/93] Update to 3.12.9

Security fix for CVE-2025-0938

Fixes: rhbz#2343275
---
 ...elines-pauses-the-protocol-if-needed.patch | 62 -------------------
 python3.12.spec                               | 17 +++--
 sources                                       |  4 +-
 3 files changed, 9 insertions(+), 74 deletions(-)
 delete mode 100644 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch

diff --git a/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch b/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch
deleted file mode 100644
index 70778f9..0000000
--- a/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Fri, 6 Dec 2024 06:12:40 +0100
-Subject: [PATCH] 00445: CVE-2024-12254: Ensure
- _SelectorSocketTransport.writelines pauses the protocol if needed
-
-Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed.
-
-Resolved upstream: https://github.com/python/cpython/issues/127655
-
-Co-authored-by: J. Nick Koston <nick@koston.org>
-Co-authored-by: Kumar Aditya <kumaraditya@python.org>
----
- Lib/asyncio/selector_events.py                       |  1 +
- Lib/test/test_asyncio/test_selector_events.py        | 12 ++++++++++++
- .../2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst   |  1 +
- 3 files changed, 14 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
-
-diff --git a/Lib/asyncio/selector_events.py b/Lib/asyncio/selector_events.py
-index 790711f834..dd79ad18df 100644
---- a/Lib/asyncio/selector_events.py
-+++ b/Lib/asyncio/selector_events.py
-@@ -1183,6 +1183,7 @@ def writelines(self, list_of_data):
-         # If the entire buffer couldn't be written, register a write handler
-         if self._buffer:
-             self._loop._add_writer(self._sock_fd, self._write_ready)
-+            self._maybe_pause_protocol()
- 
-     def can_write_eof(self):
-         return True
-diff --git a/Lib/test/test_asyncio/test_selector_events.py b/Lib/test/test_asyncio/test_selector_events.py
-index 47693ea4d3..736c19796e 100644
---- a/Lib/test/test_asyncio/test_selector_events.py
-+++ b/Lib/test/test_asyncio/test_selector_events.py
-@@ -805,6 +805,18 @@ def test_writelines_send_partial(self):
-         self.assertTrue(self.sock.send.called)
-         self.assertTrue(self.loop.writers)
- 
-+    def test_writelines_pauses_protocol(self):
-+        data = memoryview(b'data')
-+        self.sock.send.return_value = 2
-+        self.sock.send.fileno.return_value = 7
-+
-+        transport = self.socket_transport()
-+        transport._high_water = 1
-+        transport.writelines([data])
-+        self.assertTrue(self.protocol.pause_writing.called)
-+        self.assertTrue(self.sock.send.called)
-+        self.assertTrue(self.loop.writers)
-+
-     @unittest.skipUnless(selector_events._HAS_SENDMSG, 'no sendmsg')
-     def test_write_sendmsg_full(self):
-         data = memoryview(b'data')
-diff --git a/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
-new file mode 100644
-index 0000000000..76cfc58121
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst
-@@ -0,0 +1 @@
-+Fixed the :class:`!asyncio.selector_events._SelectorSocketTransport` transport not pausing writes for the protocol when the buffer reaches the high water mark when using :meth:`asyncio.WriteTransport.writelines`.
diff --git a/python3.12.spec b/python3.12.spec
index 54e1adf..d30a493 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.8
+%global general_version %{pybasever}.9
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 4%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -365,14 +365,6 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00445 # d1a32daddefad32ceb93155552858c0a0311b23e
-# CVE-2024-12254: Ensure _SelectorSocketTransport.writelines pauses the protocol if needed
-#
-# Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed.
-#
-# Resolved upstream: https://github.com/python/cpython/issues/127655
-Patch445: 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1691,6 +1683,11 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Feb 04 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.9-1
+- Update to 3.12.9
+- Security fix for CVE-2025-0938
+- Fixes: rhbz#2343275
+
 * Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.12.8-4
 - Add explicit BR: libxcrypt-devel
 
diff --git a/sources b/sources
index 403c2c2..6089763 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.8.tar.xz) = 406ce1146c4c2c70d252df56bbe9e5970ef469395cbaa211a96af71f32de2cf7abd944906920cc18b4a470027e63a3f64bf7679fb4954b31bf4ca4baf24fa370
-SHA512 (Python-3.12.8.tar.xz.asc) = 19493499ddb80764aa105e100585d2ef872798dc30fdff2e31d158cd7fd65b69ca133c6d9d16eb974660eed6ba474a26a2af3acd13a90522cf50e142492bd9a6
+SHA512 (Python-3.12.9.tar.xz) = c840b14aa21e6a963d18c06ebaafb551d9c9a101b3866417e762fc4a2fde071a7a25fa257faba2956c7344bbc2413ed61690a712d26fba4d0dbeaa50e49b2574
+SHA512 (Python-3.12.9.tar.xz.asc) = b59251ca3a0a17c06ff7d165f6c025eb91127c80be0782642590f5c922297e0710544ac5a9ae977378e393f1c4861149576a0515af5ec0e54e6827c4010d544f

From 5c4e561e0dea5a7dc41551f13777c691e39b709c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Thu, 6 Feb 2025 12:04:28 +0100
Subject: [PATCH 62/93] Rebuilt with mpdecimal 4.0.0

---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index d30a493..235a43a 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -1683,6 +1683,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Feb 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.9-2
+- Rebuilt with mpdecimal 4.0.0
+
 * Tue Feb 04 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.9-1
 - Update to 3.12.9
 - Security fix for CVE-2025-0938

From ebed0922de9fe78c594e3d4df33da9d291f1ef00 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Tue, 1 Apr 2025 01:15:52 +0200
Subject: [PATCH 63/93] Properly apply exported CFLAGS for dtrace/systemtap
 builds

Fixes: rhbz#2356301
---
 00251-change-user-install-location.patch      |  2 +-
 ...or-the-main-thread-gh-28549-gh-28589.patch |  2 +-
 ...d-cflags-for-dtrace-systemtap-builds.patch | 52 +++++++++++++++++++
 python3.12.spec                               | 18 ++++++-
 4 files changed, 71 insertions(+), 3 deletions(-)
 create mode 100644 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index dd7a07a..123640e 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -51,7 +51,7 @@ index aed254ad50..568dbdb945 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index 517b13acaf..928d1a0541 100644
+index 7dd63b9355..41a151e70e 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
 @@ -104,6 +104,11 @@
diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 1268e76..02f7357 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -60,7 +60,7 @@ index 75a56f7830..c2509fced1 100644
          code = """if 1:
              import _thread
 diff --git a/Lib/threading.py b/Lib/threading.py
-index 0bba85d08a..b256e3273f 100644
+index 064c74d40f..9e3abacd42 100644
 --- a/Lib/threading.py
 +++ b/Lib/threading.py
 @@ -1587,29 +1587,20 @@ def _shutdown():
diff --git a/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch b/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
new file mode 100644
index 0000000..8d4cdb6
--- /dev/null
+++ b/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
@@ -0,0 +1,52 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 31 Mar 2025 20:29:04 +0200
+Subject: [PATCH] 00452: Properly apply exported CFLAGS for dtrace/systemtap
+ builds
+
+When using --with-dtrace the resulting object file could be missing
+specific CFLAGS exported by the build system due to the systemtap
+script using specific defaults.
+
+Exporting the CC and CFLAGS variables before the dtrace invocation
+allows us to properly apply CFLAGS exported by the build system
+even when cross-compiling.
+
+Co-authored-by: stratakis <cstratak@redhat.com>
+---
+ Makefile.pre.in                                               | 4 ++--
+ .../next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index 689f33d8ff..750559c58d 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -1574,7 +1574,7 @@ Python/frozen.o: $(FROZEN_FILES_OUT)
+ # an include guard, so we can't use a pipeline to transform its output.
+ Include/pydtrace_probes.h: $(srcdir)/Include/pydtrace.d
+ 	$(MKDIR_P) Include
+-	$(DTRACE) $(DFLAGS) -o $@ -h -s $<
++	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -h -s $<
+ 	: sed in-place edit with POSIX-only tools
+ 	sed 's/PYTHON_/PyDTrace_/' $@ > $@.tmp
+ 	mv $@.tmp $@
+@@ -1584,7 +1584,7 @@ Python/import.o: $(srcdir)/Include/pydtrace.h
+ Modules/gcmodule.o: $(srcdir)/Include/pydtrace.h
+ 
+ Python/pydtrace.o: $(srcdir)/Include/pydtrace.d $(DTRACE_DEPS)
+-	$(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
++	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
+ 
+ Objects/typeobject.o: Objects/typeslots.inc
+ 
+diff --git a/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
+new file mode 100644
+index 0000000000..a287e0b228
+--- /dev/null
++++ b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
+@@ -0,0 +1,2 @@
++The DTrace build now properly passes the ``CC`` and ``CFLAGS`` variables
++to the ``dtrace`` command when utilizing SystemTap on Linux.
diff --git a/python3.12.spec b/python3.12.spec
index 235a43a..09cdff8 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -365,6 +365,18 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
+# 00452 # eb11d070c5af7d1b5e47f4e02186152d08eaf793
+# Properly apply exported CFLAGS for dtrace/systemtap builds
+#
+# When using --with-dtrace the resulting object file could be missing
+# specific CFLAGS exported by the build system due to the systemtap
+# script using specific defaults.
+#
+# Exporting the CC and CFLAGS variables before the dtrace invocation
+# allows us to properly apply CFLAGS exported by the build system
+# even when cross-compiling.
+Patch452: 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1683,6 +1695,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon Mar 31 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.9-3
+- Properly apply exported CFLAGS for dtrace/systemtap builds
+- Fixes: rhbz#2356301
+
 * Thu Feb 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.9-2
 - Rebuilt with mpdecimal 4.0.0
 

From fe206952d2a2cfb7bea8b9ca034b4da8ff0f6c82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Wed, 9 Apr 2025 09:32:57 +0200
Subject: [PATCH 64/93] Update to 3.12.10

Patch 452 was merged upstream.
---
 00251-change-user-install-location.patch      |  6 +--
 ...d-cflags-for-dtrace-systemtap-builds.patch | 52 -------------------
 python3.12.spec                               | 37 +++++--------
 sources                                       |  4 +-
 4 files changed, 19 insertions(+), 80 deletions(-)
 delete mode 100644 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index 123640e..6a5402d 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -51,7 +51,7 @@ index aed254ad50..568dbdb945 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index 7dd63b9355..41a151e70e 100644
+index acc8d4d182..6355669f62 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
 @@ -104,6 +104,11 @@
@@ -86,7 +86,7 @@ index 7dd63b9355..41a151e70e 100644
  _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
                  'scripts', 'data')
  
-@@ -261,11 +279,40 @@ def _extend_dict(target_dict, other_dict):
+@@ -268,11 +286,40 @@ def _extend_dict(target_dict, other_dict):
          target_dict[key] = value
  
  
@@ -129,7 +129,7 @@ index 7dd63b9355..41a151e70e 100644
          # On Windows we want to substitute 'lib' for schemes rather
          # than the native value (without modifying vars, in case it
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index 3468d0ce02..ff31010427 100644
+index 67647e1b78..7baddaa9d6 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
 @@ -119,8 +119,19 @@ def test_get_path(self):
diff --git a/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch b/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
deleted file mode 100644
index 8d4cdb6..0000000
--- a/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Mon, 31 Mar 2025 20:29:04 +0200
-Subject: [PATCH] 00452: Properly apply exported CFLAGS for dtrace/systemtap
- builds
-
-When using --with-dtrace the resulting object file could be missing
-specific CFLAGS exported by the build system due to the systemtap
-script using specific defaults.
-
-Exporting the CC and CFLAGS variables before the dtrace invocation
-allows us to properly apply CFLAGS exported by the build system
-even when cross-compiling.
-
-Co-authored-by: stratakis <cstratak@redhat.com>
----
- Makefile.pre.in                                               | 4 ++--
- .../next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst | 2 ++
- 2 files changed, 4 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-
-diff --git a/Makefile.pre.in b/Makefile.pre.in
-index 689f33d8ff..750559c58d 100644
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -1574,7 +1574,7 @@ Python/frozen.o: $(FROZEN_FILES_OUT)
- # an include guard, so we can't use a pipeline to transform its output.
- Include/pydtrace_probes.h: $(srcdir)/Include/pydtrace.d
- 	$(MKDIR_P) Include
--	$(DTRACE) $(DFLAGS) -o $@ -h -s $<
-+	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -h -s $<
- 	: sed in-place edit with POSIX-only tools
- 	sed 's/PYTHON_/PyDTrace_/' $@ > $@.tmp
- 	mv $@.tmp $@
-@@ -1584,7 +1584,7 @@ Python/import.o: $(srcdir)/Include/pydtrace.h
- Modules/gcmodule.o: $(srcdir)/Include/pydtrace.h
- 
- Python/pydtrace.o: $(srcdir)/Include/pydtrace.d $(DTRACE_DEPS)
--	$(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
-+	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
- 
- Objects/typeobject.o: Objects/typeslots.inc
- 
-diff --git a/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-new file mode 100644
-index 0000000000..a287e0b228
---- /dev/null
-+++ b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-@@ -0,0 +1,2 @@
-+The DTrace build now properly passes the ``CC`` and ``CFLAGS`` variables
-+to the ``dtrace`` command when utilizing SystemTap on Linux.
diff --git a/python3.12.spec b/python3.12.spec
index 09cdff8..80cf90c 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.9
+%global general_version %{pybasever}.10
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -71,28 +71,28 @@ License: Python-2.0.1
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 24.3.1
+%global pip_version 25.0.1
 %global setuptools_version 67.6.1
 %global wheel_version 0.40.0
 # All of those also include a list of indirect bundled libs:
 # pip
 #  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
 %global pip_bundled_provides %{expand:
-Provides: bundled(python3dist(cachecontrol)) = 0.14
+Provides: bundled(python3dist(cachecontrol)) = 0.14.1
 Provides: bundled(python3dist(certifi)) = 2024.8.30
 Provides: bundled(python3dist(distlib)) = 0.3.9
 Provides: bundled(python3dist(distro)) = 1.9
-Provides: bundled(python3dist(idna)) = 3.7
-Provides: bundled(python3dist(msgpack)) = 1.0.8
-Provides: bundled(python3dist(packaging)) = 24.1
-Provides: bundled(python3dist(platformdirs)) = 4.2.2
+Provides: bundled(python3dist(idna)) = 3.10
+Provides: bundled(python3dist(msgpack)) = 1.1
+Provides: bundled(python3dist(packaging)) = 24.2
+Provides: bundled(python3dist(platformdirs)) = 4.3.6
 Provides: bundled(python3dist(pygments)) = 2.18
-Provides: bundled(python3dist(pyproject-hooks)) = 1
+Provides: bundled(python3dist(pyproject-hooks)) = 1.2
 Provides: bundled(python3dist(requests)) = 2.32.3
 Provides: bundled(python3dist(resolvelib)) = 1.0.1
-Provides: bundled(python3dist(rich)) = 13.7.1
+Provides: bundled(python3dist(rich)) = 13.9.4
 Provides: bundled(python3dist(setuptools)) = 70.3
-Provides: bundled(python3dist(tomli)) = 2.0.1
+Provides: bundled(python3dist(tomli)) = 2.2.1
 Provides: bundled(python3dist(truststore)) = 0.10
 Provides: bundled(python3dist(typing-extensions)) = 4.12.2
 Provides: bundled(python3dist(urllib3)) = 1.26.20
@@ -365,18 +365,6 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00452 # eb11d070c5af7d1b5e47f4e02186152d08eaf793
-# Properly apply exported CFLAGS for dtrace/systemtap builds
-#
-# When using --with-dtrace the resulting object file could be missing
-# specific CFLAGS exported by the build system due to the systemtap
-# script using specific defaults.
-#
-# Exporting the CC and CFLAGS variables before the dtrace invocation
-# allows us to properly apply CFLAGS exported by the build system
-# even when cross-compiling.
-Patch452: 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1695,6 +1683,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Apr 09 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.10-1
+- Update to 3.12.10
+
 * Mon Mar 31 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.9-3
 - Properly apply exported CFLAGS for dtrace/systemtap builds
 - Fixes: rhbz#2356301
diff --git a/sources b/sources
index 6089763..da3276e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.9.tar.xz) = c840b14aa21e6a963d18c06ebaafb551d9c9a101b3866417e762fc4a2fde071a7a25fa257faba2956c7344bbc2413ed61690a712d26fba4d0dbeaa50e49b2574
-SHA512 (Python-3.12.9.tar.xz.asc) = b59251ca3a0a17c06ff7d165f6c025eb91127c80be0782642590f5c922297e0710544ac5a9ae977378e393f1c4861149576a0515af5ec0e54e6827c4010d544f
+SHA512 (Python-3.12.10.tar.xz) = 520c30e3958d0be3c127e5dbb1c52bb3bfc404b5b3c7eb56525e25b9b59af9b21b53bee192f323f470e1df806f6cb2dd3411eb90cbc1c4b7d9b6b0777c29e644
+SHA512 (Python-3.12.10.tar.xz.asc) = 7edfa6fd816cf2a052abdb775d464e2f389105ed3e782cacf90805613aaca54bf71308504a5336ee1204e872e7db28df32413fb10b057056b0d5cb3c7a20a9f1

From 893248a9312e47aa5b2d1586852d44d50b67a2cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Thu, 17 Apr 2025 12:02:56 +0200
Subject: [PATCH 65/93] Regenerate patches with updated importpatches script

---
 00251-change-user-install-location.patch                      | 2 +-
 ...ding-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch
index 6a5402d..9deba18 100644
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
 Date: Mon, 15 Feb 2021 12:19:27 +0100
-Subject: [PATCH] 00251: Change user install location
+Subject: 00251: Change user install location
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
diff --git a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
index 02f7357..8a6f95e 100644
--- a/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
+++ b/00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
@@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
 Date: Tue, 25 Oct 2022 12:02:33 +0200
-Subject: [PATCH] 00371: Revert "bpo-1596321: Fix threading._shutdown() for the
- main thread (GH-28549) (GH-28589)"
+Subject: 00371: Revert "bpo-1596321: Fix threading._shutdown() for the main
+ thread (GH-28549) (GH-28589)"
 
 This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
 introduced regression causing FreeIPA's tests to fail.

From 6ad4282b30e1652ae7758bc3ff85d289c492e7c7 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Wed, 23 Apr 2025 01:24:08 +0200
Subject: [PATCH 66/93] Apply Intel's CET for mitigation against control-flow
 hijacking attacks

---
 ...l-control-flow-technology-for-x86-64.patch | 51 +++++++++++++++++++
 python3.12.spec                               | 15 +++++-
 2 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 00459-apply-intel-control-flow-technology-for-x86-64.patch

diff --git a/00459-apply-intel-control-flow-technology-for-x86-64.patch b/00459-apply-intel-control-flow-technology-for-x86-64.patch
new file mode 100644
index 0000000..380856c
--- /dev/null
+++ b/00459-apply-intel-control-flow-technology-for-x86-64.patch
@@ -0,0 +1,51 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charalampos Stratakis <cstratak@redhat.com>
+Date: Wed, 8 Jan 2025 04:58:22 +0100
+Subject: 00459: Apply Intel Control-flow Technology for x86-64
+
+Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks
+
+Proposed upstream: https://github.com/python/cpython/pull/128606
+
+See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
+---
+ Python/asm_trampoline.S | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S
+index 460707717d..341d0bbe51 100644
+--- a/Python/asm_trampoline.S
++++ b/Python/asm_trampoline.S
+@@ -9,6 +9,9 @@
+ # }
+ _Py_trampoline_func_start:
+ #ifdef __x86_64__
++#if defined(__CET__) && (__CET__ & 1)
++    endbr64
++#endif
+     sub    $8, %rsp
+     call    *%rcx
+     add    $8, %rsp
+@@ -26,3 +29,22 @@ _Py_trampoline_func_start:
+     .globl	_Py_trampoline_func_end
+ _Py_trampoline_func_end:
+     .section        .note.GNU-stack,"",@progbits
++# Note for indicating the assembly code supports CET
++#if defined(__x86_64__) && defined(__CET__) && (__CET__ & 1)
++    .section    .note.gnu.property,"a"
++    .align 8
++    .long    1f - 0f
++    .long    4f - 1f
++    .long    5
++0:
++    .string  "GNU"
++1:
++    .align 8
++    .long    0xc0000002
++    .long    3f - 2f
++2:
++    .long    0x3
++3:
++    .align 8
++4:
++#endif // __x86_64__
diff --git a/python3.12.spec b/python3.12.spec
index 80cf90c..eace632 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -365,6 +365,16 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
+# 00459 # 906f6692bd85034012c9554f2434627ccfc04c67
+# Apply Intel Control-flow Technology for x86-64
+#
+# Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks
+#
+# Proposed upstream: https://github.com/python/cpython/pull/128606
+#
+# See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
+Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1683,6 +1693,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Apr 22 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-2
+- Apply Intel's CET for mitigation against control-flow hijacking attacks
+
 * Wed Apr 09 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.10-1
 - Update to 3.12.10
 

From 1821cc867485703dd142745fd0c86063ece211f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Tue, 6 May 2025 15:18:28 +0200
Subject: [PATCH 67/93] Drop requirement on python-wheel-wheel with setuptools
 >= 71

---
 ...red-setuptools-in-lib-test-wheeldata.patch | 110 ++++++++++++++++++
 ...eel-in-test-venvs-when-setuptools-71.patch |  34 ++++++
 python3.12.spec                               |  21 +++-
 3 files changed, 162 insertions(+), 3 deletions(-)
 create mode 100644 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
 create mode 100644 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch

diff --git a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
new file mode 100644
index 0000000..03d769e
--- /dev/null
+++ b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
@@ -0,0 +1,110 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Adam Turner <9087854+AA-Turner@users.noreply.github.com>
+Date: Fri, 25 Apr 2025 00:46:20 +0100
+Subject: 00460: gh-132415: Update vendored setuptools in
+ ``Lib/test/wheeldata``
+
+(cherry picked from commit c9f3f5b4ed52d7bed6073ffa39717ece47202558)
+(actual changes in .whl files removed to make this patch smaller)
+
+gh-127906: Add missing sys import to test_cppext
+
+(cherry picked from commit 9cba14881b371b1e95d57877896169c4605f9b75)
+
+Co-Authored-By: Victor Stinner <vstinner@python.org>
+---
+ Lib/test/support/__init__.py                 | 11 +++++------
+ Lib/test/test_cext/__init__.py               |  2 +-
+ Lib/test/test_cppext/__init__.py             |  2 +-
+ Lib/test/test_cppext/setup.py                |  1 +
+ Lib/test/test_peg_generator/test_c_parser.py |  2 +-
+ 5 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
+index c899347624..223787244f 100644
+--- a/Lib/test/support/__init__.py
++++ b/Lib/test/support/__init__.py
+@@ -2260,7 +2260,7 @@ def _findwheel(pkgname):
+     filenames = os.listdir(wheel_dir)
+     filenames = sorted(filenames, reverse=True)  # approximate "newest" first
+     for filename in filenames:
+-        # filename is like 'setuptools-67.6.1-py3-none-any.whl'
++        # filename is like 'setuptools-{version}-py3-none-any.whl'
+         if not filename.endswith(".whl"):
+             continue
+         prefix = pkgname + '-'
+@@ -2269,10 +2269,10 @@ def _findwheel(pkgname):
+     raise FileNotFoundError(f"No wheel for {pkgname} found in {wheel_dir}")
+ 
+ 
+-# Context manager that creates a virtual environment, install setuptools and wheel in it
+-# and returns the path to the venv directory and the path to the python executable
++# Context manager that creates a virtual environment, install setuptools in it,
++# and returns the paths to the venv directory and the python executable
+ @contextlib.contextmanager
+-def setup_venv_with_pip_setuptools_wheel(venv_dir):
++def setup_venv_with_pip_setuptools(venv_dir):
+     import subprocess
+     from .os_helper import temp_cwd
+ 
+@@ -2295,8 +2295,7 @@ def setup_venv_with_pip_setuptools_wheel(venv_dir):
+ 
+         cmd = [python, '-X', 'dev',
+                '-m', 'pip', 'install',
+-               _findwheel('setuptools'),
+-               _findwheel('wheel')]
++               _findwheel('setuptools')]
+         if verbose:
+             print()
+             print('Run:', ' '.join(cmd))
+diff --git a/Lib/test/test_cext/__init__.py b/Lib/test/test_cext/__init__.py
+index d5ea1dc660..04a6361ff3 100644
+--- a/Lib/test/test_cext/__init__.py
++++ b/Lib/test/test_cext/__init__.py
+@@ -53,7 +53,7 @@ def check_build(self, extension_name, std=None, limited=False):
+             self.skipTest('Py_LIMITED_API is incompatible with Py_TRACE_REFS')
+ 
+         venv_dir = 'env'
+-        with support.setup_venv_with_pip_setuptools_wheel(venv_dir) as python_exe:
++        with support.setup_venv_with_pip_setuptools(venv_dir) as python_exe:
+             self._check_build(extension_name, python_exe,
+                               std=std, limited=limited)
+ 
+diff --git a/Lib/test/test_cppext/__init__.py b/Lib/test/test_cppext/__init__.py
+index 2198b7b2c0..31ea4ac7a1 100644
+--- a/Lib/test/test_cppext/__init__.py
++++ b/Lib/test/test_cppext/__init__.py
+@@ -51,7 +51,7 @@ def check_build(self, extension_name, std=None, limited=False):
+             self.skipTest('Py_LIMITED_API is incompatible with Py_TRACE_REFS')
+ 
+         venv_dir = 'env'
+-        with support.setup_venv_with_pip_setuptools_wheel(venv_dir) as python_exe:
++        with support.setup_venv_with_pip_setuptools(venv_dir) as python_exe:
+             self._check_build(extension_name, python_exe,
+                               std=std, limited=limited)
+ 
+diff --git a/Lib/test/test_cppext/setup.py b/Lib/test/test_cppext/setup.py
+index 019ff18446..25d71cd9a2 100644
+--- a/Lib/test/test_cppext/setup.py
++++ b/Lib/test/test_cppext/setup.py
+@@ -3,6 +3,7 @@
+ import os
+ import platform
+ import shlex
++import sys
+ import sysconfig
+ from test import support
+ 
+diff --git a/Lib/test/test_peg_generator/test_c_parser.py b/Lib/test/test_peg_generator/test_c_parser.py
+index eb31569c03..2fe1367b51 100644
+--- a/Lib/test/test_peg_generator/test_c_parser.py
++++ b/Lib/test/test_peg_generator/test_c_parser.py
+@@ -99,7 +99,7 @@ def setUpClass(cls):
+         cls.addClassCleanup(shutil.rmtree, cls.library_dir)
+ 
+         with contextlib.ExitStack() as stack:
+-            python_exe = stack.enter_context(support.setup_venv_with_pip_setuptools_wheel("venv"))
++            python_exe = stack.enter_context(support.setup_venv_with_pip_setuptools("venv"))
+             sitepackages = subprocess.check_output(
+                 [python_exe, "-c", "import sysconfig; print(sysconfig.get_path('platlib'))"],
+                 text=True,
diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
new file mode 100644
index 0000000..06cb28a
--- /dev/null
+++ b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Fri, 25 Apr 2025 09:33:37 +0200
+Subject: 00461: Downstream only: Install wheel in test venvs when setuptools <
+ 71
+
+---
+ Lib/test/support/__init__.py | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
+index 223787244f..94f55ccaf0 100644
+--- a/Lib/test/support/__init__.py
++++ b/Lib/test/support/__init__.py
+@@ -2293,9 +2293,18 @@ def setup_venv_with_pip_setuptools(venv_dir):
+         else:
+             python = os.path.join(venv, 'bin', python_exe)
+ 
++        setuptools_whl = _findwheel('setuptools')
++        whl_filename = os.path.basename(setuptools_whl)
++        setuptools_major = int(whl_filename.split('-')[1].split('.')[0])
++        if setuptools_major >= 71:  # we need 70.1+, but that's OK
++            wheels = (setuptools_whl,)
++        else:
++            wheels = (setuptools_whl, _findwheel('wheel'))
++
+         cmd = [python, '-X', 'dev',
+                '-m', 'pip', 'install',
+-               _findwheel('setuptools')]
++               *wheels,
++               ]
+         if verbose:
+             print()
+             print('Run:', ' '.join(cmd))
diff --git a/python3.12.spec b/python3.12.spec
index eace632..dcb0cc8 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -298,7 +298,7 @@ BuildRequires: /usr/sbin/ifconfig
 BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
 %if %{with tests}
 BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel
-BuildRequires: %{python_wheel_pkg_prefix}-wheel-wheel
+BuildRequires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_prefix}-setuptools-wheel < 71)
 %endif
 %endif
 
@@ -375,6 +375,18 @@ Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-g
 # See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
 Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch
 
+# 00460 # f399a428258bbb149de1a9b8a62583bf77742eb0
+# gh-132415: Update vendored setuptools in ``Lib/test/wheeldata``
+#
+# (actual changes in .whl files removed to make this patch smaller)
+#
+# gh-127906: Add missing sys import to test_cppext
+Patch460: 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
+
+# 00461 # 47f50dd1f049470c33edb114754529777ab2332f
+# Downstream only: Install wheel in test venvs when setuptools < 71
+Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -637,7 +649,7 @@ Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 
 %if %{with rpmwheels}
 Requires: %{python_wheel_pkg_prefix}-setuptools-wheel
-Requires: %{python_wheel_pkg_prefix}-wheel-wheel
+Requires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_prefix}-setuptools-wheel < 71)
 %else
 Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
 %setuptools_bundled_provides
@@ -1693,6 +1705,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue May 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.10-3
+- Drop requirement on python-wheel-wheel with setuptools >= 71
+
 * Tue Apr 22 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-2
 - Apply Intel's CET for mitigation against control-flow hijacking attacks
 

From 8b88d87c440808c7269dde4a1221fbc81fc82bc7 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Tue, 6 May 2025 03:12:09 +0200
Subject: [PATCH 68/93] Add perf to the testing BuildRequires

Perf profiling showing the Python functions is only
supported on x86_64 and aarch64 at the moment.

Adding perf as a BuildRequires allows tests that utilize the
perf binary to run.
---
 python3.12.spec | 5 +++++
 tests/tests.yml | 1 +
 2 files changed, 6 insertions(+)

diff --git a/python3.12.spec b/python3.12.spec
index dcb0cc8..e2c05a1 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -279,6 +279,11 @@ BuildRequires: tix-devel
 BuildRequires: tk-devel < 1:9
 BuildRequires: tzdata
 
+# Perf support is only available on x86_64 and aarch64 right now
+%ifarch x86_64 aarch64
+BuildRequires: perf
+%endif
+
 %if %{with valgrind}
 BuildRequires: valgrind-devel
 %endif
diff --git a/tests/tests.yml b/tests/tests.yml
index cc1e061..e78c001 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -54,3 +54,4 @@
     - glibc-all-langpacks # for locale tests
     - marshalparser  # for testing compatibility (magic numbers) with marshalparser
     - rpm  # for debugging
+    - perf # for test_perf_profiler

From 3a160e81147c1f3f167a030285a2c6ae71178537 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Sat, 10 May 2025 01:17:10 +0200
Subject: [PATCH 69/93] Fix PySSL_SetError handling SSL_ERROR_SYSCALL

This fixes random flakiness of test_ssl on stressed machines
---
 ..._seterror-handling-ssl_error_syscall.patch | 196 ++++++++++++++++++
 python3.12.spec                               |  19 +-
 2 files changed, 214 insertions(+), 1 deletion(-)
 create mode 100644 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch

diff --git a/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch b/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
new file mode 100644
index 0000000..bfa2f8e
--- /dev/null
+++ b/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
@@ -0,0 +1,196 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: yevgeny hong <hongyevgeny@gmail.com>
+Date: Tue, 26 Mar 2024 16:45:43 +0900
+Subject: 00462: Fix PySSL_SetError handling SSL_ERROR_SYSCALL
+
+Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
+SSL_read_ex(), but did not update handling of the return value.
+
+Change error handling so that the return value is not examined.
+OSError (not EOF) is now returned when retval is 0.
+
+This resolves the issue of failing tests when a system is
+stressed on OpenSSL 3.5.
+
+Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+---
+ Lib/test/test_ssl.py                          | 28 ++++++-----
+ ...-02-18-09-50-31.gh-issue-115627.HGchj0.rst |  2 +
+ Modules/_ssl.c                                | 48 +++++++------------
+ 3 files changed, 35 insertions(+), 43 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
+
+diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
+index b13e37d0cd..daeb8cba74 100644
+--- a/Lib/test/test_ssl.py
++++ b/Lib/test/test_ssl.py
+@@ -2427,16 +2427,18 @@ def run(self):
+                         self.write(msg.lower())
+                 except OSError as e:
+                     # handles SSLError and socket errors
++                    if isinstance(e, ConnectionError):
++                        # OpenSSL 1.1.1 sometimes raises
++                        # ConnectionResetError when connection is not
++                        # shut down gracefully.
++                        if self.server.chatty and support.verbose:
++                            print(f" Connection reset by peer: {self.addr}")
++
++                        self.close()
++                        self.running = False
++                        return
+                     if self.server.chatty and support.verbose:
+-                        if isinstance(e, ConnectionError):
+-                            # OpenSSL 1.1.1 sometimes raises
+-                            # ConnectionResetError when connection is not
+-                            # shut down gracefully.
+-                            print(
+-                                f" Connection reset by peer: {self.addr}"
+-                            )
+-                        else:
+-                            handle_error("Test server failure:\n")
++                        handle_error("Test server failure:\n")
+                     try:
+                         self.write(b"ERROR\n")
+                     except OSError:
+@@ -3148,8 +3150,8 @@ def test_wrong_cert_tls13(self):
+                                         suppress_ragged_eofs=False) as s:
+             s.connect((HOST, server.port))
+             with self.assertRaisesRegex(
+-                ssl.SSLError,
+-                'alert unknown ca|EOF occurred|TLSV1_ALERT_UNKNOWN_CA'
++                OSError,
++                'alert unknown ca|EOF occurred|TLSV1_ALERT_UNKNOWN_CA|closed by the remote host|Connection reset by peer'
+             ):
+                 # TLS 1.3 perform client cert exchange after handshake
+                 s.write(b'data')
+@@ -4422,8 +4424,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
+                 # test sometimes fails with EOF error. Test passes as long as
+                 # server aborts connection with an error.
+                 with self.assertRaisesRegex(
+-                    ssl.SSLError,
+-                    '(certificate required|EOF occurred)'
++                    OSError,
++                    'certificate required|EOF occurred|closed by the remote host|Connection reset by peer'
+                 ):
+                     # receive CertificateRequest
+                     data = s.recv(1024)
+diff --git a/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
+new file mode 100644
+index 0000000000..75d926ab59
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
+@@ -0,0 +1,2 @@
++Fix the :mod:`ssl` module error handling of connection terminate by peer.
++It now throws an OSError with the appropriate error code instead of an EOFError.
+diff --git a/Modules/_ssl.c b/Modules/_ssl.c
+index 0b8cf0b6df..42a4c95890 100644
+--- a/Modules/_ssl.c
++++ b/Modules/_ssl.c
+@@ -573,7 +573,7 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) {
+ }
+ 
+ static PyObject *
+-PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
++PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno)
+ {
+     PyObject *type;
+     char *errstr = NULL;
+@@ -586,7 +586,6 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
+     _sslmodulestate *state = get_state_sock(sslsock);
+     type = state->PySSLErrorObject;
+ 
+-    assert(ret <= 0);
+     e = ERR_peek_last_error();
+ 
+     if (sslsock->ssl != NULL) {
+@@ -619,32 +618,21 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
+         case SSL_ERROR_SYSCALL:
+         {
+             if (e == 0) {
+-                PySocketSockObject *s = GET_SOCKET(sslsock);
+-                if (ret == 0 || (((PyObject *)s) == Py_None)) {
++                /* underlying BIO reported an I/O error */
++                ERR_clear_error();
++#ifdef MS_WINDOWS
++                if (err.ws) {
++                    return PyErr_SetFromWindowsErr(err.ws);
++                }
++#endif
++                if (err.c) {
++                    errno = err.c;
++                    return PyErr_SetFromErrno(PyExc_OSError);
++                }
++                else {
+                     p = PY_SSL_ERROR_EOF;
+                     type = state->PySSLEOFErrorObject;
+                     errstr = "EOF occurred in violation of protocol";
+-                } else if (s && ret == -1) {
+-                    /* underlying BIO reported an I/O error */
+-                    ERR_clear_error();
+-#ifdef MS_WINDOWS
+-                    if (err.ws) {
+-                        return PyErr_SetFromWindowsErr(err.ws);
+-                    }
+-#endif
+-                    if (err.c) {
+-                        errno = err.c;
+-                        return PyErr_SetFromErrno(PyExc_OSError);
+-                    }
+-                    else {
+-                        p = PY_SSL_ERROR_EOF;
+-                        type = state->PySSLEOFErrorObject;
+-                        errstr = "EOF occurred in violation of protocol";
+-                    }
+-                } else { /* possible? */
+-                    p = PY_SSL_ERROR_SYSCALL;
+-                    type = state->PySSLSyscallErrorObject;
+-                    errstr = "Some I/O error occurred";
+                 }
+             } else {
+                 if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
+@@ -1007,7 +995,7 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
+              err.ssl == SSL_ERROR_WANT_WRITE);
+     Py_XDECREF(sock);
+     if (ret < 1)
+-        return PySSL_SetError(self, ret, __FILE__, __LINE__);
++        return PySSL_SetError(self, __FILE__, __LINE__);
+     if (PySSL_ChainExceptions(self) < 0)
+         return NULL;
+     Py_RETURN_NONE;
+@@ -2424,7 +2412,7 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
+ 
+     Py_XDECREF(sock);
+     if (retval == 0)
+-        return PySSL_SetError(self, retval, __FILE__, __LINE__);
++        return PySSL_SetError(self, __FILE__, __LINE__);
+     if (PySSL_ChainExceptions(self) < 0)
+         return NULL;
+     return PyLong_FromSize_t(count);
+@@ -2454,7 +2442,7 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
+     self->err = err;
+ 
+     if (count < 0)
+-        return PySSL_SetError(self, count, __FILE__, __LINE__);
++        return PySSL_SetError(self, __FILE__, __LINE__);
+     else
+         return PyLong_FromLong(count);
+ }
+@@ -2577,7 +2565,7 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
+              err.ssl == SSL_ERROR_WANT_WRITE);
+ 
+     if (retval == 0) {
+-        PySSL_SetError(self, retval, __FILE__, __LINE__);
++        PySSL_SetError(self, __FILE__, __LINE__);
+         goto error;
+     }
+     if (self->exc != NULL)
+@@ -2703,7 +2691,7 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
+     }
+     if (ret < 0) {
+         Py_XDECREF(sock);
+-        PySSL_SetError(self, ret, __FILE__, __LINE__);
++        PySSL_SetError(self, __FILE__, __LINE__);
+         return NULL;
+     }
+     if (self->exc != NULL)
diff --git a/python3.12.spec b/python3.12.spec
index e2c05a1..86ca81e 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: Python-2.0.1
 
 
@@ -392,6 +392,19 @@ Patch460: 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
 # Downstream only: Install wheel in test venvs when setuptools < 71
 Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
 
+# 00462 # 5324dc5f57e0068f7e4f7b2f20006e88ff5f4e47
+# Fix PySSL_SetError handling SSL_ERROR_SYSCALL
+#
+# Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
+# SSL_read_ex(), but did not update handling of the return value.
+#
+# Change error handling so that the return value is not examined.
+# OSError (not EOF) is now returned when retval is 0.
+#
+# This resolves the issue of failing tests when a system is
+# stressed on OpenSSL 3.5.
+Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1710,6 +1723,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri May 09 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-4
+- Fix PySSL_SetError handling SSL_ERROR_SYSCALL
+- This fixes random flakiness of test_ssl on stressed machines
+
 * Tue May 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.10-3
 - Drop requirement on python-wheel-wheel with setuptools >= 71
 

From 2108326f5062d47f11104aaa3eba86e0868c20b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Wed, 4 Jun 2025 09:08:04 +0200
Subject: [PATCH 70/93] Update to 3.12.11

---
 python3.12.spec | 7 +++++--
 sources         | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 86ca81e..7650457 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.10
+%global general_version %{pybasever}.11
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 4%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -1723,6 +1723,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Wed Jun 04 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
+- Update to 3.12.11
+
 * Fri May 09 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-4
 - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
 - This fixes random flakiness of test_ssl on stressed machines
diff --git a/sources b/sources
index da3276e..0587ac7 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.10.tar.xz) = 520c30e3958d0be3c127e5dbb1c52bb3bfc404b5b3c7eb56525e25b9b59af9b21b53bee192f323f470e1df806f6cb2dd3411eb90cbc1c4b7d9b6b0777c29e644
-SHA512 (Python-3.12.10.tar.xz.asc) = 7edfa6fd816cf2a052abdb775d464e2f389105ed3e782cacf90805613aaca54bf71308504a5336ee1204e872e7db28df32413fb10b057056b0d5cb3c7a20a9f1
+SHA512 (Python-3.12.11.tar.xz) = 81f259c5bb293a5b685ebead1dff56c7c9d28eed12edb508b3e5e1a882991e762fc959803cf2734f4233bb1c5407b4f5303324c67b25d860b069d38bbebe4454
+SHA512 (Python-3.12.11.tar.xz.asc) = 3589deba17c5adcfcd614387a5207ad20db56cd9c7937eb44e21035a8745f1c6bb9a1b7cfe8bc5b58ecc7cca09ed49fd4c2878f65baecb2514e79c666f85a22e

From 959b0d3fec34d8b2307ed8ffc55004d27e218727 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 12 Jun 2025 02:59:48 +0200
Subject: [PATCH 71/93] Enable PAC and BTI hardware protections for aarch64

---
 ...-pac-and-bti-protections-for-aarch64.patch | 102 ++++++++++++++++++
 python3.12.spec                               |  22 +++-
 2 files changed, 123 insertions(+), 1 deletion(-)
 create mode 100644 00464-enable-pac-and-bti-protections-for-aarch64.patch

diff --git a/00464-enable-pac-and-bti-protections-for-aarch64.patch b/00464-enable-pac-and-bti-protections-for-aarch64.patch
new file mode 100644
index 0000000..81729d2
--- /dev/null
+++ b/00464-enable-pac-and-bti-protections-for-aarch64.patch
@@ -0,0 +1,102 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charalampos Stratakis <cstratak@redhat.com>
+Date: Tue, 3 Jun 2025 03:02:15 +0200
+Subject: 00464: Enable PAC and BTI protections for aarch64
+
+Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
+
+The BTI flag must be applied in the assembler sources for this class
+of attacks to be mitigated on newer aarch64 processors.
+
+Upstream PR: https://github.com/python/cpython/pull/130864/files
+
+The upstream patch is incomplete but only for the case where
+frame pointers are not used on 3.13+.
+
+Since on Fedora we always compile with frame pointers the BTI/PAC
+hardware protections can be enabled without losing Perf unwinding.
+---
+ Python/asm_trampoline.S         |  4 +++
+ Python/asm_trampoline_aarch64.h | 50 +++++++++++++++++++++++++++++++++
+ 2 files changed, 54 insertions(+)
+ create mode 100644 Python/asm_trampoline_aarch64.h
+
+diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S
+index 341d0bbe51..ae882660b5 100644
+--- a/Python/asm_trampoline.S
++++ b/Python/asm_trampoline.S
+@@ -1,3 +1,5 @@
++#include "asm_trampoline_aarch64.h"
++
+     .text
+     .globl	_Py_trampoline_func_start
+ # The following assembly is equivalent to:
+@@ -20,10 +22,12 @@ _Py_trampoline_func_start:
+ #if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__)
+     // ARM64 little endian, 64bit ABI
+     // generate with aarch64-linux-gnu-gcc 12.1
++    SIGN_LR
+     stp     x29, x30, [sp, -16]!
+     mov     x29, sp
+     blr     x3
+     ldp     x29, x30, [sp], 16
++    VERIFY_LR
+     ret
+ #endif
+     .globl	_Py_trampoline_func_end
+diff --git a/Python/asm_trampoline_aarch64.h b/Python/asm_trampoline_aarch64.h
+new file mode 100644
+index 0000000000..4b0ec4a7dc
+--- /dev/null
++++ b/Python/asm_trampoline_aarch64.h
+@@ -0,0 +1,50 @@
++#ifndef ASM_TRAMPOLINE_AARCH_64_H_
++#define ASM_TRAMPOLINE_AARCH_64_H_
++
++/*
++ * References:
++ *  - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros
++ *  - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst
++ */
++
++#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
++  #define BTI_J hint 36 /* bti j: for jumps, IE br instructions */
++  #define BTI_C hint 34  /* bti c: for calls, IE bl instructions */
++  #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */
++#else
++  #define BTI_J
++  #define BTI_C
++  #define GNU_PROPERTY_AARCH64_BTI 0
++#endif
++
++#if defined(__ARM_FEATURE_PAC_DEFAULT)
++  #if __ARM_FEATURE_PAC_DEFAULT & 1
++    #define SIGN_LR hint 25 /* paciasp: sign with the A key */
++    #define VERIFY_LR hint 29 /* autiasp: verify with the A key */
++  #elif __ARM_FEATURE_PAC_DEFAULT & 2
++    #define SIGN_LR hint 27 /* pacibsp: sign with the b key */
++    #define VERIFY_LR hint 31 /* autibsp: verify with the b key */
++  #endif
++  #define GNU_PROPERTY_AARCH64_POINTER_AUTH 2 /* bit 1 GNU Notes is for PAC support */
++#else
++  #define SIGN_LR BTI_C
++  #define VERIFY_LR
++  #define GNU_PROPERTY_AARCH64_POINTER_AUTH 0
++#endif
++
++/* Add the BTI and PAC support to GNU Notes section */
++#if GNU_PROPERTY_AARCH64_BTI != 0 || GNU_PROPERTY_AARCH64_POINTER_AUTH != 0
++    .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */
++    .balign 8; /* align it on a byte boundry */
++    .long 4; /* size of "GNU\0" */
++    .long 0x10; /* size of descriptor */
++    .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */
++    .asciz "GNU";
++    .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
++    .long 4; /* Four bytes of data */
++    .long (GNU_PROPERTY_AARCH64_BTI|GNU_PROPERTY_AARCH64_POINTER_AUTH); /* BTI or PAC is enabled */
++    .long 0; /* padding for 8 byte alignment */
++    .popsection; /* end the section */
++#endif
++
++#endif
diff --git a/python3.12.spec b/python3.12.spec
index 7650457..6979a67 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -405,6 +405,23 @@ Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.p
 # stressed on OpenSSL 3.5.
 Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
 
+# 00464 # 1c713e02a26bf8865bb6421749d19d0766cac178
+# Enable PAC and BTI protections for aarch64
+#
+# Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
+#
+# The BTI flag must be applied in the assembler sources for this class
+# of attacks to be mitigated on newer aarch64 processors.
+#
+# Upstream PR: https://github.com/python/cpython/pull/130864/files
+#
+# The upstream patch is incomplete but only for the case where
+# frame pointers are not used on 3.13+.
+#
+# Since on Fedora we always compile with frame pointers the BTI/PAC
+# hardware protections can be enabled without losing Perf unwinding.
+Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1723,6 +1740,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Jun 12 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.11-2
+- Enable PAC and BTI hardware protections for aarch64
+
 * Wed Jun 04 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
 - Update to 3.12.11
 

From b9238cffc1960b3193f55057b5cfb4e36220237d Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 25 Jul 2025 11:19:17 +0000
Subject: [PATCH 72/93] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 6979a67..52401be 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -1740,6 +1740,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.11-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
 * Thu Jun 12 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.11-2
 - Enable PAC and BTI hardware protections for aarch64
 

From 29a7358e19823aa9fdcf12ad3ca019507b3d1a52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zachar?= <lzachar@redhat.com>
Date: Mon, 28 Jul 2025 09:52:38 +0200
Subject: [PATCH 73/93] Drop STI and use tmt instead

Resolves: rhbz#2383058
---
 .fmf/version        |  1 +
 plan.fmf            | 63 +++++++++++++++++++++++++++++++++++++++++++++
 tests/provision.fmf |  4 ---
 tests/tests.yml     | 57 ----------------------------------------
 4 files changed, 64 insertions(+), 61 deletions(-)
 create mode 100644 .fmf/version
 create mode 100644 plan.fmf
 delete mode 100644 tests/provision.fmf
 delete mode 100644 tests/tests.yml

diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/plan.fmf b/plan.fmf
new file mode 100644
index 0000000..663476e
--- /dev/null
+++ b/plan.fmf
@@ -0,0 +1,63 @@
+execute:
+  how: tmt
+
+provision:
+  hardware:
+    memory: '>= 3 GB'
+
+environment:
+  pybasever: '3.12'
+
+discover:
+  - name: tests_python
+    how: shell
+    url: https://src.fedoraproject.org/tests/python.git
+    tests:
+    - name: smoke
+      path: /smoke
+      test: "VERSION=${pybasever} ./venv.sh"
+    - name: smoke_virtualenv
+      path: /smoke
+      test: "VERSION=${pybasever} METHOD=virtualenv ./venv.sh"
+    - name: debugsmoke
+      path: /smoke
+      test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} ./venv.sh"
+    - name: selftest
+      path: /selftest
+      test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh"
+    - name: debugtest
+      path: /selftest
+      test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes' ./parallel.sh"
+    - name: debugflags
+      path: /flags
+      test: "python${pybasever}d ./assertflags.py -O0"
+    - name: marshalparser
+      path: /marshalparser
+      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
+
+prepare:
+  - name: Install dependencies
+    how: install
+    package:
+    - gcc  # for extension building in venv and selftest
+    - gcc-c++ # for test_cppext
+    - gdb  # for test_gdb
+    - "python${pybasever}"  # the test subject
+    - "python${pybasever}-debug"  # for leak testing
+    - "python${pybasever}-devel"  # for extension building in venv and selftest
+    - "python${pybasever}-tkinter"  # for selftest
+    - "python${pybasever}-test"  # for selftest
+    - tox  # for venv tests
+    - virtualenv  # for virtualenv tests
+    - glibc-all-langpacks # for locale tests
+    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - rpm  # for debugging
+    - dnf  # for upgrade
+    - perf # for test_perf_profiler
+  - name: Update packages
+    how: shell
+    script: dnf upgrade -y
+  - name: rpm_qa
+    order: 100
+    how: shell
+    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt
diff --git a/tests/provision.fmf b/tests/provision.fmf
deleted file mode 100644
index 1a4f0f0..0000000
--- a/tests/provision.fmf
+++ /dev/null
@@ -1,4 +0,0 @@
----
-standard-inventory-qcow2:
-  qemu:
-    m: 3G  # Amount of VM memory
diff --git a/tests/tests.yml b/tests/tests.yml
deleted file mode 100644
index e78c001..0000000
--- a/tests/tests.yml
+++ /dev/null
@@ -1,57 +0,0 @@
----
-- hosts: localhost
-  tags:
-    - classic
-  tasks:
-    - dnf:
-        name: "*"
-        state: latest
-
-- hosts: localhost
-  roles:
-  - role: standard-test-basic
-    tags:
-    - classic
-    repositories:
-    - repo: "https://src.fedoraproject.org/tests/python.git"
-      dest: "python"
-    pybasever: "3.12"
-    tests:
-    - rpm_qa:
-        run: rpm -qa
-    - smoke:
-        dir: python/smoke
-        run: "VERSION={{ pybasever }} ./venv.sh"
-    - smoke_virtualenv:
-        dir: python/smoke
-        run: "VERSION={{ pybasever }} METHOD=virtualenv ./venv.sh"
-    - debugsmoke:
-        dir: python/smoke
-        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} ./venv.sh"
-    - selftest:
-        dir: python/selftest
-        run: "VERSION={{ pybasever }} X='-i test_check_probes' ./parallel.sh"
-    - debugtest:
-        dir: python/selftest
-        run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='-i test_check_probes' ./parallel.sh"
-    - debugflags:
-        dir: python/flags
-        run: "python{{ pybasever }}d ./assertflags.py -O0"
-    - marshalparser:
-        dir: python/marshalparser
-        run: "VERSION={{ pybasever }} SAMPLE=10 test_marshalparser_compatibility.sh"
-    required_packages:
-    - gcc  # for extension building in venv and selftest
-    - gcc-c++ # for test_cppext
-    - gdb  # for test_gdb
-    - "python{{ pybasever }}"  # the test subject
-    - "python{{ pybasever }}-debug"  # for leak testing
-    - "python{{ pybasever }}-devel"  # for extension building in venv and selftest
-    - "python{{ pybasever }}-tkinter"  # for selftest
-    - "python{{ pybasever }}-test"  # for selftest
-    - tox  # for venv tests
-    - virtualenv  # for virtualenv tests
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
-    - rpm  # for debugging
-    - perf # for test_perf_profiler

From d05b5cbd7e379f20ba591a9b223e50a012e6ca63 Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Tue, 26 Aug 2025 10:01:22 +0200
Subject: [PATCH 74/93] rpminspect: Wrap strings with globs with single quotes

It seems to be required since rpminspect 2.0:
https://github.com/rpminspect/rpminspect/commit/1593c38ce46980e0279150706d1f7c7bdd82de28
---
 rpminspect.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/rpminspect.yaml b/rpminspect.yaml
index 83dfb5e..8cc18cb 100644
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@@ -1,22 +1,22 @@
 # exclude test XML data (not always valid) from XML validity check:
 xml:
     ignore:
-        - /usr/lib*/python*/test/xmltestdata/*
-        - /usr/lib*/python*/test/xmltestdata/*/*
+        - '/usr/lib*/python*/test/xmltestdata/*'
+        - '/usr/lib*/python*/test/xmltestdata/*/*'
 
 # exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
 badfuncs:
     allowed:
-        /usr/lib*/python*/lib-dynload/_socket.*:
+        '/usr/lib*/python*/lib-dynload/_socket.*':
             - inet_aton
             - inet_ntoa
 
 # exclude the debug build from annocheck entirely
 annocheck:
     ignore:
-        - /usr/bin/python*d
-        - /usr/lib*/libpython*d.so.1.0
-        - /usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so
+        - '/usr/bin/python*d'
+        - '/usr/lib*/libpython*d.so.1.0'
+        - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so'
 
 # don't report changed content of compiled files
 # that is expected with every toolchain update and not reproducible yet

From 9dc158f0bf1a746d3d753e9dc02b5aa44fd65f23 Mon Sep 17 00:00:00 2001
From: Karolina Surma <ksurma@redhat.com>
Date: Fri, 10 Oct 2025 13:21:13 +0200
Subject: [PATCH 75/93] Update to Python 3.12.12

---
 ...l-control-flow-technology-for-x86-64.patch | 51 ------------------
 ...red-setuptools-in-lib-test-wheeldata.patch | 42 +++++----------
 ...eel-in-test-venvs-when-setuptools-71.patch | 10 ++--
 python3.12.spec                               | 54 +++++++++----------
 sources                                       |  4 +-
 5 files changed, 46 insertions(+), 115 deletions(-)
 delete mode 100644 00459-apply-intel-control-flow-technology-for-x86-64.patch

diff --git a/00459-apply-intel-control-flow-technology-for-x86-64.patch b/00459-apply-intel-control-flow-technology-for-x86-64.patch
deleted file mode 100644
index 380856c..0000000
--- a/00459-apply-intel-control-flow-technology-for-x86-64.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Charalampos Stratakis <cstratak@redhat.com>
-Date: Wed, 8 Jan 2025 04:58:22 +0100
-Subject: 00459: Apply Intel Control-flow Technology for x86-64
-
-Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks
-
-Proposed upstream: https://github.com/python/cpython/pull/128606
-
-See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
----
- Python/asm_trampoline.S | 22 ++++++++++++++++++++++
- 1 file changed, 22 insertions(+)
-
-diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S
-index 460707717d..341d0bbe51 100644
---- a/Python/asm_trampoline.S
-+++ b/Python/asm_trampoline.S
-@@ -9,6 +9,9 @@
- # }
- _Py_trampoline_func_start:
- #ifdef __x86_64__
-+#if defined(__CET__) && (__CET__ & 1)
-+    endbr64
-+#endif
-     sub    $8, %rsp
-     call    *%rcx
-     add    $8, %rsp
-@@ -26,3 +29,22 @@ _Py_trampoline_func_start:
-     .globl	_Py_trampoline_func_end
- _Py_trampoline_func_end:
-     .section        .note.GNU-stack,"",@progbits
-+# Note for indicating the assembly code supports CET
-+#if defined(__x86_64__) && defined(__CET__) && (__CET__ & 1)
-+    .section    .note.gnu.property,"a"
-+    .align 8
-+    .long    1f - 0f
-+    .long    4f - 1f
-+    .long    5
-+0:
-+    .string  "GNU"
-+1:
-+    .align 8
-+    .long    0xc0000002
-+    .long    3f - 2f
-+2:
-+    .long    0x3
-+3:
-+    .align 8
-+4:
-+#endif // __x86_64__
diff --git a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
index 03d769e..746ebb2 100644
--- a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
+++ b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
@@ -13,47 +13,33 @@ gh-127906: Add missing sys import to test_cppext
 
 Co-Authored-By: Victor Stinner <vstinner@python.org>
 ---
- Lib/test/support/__init__.py                 | 11 +++++------
- Lib/test/test_cext/__init__.py               |  2 +-
- Lib/test/test_cppext/__init__.py             |  2 +-
- Lib/test/test_cppext/setup.py                |  1 +
- Lib/test/test_peg_generator/test_c_parser.py |  2 +-
- 5 files changed, 9 insertions(+), 9 deletions(-)
+ Lib/test/support/__init__.py                 | 5 ++---
+ Lib/test/test_cext/__init__.py               | 2 +-
+ Lib/test/test_cppext/__init__.py             | 2 +-
+ Lib/test/test_cppext/setup.py                | 1 +
+ Lib/test/test_peg_generator/test_c_parser.py | 2 +-
+ 5 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index c899347624..223787244f 100644
+index 4c22f131e3..e49e3668a3 100644
 --- a/Lib/test/support/__init__.py
 +++ b/Lib/test/support/__init__.py
-@@ -2260,7 +2260,7 @@ def _findwheel(pkgname):
-     filenames = os.listdir(wheel_dir)
-     filenames = sorted(filenames, reverse=True)  # approximate "newest" first
-     for filename in filenames:
--        # filename is like 'setuptools-67.6.1-py3-none-any.whl'
-+        # filename is like 'setuptools-{version}-py3-none-any.whl'
-         if not filename.endswith(".whl"):
-             continue
-         prefix = pkgname + '-'
-@@ -2269,10 +2269,10 @@ def _findwheel(pkgname):
-     raise FileNotFoundError(f"No wheel for {pkgname} found in {wheel_dir}")
- 
- 
--# Context manager that creates a virtual environment, install setuptools and wheel in it
--# and returns the path to the venv directory and the path to the python executable
-+# Context manager that creates a virtual environment, install setuptools in it,
-+# and returns the paths to the venv directory and the python executable
+@@ -2308,7 +2308,7 @@ def _findwheel(pkgname):
+ # Context manager that creates a virtual environment, install setuptools in it,
+ # and returns the paths to the venv directory and the python executable
  @contextlib.contextmanager
 -def setup_venv_with_pip_setuptools_wheel(venv_dir):
 +def setup_venv_with_pip_setuptools(venv_dir):
      import subprocess
      from .os_helper import temp_cwd
  
-@@ -2295,8 +2295,7 @@ def setup_venv_with_pip_setuptools_wheel(venv_dir):
+@@ -2331,8 +2331,7 @@ def setup_venv_with_pip_setuptools_wheel(venv_dir):
  
-         cmd = [python, '-X', 'dev',
+         cmd = (python, '-X', 'dev',
                 '-m', 'pip', 'install',
 -               _findwheel('setuptools'),
--               _findwheel('wheel')]
-+               _findwheel('setuptools')]
+-               _findwheel('wheel'))
++               _findwheel('setuptools'))
          if verbose:
              print()
              print('Run:', ' '.join(cmd))
diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
index 06cb28a..415766e 100644
--- a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
+++ b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
@@ -9,10 +9,10 @@ Subject: 00461: Downstream only: Install wheel in test venvs when setuptools <
  1 file changed, 10 insertions(+), 1 deletion(-)
 
 diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index 223787244f..94f55ccaf0 100644
+index e49e3668a3..4c42234ccc 100644
 --- a/Lib/test/support/__init__.py
 +++ b/Lib/test/support/__init__.py
-@@ -2293,9 +2293,18 @@ def setup_venv_with_pip_setuptools(venv_dir):
+@@ -2329,9 +2329,18 @@ def setup_venv_with_pip_setuptools(venv_dir):
          else:
              python = os.path.join(venv, 'bin', python_exe)
  
@@ -24,11 +24,11 @@ index 223787244f..94f55ccaf0 100644
 +        else:
 +            wheels = (setuptools_whl, _findwheel('wheel'))
 +
-         cmd = [python, '-X', 'dev',
+         cmd = (python, '-X', 'dev',
                 '-m', 'pip', 'install',
--               _findwheel('setuptools')]
+-               _findwheel('setuptools'))
 +               *wheels,
-+               ]
++               )
          if verbose:
              print()
              print('Run:', ' '.join(cmd))
diff --git a/python3.12.spec b/python3.12.spec
index 52401be..f725071 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.11
+%global general_version %{pybasever}.12
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -72,7 +72,7 @@ License: Python-2.0.1
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
 %global pip_version 25.0.1
-%global setuptools_version 67.6.1
+%global setuptools_version 79.0.1
 %global wheel_version 0.40.0
 # All of those also include a list of indirect bundled libs:
 # pip
@@ -98,22 +98,25 @@ Provides: bundled(python3dist(typing-extensions)) = 4.12.2
 Provides: bundled(python3dist(urllib3)) = 1.26.20
 }
 # setuptools
-# vendor.txt files not in .whl
-#  $ %%{_rpmconfigdir}/pythonbundles.py \
-#    <(curl -L https://github.com/pypa/setuptools/raw/v%%{setuptools_version}/setuptools/_vendor/vendored.txt) \
-#    <(curl -L https://github.com/pypa/setuptools/raw/v%%{setuptools_version}/pkg_resources/_vendor/vendored.txt)
+# vendor.txt not in .whl
+# %%{_rpmconfigdir}/pythonbundles.py <(unzip -l Lib/test/wheeldata/setuptools-*.whl | grep -E '_vendor/.+dist-info/RECORD' | sed -E 's@^.*/([^-]+)-([^-]+)\.dist-info/.*$@\1==\2@')
 %global setuptools_bundled_provides %{expand:
-Provides: bundled(python3dist(importlib-metadata)) = 6
-Provides: bundled(python3dist(importlib-resources)) = 5.10.2
-Provides: bundled(python3dist(jaraco-text)) = 3.7
-Provides: bundled(python3dist(more-itertools)) = 8.8
-Provides: bundled(python3dist(ordered-set)) = 3.1.1
-Provides: bundled(python3dist(packaging)) = 23
-Provides: bundled(python3dist(platformdirs)) = 2.6.2
+Provides: bundled(python3dist(autocommand)) = 2.2.2
+Provides: bundled(python3dist(backports-tarfile)) = 1.2
+Provides: bundled(python3dist(importlib-metadata)) = 8
+Provides: bundled(python3dist(inflect)) = 7.3.1
+Provides: bundled(python3dist(jaraco-collections)) = 5.1
+Provides: bundled(python3dist(jaraco-context)) = 5.3
+Provides: bundled(python3dist(jaraco-functools)) = 4.0.1
+Provides: bundled(python3dist(jaraco-text)) = 3.12.1
+Provides: bundled(python3dist(more-itertools)) = 10.3
+Provides: bundled(python3dist(packaging)) = 24.2
+Provides: bundled(python3dist(platformdirs)) = 4.2.2
 Provides: bundled(python3dist(tomli)) = 2.0.1
-Provides: bundled(python3dist(typing-extensions)) = 4.0.1
-Provides: bundled(python3dist(typing-extensions)) = 4.4
-Provides: bundled(python3dist(zipp)) = 3.7
+Provides: bundled(python3dist(typeguard)) = 4.3
+Provides: bundled(python3dist(typing-extensions)) = 4.12.2
+Provides: bundled(python3dist(wheel)) = 0.45.1
+Provides: bundled(python3dist(zipp)) = 3.19.2
 }
 # wheel
 #  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheeldata/wheel-*.whl wheel/vendored/vendor.txt)
@@ -370,17 +373,7 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00459 # 906f6692bd85034012c9554f2434627ccfc04c67
-# Apply Intel Control-flow Technology for x86-64
-#
-# Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks
-#
-# Proposed upstream: https://github.com/python/cpython/pull/128606
-#
-# See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
-Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch
-
-# 00460 # f399a428258bbb149de1a9b8a62583bf77742eb0
+# 00460 # 1da89114f7ee7e7f392128a9861d9c2b41c0ddeb
 # gh-132415: Update vendored setuptools in ``Lib/test/wheeldata``
 #
 # (actual changes in .whl files removed to make this patch smaller)
@@ -388,7 +381,7 @@ Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch
 # gh-127906: Add missing sys import to test_cppext
 Patch460: 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
 
-# 00461 # 47f50dd1f049470c33edb114754529777ab2332f
+# 00461 # f7bc103c7bcc6e48789b225e06daf835793e1086
 # Downstream only: Install wheel in test venvs when setuptools < 71
 Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
 
@@ -1740,6 +1733,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Oct 10 2025 Karolina Surma <ksurma@redhat.com> - 3.12.12-1
+- Update to 3.12.12
+
 * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.11-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 
diff --git a/sources b/sources
index 0587ac7..6b54e57 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.11.tar.xz) = 81f259c5bb293a5b685ebead1dff56c7c9d28eed12edb508b3e5e1a882991e762fc959803cf2734f4233bb1c5407b4f5303324c67b25d860b069d38bbebe4454
-SHA512 (Python-3.12.11.tar.xz.asc) = 3589deba17c5adcfcd614387a5207ad20db56cd9c7937eb44e21035a8745f1c6bb9a1b7cfe8bc5b58ecc7cca09ed49fd4c2878f65baecb2514e79c666f85a22e
+SHA512 (Python-3.12.12.tar.xz) = 4b99d240dd96a6e154909dcffe87f8bb38193d634cd80a1c3d9e819b7a63af2afa46d5e6423e81f00dd388840dc29a4a71580f6aa1ce9a12e559c1d63f65a205
+SHA512 (Python-3.12.12.tar.xz.asc) = 32c10fd427c6f9f11595493d1b4d4c3cade85bffd439fe11e8b0b2c619e06734097b6aaedfdb4fe035b7fdd7196714dba77cdc806923e4454d5bcf60056991a0

From e6a47de8e840926ad08dabeb9928c0a6ecc90cac Mon Sep 17 00:00:00 2001
From: Karolina Surma <ksurma@redhat.com>
Date: Fri, 10 Oct 2025 14:54:30 +0200
Subject: [PATCH 76/93] Verify the bundled setuptools provides are correct

---
 python3.12.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/python3.12.spec b/python3.12.spec
index f725071..84ab4ec 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -745,6 +745,7 @@ The debug runtime additionally supports debug builds of C-API extensions
 if [ -f %{_rpmconfigdir}/pythonbundles.py ]; then
   %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) --compare-with '%pip_bundled_provides'
   %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheeldata/wheel-*.whl wheel/vendored/vendor.txt) --compare-with '%wheel_bundled_provides'
+  %{_rpmconfigdir}/pythonbundles.py <(unzip -l Lib/test/wheeldata/setuptools-*.whl | grep -E '_vendor/.+dist-info/RECORD' | sed -E 's@^.*/([^-]+)-([^-]+)\.dist-info/.*$@\1==\2@') --compare-with '%setuptools_bundled_provides'
 fi
 
 %if %{with rpmwheels}

From 1c0680c74feb32b5c972a8cc39bad20bc1823e2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Fri, 5 Sep 2025 13:23:10 +0000
Subject: [PATCH 77/93] Inject SBOM into the installed wheels (when using the
 bundled ones)

---
 python3.12.spec | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/python3.12.spec b/python3.12.spec
index 84ab4ec..17def23 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -1150,6 +1150,11 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
     rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done
 
+%if %{without rpmwheels}
+# Inject SBOM into the installed wheels (if the macro is available)
+%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl}
+%endif
+
 # ======================================================
 # Checks for packaging issues
 # ======================================================

From 44d63ded35a5e207b7e811ec956692fd6eaa53e2 Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Tue, 6 Jan 2026 11:32:44 +0100
Subject: [PATCH 78/93] Security fix for CVE-2025-12084

---
 00471-cve-2025-12084.patch | 139 +++++++++++++++++++++++++++++++++++++
 python3.12.spec            |  12 +++-
 2 files changed, 150 insertions(+), 1 deletion(-)
 create mode 100644 00471-cve-2025-12084.patch

diff --git a/00471-cve-2025-12084.patch b/00471-cve-2025-12084.patch
new file mode 100644
index 0000000..bb0903c
--- /dev/null
+++ b/00471-cve-2025-12084.patch
@@ -0,0 +1,139 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 22 Dec 2025 14:48:49 +0100
+Subject: 00471: CVE-2025-12084
+
+* gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146)
+* gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
+(cherry picked from commit 1cc7551b3f9f71efbc88d96dce90f82de98b2454)
+(cherry picked from commit 08d8e18ad81cd45bc4a27d6da478b51ea49486e4)
+(cherry picked from commit 8d2d7bb2e754f8649a68ce4116271a4932f76907)
+
+Co-authored-by: Jacob Walls <38668450+jacobtylerwalls@users.noreply.github.com>
+Co-authored-by: Seth Michael Larson <seth@python.org>
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
+Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
+Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
+Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+---
+ Lib/test/test_minidom.py                      | 33 ++++++++++++++++++-
+ Lib/xml/dom/minidom.py                        | 11 ++-----
+ ...-12-01-09-36-45.gh-issue-142145.tcAUhg.rst |  6 ++++
+ 3 files changed, 41 insertions(+), 9 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2025-12-01-09-36-45.gh-issue-142145.tcAUhg.rst
+
+diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py
+index 699265ccad..ab4823c831 100644
+--- a/Lib/test/test_minidom.py
++++ b/Lib/test/test_minidom.py
+@@ -2,13 +2,14 @@
+ 
+ import copy
+ import pickle
++import time
+ import io
+ from test import support
+ import unittest
+ 
+ import xml.dom.minidom
+ 
+-from xml.dom.minidom import parse, Attr, Node, Document, parseString
++from xml.dom.minidom import parse, Attr, Node, Document, Element, parseString
+ from xml.dom.minidom import getDOMImplementation
+ from xml.parsers.expat import ExpatError
+ 
+@@ -176,6 +177,36 @@ def testAppendChild(self):
+         self.confirm(dom.documentElement.childNodes[-1].data == "Hello")
+         dom.unlink()
+ 
++    @support.requires_resource('cpu')
++    def testAppendChildNoQuadraticComplexity(self):
++        impl = getDOMImplementation()
++
++        newdoc = impl.createDocument(None, "some_tag", None)
++        top_element = newdoc.documentElement
++        children = [newdoc.createElement(f"child-{i}") for i in range(1, 2 ** 15 + 1)]
++        element = top_element
++
++        start = time.monotonic()
++        for child in children:
++            element.appendChild(child)
++            element = child
++        end = time.monotonic()
++
++        # This example used to take at least 30 seconds.
++        # Conservative assertion due to the wide variety of systems and
++        # build configs timing based tests wind up run under.
++        # A --with-address-sanitizer --with-pydebug build on a rpi5 still
++        # completes this loop in <0.5 seconds.
++        self.assertLess(end - start, 4)
++
++    def testSetAttributeNodeWithoutOwnerDocument(self):
++        # regression test for gh-142754
++        elem = Element("test")
++        attr = Attr("id")
++        attr.value = "test-id"
++        elem.setAttributeNode(attr)
++        self.assertEqual(elem.getAttribute("id"), "test-id")
++
+     def testAppendChildFragment(self):
+         dom, orig, c1, c2, c3, frag = self._create_fragment_test_nodes()
+         dom.documentElement.appendChild(frag)
+diff --git a/Lib/xml/dom/minidom.py b/Lib/xml/dom/minidom.py
+index ef8a159833..cada981f39 100644
+--- a/Lib/xml/dom/minidom.py
++++ b/Lib/xml/dom/minidom.py
+@@ -292,13 +292,6 @@ def _append_child(self, node):
+     childNodes.append(node)
+     node.parentNode = self
+ 
+-def _in_document(node):
+-    # return True iff node is part of a document tree
+-    while node is not None:
+-        if node.nodeType == Node.DOCUMENT_NODE:
+-            return True
+-        node = node.parentNode
+-    return False
+ 
+ def _write_data(writer, data):
+     "Writes datachars to writer."
+@@ -355,6 +348,7 @@ class Attr(Node):
+     def __init__(self, qName, namespaceURI=EMPTY_NAMESPACE, localName=None,
+                  prefix=None):
+         self.ownerElement = None
++        self.ownerDocument = None
+         self._name = qName
+         self.namespaceURI = namespaceURI
+         self._prefix = prefix
+@@ -680,6 +674,7 @@ class Element(Node):
+ 
+     def __init__(self, tagName, namespaceURI=EMPTY_NAMESPACE, prefix=None,
+                  localName=None):
++        self.ownerDocument = None
+         self.parentNode = None
+         self.tagName = self.nodeName = tagName
+         self.prefix = prefix
+@@ -1539,7 +1534,7 @@ def _clear_id_cache(node):
+     if node.nodeType == Node.DOCUMENT_NODE:
+         node._id_cache.clear()
+         node._id_search_stack = None
+-    elif _in_document(node):
++    elif node.ownerDocument:
+         node.ownerDocument._id_cache.clear()
+         node.ownerDocument._id_search_stack= None
+ 
+diff --git a/Misc/NEWS.d/next/Security/2025-12-01-09-36-45.gh-issue-142145.tcAUhg.rst b/Misc/NEWS.d/next/Security/2025-12-01-09-36-45.gh-issue-142145.tcAUhg.rst
+new file mode 100644
+index 0000000000..05c7df35d1
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2025-12-01-09-36-45.gh-issue-142145.tcAUhg.rst
+@@ -0,0 +1,6 @@
++Remove quadratic behavior in ``xml.minidom`` node ID cache clearing.  In order
++to do this without breaking existing users, we also add the *ownerDocument*
++attribute to :mod:`xml.dom.minidom` elements and attributes created by directly
++instantiating the ``Element`` or ``Attr`` class. Note that this way of creating
++nodes is not supported; creator functions like
++:py:meth:`xml.dom.Document.documentElement` should be used instead.
diff --git a/python3.12.spec b/python3.12.spec
index 17def23..1432fda 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -415,6 +415,13 @@ Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
 # hardware protections can be enabled without losing Perf unwinding.
 Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
 
+# 00471 # 37c05f26d11e8e24f2a760167015a267996b1d69
+# CVE-2025-12084
+#
+# * gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146)
+# * gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
+Patch471: 00471-cve-2025-12084.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1739,6 +1746,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Jan 06 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-2
+- Security fix for CVE-2025-12084
+
 * Fri Oct 10 2025 Karolina Surma <ksurma@redhat.com> - 3.12.12-1
 - Update to 3.12.12
 

From 0b2d48a807df74abf348ef8f63659fbc84c15ea6 Mon Sep 17 00:00:00 2001
From: Karolina Surma <ksurma@redhat.com>
Date: Tue, 6 Jan 2026 17:04:29 +0100
Subject: [PATCH 79/93] Require at least the same expat version as used during
 the build

The versioned requirement is no longer valid -
this happens again now with expat 2.7.2 introducing new symbols.

Make the versioned requirement future-proof - the generated version will always
match at least the one present in the buildroot during the Python build.
---
 python3.12.spec | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/python3.12.spec b/python3.12.spec
index 1432fda..ba27c1e 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -240,8 +240,7 @@ BuildRequires: bluez-libs-devel
 BuildRequires: bzip2
 BuildRequires: bzip2-devel
 BuildRequires: desktop-file-utils
-# See the runtime requirement in the -libs subpackage
-BuildRequires: expat-devel >= 2.6
+BuildRequires: expat-devel
 
 BuildRequires: findutils
 BuildRequires: gcc-c++
@@ -574,12 +573,20 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa})
 Requires: tzdata
 
 # The requirement on libexpat is generated, but we need to version it.
-# When built with expat >= 2.6, but installed with older expat, we get:
+# When built with a specific expat version, but installed with an older one,
+# we sometimes get:
 #   ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so:
-#   undefined symbol: XML_SetReparseDeferralEnabled
+#   undefined symbol: XML_...
+# The pyexpat module has build-time checks for expat version to only use the
+# available symbols. However, there is no runtime protection, so when the module
+# is later installed with an older expat, it may error due to undefined symbols.
 # This breaks many things, including python -m venv.
+# We avoid this problem by requiring at least the same version of expat that
+# was used during the build time.
 # Other subpackages (like -debug) also need this, but they all depend on -libs.
-Requires: expat >= 2.6
+%global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/')
+Requires: expat >= %{expat_version}
+
 
 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
@@ -1748,6 +1755,7 @@ CheckPython optimized
 %changelog
 * Tue Jan 06 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-2
 - Security fix for CVE-2025-12084
+- Require at least the same expat version as used during the build time
 
 * Fri Oct 10 2025 Karolina Surma <ksurma@redhat.com> - 3.12.12-1
 - Update to 3.12.12

From 2d0b50b214bea94a1925ec93b8da237e4adba678 Mon Sep 17 00:00:00 2001
From: Karolina Surma <ksurma@redhat.com>
Date: Mon, 12 Jan 2026 11:55:39 +0100
Subject: [PATCH 80/93] Extend the expat requirement to differentiate between
 32 and 64 arches

(cherry picked from python3.15 commit a5ca170d3f1e6e19f5df66f21482c2b10593af42)
---
 python3.12.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index ba27c1e..8607439 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -585,7 +585,7 @@ Requires: tzdata
 # was used during the build time.
 # Other subpackages (like -debug) also need this, but they all depend on -libs.
 %global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/')
-Requires: expat >= %{expat_version}
+Requires: expat%{?_isa} >= %{expat_version}
 
 
 %description -n %{pkgname}-libs

From ddb24d27e2a4e4c97692bd10aa015bc40e6684d0 Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Fri, 16 Jan 2026 09:29:14 +0100
Subject: [PATCH 81/93] Security fix for CVE-2025-13836

---
 00472-cve-2025-13836.patch | 159 +++++++++++++++++++++++++++++++++++++
 python3.12.spec            |  19 ++++-
 2 files changed, 177 insertions(+), 1 deletion(-)
 create mode 100644 00472-cve-2025-13836.patch

diff --git a/00472-cve-2025-13836.patch b/00472-cve-2025-13836.patch
new file mode 100644
index 0000000..9b2947d
--- /dev/null
+++ b/00472-cve-2025-13836.patch
@@ -0,0 +1,159 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 22 Dec 2025 14:50:18 +0100
+Subject: 00472: CVE-2025-13836
+
+[3.12] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142140)
+
+gh-119451: Fix a potential denial of service in http.client (GH-119454)
+
+Reading the whole body of the HTTP response could cause OOM if
+the Content-Length value is too large even if the server does not send
+a large amount of data. Now the HTTP client reads large data by chunks,
+therefore the amount of consumed memory is proportional to the amount
+of sent data.
+(cherry picked from commit 5a4c4a033a4a54481be6870aa1896fad732555b5)
+
+Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
+---
+ Lib/http/client.py                            | 28 ++++++--
+ Lib/test/test_httplib.py                      | 66 +++++++++++++++++++
+ ...-05-23-11-47-48.gh-issue-119451.qkJe9-.rst |  5 ++
+ 3 files changed, 95 insertions(+), 4 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst
+
+diff --git a/Lib/http/client.py b/Lib/http/client.py
+index fb29923d94..70451d67d4 100644
+--- a/Lib/http/client.py
++++ b/Lib/http/client.py
+@@ -111,6 +111,11 @@
+ _MAXLINE = 65536
+ _MAXHEADERS = 100
+ 
++# Data larger than this will be read in chunks, to prevent extreme
++# overallocation.
++_MIN_READ_BUF_SIZE = 1 << 20
++
++
+ # Header name/value ABNF (http://tools.ietf.org/html/rfc7230#section-3.2)
+ #
+ # VCHAR          = %x21-7E
+@@ -639,10 +644,25 @@ def _safe_read(self, amt):
+         reading. If the bytes are truly not available (due to EOF), then the
+         IncompleteRead exception can be used to detect the problem.
+         """
+-        data = self.fp.read(amt)
+-        if len(data) < amt:
+-            raise IncompleteRead(data, amt-len(data))
+-        return data
++        cursize = min(amt, _MIN_READ_BUF_SIZE)
++        data = self.fp.read(cursize)
++        if len(data) >= amt:
++            return data
++        if len(data) < cursize:
++            raise IncompleteRead(data, amt - len(data))
++
++        data = io.BytesIO(data)
++        data.seek(0, 2)
++        while True:
++            # This is a geometric increase in read size (never more than
++            # doubling out the current length of data per loop iteration).
++            delta = min(cursize, amt - cursize)
++            data.write(self.fp.read(delta))
++            if data.tell() >= amt:
++                return data.getvalue()
++            cursize += delta
++            if data.tell() < cursize:
++                raise IncompleteRead(data.getvalue(), amt - data.tell())
+ 
+     def _safe_readinto(self, b):
+         """Same as _safe_read, but for reading into a buffer."""
+diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
+index 01f5a10190..e46dac0077 100644
+--- a/Lib/test/test_httplib.py
++++ b/Lib/test/test_httplib.py
+@@ -1452,6 +1452,72 @@ def run_server():
+         thread.join()
+         self.assertEqual(result, b"proxied data\n")
+ 
++    def test_large_content_length(self):
++        serv = socket.create_server((HOST, 0))
++        self.addCleanup(serv.close)
++
++        def run_server():
++            [conn, address] = serv.accept()
++            with conn:
++                while conn.recv(1024):
++                    conn.sendall(
++                        b"HTTP/1.1 200 Ok\r\n"
++                        b"Content-Length: %d\r\n"
++                        b"\r\n" % size)
++                    conn.sendall(b'A' * (size//3))
++                    conn.sendall(b'B' * (size - size//3))
++
++        thread = threading.Thread(target=run_server)
++        thread.start()
++        self.addCleanup(thread.join, 1.0)
++
++        conn = client.HTTPConnection(*serv.getsockname())
++        try:
++            for w in range(15, 27):
++                size = 1 << w
++                conn.request("GET", "/")
++                with conn.getresponse() as response:
++                    self.assertEqual(len(response.read()), size)
++        finally:
++            conn.close()
++            thread.join(1.0)
++
++    def test_large_content_length_truncated(self):
++        serv = socket.create_server((HOST, 0))
++        self.addCleanup(serv.close)
++
++        def run_server():
++            while True:
++                [conn, address] = serv.accept()
++                with conn:
++                    conn.recv(1024)
++                    if not size:
++                        break
++                    conn.sendall(
++                        b"HTTP/1.1 200 Ok\r\n"
++                        b"Content-Length: %d\r\n"
++                        b"\r\n"
++                        b"Text" % size)
++
++        thread = threading.Thread(target=run_server)
++        thread.start()
++        self.addCleanup(thread.join, 1.0)
++
++        conn = client.HTTPConnection(*serv.getsockname())
++        try:
++            for w in range(18, 65):
++                size = 1 << w
++                conn.request("GET", "/")
++                with conn.getresponse() as response:
++                    self.assertRaises(client.IncompleteRead, response.read)
++                conn.close()
++        finally:
++            conn.close()
++            size = 0
++            conn.request("GET", "/")
++            conn.close()
++            thread.join(1.0)
++
+     def test_putrequest_override_domain_validation(self):
+         """
+         It should be possible to override the default validation
+diff --git a/Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst b/Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst
+new file mode 100644
+index 0000000000..6d6f25cd2f
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst
+@@ -0,0 +1,5 @@
++Fix a potential memory denial of service in the :mod:`http.client` module.
++When connecting to a malicious server, it could cause
++an arbitrary amount of memory to be allocated.
++This could have led to symptoms including a :exc:`MemoryError`, swapping, out
++of memory (OOM) killed processes or containers, or even system crashes.
diff --git a/python3.12.spec b/python3.12.spec
index 8607439..1d58096 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -421,6 +421,20 @@ Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
 # * gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
 Patch471: 00471-cve-2025-12084.patch
 
+# 00472 # 2ba215eaba508b2cdd7c3acfdf3b9a6e32872274
+# CVE-2025-13836
+#
+# [3.12] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142140)
+#
+# gh-119451: Fix a potential denial of service in http.client (GH-119454)
+#
+# Reading the whole body of the HTTP response could cause OOM if
+# the Content-Length value is too large even if the server does not send
+# a large amount of data. Now the HTTP client reads large data by chunks,
+# therefore the amount of consumed memory is proportional to the amount
+# of sent data.
+Patch472: 00472-cve-2025-13836.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1753,6 +1767,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Jan 16 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-3
+- Security fix for CVE-2025-13836
+
 * Tue Jan 06 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-2
 - Security fix for CVE-2025-12084
 - Require at least the same expat version as used during the build time

From af31abb4d686b5b3b161caa3c5bfbd1e76b78a7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Fri, 6 Feb 2026 15:55:52 +0100
Subject: [PATCH 82/93] Security fixes for CVE-2026-0865, CVE-2025-15366 and
 CVE-2025-15367

---
 00473-cve-2026-0865.patch  | 90 ++++++++++++++++++++++++++++++++++++++
 00474-cve-2025-15366.patch | 61 ++++++++++++++++++++++++++
 00475-cve-2025-15367.patch | 61 ++++++++++++++++++++++++++
 python3.12.spec            | 30 ++++++++++++-
 4 files changed, 241 insertions(+), 1 deletion(-)
 create mode 100644 00473-cve-2026-0865.patch
 create mode 100644 00474-cve-2025-15366.patch
 create mode 100644 00475-cve-2025-15367.patch

diff --git a/00473-cve-2026-0865.patch b/00473-cve-2026-0865.patch
new file mode 100644
index 0000000..3a93b65
--- /dev/null
+++ b/00473-cve-2026-0865.patch
@@ -0,0 +1,90 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Sat, 17 Jan 2026 11:46:21 -0600
+Subject: 00473: CVE-2026-0865
+
+ gh-143916: Reject control characters in wsgiref.headers.Headers  (GH-143917)
+
+* Add 'test.support' fixture for C0 control characters
+* gh-143916: Reject control characters in wsgiref.headers.Headers
+---
+ Lib/test/support/__init__.py                         |  7 +++++++
+ Lib/test/test_wsgiref.py                             | 12 +++++++++++-
+ Lib/wsgiref/headers.py                               |  3 +++
+ .../2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst   |  2 ++
+ 4 files changed, 23 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
+
+diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
+index 4c42234ccc..26c0af4b13 100644
+--- a/Lib/test/support/__init__.py
++++ b/Lib/test/support/__init__.py
+@@ -2599,3 +2599,10 @@ def __iter__(self):
+         if self.iter_raises:
+             1/0
+         return self
++
++
++def control_characters_c0() -> list[str]:
++    """Returns a list of C0 control characters as strings.
++    C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
++    """
++    return [chr(c) for c in range(0x00, 0x20)] + ["\x7F"]
+diff --git a/Lib/test/test_wsgiref.py b/Lib/test/test_wsgiref.py
+index 9316d0ecbc..28e3656632 100644
+--- a/Lib/test/test_wsgiref.py
++++ b/Lib/test/test_wsgiref.py
+@@ -1,6 +1,6 @@
+ from unittest import mock
+ from test import support
+-from test.support import socket_helper
++from test.support import socket_helper, control_characters_c0
+ from test.test_httpservers import NoLogRequestHandler
+ from unittest import TestCase
+ from wsgiref.util import setup_testing_defaults
+@@ -503,6 +503,16 @@ def testExtras(self):
+             '\r\n'
+         )
+ 
++    def testRaisesControlCharacters(self):
++        headers = Headers()
++        for c0 in control_characters_c0():
++            self.assertRaises(ValueError, headers.__setitem__, f"key{c0}", "val")
++            self.assertRaises(ValueError, headers.__setitem__, "key", f"val{c0}")
++            self.assertRaises(ValueError, headers.add_header, f"key{c0}", "val", param="param")
++            self.assertRaises(ValueError, headers.add_header, "key", f"val{c0}", param="param")
++            self.assertRaises(ValueError, headers.add_header, "key", "val", param=f"param{c0}")
++
++
+ class ErrorHandler(BaseCGIHandler):
+     """Simple handler subclass for testing BaseHandler"""
+ 
+diff --git a/Lib/wsgiref/headers.py b/Lib/wsgiref/headers.py
+index fab851c5a4..fd98e85d75 100644
+--- a/Lib/wsgiref/headers.py
++++ b/Lib/wsgiref/headers.py
+@@ -9,6 +9,7 @@
+ # existence of which force quoting of the parameter value.
+ import re
+ tspecials = re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')
++_control_chars_re = re.compile(r'[\x00-\x1F\x7F]')
+ 
+ def _formatparam(param, value=None, quote=1):
+     """Convenience function to format and return a key=value pair.
+@@ -41,6 +42,8 @@ def __init__(self, headers=None):
+     def _convert_string_type(self, value):
+         """Convert/check value type."""
+         if type(value) is str:
++            if _control_chars_re.search(value):
++                raise ValueError("Control characters not allowed in headers")
+             return value
+         raise AssertionError("Header names/values must be"
+             " of type str (got {0})".format(repr(value)))
+diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
+new file mode 100644
+index 0000000000..44bd0b2705
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
+@@ -0,0 +1,2 @@
++Reject C0 control characters within wsgiref.headers.Headers fields, values,
++and parameters.
diff --git a/00474-cve-2025-15366.patch b/00474-cve-2025-15366.patch
new file mode 100644
index 0000000..50f62d9
--- /dev/null
+++ b/00474-cve-2025-15366.patch
@@ -0,0 +1,61 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Tue, 20 Jan 2026 14:45:42 -0600
+Subject: 00474: CVE-2025-15366
+
+gh-143921: Reject control characters in IMAP commands
+
+(cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
+---
+ Lib/imaplib.py                                              | 4 +++-
+ Lib/test/test_imaplib.py                                    | 6 ++++++
+ .../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 +
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
+
+diff --git a/Lib/imaplib.py b/Lib/imaplib.py
+index e337fe6471..c7f44f05b1 100644
+--- a/Lib/imaplib.py
++++ b/Lib/imaplib.py
+@@ -132,7 +132,7 @@
+ # We compile these in _mode_xxx.
+ _Literal = br'.*{(?P<size>\d+)}$'
+ _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
+-
++_control_chars = re.compile(b'[\x00-\x1F\x7F]')
+ 
+ 
+ class IMAP4:
+@@ -994,6 +994,8 @@ def _command(self, name, *args):
+             if arg is None: continue
+             if isinstance(arg, str):
+                 arg = bytes(arg, self._encoding)
++            if _control_chars.search(arg):
++                raise ValueError("Control characters not allowed in commands")
+             data = data + b' ' + arg
+ 
+         literal = self.literal
+diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py
+index 4429a90050..73c25bc733 100644
+--- a/Lib/test/test_imaplib.py
++++ b/Lib/test/test_imaplib.py
+@@ -504,6 +504,12 @@ def test_login(self):
+         self.assertEqual(data[0], b'LOGIN completed')
+         self.assertEqual(client.state, 'AUTH')
+ 
++    def test_control_characters(self):
++        client, _ = self._setup(SimpleIMAPHandler)
++        for c0 in support.control_characters_c0():
++            with self.assertRaises(ValueError):
++                client.login(f'user{c0}', 'pass')
++
+     def test_logout(self):
+         client, _ = self._setup(SimpleIMAPHandler)
+         typ, data = client.login('user', 'pass')
+diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
+new file mode 100644
+index 0000000000..4e13fe92bc
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
+@@ -0,0 +1 @@
++Reject control characters in IMAP commands.
diff --git a/00475-cve-2025-15367.patch b/00475-cve-2025-15367.patch
new file mode 100644
index 0000000..12b945f
--- /dev/null
+++ b/00475-cve-2025-15367.patch
@@ -0,0 +1,61 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Tue, 20 Jan 2026 14:46:32 -0600
+Subject: 00475: CVE-2025-15367
+
+gh-143923: Reject control characters in POP3 commands
+
+(cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
+---
+ Lib/poplib.py                                             | 2 ++
+ Lib/test/test_poplib.py                                   | 8 ++++++++
+ .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst        | 1 +
+ 3 files changed, 11 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+
+diff --git a/Lib/poplib.py b/Lib/poplib.py
+index 9eb662d000..5c83522504 100644
+--- a/Lib/poplib.py
++++ b/Lib/poplib.py
+@@ -122,6 +122,8 @@ def _putline(self, line):
+     def _putcmd(self, line):
+         if self._debugging: print('*cmd*', repr(line))
+         line = bytes(line, self.encoding)
++        if re.search(b'[\x00-\x1F\x7F]', line):
++            raise ValueError('Control characters not allowed in commands')
+         self._putline(line)
+ 
+ 
+diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
+index f1ebbeafe0..50d8c255d6 100644
+--- a/Lib/test/test_poplib.py
++++ b/Lib/test/test_poplib.py
+@@ -12,6 +12,7 @@
+ import unittest
+ from unittest import TestCase, skipUnless
+ from test import support as test_support
++from test.support import control_characters_c0
+ from test.support import hashlib_helper
+ from test.support import socket_helper
+ from test.support import threading_helper
+@@ -395,6 +396,13 @@ def test_quit(self):
+         self.assertIsNone(self.client.sock)
+         self.assertIsNone(self.client.file)
+ 
++    def test_control_characters(self):
++        for c0 in control_characters_c0():
++            with self.assertRaises(ValueError):
++                self.client.user(f'user{c0}')
++            with self.assertRaises(ValueError):
++                self.client.pass_(f'{c0}pass')
++
+     @requires_ssl
+     def test_stls_capa(self):
+         capa = self.client.capa()
+diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+new file mode 100644
+index 0000000000..3cde4df3e0
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+@@ -0,0 +1 @@
++Reject control characters in POP3 commands.
diff --git a/python3.12.spec b/python3.12.spec
index 1d58096..2ed264e 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: Python-2.0.1
 
 
@@ -435,6 +435,31 @@ Patch471: 00471-cve-2025-12084.patch
 # of sent data.
 Patch472: 00472-cve-2025-13836.patch
 
+# 00473 # dd705786aa0c1ccfde913858598e34e1f196be2e
+# CVE-2026-0865
+#
+#  gh-143916: Reject control characters in wsgiref.headers.Headers  (GH-143917)
+#
+# * Add 'test.support' fixture for C0 control characters
+# * gh-143916: Reject control characters in wsgiref.headers.Headers
+Patch473: 00473-cve-2026-0865.patch
+
+# 00474 # 837ddca0372fa87ff9cee47142200caa21e77def
+# CVE-2025-15366
+#
+# gh-143921: Reject control characters in IMAP commands
+#
+# (cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
+Patch474: 00474-cve-2025-15366.patch
+
+# 00475 # 3748209a316662d4e85981ca1a7418547a1d25c6
+# CVE-2025-15367
+#
+# gh-143923: Reject control characters in POP3 commands
+#
+# (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
+Patch475: 00475-cve-2025-15367.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1767,6 +1792,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Feb 06 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-4
+- Security fixes for CVE-2026-0865, CVE-2025-15366 and CVE-2025-15367
+
 * Fri Jan 16 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-3
 - Security fix for CVE-2025-13836
 

From 0399a359eac43d8a680316a148cedae064c9eb6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
Date: Tue, 3 Mar 2026 14:55:29 +0100
Subject: [PATCH 83/93] Update to 3.12.13

---
 ...red-setuptools-in-lib-test-wheeldata.patch |   2 +-
 ...eel-in-test-venvs-when-setuptools-71.patch |   2 +-
 ..._seterror-handling-ssl_error_syscall.patch |   2 +-
 00471-cve-2025-12084.patch                    | 139 ---------------
 00472-cve-2025-13836.patch                    | 159 ------------------
 00473-cve-2026-0865.patch                     |  90 ----------
 python3.12.spec                               |  37 +---
 sources                                       |   4 +-
 8 files changed, 10 insertions(+), 425 deletions(-)
 delete mode 100644 00471-cve-2025-12084.patch
 delete mode 100644 00472-cve-2025-13836.patch
 delete mode 100644 00473-cve-2026-0865.patch

diff --git a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
index 746ebb2..d6c067b 100644
--- a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
+++ b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
@@ -21,7 +21,7 @@ Co-Authored-By: Victor Stinner <vstinner@python.org>
  5 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index 4c22f131e3..e49e3668a3 100644
+index 1ee8ffc1b7..cab0f49366 100644
 --- a/Lib/test/support/__init__.py
 +++ b/Lib/test/support/__init__.py
 @@ -2308,7 +2308,7 @@ def _findwheel(pkgname):
diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
index 415766e..5d1416c 100644
--- a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
+++ b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
@@ -9,7 +9,7 @@ Subject: 00461: Downstream only: Install wheel in test venvs when setuptools <
  1 file changed, 10 insertions(+), 1 deletion(-)
 
 diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index e49e3668a3..4c42234ccc 100644
+index cab0f49366..26c0af4b13 100644
 --- a/Lib/test/support/__init__.py
 +++ b/Lib/test/support/__init__.py
 @@ -2329,9 +2329,18 @@ def setup_venv_with_pip_setuptools(venv_dir):
diff --git a/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch b/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
index bfa2f8e..93984f2 100644
--- a/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
+++ b/00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
@@ -84,7 +84,7 @@ index 0000000000..75d926ab59
 +Fix the :mod:`ssl` module error handling of connection terminate by peer.
 +It now throws an OSError with the appropriate error code instead of an EOFError.
 diff --git a/Modules/_ssl.c b/Modules/_ssl.c
-index 0b8cf0b6df..42a4c95890 100644
+index aae4dc323d..27dd7bbe11 100644
 --- a/Modules/_ssl.c
 +++ b/Modules/_ssl.c
 @@ -573,7 +573,7 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) {
diff --git a/00471-cve-2025-12084.patch b/00471-cve-2025-12084.patch
deleted file mode 100644
index bb0903c..0000000
--- a/00471-cve-2025-12084.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Mon, 22 Dec 2025 14:48:49 +0100
-Subject: 00471: CVE-2025-12084
-
-* gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146)
-* gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
-(cherry picked from commit 1cc7551b3f9f71efbc88d96dce90f82de98b2454)
-(cherry picked from commit 08d8e18ad81cd45bc4a27d6da478b51ea49486e4)
-(cherry picked from commit 8d2d7bb2e754f8649a68ce4116271a4932f76907)
-
-Co-authored-by: Jacob Walls <38668450+jacobtylerwalls@users.noreply.github.com>
-Co-authored-by: Seth Michael Larson <seth@python.org>
-Co-authored-by: Petr Viktorin <encukou@gmail.com>
-Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
-Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
-Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
-Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
-Co-authored-by: Gregory P. Smith <greg@krypto.org>
----
- Lib/test/test_minidom.py                      | 33 ++++++++++++++++++-
- Lib/xml/dom/minidom.py                        | 11 ++-----
- ...-12-01-09-36-45.gh-issue-142145.tcAUhg.rst |  6 ++++
- 3 files changed, 41 insertions(+), 9 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2025-12-01-09-36-45.gh-issue-142145.tcAUhg.rst
-
-diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py
-index 699265ccad..ab4823c831 100644
---- a/Lib/test/test_minidom.py
-+++ b/Lib/test/test_minidom.py
-@@ -2,13 +2,14 @@
- 
- import copy
- import pickle
-+import time
- import io
- from test import support
- import unittest
- 
- import xml.dom.minidom
- 
--from xml.dom.minidom import parse, Attr, Node, Document, parseString
-+from xml.dom.minidom import parse, Attr, Node, Document, Element, parseString
- from xml.dom.minidom import getDOMImplementation
- from xml.parsers.expat import ExpatError
- 
-@@ -176,6 +177,36 @@ def testAppendChild(self):
-         self.confirm(dom.documentElement.childNodes[-1].data == "Hello")
-         dom.unlink()
- 
-+    @support.requires_resource('cpu')
-+    def testAppendChildNoQuadraticComplexity(self):
-+        impl = getDOMImplementation()
-+
-+        newdoc = impl.createDocument(None, "some_tag", None)
-+        top_element = newdoc.documentElement
-+        children = [newdoc.createElement(f"child-{i}") for i in range(1, 2 ** 15 + 1)]
-+        element = top_element
-+
-+        start = time.monotonic()
-+        for child in children:
-+            element.appendChild(child)
-+            element = child
-+        end = time.monotonic()
-+
-+        # This example used to take at least 30 seconds.
-+        # Conservative assertion due to the wide variety of systems and
-+        # build configs timing based tests wind up run under.
-+        # A --with-address-sanitizer --with-pydebug build on a rpi5 still
-+        # completes this loop in <0.5 seconds.
-+        self.assertLess(end - start, 4)
-+
-+    def testSetAttributeNodeWithoutOwnerDocument(self):
-+        # regression test for gh-142754
-+        elem = Element("test")
-+        attr = Attr("id")
-+        attr.value = "test-id"
-+        elem.setAttributeNode(attr)
-+        self.assertEqual(elem.getAttribute("id"), "test-id")
-+
-     def testAppendChildFragment(self):
-         dom, orig, c1, c2, c3, frag = self._create_fragment_test_nodes()
-         dom.documentElement.appendChild(frag)
-diff --git a/Lib/xml/dom/minidom.py b/Lib/xml/dom/minidom.py
-index ef8a159833..cada981f39 100644
---- a/Lib/xml/dom/minidom.py
-+++ b/Lib/xml/dom/minidom.py
-@@ -292,13 +292,6 @@ def _append_child(self, node):
-     childNodes.append(node)
-     node.parentNode = self
- 
--def _in_document(node):
--    # return True iff node is part of a document tree
--    while node is not None:
--        if node.nodeType == Node.DOCUMENT_NODE:
--            return True
--        node = node.parentNode
--    return False
- 
- def _write_data(writer, data):
-     "Writes datachars to writer."
-@@ -355,6 +348,7 @@ class Attr(Node):
-     def __init__(self, qName, namespaceURI=EMPTY_NAMESPACE, localName=None,
-                  prefix=None):
-         self.ownerElement = None
-+        self.ownerDocument = None
-         self._name = qName
-         self.namespaceURI = namespaceURI
-         self._prefix = prefix
-@@ -680,6 +674,7 @@ class Element(Node):
- 
-     def __init__(self, tagName, namespaceURI=EMPTY_NAMESPACE, prefix=None,
-                  localName=None):
-+        self.ownerDocument = None
-         self.parentNode = None
-         self.tagName = self.nodeName = tagName
-         self.prefix = prefix
-@@ -1539,7 +1534,7 @@ def _clear_id_cache(node):
-     if node.nodeType == Node.DOCUMENT_NODE:
-         node._id_cache.clear()
-         node._id_search_stack = None
--    elif _in_document(node):
-+    elif node.ownerDocument:
-         node.ownerDocument._id_cache.clear()
-         node.ownerDocument._id_search_stack= None
- 
-diff --git a/Misc/NEWS.d/next/Security/2025-12-01-09-36-45.gh-issue-142145.tcAUhg.rst b/Misc/NEWS.d/next/Security/2025-12-01-09-36-45.gh-issue-142145.tcAUhg.rst
-new file mode 100644
-index 0000000000..05c7df35d1
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2025-12-01-09-36-45.gh-issue-142145.tcAUhg.rst
-@@ -0,0 +1,6 @@
-+Remove quadratic behavior in ``xml.minidom`` node ID cache clearing.  In order
-+to do this without breaking existing users, we also add the *ownerDocument*
-+attribute to :mod:`xml.dom.minidom` elements and attributes created by directly
-+instantiating the ``Element`` or ``Attr`` class. Note that this way of creating
-+nodes is not supported; creator functions like
-+:py:meth:`xml.dom.Document.documentElement` should be used instead.
diff --git a/00472-cve-2025-13836.patch b/00472-cve-2025-13836.patch
deleted file mode 100644
index 9b2947d..0000000
--- a/00472-cve-2025-13836.patch
+++ /dev/null
@@ -1,159 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Mon, 22 Dec 2025 14:50:18 +0100
-Subject: 00472: CVE-2025-13836
-
-[3.12] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142140)
-
-gh-119451: Fix a potential denial of service in http.client (GH-119454)
-
-Reading the whole body of the HTTP response could cause OOM if
-the Content-Length value is too large even if the server does not send
-a large amount of data. Now the HTTP client reads large data by chunks,
-therefore the amount of consumed memory is proportional to the amount
-of sent data.
-(cherry picked from commit 5a4c4a033a4a54481be6870aa1896fad732555b5)
-
-Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
----
- Lib/http/client.py                            | 28 ++++++--
- Lib/test/test_httplib.py                      | 66 +++++++++++++++++++
- ...-05-23-11-47-48.gh-issue-119451.qkJe9-.rst |  5 ++
- 3 files changed, 95 insertions(+), 4 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst
-
-diff --git a/Lib/http/client.py b/Lib/http/client.py
-index fb29923d94..70451d67d4 100644
---- a/Lib/http/client.py
-+++ b/Lib/http/client.py
-@@ -111,6 +111,11 @@
- _MAXLINE = 65536
- _MAXHEADERS = 100
- 
-+# Data larger than this will be read in chunks, to prevent extreme
-+# overallocation.
-+_MIN_READ_BUF_SIZE = 1 << 20
-+
-+
- # Header name/value ABNF (http://tools.ietf.org/html/rfc7230#section-3.2)
- #
- # VCHAR          = %x21-7E
-@@ -639,10 +644,25 @@ def _safe_read(self, amt):
-         reading. If the bytes are truly not available (due to EOF), then the
-         IncompleteRead exception can be used to detect the problem.
-         """
--        data = self.fp.read(amt)
--        if len(data) < amt:
--            raise IncompleteRead(data, amt-len(data))
--        return data
-+        cursize = min(amt, _MIN_READ_BUF_SIZE)
-+        data = self.fp.read(cursize)
-+        if len(data) >= amt:
-+            return data
-+        if len(data) < cursize:
-+            raise IncompleteRead(data, amt - len(data))
-+
-+        data = io.BytesIO(data)
-+        data.seek(0, 2)
-+        while True:
-+            # This is a geometric increase in read size (never more than
-+            # doubling out the current length of data per loop iteration).
-+            delta = min(cursize, amt - cursize)
-+            data.write(self.fp.read(delta))
-+            if data.tell() >= amt:
-+                return data.getvalue()
-+            cursize += delta
-+            if data.tell() < cursize:
-+                raise IncompleteRead(data.getvalue(), amt - data.tell())
- 
-     def _safe_readinto(self, b):
-         """Same as _safe_read, but for reading into a buffer."""
-diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
-index 01f5a10190..e46dac0077 100644
---- a/Lib/test/test_httplib.py
-+++ b/Lib/test/test_httplib.py
-@@ -1452,6 +1452,72 @@ def run_server():
-         thread.join()
-         self.assertEqual(result, b"proxied data\n")
- 
-+    def test_large_content_length(self):
-+        serv = socket.create_server((HOST, 0))
-+        self.addCleanup(serv.close)
-+
-+        def run_server():
-+            [conn, address] = serv.accept()
-+            with conn:
-+                while conn.recv(1024):
-+                    conn.sendall(
-+                        b"HTTP/1.1 200 Ok\r\n"
-+                        b"Content-Length: %d\r\n"
-+                        b"\r\n" % size)
-+                    conn.sendall(b'A' * (size//3))
-+                    conn.sendall(b'B' * (size - size//3))
-+
-+        thread = threading.Thread(target=run_server)
-+        thread.start()
-+        self.addCleanup(thread.join, 1.0)
-+
-+        conn = client.HTTPConnection(*serv.getsockname())
-+        try:
-+            for w in range(15, 27):
-+                size = 1 << w
-+                conn.request("GET", "/")
-+                with conn.getresponse() as response:
-+                    self.assertEqual(len(response.read()), size)
-+        finally:
-+            conn.close()
-+            thread.join(1.0)
-+
-+    def test_large_content_length_truncated(self):
-+        serv = socket.create_server((HOST, 0))
-+        self.addCleanup(serv.close)
-+
-+        def run_server():
-+            while True:
-+                [conn, address] = serv.accept()
-+                with conn:
-+                    conn.recv(1024)
-+                    if not size:
-+                        break
-+                    conn.sendall(
-+                        b"HTTP/1.1 200 Ok\r\n"
-+                        b"Content-Length: %d\r\n"
-+                        b"\r\n"
-+                        b"Text" % size)
-+
-+        thread = threading.Thread(target=run_server)
-+        thread.start()
-+        self.addCleanup(thread.join, 1.0)
-+
-+        conn = client.HTTPConnection(*serv.getsockname())
-+        try:
-+            for w in range(18, 65):
-+                size = 1 << w
-+                conn.request("GET", "/")
-+                with conn.getresponse() as response:
-+                    self.assertRaises(client.IncompleteRead, response.read)
-+                conn.close()
-+        finally:
-+            conn.close()
-+            size = 0
-+            conn.request("GET", "/")
-+            conn.close()
-+            thread.join(1.0)
-+
-     def test_putrequest_override_domain_validation(self):
-         """
-         It should be possible to override the default validation
-diff --git a/Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst b/Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst
-new file mode 100644
-index 0000000000..6d6f25cd2f
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst
-@@ -0,0 +1,5 @@
-+Fix a potential memory denial of service in the :mod:`http.client` module.
-+When connecting to a malicious server, it could cause
-+an arbitrary amount of memory to be allocated.
-+This could have led to symptoms including a :exc:`MemoryError`, swapping, out
-+of memory (OOM) killed processes or containers, or even system crashes.
diff --git a/00473-cve-2026-0865.patch b/00473-cve-2026-0865.patch
deleted file mode 100644
index 3a93b65..0000000
--- a/00473-cve-2026-0865.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Sat, 17 Jan 2026 11:46:21 -0600
-Subject: 00473: CVE-2026-0865
-
- gh-143916: Reject control characters in wsgiref.headers.Headers  (GH-143917)
-
-* Add 'test.support' fixture for C0 control characters
-* gh-143916: Reject control characters in wsgiref.headers.Headers
----
- Lib/test/support/__init__.py                         |  7 +++++++
- Lib/test/test_wsgiref.py                             | 12 +++++++++++-
- Lib/wsgiref/headers.py                               |  3 +++
- .../2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst   |  2 ++
- 4 files changed, 23 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
-
-diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index 4c42234ccc..26c0af4b13 100644
---- a/Lib/test/support/__init__.py
-+++ b/Lib/test/support/__init__.py
-@@ -2599,3 +2599,10 @@ def __iter__(self):
-         if self.iter_raises:
-             1/0
-         return self
-+
-+
-+def control_characters_c0() -> list[str]:
-+    """Returns a list of C0 control characters as strings.
-+    C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
-+    """
-+    return [chr(c) for c in range(0x00, 0x20)] + ["\x7F"]
-diff --git a/Lib/test/test_wsgiref.py b/Lib/test/test_wsgiref.py
-index 9316d0ecbc..28e3656632 100644
---- a/Lib/test/test_wsgiref.py
-+++ b/Lib/test/test_wsgiref.py
-@@ -1,6 +1,6 @@
- from unittest import mock
- from test import support
--from test.support import socket_helper
-+from test.support import socket_helper, control_characters_c0
- from test.test_httpservers import NoLogRequestHandler
- from unittest import TestCase
- from wsgiref.util import setup_testing_defaults
-@@ -503,6 +503,16 @@ def testExtras(self):
-             '\r\n'
-         )
- 
-+    def testRaisesControlCharacters(self):
-+        headers = Headers()
-+        for c0 in control_characters_c0():
-+            self.assertRaises(ValueError, headers.__setitem__, f"key{c0}", "val")
-+            self.assertRaises(ValueError, headers.__setitem__, "key", f"val{c0}")
-+            self.assertRaises(ValueError, headers.add_header, f"key{c0}", "val", param="param")
-+            self.assertRaises(ValueError, headers.add_header, "key", f"val{c0}", param="param")
-+            self.assertRaises(ValueError, headers.add_header, "key", "val", param=f"param{c0}")
-+
-+
- class ErrorHandler(BaseCGIHandler):
-     """Simple handler subclass for testing BaseHandler"""
- 
-diff --git a/Lib/wsgiref/headers.py b/Lib/wsgiref/headers.py
-index fab851c5a4..fd98e85d75 100644
---- a/Lib/wsgiref/headers.py
-+++ b/Lib/wsgiref/headers.py
-@@ -9,6 +9,7 @@
- # existence of which force quoting of the parameter value.
- import re
- tspecials = re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')
-+_control_chars_re = re.compile(r'[\x00-\x1F\x7F]')
- 
- def _formatparam(param, value=None, quote=1):
-     """Convenience function to format and return a key=value pair.
-@@ -41,6 +42,8 @@ def __init__(self, headers=None):
-     def _convert_string_type(self, value):
-         """Convert/check value type."""
-         if type(value) is str:
-+            if _control_chars_re.search(value):
-+                raise ValueError("Control characters not allowed in headers")
-             return value
-         raise AssertionError("Header names/values must be"
-             " of type str (got {0})".format(repr(value)))
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
-new file mode 100644
-index 0000000000..44bd0b2705
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
-@@ -0,0 +1,2 @@
-+Reject C0 control characters within wsgiref.headers.Headers fields, values,
-+and parameters.
diff --git a/python3.12.spec b/python3.12.spec
index 2ed264e..3f76bfb 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.12
+%global general_version %{pybasever}.13
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 4%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -414,36 +414,6 @@ Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
 # hardware protections can be enabled without losing Perf unwinding.
 Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
 
-# 00471 # 37c05f26d11e8e24f2a760167015a267996b1d69
-# CVE-2025-12084
-#
-# * gh-142145: Remove quadratic behavior in node ID cache clearing (GH-142146)
-# * gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
-Patch471: 00471-cve-2025-12084.patch
-
-# 00472 # 2ba215eaba508b2cdd7c3acfdf3b9a6e32872274
-# CVE-2025-13836
-#
-# [3.12] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142140)
-#
-# gh-119451: Fix a potential denial of service in http.client (GH-119454)
-#
-# Reading the whole body of the HTTP response could cause OOM if
-# the Content-Length value is too large even if the server does not send
-# a large amount of data. Now the HTTP client reads large data by chunks,
-# therefore the amount of consumed memory is proportional to the amount
-# of sent data.
-Patch472: 00472-cve-2025-13836.patch
-
-# 00473 # dd705786aa0c1ccfde913858598e34e1f196be2e
-# CVE-2026-0865
-#
-#  gh-143916: Reject control characters in wsgiref.headers.Headers  (GH-143917)
-#
-# * Add 'test.support' fixture for C0 control characters
-# * gh-143916: Reject control characters in wsgiref.headers.Headers
-Patch473: 00473-cve-2026-0865.patch
-
 # 00474 # 837ddca0372fa87ff9cee47142200caa21e77def
 # CVE-2025-15366
 #
@@ -1792,6 +1762,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Mar 03 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
+- Update to 3.12.13
+
 * Fri Feb 06 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-4
 - Security fixes for CVE-2026-0865, CVE-2025-15366 and CVE-2025-15367
 
diff --git a/sources b/sources
index 6b54e57..5b33098 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.12.tar.xz) = 4b99d240dd96a6e154909dcffe87f8bb38193d634cd80a1c3d9e819b7a63af2afa46d5e6423e81f00dd388840dc29a4a71580f6aa1ce9a12e559c1d63f65a205
-SHA512 (Python-3.12.12.tar.xz.asc) = 32c10fd427c6f9f11595493d1b4d4c3cade85bffd439fe11e8b0b2c619e06734097b6aaedfdb4fe035b7fdd7196714dba77cdc806923e4454d5bcf60056991a0
+SHA512 (Python-3.12.13.tar.xz) = e1eb66f0b34581f0155e3ce25ba72cf0b4b1107672ed0ad3e86bcfe616945c9204c41ffc492f32b1066b9154913ff88343038967ad8711dd05e6f2332fdb735b
+SHA512 (Python-3.12.13.tar.xz.asc) = 903fd3baa7e29891bb00fb159ec9c43804a71002c4cd38902d25bf4e5167f856b37d211a5b1098ee60e1ea41f8a10a1596dd2382edc6d7367d55dd4154807fc7

From 928429ac6e6d4652785c39d1d9dbba91feb2fd83 Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Thu, 26 Mar 2026 09:30:06 +0100
Subject: [PATCH 84/93] Security fix for CVE-2026-4519 (rhbz#2449728)

---
 00478-cve-2026-4519.patch | 105 ++++++++++++++++++++++++++++++++++++++
 python3.12.spec           |  11 +++-
 2 files changed, 115 insertions(+), 1 deletion(-)
 create mode 100644 00478-cve-2026-4519.patch

diff --git a/00478-cve-2026-4519.patch b/00478-cve-2026-4519.patch
new file mode 100644
index 0000000..8598b76
--- /dev/null
+++ b/00478-cve-2026-4519.patch
@@ -0,0 +1,105 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Pinky <pinky00ch@gmail.com>
+Date: Wed, 25 Mar 2026 01:02:37 +0530
+Subject: 00478: CVE-2026-4519
+
+Reject leading dashes in webbrowser URLs (GH-146360)
+
+(cherry picked from commit 82a24a4442312bdcfc4c799885e8b3e00990f02b)
+
+Co-authored-by: Seth Michael Larson <seth@python.org>
+---
+ Lib/test/test_webbrowser.py                          |  5 +++++
+ Lib/webbrowser.py                                    | 12 ++++++++++++
+ .../2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst   |  1 +
+ 3 files changed, 18 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
+
+diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
+index 2d695bc883..60f094fd6a 100644
+--- a/Lib/test/test_webbrowser.py
++++ b/Lib/test/test_webbrowser.py
+@@ -59,6 +59,11 @@ def test_open(self):
+                    options=[],
+                    arguments=[URL])
+ 
++    def test_reject_dash_prefixes(self):
++        browser = self.browser_class(name=CMD_NAME)
++        with self.assertRaises(ValueError):
++            browser.open(f"--key=val {URL}")
++
+ 
+ class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
+ 
+diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
+index 13b9e85f9e..0bdb644d7d 100755
+--- a/Lib/webbrowser.py
++++ b/Lib/webbrowser.py
+@@ -158,6 +158,12 @@ def open_new(self, url):
+     def open_new_tab(self, url):
+         return self.open(url, 2)
+ 
++    @staticmethod
++    def _check_url(url):
++        """Ensures that the URL is safe to pass to subprocesses as a parameter"""
++        if url and url.lstrip().startswith("-"):
++            raise ValueError(f"Invalid URL: {url}")
++
+ 
+ class GenericBrowser(BaseBrowser):
+     """Class for all browsers started with a command
+@@ -175,6 +181,7 @@ def __init__(self, name):
+ 
+     def open(self, url, new=0, autoraise=True):
+         sys.audit("webbrowser.open", url)
++        self._check_url(url)
+         cmdline = [self.name] + [arg.replace("%s", url)
+                                  for arg in self.args]
+         try:
+@@ -195,6 +202,7 @@ def open(self, url, new=0, autoraise=True):
+         cmdline = [self.name] + [arg.replace("%s", url)
+                                  for arg in self.args]
+         sys.audit("webbrowser.open", url)
++        self._check_url(url)
+         try:
+             if sys.platform[:3] == 'win':
+                 p = subprocess.Popen(cmdline)
+@@ -260,6 +268,7 @@ def _invoke(self, args, remote, autoraise, url=None):
+ 
+     def open(self, url, new=0, autoraise=True):
+         sys.audit("webbrowser.open", url)
++        self._check_url(url)
+         if new == 0:
+             action = self.remote_action
+         elif new == 1:
+@@ -350,6 +359,7 @@ class Konqueror(BaseBrowser):
+ 
+     def open(self, url, new=0, autoraise=True):
+         sys.audit("webbrowser.open", url)
++        self._check_url(url)
+         # XXX Currently I know no way to prevent KFM from opening a new win.
+         if new == 2:
+             action = "newTab"
+@@ -554,6 +564,7 @@ def register_standard_browsers():
+     class WindowsDefault(BaseBrowser):
+         def open(self, url, new=0, autoraise=True):
+             sys.audit("webbrowser.open", url)
++            self._check_url(url)
+             try:
+                 os.startfile(url)
+             except OSError:
+@@ -638,6 +649,7 @@ def _name(self, val):
+ 
+         def open(self, url, new=0, autoraise=True):
+             sys.audit("webbrowser.open", url)
++            self._check_url(url)
+             if self.name == 'default':
+                 script = 'open location "%s"' % url.replace('"', '%22') # opens in default browser
+             else:
+diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
+new file mode 100644
+index 0000000000..0f27eae99a
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
+@@ -0,0 +1 @@
++Reject leading dashes in URLs passed to :func:`webbrowser.open`
diff --git a/python3.12.spec b/python3.12.spec
index 3f76bfb..ba68f9c 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python-2.0.1
 
 
@@ -430,6 +430,12 @@ Patch474: 00474-cve-2025-15366.patch
 # (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
 Patch475: 00475-cve-2025-15367.patch
 
+# 00478 # eb93352dc8e31f4d52546b84daad875e6ff7f29e
+# CVE-2026-4519
+#
+# Reject leading dashes in webbrowser URLs (GH-146360)
+Patch478: 00478-cve-2026-4519.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1762,6 +1768,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.13-2
+- Security fix for CVE-2026-4519 (rhbz#2449728)
+
 * Tue Mar 03 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
 - Update to 3.12.13
 

From a7bbaa99036edc8409a18d785b164f29289d2b51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Wed, 11 Mar 2026 19:39:18 +0100
Subject: [PATCH 85/93] Only explicitly require expat >= installed version when
 expat < 2.7.4

See https://src.fedoraproject.org/rpms/expat/c/4da0543472

(cherry picked from python3.15 commit ce1bde3e67443b7cf5df33bf58cb2ec75cc2c8e2)
---
 python3.12.spec | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/python3.12.spec b/python3.12.spec
index ba68f9c..8ce0563 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -599,8 +599,12 @@ Requires: tzdata
 # We avoid this problem by requiring at least the same version of expat that
 # was used during the build time.
 # Other subpackages (like -debug) also need this, but they all depend on -libs.
+# Since expat 2.7.4, the library has versioned symbols and this is no longer needed,
+# as the generated requirement will be in the form of libexpat.so.1(LIBEXPAT_2.7.2) etc.
 %global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/')
+%if v"%{expat_version}" < v"2.7.4"
 Requires: expat%{?_isa} >= %{expat_version}
+%endif
 
 
 %description -n %{pkgname}-libs

From b85950ed24a601d6233d446d68b9942863d7fcb2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Thu, 9 Apr 2026 13:16:25 +0200
Subject: [PATCH 86/93] Explicitly build with OpenSSL 3 for now

https://fedoraproject.org/wiki/Changes/OpenSSL40
---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 8ce0563..b74fd68 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -267,7 +267,6 @@ BuildRequires: make
 BuildRequires: mpdecimal-devel
 BuildRequires: ncurses-devel
 
-BuildRequires: openssl-devel
 BuildRequires: pkgconfig
 BuildRequires: python-rpm-macros
 BuildRequires: readline-devel
@@ -281,6 +280,10 @@ BuildRequires: tix-devel
 BuildRequires: tk-devel < 1:9
 BuildRequires: tzdata
 
+# Support for OpenSSL 4 only landed in Python 3.15 for now
+# https://github.com/python/cpython/issues/146207
+BuildRequires: (openssl-devel < 1:4 or openssl3-devel)
+
 # Perf support is only available on x86_64 and aarch64 right now
 %ifarch x86_64 aarch64
 BuildRequires: perf

From 5b0b65def8430636bedc2ed3912240cef307e244 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 16 Apr 2026 05:33:50 +0200
Subject: [PATCH 87/93] Security fixes for CVE-2026-1502, CVE-2026-4786,
 CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224

Resolves: rhbz#2444705, rhbz#2448189, rhbz#2448205, rhbz#2457942, rhbz#2458014, rhbz#2458222
---
 00479-cve-2026-1502.patch | 107 ++++++++++++++++++++++++++++
 00480-cve-2026-4786.patch |  64 +++++++++++++++++
 00482-cve-2026-6100.patch |  61 ++++++++++++++++
 00483-cve-2026-2297.patch |  33 +++++++++
 00484-cve-2026-3644.patch | 146 ++++++++++++++++++++++++++++++++++++++
 00485-cve-2026-4224.patch |  98 +++++++++++++++++++++++++
 python3.12.spec           |  42 ++++++++++-
 7 files changed, 550 insertions(+), 1 deletion(-)
 create mode 100644 00479-cve-2026-1502.patch
 create mode 100644 00480-cve-2026-4786.patch
 create mode 100644 00482-cve-2026-6100.patch
 create mode 100644 00483-cve-2026-2297.patch
 create mode 100644 00484-cve-2026-3644.patch
 create mode 100644 00485-cve-2026-4224.patch

diff --git a/00479-cve-2026-1502.patch b/00479-cve-2026-1502.patch
new file mode 100644
index 0000000..16dc99b
--- /dev/null
+++ b/00479-cve-2026-1502.patch
@@ -0,0 +1,107 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Seth Larson <seth@python.org>
+Date: Fri, 10 Apr 2026 10:21:42 -0500
+Subject: 00479: CVE-2026-1502
+
+Reject CR/LF in HTTP tunnel request headers
+
+Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
+---
+ Lib/http/client.py                            | 11 ++++-
+ Lib/test/test_httplib.py                      | 45 +++++++++++++++++++
+ ...-03-20-09-29-42.gh-issue-146211.PQVbs7.rst |  2 +
+ 3 files changed, 57 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
+
+diff --git a/Lib/http/client.py b/Lib/http/client.py
+index 70451d67d4..7db4807b30 100644
+--- a/Lib/http/client.py
++++ b/Lib/http/client.py
+@@ -972,13 +972,22 @@ def _wrap_ipv6(self, ip):
+         return ip
+ 
+     def _tunnel(self):
++        if _contains_disallowed_url_pchar_re.search(self._tunnel_host):
++            raise ValueError('Tunnel host can\'t contain control characters %r'
++                             % (self._tunnel_host,))
+         connect = b"CONNECT %s:%d %s\r\n" % (
+             self._wrap_ipv6(self._tunnel_host.encode("idna")),
+             self._tunnel_port,
+             self._http_vsn_str.encode("ascii"))
+         headers = [connect]
+         for header, value in self._tunnel_headers.items():
+-            headers.append(f"{header}: {value}\r\n".encode("latin-1"))
++            header_bytes = header.encode("latin-1")
++            value_bytes = value.encode("latin-1")
++            if not _is_legal_header_name(header_bytes):
++                raise ValueError('Invalid header name %r' % (header_bytes,))
++            if _is_illegal_header_value(value_bytes):
++                raise ValueError('Invalid header value %r' % (value_bytes,))
++            headers.append(b"%s: %s\r\n" % (header_bytes, value_bytes))
+         headers.append(b"\r\n")
+         # Making a single send() call instead of one per line encourages
+         # the host OS to use a more optimal packet size instead of
+diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
+index e46dac0077..e027d930d9 100644
+--- a/Lib/test/test_httplib.py
++++ b/Lib/test/test_httplib.py
+@@ -369,6 +369,51 @@ def test_invalid_headers(self):
+                 with self.assertRaisesRegex(ValueError, 'Invalid header'):
+                     conn.putheader(name, value)
+ 
++    def test_invalid_tunnel_headers(self):
++        cases = (
++            ('Invalid\r\nName', 'ValidValue'),
++            ('Invalid\rName', 'ValidValue'),
++            ('Invalid\nName', 'ValidValue'),
++            ('\r\nInvalidName', 'ValidValue'),
++            ('\rInvalidName', 'ValidValue'),
++            ('\nInvalidName', 'ValidValue'),
++            (' InvalidName', 'ValidValue'),
++            ('\tInvalidName', 'ValidValue'),
++            ('Invalid:Name', 'ValidValue'),
++            (':InvalidName', 'ValidValue'),
++            ('ValidName', 'Invalid\r\nValue'),
++            ('ValidName', 'Invalid\rValue'),
++            ('ValidName', 'Invalid\nValue'),
++            ('ValidName', 'InvalidValue\r\n'),
++            ('ValidName', 'InvalidValue\r'),
++            ('ValidName', 'InvalidValue\n'),
++        )
++        for name, value in cases:
++            with self.subTest((name, value)):
++                conn = client.HTTPConnection('example.com')
++                conn.set_tunnel('tunnel', headers={
++                    name: value
++                })
++                conn.sock = FakeSocket('')
++                with self.assertRaisesRegex(ValueError, 'Invalid header'):
++                    conn._tunnel()  # Called in .connect()
++
++    def test_invalid_tunnel_host(self):
++        cases = (
++            'invalid\r.host',
++            '\ninvalid.host',
++            'invalid.host\r\n',
++            'invalid.host\x00',
++            'invalid host',
++        )
++        for tunnel_host in cases:
++            with self.subTest(tunnel_host):
++                conn = client.HTTPConnection('example.com')
++                conn.set_tunnel(tunnel_host)
++                conn.sock = FakeSocket('')
++                with self.assertRaisesRegex(ValueError, 'Tunnel host can\'t contain control characters'):
++                    conn._tunnel()  # Called in .connect()
++
+     def test_headers_debuglevel(self):
+         body = (
+             b'HTTP/1.1 200 OK\r\n'
+diff --git a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
+new file mode 100644
+index 0000000000..4993633b8e
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
+@@ -0,0 +1,2 @@
++Reject CR/LF characters in tunnel request headers for the
++HTTPConnection.set_tunnel() method.
diff --git a/00480-cve-2026-4786.patch b/00480-cve-2026-4786.patch
new file mode 100644
index 0000000..73e4e13
--- /dev/null
+++ b/00480-cve-2026-4786.patch
@@ -0,0 +1,64 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <stan@python.org>
+Date: Mon, 13 Apr 2026 20:02:52 +0100
+Subject: 00480: CVE-2026-4786
+
+Fix webbrowser `%action` substitution bypass of dash-prefix check
+---
+ Lib/test/test_webbrowser.py                              | 9 +++++++++
+ Lib/webbrowser.py                                        | 5 +++--
+ .../2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst       | 2 ++
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
+
+diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
+index 60f094fd6a..e900c0212b 100644
+--- a/Lib/test/test_webbrowser.py
++++ b/Lib/test/test_webbrowser.py
+@@ -99,6 +99,15 @@ def test_open_new_tab(self):
+                    options=[],
+                    arguments=[URL])
+ 
++    def test_reject_action_dash_prefixes(self):
++        browser = self.browser_class(name=CMD_NAME)
++        with self.assertRaises(ValueError):
++            browser.open('%action--incognito')
++        # new=1: action is "--new-window", so "%action" itself expands to
++        # a dash-prefixed flag even with no dash in the original URL.
++        with self.assertRaises(ValueError):
++            browser.open('%action', new=1)
++
+ 
+ class EdgeCommandTest(CommandTestMixin, unittest.TestCase):
+ 
+diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
+index 0bdb644d7d..79d410bcae 100755
+--- a/Lib/webbrowser.py
++++ b/Lib/webbrowser.py
+@@ -268,7 +268,6 @@ def _invoke(self, args, remote, autoraise, url=None):
+ 
+     def open(self, url, new=0, autoraise=True):
+         sys.audit("webbrowser.open", url)
+-        self._check_url(url)
+         if new == 0:
+             action = self.remote_action
+         elif new == 1:
+@@ -282,7 +281,9 @@ def open(self, url, new=0, autoraise=True):
+             raise Error("Bad 'new' parameter to open(); " +
+                         "expected 0, 1, or 2, got %s" % new)
+ 
+-        args = [arg.replace("%s", url).replace("%action", action)
++        self._check_url(url.replace("%action", action))
++
++        args = [arg.replace("%action", action).replace("%s", url)
+                 for arg in self.remote_args]
+         args = [arg for arg in args if arg]
+         success = self._invoke(args, True, autoraise, url)
+diff --git a/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
+new file mode 100644
+index 0000000000..45cdeebe1b
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
+@@ -0,0 +1,2 @@
++A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
++the dash-prefix safety check.
diff --git a/00482-cve-2026-6100.patch b/00482-cve-2026-6100.patch
new file mode 100644
index 0000000..5656e3d
--- /dev/null
+++ b/00482-cve-2026-6100.patch
@@ -0,0 +1,61 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <stan@python.org>
+Date: Mon, 13 Apr 2026 02:14:54 +0100
+Subject: 00482: CVE-2026-6100
+
+Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
+---
+ .../Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst  | 5 +++++
+ Modules/_bz2module.c                                         | 1 +
+ Modules/_lzmamodule.c                                        | 1 +
+ Modules/zlibmodule.c                                         | 1 +
+ 4 files changed, 8 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
+
+diff --git a/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst b/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
+new file mode 100644
+index 0000000000..9502189ab1
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
+@@ -0,0 +1,5 @@
++Fix a dangling input pointer in :class:`lzma.LZMADecompressor`,
++:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor`
++when memory allocation fails with :exc:`MemoryError`, which could let a
++subsequent :meth:`!decompress` call read or write through a stale pointer to
++the already-released caller buffer.
+diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c
+index 97bd44b4ac..a732e89d55 100644
+--- a/Modules/_bz2module.c
++++ b/Modules/_bz2module.c
+@@ -587,6 +587,7 @@ decompress(BZ2Decompressor *d, char *data, size_t len, Py_ssize_t max_length)
+     return result;
+ 
+ error:
++    bzs->next_in = NULL;
+     Py_XDECREF(result);
+     return NULL;
+ }
+diff --git a/Modules/_lzmamodule.c b/Modules/_lzmamodule.c
+index 7bbd6569aa..103a6ef86c 100644
+--- a/Modules/_lzmamodule.c
++++ b/Modules/_lzmamodule.c
+@@ -1114,6 +1114,7 @@ decompress(Decompressor *d, uint8_t *data, size_t len, Py_ssize_t max_length)
+     return result;
+ 
+ error:
++    lzs->next_in = NULL;
+     Py_XDECREF(result);
+     return NULL;
+ }
+diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c
+index f94c57e4c8..9759593b6a 100644
+--- a/Modules/zlibmodule.c
++++ b/Modules/zlibmodule.c
+@@ -1645,6 +1645,7 @@ decompress(ZlibDecompressor *self, uint8_t *data,
+     return result;
+ 
+ error:
++    self->zst.next_in = NULL;
+     Py_XDECREF(result);
+     return NULL;
+ }
diff --git a/00483-cve-2026-2297.patch b/00483-cve-2026-2297.patch
new file mode 100644
index 0000000..8b504c9
--- /dev/null
+++ b/00483-cve-2026-2297.patch
@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Steve Dower <steve.dower@python.org>
+Date: Wed, 4 Mar 2026 19:55:52 +0000
+Subject: 00483: CVE-2026-2297
+
+Logging Bypass in Legacy .pyc File Handling
+---
+ Lib/importlib/_bootstrap_external.py                            | 2 +-
+ .../Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst     | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
+
+diff --git a/Lib/importlib/_bootstrap_external.py b/Lib/importlib/_bootstrap_external.py
+index 9b8a8dfc5a..6e4a087a10 100644
+--- a/Lib/importlib/_bootstrap_external.py
++++ b/Lib/importlib/_bootstrap_external.py
+@@ -1186,7 +1186,7 @@ def get_filename(self, fullname):
+ 
+     def get_data(self, path):
+         """Return the data from path as raw bytes."""
+-        if isinstance(self, (SourceLoader, ExtensionFileLoader)):
++        if isinstance(self, (SourceLoader, SourcelessFileLoader, ExtensionFileLoader)):
+             with _io.open_code(str(path)) as file:
+                 return file.read()
+         else:
+diff --git a/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst b/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
+new file mode 100644
+index 0000000000..dcdb44d4fa
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
+@@ -0,0 +1,2 @@
++Fixes :cve:`2026-2297` by ensuring that ``SourcelessFileLoader`` uses
++:func:`io.open_code` when opening ``.pyc`` files.
diff --git a/00484-cve-2026-3644.patch b/00484-cve-2026-3644.patch
new file mode 100644
index 0000000..a1c12bd
--- /dev/null
+++ b/00484-cve-2026-3644.patch
@@ -0,0 +1,146 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
+Date: Mon, 16 Mar 2026 13:43:43 +0000
+Subject: 00484: CVE-2026-3644
+
+Incomplete control character validation in http.cookies
+
+Co-authored-by: Victor Stinner <victor.stinner@gmail.com>
+---
+ Lib/http/cookies.py                           | 24 ++++++++++--
+ Lib/test/test_http_cookies.py                 | 38 +++++++++++++++++++
+ ...-03-06-17-03-38.gh-issue-145599.kchwZV.rst |  4 ++
+ 3 files changed, 62 insertions(+), 4 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
+
+diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py
+index d0a69cbe19..63d119ad46 100644
+--- a/Lib/http/cookies.py
++++ b/Lib/http/cookies.py
+@@ -335,9 +335,16 @@ def update(self, values):
+             key = key.lower()
+             if key not in self._reserved:
+                 raise CookieError("Invalid attribute %r" % (key,))
++            if _has_control_character(key, val):
++                raise CookieError("Control characters are not allowed in "
++                                  f"cookies {key!r} {val!r}")
+             data[key] = val
+         dict.update(self, data)
+ 
++    def __ior__(self, values):
++        self.update(values)
++        return self
++
+     def isReservedKey(self, K):
+         return K.lower() in self._reserved
+ 
+@@ -363,9 +370,15 @@ def __getstate__(self):
+         }
+ 
+     def __setstate__(self, state):
+-        self._key = state['key']
+-        self._value = state['value']
+-        self._coded_value = state['coded_value']
++        key = state['key']
++        value = state['value']
++        coded_value = state['coded_value']
++        if _has_control_character(key, value, coded_value):
++            raise CookieError("Control characters are not allowed in cookies "
++                              f"{key!r} {value!r} {coded_value!r}")
++        self._key = key
++        self._value = value
++        self._coded_value = coded_value
+ 
+     def output(self, attrs=None, header="Set-Cookie:"):
+         return "%s %s" % (header, self.OutputString(attrs))
+@@ -377,13 +390,16 @@ def __repr__(self):
+ 
+     def js_output(self, attrs=None):
+         # Print javascript
++        output_string = self.OutputString(attrs)
++        if _has_control_character(output_string):
++            raise CookieError("Control characters are not allowed in cookies")
+         return """
+         <script type="text/javascript">
+         <!-- begin hiding
+         document.cookie = \"%s\";
+         // end hiding -->
+         </script>
+-        """ % (self.OutputString(attrs).replace('"', r'\"'))
++        """ % (output_string.replace('"', r'\"'))
+ 
+     def OutputString(self, attrs=None):
+         # Build up our result
+diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
+index f196bcc48e..2478a6c630 100644
+--- a/Lib/test/test_http_cookies.py
++++ b/Lib/test/test_http_cookies.py
+@@ -573,6 +573,14 @@ def test_control_characters(self):
+             with self.assertRaises(cookies.CookieError):
+                 morsel["path"] = c0
+ 
++            # .__setstate__()
++            with self.assertRaises(cookies.CookieError):
++                morsel.__setstate__({'key': c0, 'value': 'val', 'coded_value': 'coded'})
++            with self.assertRaises(cookies.CookieError):
++                morsel.__setstate__({'key': 'key', 'value': c0, 'coded_value': 'coded'})
++            with self.assertRaises(cookies.CookieError):
++                morsel.__setstate__({'key': 'key', 'value': 'val', 'coded_value': c0})
++
+             # .setdefault()
+             with self.assertRaises(cookies.CookieError):
+                 morsel.setdefault("path", c0)
+@@ -587,6 +595,18 @@ def test_control_characters(self):
+             with self.assertRaises(cookies.CookieError):
+                 morsel.set("path", "val", c0)
+ 
++            # .update()
++            with self.assertRaises(cookies.CookieError):
++                morsel.update({"path": c0})
++            with self.assertRaises(cookies.CookieError):
++                morsel.update({c0: "val"})
++
++            # .__ior__()
++            with self.assertRaises(cookies.CookieError):
++                morsel |= {"path": c0}
++            with self.assertRaises(cookies.CookieError):
++                morsel |= {c0: "val"}
++
+     def test_control_characters_output(self):
+         # Tests that even if the internals of Morsel are modified
+         # that a call to .output() has control character safeguards.
+@@ -607,6 +627,24 @@ def test_control_characters_output(self):
+             with self.assertRaises(cookies.CookieError):
+                 cookie.output()
+ 
++        # Tests that .js_output() also has control character safeguards.
++        for c0 in support.control_characters_c0():
++            morsel = cookies.Morsel()
++            morsel.set("key", "value", "coded-value")
++            morsel._key = c0  # Override private variable.
++            cookie = cookies.SimpleCookie()
++            cookie["cookie"] = morsel
++            with self.assertRaises(cookies.CookieError):
++                cookie.js_output()
++
++            morsel = cookies.Morsel()
++            morsel.set("key", "value", "coded-value")
++            morsel._coded_value = c0  # Override private variable.
++            cookie = cookies.SimpleCookie()
++            cookie["cookie"] = morsel
++            with self.assertRaises(cookies.CookieError):
++                cookie.js_output()
++
+ 
+ def load_tests(loader, tests, pattern):
+     tests.addTest(doctest.DocTestSuite(cookies))
+diff --git a/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
+new file mode 100644
+index 0000000000..e53a932d12
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
+@@ -0,0 +1,4 @@
++Reject control characters in :class:`http.cookies.Morsel`
++:meth:`~http.cookies.Morsel.update` and
++:meth:`~http.cookies.BaseCookie.js_output`.
++This addresses :cve:`2026-3644`.
diff --git a/00485-cve-2026-4224.patch b/00485-cve-2026-4224.patch
new file mode 100644
index 0000000..14f8734
--- /dev/null
+++ b/00485-cve-2026-4224.patch
@@ -0,0 +1,98 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
+Date: Sun, 15 Mar 2026 21:46:06 +0000
+Subject: 00485: CVE-2026-4224
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Stack overflow parsing XML with deeply nested DTD content models
+
+Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
+---
+ Lib/test/test_pyexpat.py                       | 18 ++++++++++++++++++
+ ...6-03-14-17-31-39.gh-issue-145986.ifSSr8.rst |  4 ++++
+ Modules/pyexpat.c                              |  9 ++++++++-
+ 3 files changed, 30 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
+
+diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
+index 38f951573f..37d9086f40 100644
+--- a/Lib/test/test_pyexpat.py
++++ b/Lib/test/test_pyexpat.py
+@@ -675,6 +675,24 @@ def test_change_size_2(self):
+         parser.Parse(xml2, True)
+         self.assertEqual(self.n, 4)
+ 
++class ElementDeclHandlerTest(unittest.TestCase):
++    def test_deeply_nested_content_model(self):
++        # This should raise a RecursionError and not crash.
++        # See https://github.com/python/cpython/issues/145986.
++        N = 500_000
++        data = (
++            b'<!DOCTYPE root [\n<!ELEMENT root '
++            + b'(a, ' * N + b'a' + b')' * N
++            + b'>\n]>\n<root/>\n'
++        )
++
++        parser = expat.ParserCreate()
++        parser.ElementDeclHandler = lambda _1, _2: None
++        with support.infinite_recursion():
++            with self.assertRaises(RecursionError):
++                parser.Parse(data)
++
++
+ class MalformedInputTest(unittest.TestCase):
+     def test1(self):
+         xml = b"\0\r\n"
+diff --git a/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
+new file mode 100644
+index 0000000000..79536d1fef
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
+@@ -0,0 +1,4 @@
++:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
++converting deeply nested XML content models with
++:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`.
++This addresses :cve:`2026-4224`.
+diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
+index 79492ca5c4..8673540f35 100644
+--- a/Modules/pyexpat.c
++++ b/Modules/pyexpat.c
+@@ -3,6 +3,7 @@
+ #endif
+ 
+ #include "Python.h"
++#include "pycore_ceval.h"           // _Py_EnterRecursiveCall()
+ #include "pycore_runtime.h"         // _Py_ID()
+ #include <ctype.h>
+ 
+@@ -578,6 +579,10 @@ static PyObject *
+ conv_content_model(XML_Content * const model,
+                    PyObject *(*conv_string)(const XML_Char *))
+ {
++    if (_Py_EnterRecursiveCall(" in conv_content_model")) {
++        return NULL;
++    }
++
+     PyObject *result = NULL;
+     PyObject *children = PyTuple_New(model->numchildren);
+     int i;
+@@ -589,7 +594,7 @@ conv_content_model(XML_Content * const model,
+                                                  conv_string);
+             if (child == NULL) {
+                 Py_XDECREF(children);
+-                return NULL;
++                goto done;
+             }
+             PyTuple_SET_ITEM(children, i, child);
+         }
+@@ -597,6 +602,8 @@ conv_content_model(XML_Content * const model,
+                                model->type, model->quant,
+                                conv_string,model->name, children);
+     }
++done:
++    _Py_LeaveRecursiveCall();
+     return result;
+ }
+ 
diff --git a/python3.12.spec b/python3.12.spec
index b74fd68..0e96a8f 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -439,6 +439,42 @@ Patch475: 00475-cve-2025-15367.patch
 # Reject leading dashes in webbrowser URLs (GH-146360)
 Patch478: 00478-cve-2026-4519.patch
 
+# 00479 # 97404b2cf62e545c2d41be7ccfed4e74da9ee665
+# CVE-2026-1502
+#
+# Reject CR/LF in HTTP tunnel request headers
+Patch479: 00479-cve-2026-1502.patch
+
+# 00480 # 6f4eef3ba4d9818a53698e994550ee8db17a1e2e
+# CVE-2026-4786
+#
+# Fix webbrowser `%%action` substitution bypass of dash-prefix check
+Patch480: 00480-cve-2026-4786.patch
+
+# 00482 # 69f14bc306fc62400d45565faa980b77858b9151
+# CVE-2026-6100
+#
+# Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
+Patch482: 00482-cve-2026-6100.patch
+
+# 00483 # 577c595137ce6ff92158ddaf2d7b7ea86437825d
+# CVE-2026-2297
+#
+# Logging Bypass in Legacy .pyc File Handling
+Patch483: 00483-cve-2026-2297.patch
+
+# 00484 # 8b5133c1ab17a060cd134bea2a4b6e1831c47fed
+# CVE-2026-3644
+#
+# Incomplete control character validation in http.cookies
+Patch484: 00484-cve-2026-3644.patch
+
+# 00485 # 12a5b206676927bcee131ab4f2bd6783d2f5914a
+# CVE-2026-4224
+#
+# Stack overflow parsing XML with deeply nested DTD content models
+Patch485: 00485-cve-2026-4224.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1775,6 +1811,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-3
+- Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
+Resolves: rhbz#2444705, rhbz#2448189, rhbz#2448205, rhbz#2457942, rhbz#2458014, rhbz#2458222
+
 * Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.13-2
 - Security fix for CVE-2026-4519 (rhbz#2449728)
 

From 968e96cb266bf169251634a3e03bb45287378c4f Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Wed, 24 Jun 2026 22:07:41 +0200
Subject: [PATCH 88/93] Run a new test to monitor changes in required symbols

---
 plan.fmf | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/plan.fmf b/plan.fmf
index 663476e..bb48d32 100644
--- a/plan.fmf
+++ b/plan.fmf
@@ -34,6 +34,9 @@ discover:
     - name: marshalparser
       path: /marshalparser
       test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
+    - name: required_symbols
+      path: /required-symbols
+      test: "VERSION=${pybasever} ./check.sh"
 
 prepare:
   - name: Install dependencies
@@ -51,8 +54,9 @@ prepare:
     - virtualenv  # for virtualenv tests
     - glibc-all-langpacks # for locale tests
     - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - binutils  # for nm (symbol inspection)
     - rpm  # for debugging
-    - dnf  # for upgrade
+    - dnf  # for upgrade and downgrade
     - perf # for test_perf_profiler
   - name: Update packages
     how: shell

From 6836c733644e69aaf4c135272982686c3d2e3c71 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 16 Jul 2026 22:48:14 +0000
Subject: [PATCH 89/93] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

---
 python3.12.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python3.12.spec b/python3.12.spec
index 0e96a8f..330ba4e 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: Python-2.0.1
 
 
@@ -1811,6 +1811,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.13-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
 * Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-3
 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
 Resolves: rhbz#2444705, rhbz#2448189, rhbz#2448205, rhbz#2457942, rhbz#2458014, rhbz#2458222

From 223df02052f2cc62c3968fab0a76e51990caf77a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
Date: Tue, 28 Jul 2026 11:41:07 +0200
Subject: [PATCH 90/93] Skip UDP Lite tests if it's not supported

- Fixes FTBFS on Linux kernel 7.1 and newer
---
 ...udp-lite-tests-if-it-s-not-supported.patch | 63 +++++++++++++++++++
 python3.12.spec                               | 13 +++-
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch

diff --git a/00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch b/00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
new file mode 100644
index 0000000..1419963
--- /dev/null
+++ b/00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
@@ -0,0 +1,63 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Wed, 13 May 2026 17:27:56 +0200
+Subject: 00491: gh-149776: Skip UDP Lite tests if it's not supported
+
+Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if
+it's not supported.
+
+(cherry picked from commit 3cfc249e11a132dc69624150843779aa96c72b2b)
+(cherry picked from commit 49d08674d8dba50dc29539e3c7bce21d66066b06)
+---
+ Lib/test/test_socket.py                       | 21 ++++++++++++++++++-
+ ...-05-13-14-53-23.gh-issue-149776.orqgsn.rst |  2 ++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
+
+diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py
+index f200fc9792..9453a2c7e8 100644
+--- a/Lib/test/test_socket.py
++++ b/Lib/test/test_socket.py
+@@ -157,6 +157,25 @@ def _have_socket_hyperv():
+     return True
+ 
+ 
++def _have_udp_lite():
++    if not hasattr(socket, "IPPROTO_UDPLITE"):
++        return False
++    # Older Android versions block UDPLITE with SELinux.
++    if support.is_android and platform.android_ver().api_level < 29:
++        return False
++
++    try:
++        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDPLITE)
++    except OSError as exc:
++        # Linux 7.1 removed UDP Lite support
++        if exc.errno == errno.EPROTONOSUPPORT:
++            return False
++        raise
++    sock.close()
++
++    return True
++
++
+ @contextlib.contextmanager
+ def socket_setdefaulttimeout(timeout):
+     old_timeout = socket.getdefaulttimeout()
+@@ -181,7 +200,7 @@ def socket_setdefaulttimeout(timeout):
+ 
+ HAVE_SOCKET_VSOCK = _have_socket_vsock()
+ 
+-HAVE_SOCKET_UDPLITE = hasattr(socket, "IPPROTO_UDPLITE")
++HAVE_SOCKET_UDPLITE = _have_udp_lite()
+ 
+ HAVE_SOCKET_BLUETOOTH = _have_socket_bluetooth()
+ 
+diff --git a/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst b/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
+new file mode 100644
+index 0000000000..e86a9130ff
+--- /dev/null
++++ b/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
+@@ -0,0 +1,2 @@
++Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it's
++not supported. Patch by Victor Stinner.
diff --git a/python3.12.spec b/python3.12.spec
index 330ba4e..e7e350c 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: Python-2.0.1
 
 
@@ -475,6 +475,13 @@ Patch484: 00484-cve-2026-3644.patch
 # Stack overflow parsing XML with deeply nested DTD content models
 Patch485: 00485-cve-2026-4224.patch
 
+# 00491 # 1ad95144c42a6933283352245c5df5a4c142e75f
+# gh-149776: Skip UDP Lite tests if it's not supported
+#
+# Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if
+# it's not supported.
+Patch491: 00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1811,6 +1818,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Jul 28 2026 Miro Hrončok <mhroncok@redhat.com> - 3.12.13-5
+- Skip UDP Lite tests if it's not supported
+- Fixes FTBFS on Linux kernel 7.1 and newer
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.13-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 

From 06f5d3454fc8d2b6950a9334598d833ee8aa292b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zachar?= <lzachar@redhat.com>
Date: Tue, 28 Jul 2026 14:04:01 +0200
Subject: [PATCH 91/93] Security fix for CVE-2026-15308

Resolves: rhbz#2498688
---
 00490-cve-2026-15308.patch | 114 +++++++++++++++++++++++++++++++++++++
 python3.12.spec            |  15 ++++-
 2 files changed, 128 insertions(+), 1 deletion(-)
 create mode 100644 00490-cve-2026-15308.patch

diff --git a/00490-cve-2026-15308.patch b/00490-cve-2026-15308.patch
new file mode 100644
index 0000000..942b18b
--- /dev/null
+++ b/00490-cve-2026-15308.patch
@@ -0,0 +1,114 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Serhiy Storchaka <storchaka@gmail.com>
+Date: Sat, 4 Jul 2026 20:40:22 +0300
+Subject: 00490: gh-153030: Fix quadratic complexity in incremental parsing in
+ HTMLParser
+
+When an unterminated construct (e.g. a tag or comment) spanned many
+feed() calls, rescanning the growing buffer and concatenating new data
+onto it were both quadratic.  New data is now accumulated in a list and
+only joined and parsed once enough has piled up.
+(cherry picked from commit bcf98ddbc40ec9b3ee87da0124a5660b19b7e606)
+
+Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
+---
+ Lib/html/parser.py                            | 32 +++++++++++++++++--
+ Lib/test/test_htmlparser.py                   | 20 ++++++++++++
+ ...-07-04-17-00-00.gh-issue-153030.RovkP6.rst |  3 ++
+ 3 files changed, 53 insertions(+), 2 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
+
+diff --git a/Lib/html/parser.py b/Lib/html/parser.py
+index bfab3e64cd..c5d2340b71 100644
+--- a/Lib/html/parser.py
++++ b/Lib/html/parser.py
+@@ -138,6 +138,9 @@ def reset(self):
+         self.cdata_elem = None
+         self._support_cdata = True
+         self._escapable = True
++        self._pending = []
++        self._pending_len = 0
++        self._parse_threshold = 1
+         super().reset()
+ 
+     def feed(self, data):
+@@ -146,11 +149,36 @@ def feed(self, data):
+         Call this as often as you want, with as little or as much text
+         as you want (may include '\n').
+         """
+-        self.rawdata = self.rawdata + data
+-        self.goahead(0)
++        # Accumulate new data in a list and only join and parse it once
++        # enough has piled up.  Rescanning an unparsed buffer (e.g. an
++        # unterminated tag) and concatenating onto it on every call would
++        # both be quadratic in the input size.
++        self._pending_len += len(data)
++        if self._pending_len < self._parse_threshold:
++            self._pending.append(data)
++        else:
++            if not self._pending:
++                self.rawdata += data
++            else:
++                self._pending.append(data)
++                self.rawdata += ''.join(self._pending)
++                self._pending.clear()
++            self._pending_len = 0
++            n = len(self.rawdata)
++            self.goahead(0)
++            if len(self.rawdata) < n:
++                # Some data was parsed; resume on the next call.
++                self._parse_threshold = 1
++            else:
++                # Nothing was parsed; wait until the buffer doubles.
++                self._parse_threshold = len(self.rawdata)
+ 
+     def close(self):
+         """Handle any buffered data."""
++        if self._pending:
++            self.rawdata += ''.join(self._pending)
++            self._pending.clear()
++            self._pending_len = 0
+         self.goahead(1)
+ 
+     __starttag_text = None
+diff --git a/Lib/test/test_htmlparser.py b/Lib/test/test_htmlparser.py
+index 303c0baa87..e6d92a7ec5 100644
+--- a/Lib/test/test_htmlparser.py
++++ b/Lib/test/test_htmlparser.py
+@@ -930,6 +930,26 @@ def check(source):
+         check("<![CDATA[" * 9 * n)
+         check("<!doctype" * 35 * n)
+ 
++    @support.requires_resource('cpu')
++    def test_incremental_no_quadratic_complexity(self):
++        # An unterminated construct fed in many small chunks used to take
++        # quadratic time, both to rescan and to concatenate the buffer.
++        # Now it takes a fraction of a second.
++        def check(prefix, chunk, suffix):
++            parser = html.parser.HTMLParser()
++            parser.feed(prefix)
++            for _ in range(200_000):
++                parser.feed(chunk)
++            parser.feed(suffix)
++            parser.close()
++        chunk = "a" * 64
++        check("<!--", chunk, "-->")       # comment
++        check("<?", chunk, ">")           # processing instruction
++        check("<!doctype ", chunk, ">")   # doctype
++        check("<![CDATA[", chunk, "]]>")  # CDATA section
++        check("<a href='", chunk, "'>")   # start tag
++        check("<script>", chunk, "</script>")  # RAWTEXT element
++
+ 
+ class AttributesTestCase(TestCaseBase):
+ 
+diff --git a/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst b/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
+new file mode 100644
+index 0000000000..d1d60593f4
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
+@@ -0,0 +1,3 @@
++Fixed quadratic complexity in incremental parsing of long unterminated
++constructs (such as tags or comments) in :class:`html.parser.HTMLParser`,
++which could be exploited for a denial of service.
diff --git a/python3.12.spec b/python3.12.spec
index e7e350c..c3b0ce6 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: Python-2.0.1
 
 
@@ -475,6 +475,15 @@ Patch484: 00484-cve-2026-3644.patch
 # Stack overflow parsing XML with deeply nested DTD content models
 Patch485: 00485-cve-2026-4224.patch
 
+# 00490 # 3e8c5ad70d6a515107352d8779269240a0553f54
+# gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser
+#
+# When an unterminated construct (e.g. a tag or comment) spanned many
+# feed() calls, rescanning the growing buffer and concatenating new data
+# onto it were both quadratic.  New data is now accumulated in a list and
+# only joined and parsed once enough has piled up.
+Patch490: 00490-cve-2026-15308.patch
+
 # 00491 # 1ad95144c42a6933283352245c5df5a4c142e75f
 # gh-149776: Skip UDP Lite tests if it's not supported
 #
@@ -1818,6 +1827,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Tue Jul 28 2026 Lukáš Zachar <lzachar@redhat.com> - 3.12.13-6
+- Security fix for CVE-2026-15308
+Resolves: rhbz#2498688
+
 * Tue Jul 28 2026 Miro Hrončok <mhroncok@redhat.com> - 3.12.13-5
 - Skip UDP Lite tests if it's not supported
 - Fixes FTBFS on Linux kernel 7.1 and newer

From 5590da14924ea625a8d1a40684162b9482b5578a Mon Sep 17 00:00:00 2001
From: Karolina Surma <ksurma@redhat.com>
Date: Thu, 13 Aug 2026 11:37:38 +0200
Subject: [PATCH 92/93] Update to Python 3.12.14

---
 ...-pac-and-bti-protections-for-aarch64.patch | 102 ------------
 00478-cve-2026-4519.patch                     | 105 -------------
 00479-cve-2026-1502.patch                     | 107 -------------
 00480-cve-2026-4786.patch                     |  64 --------
 00482-cve-2026-6100.patch                     |  61 --------
 00483-cve-2026-2297.patch                     |  33 ----
 00484-cve-2026-3644.patch                     | 146 ------------------
 00485-cve-2026-4224.patch                     |  98 ------------
 00490-cve-2026-15308.patch                    | 114 --------------
 ...udp-lite-tests-if-it-s-not-supported.patch |  63 --------
 ...-test_large_content_length_truncated.patch |  23 +++
 python3.12.spec                               |  84 ++--------
 sources                                       |   4 +-
 13 files changed, 34 insertions(+), 970 deletions(-)
 delete mode 100644 00464-enable-pac-and-bti-protections-for-aarch64.patch
 delete mode 100644 00478-cve-2026-4519.patch
 delete mode 100644 00479-cve-2026-1502.patch
 delete mode 100644 00480-cve-2026-4786.patch
 delete mode 100644 00482-cve-2026-6100.patch
 delete mode 100644 00483-cve-2026-2297.patch
 delete mode 100644 00484-cve-2026-3644.patch
 delete mode 100644 00485-cve-2026-4224.patch
 delete mode 100644 00490-cve-2026-15308.patch
 delete mode 100644 00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
 create mode 100644 00494-increase-the-timeout-of-test_large_content_length_truncated.patch

diff --git a/00464-enable-pac-and-bti-protections-for-aarch64.patch b/00464-enable-pac-and-bti-protections-for-aarch64.patch
deleted file mode 100644
index 81729d2..0000000
--- a/00464-enable-pac-and-bti-protections-for-aarch64.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Charalampos Stratakis <cstratak@redhat.com>
-Date: Tue, 3 Jun 2025 03:02:15 +0200
-Subject: 00464: Enable PAC and BTI protections for aarch64
-
-Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
-
-The BTI flag must be applied in the assembler sources for this class
-of attacks to be mitigated on newer aarch64 processors.
-
-Upstream PR: https://github.com/python/cpython/pull/130864/files
-
-The upstream patch is incomplete but only for the case where
-frame pointers are not used on 3.13+.
-
-Since on Fedora we always compile with frame pointers the BTI/PAC
-hardware protections can be enabled without losing Perf unwinding.
----
- Python/asm_trampoline.S         |  4 +++
- Python/asm_trampoline_aarch64.h | 50 +++++++++++++++++++++++++++++++++
- 2 files changed, 54 insertions(+)
- create mode 100644 Python/asm_trampoline_aarch64.h
-
-diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S
-index 341d0bbe51..ae882660b5 100644
---- a/Python/asm_trampoline.S
-+++ b/Python/asm_trampoline.S
-@@ -1,3 +1,5 @@
-+#include "asm_trampoline_aarch64.h"
-+
-     .text
-     .globl	_Py_trampoline_func_start
- # The following assembly is equivalent to:
-@@ -20,10 +22,12 @@ _Py_trampoline_func_start:
- #if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__)
-     // ARM64 little endian, 64bit ABI
-     // generate with aarch64-linux-gnu-gcc 12.1
-+    SIGN_LR
-     stp     x29, x30, [sp, -16]!
-     mov     x29, sp
-     blr     x3
-     ldp     x29, x30, [sp], 16
-+    VERIFY_LR
-     ret
- #endif
-     .globl	_Py_trampoline_func_end
-diff --git a/Python/asm_trampoline_aarch64.h b/Python/asm_trampoline_aarch64.h
-new file mode 100644
-index 0000000000..4b0ec4a7dc
---- /dev/null
-+++ b/Python/asm_trampoline_aarch64.h
-@@ -0,0 +1,50 @@
-+#ifndef ASM_TRAMPOLINE_AARCH_64_H_
-+#define ASM_TRAMPOLINE_AARCH_64_H_
-+
-+/*
-+ * References:
-+ *  - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros
-+ *  - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst
-+ */
-+
-+#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
-+  #define BTI_J hint 36 /* bti j: for jumps, IE br instructions */
-+  #define BTI_C hint 34  /* bti c: for calls, IE bl instructions */
-+  #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */
-+#else
-+  #define BTI_J
-+  #define BTI_C
-+  #define GNU_PROPERTY_AARCH64_BTI 0
-+#endif
-+
-+#if defined(__ARM_FEATURE_PAC_DEFAULT)
-+  #if __ARM_FEATURE_PAC_DEFAULT & 1
-+    #define SIGN_LR hint 25 /* paciasp: sign with the A key */
-+    #define VERIFY_LR hint 29 /* autiasp: verify with the A key */
-+  #elif __ARM_FEATURE_PAC_DEFAULT & 2
-+    #define SIGN_LR hint 27 /* pacibsp: sign with the b key */
-+    #define VERIFY_LR hint 31 /* autibsp: verify with the b key */
-+  #endif
-+  #define GNU_PROPERTY_AARCH64_POINTER_AUTH 2 /* bit 1 GNU Notes is for PAC support */
-+#else
-+  #define SIGN_LR BTI_C
-+  #define VERIFY_LR
-+  #define GNU_PROPERTY_AARCH64_POINTER_AUTH 0
-+#endif
-+
-+/* Add the BTI and PAC support to GNU Notes section */
-+#if GNU_PROPERTY_AARCH64_BTI != 0 || GNU_PROPERTY_AARCH64_POINTER_AUTH != 0
-+    .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */
-+    .balign 8; /* align it on a byte boundry */
-+    .long 4; /* size of "GNU\0" */
-+    .long 0x10; /* size of descriptor */
-+    .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */
-+    .asciz "GNU";
-+    .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
-+    .long 4; /* Four bytes of data */
-+    .long (GNU_PROPERTY_AARCH64_BTI|GNU_PROPERTY_AARCH64_POINTER_AUTH); /* BTI or PAC is enabled */
-+    .long 0; /* padding for 8 byte alignment */
-+    .popsection; /* end the section */
-+#endif
-+
-+#endif
diff --git a/00478-cve-2026-4519.patch b/00478-cve-2026-4519.patch
deleted file mode 100644
index 8598b76..0000000
--- a/00478-cve-2026-4519.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Pinky <pinky00ch@gmail.com>
-Date: Wed, 25 Mar 2026 01:02:37 +0530
-Subject: 00478: CVE-2026-4519
-
-Reject leading dashes in webbrowser URLs (GH-146360)
-
-(cherry picked from commit 82a24a4442312bdcfc4c799885e8b3e00990f02b)
-
-Co-authored-by: Seth Michael Larson <seth@python.org>
----
- Lib/test/test_webbrowser.py                          |  5 +++++
- Lib/webbrowser.py                                    | 12 ++++++++++++
- .../2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst   |  1 +
- 3 files changed, 18 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
-
-diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
-index 2d695bc883..60f094fd6a 100644
---- a/Lib/test/test_webbrowser.py
-+++ b/Lib/test/test_webbrowser.py
-@@ -59,6 +59,11 @@ def test_open(self):
-                    options=[],
-                    arguments=[URL])
- 
-+    def test_reject_dash_prefixes(self):
-+        browser = self.browser_class(name=CMD_NAME)
-+        with self.assertRaises(ValueError):
-+            browser.open(f"--key=val {URL}")
-+
- 
- class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase):
- 
-diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
-index 13b9e85f9e..0bdb644d7d 100755
---- a/Lib/webbrowser.py
-+++ b/Lib/webbrowser.py
-@@ -158,6 +158,12 @@ def open_new(self, url):
-     def open_new_tab(self, url):
-         return self.open(url, 2)
- 
-+    @staticmethod
-+    def _check_url(url):
-+        """Ensures that the URL is safe to pass to subprocesses as a parameter"""
-+        if url and url.lstrip().startswith("-"):
-+            raise ValueError(f"Invalid URL: {url}")
-+
- 
- class GenericBrowser(BaseBrowser):
-     """Class for all browsers started with a command
-@@ -175,6 +181,7 @@ def __init__(self, name):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         cmdline = [self.name] + [arg.replace("%s", url)
-                                  for arg in self.args]
-         try:
-@@ -195,6 +202,7 @@ def open(self, url, new=0, autoraise=True):
-         cmdline = [self.name] + [arg.replace("%s", url)
-                                  for arg in self.args]
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         try:
-             if sys.platform[:3] == 'win':
-                 p = subprocess.Popen(cmdline)
-@@ -260,6 +268,7 @@ def _invoke(self, args, remote, autoraise, url=None):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         if new == 0:
-             action = self.remote_action
-         elif new == 1:
-@@ -350,6 +359,7 @@ class Konqueror(BaseBrowser):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
-+        self._check_url(url)
-         # XXX Currently I know no way to prevent KFM from opening a new win.
-         if new == 2:
-             action = "newTab"
-@@ -554,6 +564,7 @@ def register_standard_browsers():
-     class WindowsDefault(BaseBrowser):
-         def open(self, url, new=0, autoraise=True):
-             sys.audit("webbrowser.open", url)
-+            self._check_url(url)
-             try:
-                 os.startfile(url)
-             except OSError:
-@@ -638,6 +649,7 @@ def _name(self, val):
- 
-         def open(self, url, new=0, autoraise=True):
-             sys.audit("webbrowser.open", url)
-+            self._check_url(url)
-             if self.name == 'default':
-                 script = 'open location "%s"' % url.replace('"', '%22') # opens in default browser
-             else:
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
-new file mode 100644
-index 0000000000..0f27eae99a
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst
-@@ -0,0 +1 @@
-+Reject leading dashes in URLs passed to :func:`webbrowser.open`
diff --git a/00479-cve-2026-1502.patch b/00479-cve-2026-1502.patch
deleted file mode 100644
index 16dc99b..0000000
--- a/00479-cve-2026-1502.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Larson <seth@python.org>
-Date: Fri, 10 Apr 2026 10:21:42 -0500
-Subject: 00479: CVE-2026-1502
-
-Reject CR/LF in HTTP tunnel request headers
-
-Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
----
- Lib/http/client.py                            | 11 ++++-
- Lib/test/test_httplib.py                      | 45 +++++++++++++++++++
- ...-03-20-09-29-42.gh-issue-146211.PQVbs7.rst |  2 +
- 3 files changed, 57 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
-
-diff --git a/Lib/http/client.py b/Lib/http/client.py
-index 70451d67d4..7db4807b30 100644
---- a/Lib/http/client.py
-+++ b/Lib/http/client.py
-@@ -972,13 +972,22 @@ def _wrap_ipv6(self, ip):
-         return ip
- 
-     def _tunnel(self):
-+        if _contains_disallowed_url_pchar_re.search(self._tunnel_host):
-+            raise ValueError('Tunnel host can\'t contain control characters %r'
-+                             % (self._tunnel_host,))
-         connect = b"CONNECT %s:%d %s\r\n" % (
-             self._wrap_ipv6(self._tunnel_host.encode("idna")),
-             self._tunnel_port,
-             self._http_vsn_str.encode("ascii"))
-         headers = [connect]
-         for header, value in self._tunnel_headers.items():
--            headers.append(f"{header}: {value}\r\n".encode("latin-1"))
-+            header_bytes = header.encode("latin-1")
-+            value_bytes = value.encode("latin-1")
-+            if not _is_legal_header_name(header_bytes):
-+                raise ValueError('Invalid header name %r' % (header_bytes,))
-+            if _is_illegal_header_value(value_bytes):
-+                raise ValueError('Invalid header value %r' % (value_bytes,))
-+            headers.append(b"%s: %s\r\n" % (header_bytes, value_bytes))
-         headers.append(b"\r\n")
-         # Making a single send() call instead of one per line encourages
-         # the host OS to use a more optimal packet size instead of
-diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
-index e46dac0077..e027d930d9 100644
---- a/Lib/test/test_httplib.py
-+++ b/Lib/test/test_httplib.py
-@@ -369,6 +369,51 @@ def test_invalid_headers(self):
-                 with self.assertRaisesRegex(ValueError, 'Invalid header'):
-                     conn.putheader(name, value)
- 
-+    def test_invalid_tunnel_headers(self):
-+        cases = (
-+            ('Invalid\r\nName', 'ValidValue'),
-+            ('Invalid\rName', 'ValidValue'),
-+            ('Invalid\nName', 'ValidValue'),
-+            ('\r\nInvalidName', 'ValidValue'),
-+            ('\rInvalidName', 'ValidValue'),
-+            ('\nInvalidName', 'ValidValue'),
-+            (' InvalidName', 'ValidValue'),
-+            ('\tInvalidName', 'ValidValue'),
-+            ('Invalid:Name', 'ValidValue'),
-+            (':InvalidName', 'ValidValue'),
-+            ('ValidName', 'Invalid\r\nValue'),
-+            ('ValidName', 'Invalid\rValue'),
-+            ('ValidName', 'Invalid\nValue'),
-+            ('ValidName', 'InvalidValue\r\n'),
-+            ('ValidName', 'InvalidValue\r'),
-+            ('ValidName', 'InvalidValue\n'),
-+        )
-+        for name, value in cases:
-+            with self.subTest((name, value)):
-+                conn = client.HTTPConnection('example.com')
-+                conn.set_tunnel('tunnel', headers={
-+                    name: value
-+                })
-+                conn.sock = FakeSocket('')
-+                with self.assertRaisesRegex(ValueError, 'Invalid header'):
-+                    conn._tunnel()  # Called in .connect()
-+
-+    def test_invalid_tunnel_host(self):
-+        cases = (
-+            'invalid\r.host',
-+            '\ninvalid.host',
-+            'invalid.host\r\n',
-+            'invalid.host\x00',
-+            'invalid host',
-+        )
-+        for tunnel_host in cases:
-+            with self.subTest(tunnel_host):
-+                conn = client.HTTPConnection('example.com')
-+                conn.set_tunnel(tunnel_host)
-+                conn.sock = FakeSocket('')
-+                with self.assertRaisesRegex(ValueError, 'Tunnel host can\'t contain control characters'):
-+                    conn._tunnel()  # Called in .connect()
-+
-     def test_headers_debuglevel(self):
-         body = (
-             b'HTTP/1.1 200 OK\r\n'
-diff --git a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
-new file mode 100644
-index 0000000000..4993633b8e
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst
-@@ -0,0 +1,2 @@
-+Reject CR/LF characters in tunnel request headers for the
-+HTTPConnection.set_tunnel() method.
diff --git a/00480-cve-2026-4786.patch b/00480-cve-2026-4786.patch
deleted file mode 100644
index 73e4e13..0000000
--- a/00480-cve-2026-4786.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <stan@python.org>
-Date: Mon, 13 Apr 2026 20:02:52 +0100
-Subject: 00480: CVE-2026-4786
-
-Fix webbrowser `%action` substitution bypass of dash-prefix check
----
- Lib/test/test_webbrowser.py                              | 9 +++++++++
- Lib/webbrowser.py                                        | 5 +++--
- .../2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst       | 2 ++
- 3 files changed, 14 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
-
-diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py
-index 60f094fd6a..e900c0212b 100644
---- a/Lib/test/test_webbrowser.py
-+++ b/Lib/test/test_webbrowser.py
-@@ -99,6 +99,15 @@ def test_open_new_tab(self):
-                    options=[],
-                    arguments=[URL])
- 
-+    def test_reject_action_dash_prefixes(self):
-+        browser = self.browser_class(name=CMD_NAME)
-+        with self.assertRaises(ValueError):
-+            browser.open('%action--incognito')
-+        # new=1: action is "--new-window", so "%action" itself expands to
-+        # a dash-prefixed flag even with no dash in the original URL.
-+        with self.assertRaises(ValueError):
-+            browser.open('%action', new=1)
-+
- 
- class EdgeCommandTest(CommandTestMixin, unittest.TestCase):
- 
-diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py
-index 0bdb644d7d..79d410bcae 100755
---- a/Lib/webbrowser.py
-+++ b/Lib/webbrowser.py
-@@ -268,7 +268,6 @@ def _invoke(self, args, remote, autoraise, url=None):
- 
-     def open(self, url, new=0, autoraise=True):
-         sys.audit("webbrowser.open", url)
--        self._check_url(url)
-         if new == 0:
-             action = self.remote_action
-         elif new == 1:
-@@ -282,7 +281,9 @@ def open(self, url, new=0, autoraise=True):
-             raise Error("Bad 'new' parameter to open(); " +
-                         "expected 0, 1, or 2, got %s" % new)
- 
--        args = [arg.replace("%s", url).replace("%action", action)
-+        self._check_url(url.replace("%action", action))
-+
-+        args = [arg.replace("%action", action).replace("%s", url)
-                 for arg in self.remote_args]
-         args = [arg for arg in args if arg]
-         success = self._invoke(args, True, autoraise, url)
-diff --git a/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
-new file mode 100644
-index 0000000000..45cdeebe1b
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-31-09-15-51.gh-issue-148169.EZJzz2.rst
-@@ -0,0 +1,2 @@
-+A bypass in :mod:`webbrowser` allowed URLs prefixed with ``%action`` to pass
-+the dash-prefix safety check.
diff --git a/00482-cve-2026-6100.patch b/00482-cve-2026-6100.patch
deleted file mode 100644
index 5656e3d..0000000
--- a/00482-cve-2026-6100.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <stan@python.org>
-Date: Mon, 13 Apr 2026 02:14:54 +0100
-Subject: 00482: CVE-2026-6100
-
-Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
----
- .../Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst  | 5 +++++
- Modules/_bz2module.c                                         | 1 +
- Modules/_lzmamodule.c                                        | 1 +
- Modules/zlibmodule.c                                         | 1 +
- 4 files changed, 8 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
-
-diff --git a/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst b/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
-new file mode 100644
-index 0000000000..9502189ab1
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
-@@ -0,0 +1,5 @@
-+Fix a dangling input pointer in :class:`lzma.LZMADecompressor`,
-+:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor`
-+when memory allocation fails with :exc:`MemoryError`, which could let a
-+subsequent :meth:`!decompress` call read or write through a stale pointer to
-+the already-released caller buffer.
-diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c
-index 97bd44b4ac..a732e89d55 100644
---- a/Modules/_bz2module.c
-+++ b/Modules/_bz2module.c
-@@ -587,6 +587,7 @@ decompress(BZ2Decompressor *d, char *data, size_t len, Py_ssize_t max_length)
-     return result;
- 
- error:
-+    bzs->next_in = NULL;
-     Py_XDECREF(result);
-     return NULL;
- }
-diff --git a/Modules/_lzmamodule.c b/Modules/_lzmamodule.c
-index 7bbd6569aa..103a6ef86c 100644
---- a/Modules/_lzmamodule.c
-+++ b/Modules/_lzmamodule.c
-@@ -1114,6 +1114,7 @@ decompress(Decompressor *d, uint8_t *data, size_t len, Py_ssize_t max_length)
-     return result;
- 
- error:
-+    lzs->next_in = NULL;
-     Py_XDECREF(result);
-     return NULL;
- }
-diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c
-index f94c57e4c8..9759593b6a 100644
---- a/Modules/zlibmodule.c
-+++ b/Modules/zlibmodule.c
-@@ -1645,6 +1645,7 @@ decompress(ZlibDecompressor *self, uint8_t *data,
-     return result;
- 
- error:
-+    self->zst.next_in = NULL;
-     Py_XDECREF(result);
-     return NULL;
- }
diff --git a/00483-cve-2026-2297.patch b/00483-cve-2026-2297.patch
deleted file mode 100644
index 8b504c9..0000000
--- a/00483-cve-2026-2297.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Steve Dower <steve.dower@python.org>
-Date: Wed, 4 Mar 2026 19:55:52 +0000
-Subject: 00483: CVE-2026-2297
-
-Logging Bypass in Legacy .pyc File Handling
----
- Lib/importlib/_bootstrap_external.py                            | 2 +-
- .../Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst     | 2 ++
- 2 files changed, 3 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
-
-diff --git a/Lib/importlib/_bootstrap_external.py b/Lib/importlib/_bootstrap_external.py
-index 9b8a8dfc5a..6e4a087a10 100644
---- a/Lib/importlib/_bootstrap_external.py
-+++ b/Lib/importlib/_bootstrap_external.py
-@@ -1186,7 +1186,7 @@ def get_filename(self, fullname):
- 
-     def get_data(self, path):
-         """Return the data from path as raw bytes."""
--        if isinstance(self, (SourceLoader, ExtensionFileLoader)):
-+        if isinstance(self, (SourceLoader, SourcelessFileLoader, ExtensionFileLoader)):
-             with _io.open_code(str(path)) as file:
-                 return file.read()
-         else:
-diff --git a/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst b/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
-new file mode 100644
-index 0000000000..dcdb44d4fa
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-04-18-59-17.gh-issue-145506.6hwvEh.rst
-@@ -0,0 +1,2 @@
-+Fixes :cve:`2026-2297` by ensuring that ``SourcelessFileLoader`` uses
-+:func:`io.open_code` when opening ``.pyc`` files.
diff --git a/00484-cve-2026-3644.patch b/00484-cve-2026-3644.patch
deleted file mode 100644
index a1c12bd..0000000
--- a/00484-cve-2026-3644.patch
+++ /dev/null
@@ -1,146 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
-Date: Mon, 16 Mar 2026 13:43:43 +0000
-Subject: 00484: CVE-2026-3644
-
-Incomplete control character validation in http.cookies
-
-Co-authored-by: Victor Stinner <victor.stinner@gmail.com>
----
- Lib/http/cookies.py                           | 24 ++++++++++--
- Lib/test/test_http_cookies.py                 | 38 +++++++++++++++++++
- ...-03-06-17-03-38.gh-issue-145599.kchwZV.rst |  4 ++
- 3 files changed, 62 insertions(+), 4 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
-
-diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py
-index d0a69cbe19..63d119ad46 100644
---- a/Lib/http/cookies.py
-+++ b/Lib/http/cookies.py
-@@ -335,9 +335,16 @@ def update(self, values):
-             key = key.lower()
-             if key not in self._reserved:
-                 raise CookieError("Invalid attribute %r" % (key,))
-+            if _has_control_character(key, val):
-+                raise CookieError("Control characters are not allowed in "
-+                                  f"cookies {key!r} {val!r}")
-             data[key] = val
-         dict.update(self, data)
- 
-+    def __ior__(self, values):
-+        self.update(values)
-+        return self
-+
-     def isReservedKey(self, K):
-         return K.lower() in self._reserved
- 
-@@ -363,9 +370,15 @@ def __getstate__(self):
-         }
- 
-     def __setstate__(self, state):
--        self._key = state['key']
--        self._value = state['value']
--        self._coded_value = state['coded_value']
-+        key = state['key']
-+        value = state['value']
-+        coded_value = state['coded_value']
-+        if _has_control_character(key, value, coded_value):
-+            raise CookieError("Control characters are not allowed in cookies "
-+                              f"{key!r} {value!r} {coded_value!r}")
-+        self._key = key
-+        self._value = value
-+        self._coded_value = coded_value
- 
-     def output(self, attrs=None, header="Set-Cookie:"):
-         return "%s %s" % (header, self.OutputString(attrs))
-@@ -377,13 +390,16 @@ def __repr__(self):
- 
-     def js_output(self, attrs=None):
-         # Print javascript
-+        output_string = self.OutputString(attrs)
-+        if _has_control_character(output_string):
-+            raise CookieError("Control characters are not allowed in cookies")
-         return """
-         <script type="text/javascript">
-         <!-- begin hiding
-         document.cookie = \"%s\";
-         // end hiding -->
-         </script>
--        """ % (self.OutputString(attrs).replace('"', r'\"'))
-+        """ % (output_string.replace('"', r'\"'))
- 
-     def OutputString(self, attrs=None):
-         # Build up our result
-diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
-index f196bcc48e..2478a6c630 100644
---- a/Lib/test/test_http_cookies.py
-+++ b/Lib/test/test_http_cookies.py
-@@ -573,6 +573,14 @@ def test_control_characters(self):
-             with self.assertRaises(cookies.CookieError):
-                 morsel["path"] = c0
- 
-+            # .__setstate__()
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.__setstate__({'key': c0, 'value': 'val', 'coded_value': 'coded'})
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.__setstate__({'key': 'key', 'value': c0, 'coded_value': 'coded'})
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.__setstate__({'key': 'key', 'value': 'val', 'coded_value': c0})
-+
-             # .setdefault()
-             with self.assertRaises(cookies.CookieError):
-                 morsel.setdefault("path", c0)
-@@ -587,6 +595,18 @@ def test_control_characters(self):
-             with self.assertRaises(cookies.CookieError):
-                 morsel.set("path", "val", c0)
- 
-+            # .update()
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.update({"path": c0})
-+            with self.assertRaises(cookies.CookieError):
-+                morsel.update({c0: "val"})
-+
-+            # .__ior__()
-+            with self.assertRaises(cookies.CookieError):
-+                morsel |= {"path": c0}
-+            with self.assertRaises(cookies.CookieError):
-+                morsel |= {c0: "val"}
-+
-     def test_control_characters_output(self):
-         # Tests that even if the internals of Morsel are modified
-         # that a call to .output() has control character safeguards.
-@@ -607,6 +627,24 @@ def test_control_characters_output(self):
-             with self.assertRaises(cookies.CookieError):
-                 cookie.output()
- 
-+        # Tests that .js_output() also has control character safeguards.
-+        for c0 in support.control_characters_c0():
-+            morsel = cookies.Morsel()
-+            morsel.set("key", "value", "coded-value")
-+            morsel._key = c0  # Override private variable.
-+            cookie = cookies.SimpleCookie()
-+            cookie["cookie"] = morsel
-+            with self.assertRaises(cookies.CookieError):
-+                cookie.js_output()
-+
-+            morsel = cookies.Morsel()
-+            morsel.set("key", "value", "coded-value")
-+            morsel._coded_value = c0  # Override private variable.
-+            cookie = cookies.SimpleCookie()
-+            cookie["cookie"] = morsel
-+            with self.assertRaises(cookies.CookieError):
-+                cookie.js_output()
-+
- 
- def load_tests(loader, tests, pattern):
-     tests.addTest(doctest.DocTestSuite(cookies))
-diff --git a/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
-new file mode 100644
-index 0000000000..e53a932d12
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-06-17-03-38.gh-issue-145599.kchwZV.rst
-@@ -0,0 +1,4 @@
-+Reject control characters in :class:`http.cookies.Morsel`
-+:meth:`~http.cookies.Morsel.update` and
-+:meth:`~http.cookies.BaseCookie.js_output`.
-+This addresses :cve:`2026-3644`.
diff --git a/00485-cve-2026-4224.patch b/00485-cve-2026-4224.patch
deleted file mode 100644
index 14f8734..0000000
--- a/00485-cve-2026-4224.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
-Date: Sun, 15 Mar 2026 21:46:06 +0000
-Subject: 00485: CVE-2026-4224
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Stack overflow parsing XML with deeply nested DTD content models
-
-Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
----
- Lib/test/test_pyexpat.py                       | 18 ++++++++++++++++++
- ...6-03-14-17-31-39.gh-issue-145986.ifSSr8.rst |  4 ++++
- Modules/pyexpat.c                              |  9 ++++++++-
- 3 files changed, 30 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
-
-diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
-index 38f951573f..37d9086f40 100644
---- a/Lib/test/test_pyexpat.py
-+++ b/Lib/test/test_pyexpat.py
-@@ -675,6 +675,24 @@ def test_change_size_2(self):
-         parser.Parse(xml2, True)
-         self.assertEqual(self.n, 4)
- 
-+class ElementDeclHandlerTest(unittest.TestCase):
-+    def test_deeply_nested_content_model(self):
-+        # This should raise a RecursionError and not crash.
-+        # See https://github.com/python/cpython/issues/145986.
-+        N = 500_000
-+        data = (
-+            b'<!DOCTYPE root [\n<!ELEMENT root '
-+            + b'(a, ' * N + b'a' + b')' * N
-+            + b'>\n]>\n<root/>\n'
-+        )
-+
-+        parser = expat.ParserCreate()
-+        parser.ElementDeclHandler = lambda _1, _2: None
-+        with support.infinite_recursion():
-+            with self.assertRaises(RecursionError):
-+                parser.Parse(data)
-+
-+
- class MalformedInputTest(unittest.TestCase):
-     def test1(self):
-         xml = b"\0\r\n"
-diff --git a/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
-new file mode 100644
-index 0000000000..79536d1fef
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
-@@ -0,0 +1,4 @@
-+:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
-+converting deeply nested XML content models with
-+:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`.
-+This addresses :cve:`2026-4224`.
-diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
-index 79492ca5c4..8673540f35 100644
---- a/Modules/pyexpat.c
-+++ b/Modules/pyexpat.c
-@@ -3,6 +3,7 @@
- #endif
- 
- #include "Python.h"
-+#include "pycore_ceval.h"           // _Py_EnterRecursiveCall()
- #include "pycore_runtime.h"         // _Py_ID()
- #include <ctype.h>
- 
-@@ -578,6 +579,10 @@ static PyObject *
- conv_content_model(XML_Content * const model,
-                    PyObject *(*conv_string)(const XML_Char *))
- {
-+    if (_Py_EnterRecursiveCall(" in conv_content_model")) {
-+        return NULL;
-+    }
-+
-     PyObject *result = NULL;
-     PyObject *children = PyTuple_New(model->numchildren);
-     int i;
-@@ -589,7 +594,7 @@ conv_content_model(XML_Content * const model,
-                                                  conv_string);
-             if (child == NULL) {
-                 Py_XDECREF(children);
--                return NULL;
-+                goto done;
-             }
-             PyTuple_SET_ITEM(children, i, child);
-         }
-@@ -597,6 +602,8 @@ conv_content_model(XML_Content * const model,
-                                model->type, model->quant,
-                                conv_string,model->name, children);
-     }
-+done:
-+    _Py_LeaveRecursiveCall();
-     return result;
- }
- 
diff --git a/00490-cve-2026-15308.patch b/00490-cve-2026-15308.patch
deleted file mode 100644
index 942b18b..0000000
--- a/00490-cve-2026-15308.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Serhiy Storchaka <storchaka@gmail.com>
-Date: Sat, 4 Jul 2026 20:40:22 +0300
-Subject: 00490: gh-153030: Fix quadratic complexity in incremental parsing in
- HTMLParser
-
-When an unterminated construct (e.g. a tag or comment) spanned many
-feed() calls, rescanning the growing buffer and concatenating new data
-onto it were both quadratic.  New data is now accumulated in a list and
-only joined and parsed once enough has piled up.
-(cherry picked from commit bcf98ddbc40ec9b3ee87da0124a5660b19b7e606)
-
-Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
-Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
----
- Lib/html/parser.py                            | 32 +++++++++++++++++--
- Lib/test/test_htmlparser.py                   | 20 ++++++++++++
- ...-07-04-17-00-00.gh-issue-153030.RovkP6.rst |  3 ++
- 3 files changed, 53 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
-
-diff --git a/Lib/html/parser.py b/Lib/html/parser.py
-index bfab3e64cd..c5d2340b71 100644
---- a/Lib/html/parser.py
-+++ b/Lib/html/parser.py
-@@ -138,6 +138,9 @@ def reset(self):
-         self.cdata_elem = None
-         self._support_cdata = True
-         self._escapable = True
-+        self._pending = []
-+        self._pending_len = 0
-+        self._parse_threshold = 1
-         super().reset()
- 
-     def feed(self, data):
-@@ -146,11 +149,36 @@ def feed(self, data):
-         Call this as often as you want, with as little or as much text
-         as you want (may include '\n').
-         """
--        self.rawdata = self.rawdata + data
--        self.goahead(0)
-+        # Accumulate new data in a list and only join and parse it once
-+        # enough has piled up.  Rescanning an unparsed buffer (e.g. an
-+        # unterminated tag) and concatenating onto it on every call would
-+        # both be quadratic in the input size.
-+        self._pending_len += len(data)
-+        if self._pending_len < self._parse_threshold:
-+            self._pending.append(data)
-+        else:
-+            if not self._pending:
-+                self.rawdata += data
-+            else:
-+                self._pending.append(data)
-+                self.rawdata += ''.join(self._pending)
-+                self._pending.clear()
-+            self._pending_len = 0
-+            n = len(self.rawdata)
-+            self.goahead(0)
-+            if len(self.rawdata) < n:
-+                # Some data was parsed; resume on the next call.
-+                self._parse_threshold = 1
-+            else:
-+                # Nothing was parsed; wait until the buffer doubles.
-+                self._parse_threshold = len(self.rawdata)
- 
-     def close(self):
-         """Handle any buffered data."""
-+        if self._pending:
-+            self.rawdata += ''.join(self._pending)
-+            self._pending.clear()
-+            self._pending_len = 0
-         self.goahead(1)
- 
-     __starttag_text = None
-diff --git a/Lib/test/test_htmlparser.py b/Lib/test/test_htmlparser.py
-index 303c0baa87..e6d92a7ec5 100644
---- a/Lib/test/test_htmlparser.py
-+++ b/Lib/test/test_htmlparser.py
-@@ -930,6 +930,26 @@ def check(source):
-         check("<![CDATA[" * 9 * n)
-         check("<!doctype" * 35 * n)
- 
-+    @support.requires_resource('cpu')
-+    def test_incremental_no_quadratic_complexity(self):
-+        # An unterminated construct fed in many small chunks used to take
-+        # quadratic time, both to rescan and to concatenate the buffer.
-+        # Now it takes a fraction of a second.
-+        def check(prefix, chunk, suffix):
-+            parser = html.parser.HTMLParser()
-+            parser.feed(prefix)
-+            for _ in range(200_000):
-+                parser.feed(chunk)
-+            parser.feed(suffix)
-+            parser.close()
-+        chunk = "a" * 64
-+        check("<!--", chunk, "-->")       # comment
-+        check("<?", chunk, ">")           # processing instruction
-+        check("<!doctype ", chunk, ">")   # doctype
-+        check("<![CDATA[", chunk, "]]>")  # CDATA section
-+        check("<a href='", chunk, "'>")   # start tag
-+        check("<script>", chunk, "</script>")  # RAWTEXT element
-+
- 
- class AttributesTestCase(TestCaseBase):
- 
-diff --git a/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst b/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
-new file mode 100644
-index 0000000000..d1d60593f4
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-07-04-17-00-00.gh-issue-153030.RovkP6.rst
-@@ -0,0 +1,3 @@
-+Fixed quadratic complexity in incremental parsing of long unterminated
-+constructs (such as tags or comments) in :class:`html.parser.HTMLParser`,
-+which could be exploited for a denial of service.
diff --git a/00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch b/00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
deleted file mode 100644
index 1419963..0000000
--- a/00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Victor Stinner <vstinner@python.org>
-Date: Wed, 13 May 2026 17:27:56 +0200
-Subject: 00491: gh-149776: Skip UDP Lite tests if it's not supported
-
-Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if
-it's not supported.
-
-(cherry picked from commit 3cfc249e11a132dc69624150843779aa96c72b2b)
-(cherry picked from commit 49d08674d8dba50dc29539e3c7bce21d66066b06)
----
- Lib/test/test_socket.py                       | 21 ++++++++++++++++++-
- ...-05-13-14-53-23.gh-issue-149776.orqgsn.rst |  2 ++
- 2 files changed, 22 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
-
-diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py
-index f200fc9792..9453a2c7e8 100644
---- a/Lib/test/test_socket.py
-+++ b/Lib/test/test_socket.py
-@@ -157,6 +157,25 @@ def _have_socket_hyperv():
-     return True
- 
- 
-+def _have_udp_lite():
-+    if not hasattr(socket, "IPPROTO_UDPLITE"):
-+        return False
-+    # Older Android versions block UDPLITE with SELinux.
-+    if support.is_android and platform.android_ver().api_level < 29:
-+        return False
-+
-+    try:
-+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDPLITE)
-+    except OSError as exc:
-+        # Linux 7.1 removed UDP Lite support
-+        if exc.errno == errno.EPROTONOSUPPORT:
-+            return False
-+        raise
-+    sock.close()
-+
-+    return True
-+
-+
- @contextlib.contextmanager
- def socket_setdefaulttimeout(timeout):
-     old_timeout = socket.getdefaulttimeout()
-@@ -181,7 +200,7 @@ def socket_setdefaulttimeout(timeout):
- 
- HAVE_SOCKET_VSOCK = _have_socket_vsock()
- 
--HAVE_SOCKET_UDPLITE = hasattr(socket, "IPPROTO_UDPLITE")
-+HAVE_SOCKET_UDPLITE = _have_udp_lite()
- 
- HAVE_SOCKET_BLUETOOTH = _have_socket_bluetooth()
- 
-diff --git a/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst b/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
-new file mode 100644
-index 0000000000..e86a9130ff
---- /dev/null
-+++ b/Misc/NEWS.d/next/Tests/2026-05-13-14-53-23.gh-issue-149776.orqgsn.rst
-@@ -0,0 +1,2 @@
-+Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if it's
-+not supported. Patch by Victor Stinner.
diff --git a/00494-increase-the-timeout-of-test_large_content_length_truncated.patch b/00494-increase-the-timeout-of-test_large_content_length_truncated.patch
new file mode 100644
index 0000000..9d0ef51
--- /dev/null
+++ b/00494-increase-the-timeout-of-test_large_content_length_truncated.patch
@@ -0,0 +1,23 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Fri, 14 Aug 2026 09:38:26 +0200
+Subject: 00494: Increase the timeout of test_large_content_length_truncated
+
+It has started to fail randomly when run on s390x architecture.
+---
+ Lib/test/test_httpservers.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
+index 96fc9ca574..6a3f5731a4 100644
+--- a/Lib/test/test_httpservers.py
++++ b/Lib/test/test_httpservers.py
+@@ -907,7 +907,7 @@ def test_large_content_length(self):
+             self.assertEqual(res.read(), b'%d %d' % (size, size) + self.linesep)
+ 
+     def test_large_content_length_truncated(self):
+-        with support.swap_attr(self.request_handler, 'timeout', 0.001):
++        with support.swap_attr(self.request_handler, 'timeout', support.LOOPBACK_TIMEOUT):
+             for w in range(18, 65):
+                 size = 1 << w
+                 headers = {'Content-Length' : str(size)}
diff --git a/python3.12.spec b/python3.12.spec
index c3b0ce6..0c61ac1 100644
--- a/python3.12.spec
+++ b/python3.12.spec
@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.13
+%global general_version %{pybasever}.14
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 6%{?dist}
+Release: 1%{?dist}
 License: Python-2.0.1
 
 
@@ -400,23 +400,6 @@ Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.p
 # stressed on OpenSSL 3.5.
 Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
 
-# 00464 # 1c713e02a26bf8865bb6421749d19d0766cac178
-# Enable PAC and BTI protections for aarch64
-#
-# Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
-#
-# The BTI flag must be applied in the assembler sources for this class
-# of attacks to be mitigated on newer aarch64 processors.
-#
-# Upstream PR: https://github.com/python/cpython/pull/130864/files
-#
-# The upstream patch is incomplete but only for the case where
-# frame pointers are not used on 3.13+.
-#
-# Since on Fedora we always compile with frame pointers the BTI/PAC
-# hardware protections can be enabled without losing Perf unwinding.
-Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
-
 # 00474 # 837ddca0372fa87ff9cee47142200caa21e77def
 # CVE-2025-15366
 #
@@ -433,63 +416,11 @@ Patch474: 00474-cve-2025-15366.patch
 # (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
 Patch475: 00475-cve-2025-15367.patch
 
-# 00478 # eb93352dc8e31f4d52546b84daad875e6ff7f29e
-# CVE-2026-4519
+# 00494 # 430aab133397ed44cc9ee621fd311e02fee317b5
+# Increase the timeout of test_large_content_length_truncated
 #
-# Reject leading dashes in webbrowser URLs (GH-146360)
-Patch478: 00478-cve-2026-4519.patch
-
-# 00479 # 97404b2cf62e545c2d41be7ccfed4e74da9ee665
-# CVE-2026-1502
-#
-# Reject CR/LF in HTTP tunnel request headers
-Patch479: 00479-cve-2026-1502.patch
-
-# 00480 # 6f4eef3ba4d9818a53698e994550ee8db17a1e2e
-# CVE-2026-4786
-#
-# Fix webbrowser `%%action` substitution bypass of dash-prefix check
-Patch480: 00480-cve-2026-4786.patch
-
-# 00482 # 69f14bc306fc62400d45565faa980b77858b9151
-# CVE-2026-6100
-#
-# Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor
-Patch482: 00482-cve-2026-6100.patch
-
-# 00483 # 577c595137ce6ff92158ddaf2d7b7ea86437825d
-# CVE-2026-2297
-#
-# Logging Bypass in Legacy .pyc File Handling
-Patch483: 00483-cve-2026-2297.patch
-
-# 00484 # 8b5133c1ab17a060cd134bea2a4b6e1831c47fed
-# CVE-2026-3644
-#
-# Incomplete control character validation in http.cookies
-Patch484: 00484-cve-2026-3644.patch
-
-# 00485 # 12a5b206676927bcee131ab4f2bd6783d2f5914a
-# CVE-2026-4224
-#
-# Stack overflow parsing XML with deeply nested DTD content models
-Patch485: 00485-cve-2026-4224.patch
-
-# 00490 # 3e8c5ad70d6a515107352d8779269240a0553f54
-# gh-153030: Fix quadratic complexity in incremental parsing in HTMLParser
-#
-# When an unterminated construct (e.g. a tag or comment) spanned many
-# feed() calls, rescanning the growing buffer and concatenating new data
-# onto it were both quadratic.  New data is now accumulated in a list and
-# only joined and parsed once enough has piled up.
-Patch490: 00490-cve-2026-15308.patch
-
-# 00491 # 1ad95144c42a6933283352245c5df5a4c142e75f
-# gh-149776: Skip UDP Lite tests if it's not supported
-#
-# Fix test_socket on Linux kernel 7.1 and newer: skip UDP Lite tests if
-# it's not supported.
-Patch491: 00491-gh-149776-skip-udp-lite-tests-if-it-s-not-supported.patch
+# It has started to fail randomly when run on s390x architecture.
+Patch494: 00494-increase-the-timeout-of-test_large_content_length_truncated.patch
 
 # (New patches go here ^^^)
 #
@@ -1827,6 +1758,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.12.14-1
+- Update to Python 3.12.14
+
 * Tue Jul 28 2026 Lukáš Zachar <lzachar@redhat.com> - 3.12.13-6
 - Security fix for CVE-2026-15308
 Resolves: rhbz#2498688
diff --git a/sources b/sources
index 5b33098..f116187 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.13.tar.xz) = e1eb66f0b34581f0155e3ce25ba72cf0b4b1107672ed0ad3e86bcfe616945c9204c41ffc492f32b1066b9154913ff88343038967ad8711dd05e6f2332fdb735b
-SHA512 (Python-3.12.13.tar.xz.asc) = 903fd3baa7e29891bb00fb159ec9c43804a71002c4cd38902d25bf4e5167f856b37d211a5b1098ee60e1ea41f8a10a1596dd2382edc6d7367d55dd4154807fc7
+SHA512 (Python-3.12.14.tar.xz) = 9007399ffdd3a493c91a98cd7a6cb93acfb8de80f3be2f5480cda36f134d49b5043a60bc6b5c62ed18cc6a2e4e3c81cb7556ac5f337e2cd58ff3449a8099ed22
+SHA512 (Python-3.12.14.tar.xz.asc) = 69cc4757f5d79ea46f9b632d5b34f9f16855cb1f767f77c827ad65546ba8f77b68e75a661ebc4e4f453edd7a98a73d916491597f67d4fed9c891aa599a869324

From f298fbb9191127f2a47009f89b98bc3e02703c2b Mon Sep 17 00:00:00 2001
From: Cristian Le <git@lecris.dev>
Date: Mon, 17 Aug 2026 07:39:50 +0200
Subject: [PATCH 93/93] Drop outdated fmf/tmt artifact

---
 tests/.fmf/version | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 tests/.fmf/version

diff --git a/tests/.fmf/version b/tests/.fmf/version
deleted file mode 100644
index d00491f..0000000
--- a/tests/.fmf/version
+++ /dev/null
@@ -1 +0,0 @@
-1