Use bundled wheels, pip in Fedora 35 is too old

00251-change-user-install-location.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
 Date: Mon, 15 Feb 2021 12:19:27 +0100
-Subject: 00251: Change user install location
+Subject: [PATCH] 00251: Change user install location
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -30,10 +30,10 @@ Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
  3 files changed, 71 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/site.py b/Lib/site.py
-index aed254ad50..568dbdb945 100644
+index 69670d9d7f..104cb93899 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
-@@ -398,8 +398,15 @@ def getsitepackages(prefixes=None):
+@@ -377,8 +377,15 @@ def getsitepackages(prefixes=None):
      return sitepackages
  
  def addsitepackages(known_paths, prefixes=None):
@@ -51,7 +51,7 @@ index aed254ad50..568dbdb945 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index acc8d4d182..6355669f62 100644
+index 73c25684db..d43ce7f1a2 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
 @@ -104,6 +104,11 @@
@@ -86,7 +86,7 @@ index acc8d4d182..6355669f62 100644
  _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
                  'scripts', 'data')
  
-@@ -268,11 +286,40 @@ def _extend_dict(target_dict, other_dict):
+@@ -263,11 +281,40 @@ def _extend_dict(target_dict, other_dict):
          target_dict[key] = value
  
  
@@ -119,7 +119,7 @@ index acc8d4d182..6355669f62 100644
 +    # we only change the defaults here, so explicit --prefix will take precedence
 +    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +    if (scheme == 'posix_prefix' and
-+        sys.prefix == '/usr' and
++        _PREFIX == '/usr' and
 +        'RPM_BUILD_ROOT' not in os.environ):
 +            _extend_dict(vars, _config_vars_local())
 +    else:
@@ -129,10 +129,10 @@ index acc8d4d182..6355669f62 100644
          # On Windows we want to substitute 'lib' for schemes rather
          # than the native value (without modifying vars, in case it
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index 67647e1b78..7baddaa9d6 100644
+index b6dbf3d52c..4f06a7673c 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
-@@ -119,8 +119,19 @@ def test_get_path(self):
+@@ -110,8 +110,19 @@ def test_get_path(self):
          for scheme in _INSTALL_SCHEMES:
              for name in _INSTALL_SCHEMES[scheme]:
                  expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
@@ -153,7 +153,7 @@ index 67647e1b78..7baddaa9d6 100644
                      os.path.normpath(expected),
                  )
  
-@@ -353,7 +364,7 @@ def test_get_config_h_filename(self):
+@@ -335,7 +346,7 @@ def test_get_config_h_filename(self):
          self.assertTrue(os.path.isfile(config_h), config_h)
  
      def test_get_scheme_names(self):
@@ -162,7 +162,7 @@ index 67647e1b78..7baddaa9d6 100644
          if HAS_USER_BASE:
              wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
          self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
-@@ -365,6 +376,8 @@ def test_symlink(self): # Issue 7880
+@@ -347,6 +358,8 @@ def test_symlink(self): # Issue 7880
              cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
              self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
  

00328-pyc-timestamp-invalidation-mode.patch

@@ -0,0 +1,54 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Thu, 11 Jul 2019 13:44:13 +0200
+Subject: [PATCH] 00328: Restore pyc to TIMESTAMP invalidation mode as default
+ in rpmbuild
+
+Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
+%changelog date. This makes Python default to the CHECKED_HASH pyc
+invalidation mode, bringing more reproducible builds traded for an import
+performance decrease. To avoid that, we don't default to CHECKED_HASH
+when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
+
+See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
+Downstream only: only used when building RPM packages
+Ideally, we should talk to upstream and explain why we don't want this
+---
+ Lib/py_compile.py           | 3 ++-
+ Lib/test/test_py_compile.py | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/py_compile.py b/Lib/py_compile.py
+index 388614e51b..db52725016 100644
+--- a/Lib/py_compile.py
++++ b/Lib/py_compile.py
+@@ -70,7 +70,8 @@ class PycInvalidationMode(enum.Enum):
+ 
+ 
+ def _get_default_invalidation_mode():
+-    if os.environ.get('SOURCE_DATE_EPOCH'):
++    if (os.environ.get('SOURCE_DATE_EPOCH') and not
++            os.environ.get('RPM_BUILD_ROOT')):
+         return PycInvalidationMode.CHECKED_HASH
+     else:
+         return PycInvalidationMode.TIMESTAMP
+diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
+index 5e0a44ad96..ac14a6a54c 100644
+--- a/Lib/test/test_py_compile.py
++++ b/Lib/test/test_py_compile.py
+@@ -19,6 +19,7 @@ def without_source_date_epoch(fxn):
+     def wrapper(*args, **kwargs):
+         with os_helper.EnvironmentVarGuard() as env:
+             env.unset('SOURCE_DATE_EPOCH')
++            env.unset('RPM_BUILD_ROOT')
+             return fxn(*args, **kwargs)
+     return wrapper
+ 
+@@ -29,6 +30,7 @@ def with_source_date_epoch(fxn):
+     def wrapper(*args, **kwargs):
+         with os_helper.EnvironmentVarGuard() as env:
+             env['SOURCE_DATE_EPOCH'] = '123456789'
++            env.unset('RPM_BUILD_ROOT')
+             return fxn(*args, **kwargs)
+     return wrapper
+ 

00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch

@@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
 Date: Tue, 25 Oct 2022 12:02:33 +0200
-Subject: 00371: Revert "bpo-1596321: Fix threading._shutdown() for the main
+Subject: [PATCH] 00371: Revert "bpo-1596321: Fix threading._shutdown() for the
- thread (GH-28549) (GH-28589)"
+ main thread (GH-28549) (GH-28589)"
 
 This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
 introduced regression causing FreeIPA's tests to fail.
@@ -16,10 +16,10 @@ https://github.com/GrahamDumpleton/mod_wsgi/issues/730
  2 files changed, 8 insertions(+), 50 deletions(-)
 
 diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
-index 75a56f7830..c2509fced1 100644
+index 13ba5068ae..8bf97c5542 100644
 --- a/Lib/test/test_threading.py
 +++ b/Lib/test/test_threading.py
-@@ -1100,39 +1100,6 @@ def noop(): pass
+@@ -1002,39 +1002,6 @@ def noop(): pass
              threading.Thread(target=noop).start()
              # Thread.join() is not called
  
@@ -56,14 +56,14 @@ index 75a56f7830..c2509fced1 100644
 -        self.assertEqual(out, b'')
 -        self.assertEqual(err, b'')
 -
-     def test_start_new_thread_at_finalization(self):
+ 
-         code = """if 1:
+ class ThreadJoinOnShutdown(BaseTestCase):
-             import _thread
+ 
 diff --git a/Lib/threading.py b/Lib/threading.py
-index 064c74d40f..9e3abacd42 100644
+index 723bd58bf5..0bdf0b7336 100644
 --- a/Lib/threading.py
 +++ b/Lib/threading.py
-@@ -1587,29 +1587,20 @@ def _shutdown():
+@@ -1563,29 +1563,20 @@ def _shutdown():
  
      global _SHUTTING_DOWN
      _SHUTTING_DOWN = True

00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch

@@ -1,96 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Adam Turner <9087854+AA-Turner@users.noreply.github.com>
-Date: Fri, 25 Apr 2025 00:46:20 +0100
-Subject: 00460: gh-132415: Update vendored setuptools in
- ``Lib/test/wheeldata``
-
-(cherry picked from commit c9f3f5b4ed52d7bed6073ffa39717ece47202558)
-(actual changes in .whl files removed to make this patch smaller)
-
-gh-127906: Add missing sys import to test_cppext
-
-(cherry picked from commit 9cba14881b371b1e95d57877896169c4605f9b75)
-
-Co-Authored-By: Victor Stinner <vstinner@python.org>
----
- Lib/test/support/__init__.py                 | 5 ++---
- Lib/test/test_cext/__init__.py               | 2 +-
- Lib/test/test_cppext/__init__.py             | 2 +-
- Lib/test/test_cppext/setup.py                | 1 +
- Lib/test/test_peg_generator/test_c_parser.py | 2 +-
- 5 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index 1ee8ffc1b7..cab0f49366 100644
---- a/Lib/test/support/__init__.py
-+++ b/Lib/test/support/__init__.py
-@@ -2308,7 +2308,7 @@ def _findwheel(pkgname):
- # Context manager that creates a virtual environment, install setuptools in it,
- # and returns the paths to the venv directory and the python executable
- @contextlib.contextmanager
--def setup_venv_with_pip_setuptools_wheel(venv_dir):
-+def setup_venv_with_pip_setuptools(venv_dir):
-     import subprocess
-     from .os_helper import temp_cwd
- 
-@@ -2331,8 +2331,7 @@ def setup_venv_with_pip_setuptools_wheel(venv_dir):
- 
-         cmd = (python, '-X', 'dev',
-                '-m', 'pip', 'install',
--               _findwheel('setuptools'),
--               _findwheel('wheel'))
-+               _findwheel('setuptools'))
-         if verbose:
-             print()
-             print('Run:', ' '.join(cmd))
-diff --git a/Lib/test/test_cext/__init__.py b/Lib/test/test_cext/__init__.py
-index d5ea1dc660..04a6361ff3 100644
---- a/Lib/test/test_cext/__init__.py
-+++ b/Lib/test/test_cext/__init__.py
-@@ -53,7 +53,7 @@ def check_build(self, extension_name, std=None, limited=False):
-             self.skipTest('Py_LIMITED_API is incompatible with Py_TRACE_REFS')
- 
-         venv_dir = 'env'
--        with support.setup_venv_with_pip_setuptools_wheel(venv_dir) as python_exe:
-+        with support.setup_venv_with_pip_setuptools(venv_dir) as python_exe:
-             self._check_build(extension_name, python_exe,
-                               std=std, limited=limited)
- 
-diff --git a/Lib/test/test_cppext/__init__.py b/Lib/test/test_cppext/__init__.py
-index 2198b7b2c0..31ea4ac7a1 100644
---- a/Lib/test/test_cppext/__init__.py
-+++ b/Lib/test/test_cppext/__init__.py
-@@ -51,7 +51,7 @@ def check_build(self, extension_name, std=None, limited=False):
-             self.skipTest('Py_LIMITED_API is incompatible with Py_TRACE_REFS')
- 
-         venv_dir = 'env'
--        with support.setup_venv_with_pip_setuptools_wheel(venv_dir) as python_exe:
-+        with support.setup_venv_with_pip_setuptools(venv_dir) as python_exe:
-             self._check_build(extension_name, python_exe,
-                               std=std, limited=limited)
- 
-diff --git a/Lib/test/test_cppext/setup.py b/Lib/test/test_cppext/setup.py
-index 019ff18446..25d71cd9a2 100644
---- a/Lib/test/test_cppext/setup.py
-+++ b/Lib/test/test_cppext/setup.py
-@@ -3,6 +3,7 @@
- import os
- import platform
- import shlex
-+import sys
- import sysconfig
- from test import support
- 
-diff --git a/Lib/test/test_peg_generator/test_c_parser.py b/Lib/test/test_peg_generator/test_c_parser.py
-index eb31569c03..2fe1367b51 100644
---- a/Lib/test/test_peg_generator/test_c_parser.py
-+++ b/Lib/test/test_peg_generator/test_c_parser.py
-@@ -99,7 +99,7 @@ def setUpClass(cls):
-         cls.addClassCleanup(shutil.rmtree, cls.library_dir)
- 
-         with contextlib.ExitStack() as stack:
--            python_exe = stack.enter_context(support.setup_venv_with_pip_setuptools_wheel("venv"))
-+            python_exe = stack.enter_context(support.setup_venv_with_pip_setuptools("venv"))
-             sitepackages = subprocess.check_output(
-                 [python_exe, "-c", "import sysconfig; print(sysconfig.get_path('platlib'))"],
-                 text=True,

00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch

@@ -1,34 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
-Date: Fri, 25 Apr 2025 09:33:37 +0200
-Subject: 00461: Downstream only: Install wheel in test venvs when setuptools <
- 71
-
----
- Lib/test/support/__init__.py | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index cab0f49366..26c0af4b13 100644
---- a/Lib/test/support/__init__.py
-+++ b/Lib/test/support/__init__.py
-@@ -2329,9 +2329,18 @@ def setup_venv_with_pip_setuptools(venv_dir):
-         else:
-             python = os.path.join(venv, 'bin', python_exe)
- 
-+        setuptools_whl = _findwheel('setuptools')
-+        whl_filename = os.path.basename(setuptools_whl)
-+        setuptools_major = int(whl_filename.split('-')[1].split('.')[0])
-+        if setuptools_major >= 71:  # we need 70.1+, but that's OK
-+            wheels = (setuptools_whl,)
-+        else:
-+            wheels = (setuptools_whl, _findwheel('wheel'))
-+
-         cmd = (python, '-X', 'dev',
-                '-m', 'pip', 'install',
--               _findwheel('setuptools'))
-+               *wheels,
-+               )
-         if verbose:
-             print()
-             print('Run:', ' '.join(cmd))

00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch

@@ -1,196 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: yevgeny hong <hongyevgeny@gmail.com>
-Date: Tue, 26 Mar 2024 16:45:43 +0900
-Subject: 00462: Fix PySSL_SetError handling SSL_ERROR_SYSCALL
-
-Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
-SSL_read_ex(), but did not update handling of the return value.
-
-Change error handling so that the return value is not examined.
-OSError (not EOF) is now returned when retval is 0.
-
-This resolves the issue of failing tests when a system is
-stressed on OpenSSL 3.5.
-
-Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
-Co-authored-by: Petr Viktorin <encukou@gmail.com>
----
- Lib/test/test_ssl.py                          | 28 ++++++-----
- ...-02-18-09-50-31.gh-issue-115627.HGchj0.rst |  2 +
- Modules/_ssl.c                                | 48 +++++++------------
- 3 files changed, 35 insertions(+), 43 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-
-diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
-index b13e37d0cd..daeb8cba74 100644
---- a/Lib/test/test_ssl.py
-+++ b/Lib/test/test_ssl.py
-@@ -2427,16 +2427,18 @@ def run(self):
-                         self.write(msg.lower())
-                 except OSError as e:
-                     # handles SSLError and socket errors
-+                    if isinstance(e, ConnectionError):
-+                        # OpenSSL 1.1.1 sometimes raises
-+                        # ConnectionResetError when connection is not
-+                        # shut down gracefully.
-+                        if self.server.chatty and support.verbose:
-+                            print(f" Connection reset by peer: {self.addr}")
-+
-+                        self.close()
-+                        self.running = False
-+                        return
-                     if self.server.chatty and support.verbose:
--                        if isinstance(e, ConnectionError):
--                            # OpenSSL 1.1.1 sometimes raises
--                            # ConnectionResetError when connection is not
--                            # shut down gracefully.
--                            print(
--                                f" Connection reset by peer: {self.addr}"
--                            )
--                        else:
--                            handle_error("Test server failure:\n")
-+                        handle_error("Test server failure:\n")
-                     try:
-                         self.write(b"ERROR\n")
-                     except OSError:
-@@ -3148,8 +3150,8 @@ def test_wrong_cert_tls13(self):
-                                         suppress_ragged_eofs=False) as s:
-             s.connect((HOST, server.port))
-             with self.assertRaisesRegex(
--                ssl.SSLError,
--                'alert unknown ca|EOF occurred|TLSV1_ALERT_UNKNOWN_CA'
-+                OSError,
-+                'alert unknown ca|EOF occurred|TLSV1_ALERT_UNKNOWN_CA|closed by the remote host|Connection reset by peer'
-             ):
-                 # TLS 1.3 perform client cert exchange after handshake
-                 s.write(b'data')
-@@ -4422,8 +4424,8 @@ def msg_cb(conn, direction, version, content_type, msg_type, data):
-                 # test sometimes fails with EOF error. Test passes as long as
-                 # server aborts connection with an error.
-                 with self.assertRaisesRegex(
--                    ssl.SSLError,
--                    '(certificate required|EOF occurred)'
-+                    OSError,
-+                    'certificate required|EOF occurred|closed by the remote host|Connection reset by peer'
-                 ):
-                     # receive CertificateRequest
-                     data = s.recv(1024)
-diff --git a/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-new file mode 100644
-index 0000000000..75d926ab59
---- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2024-02-18-09-50-31.gh-issue-115627.HGchj0.rst
-@@ -0,0 +1,2 @@
-+Fix the :mod:`ssl` module error handling of connection terminate by peer.
-+It now throws an OSError with the appropriate error code instead of an EOFError.
-diff --git a/Modules/_ssl.c b/Modules/_ssl.c
-index aae4dc323d..27dd7bbe11 100644
---- a/Modules/_ssl.c
-+++ b/Modules/_ssl.c
-@@ -573,7 +573,7 @@ PySSL_ChainExceptions(PySSLSocket *sslsock) {
- }
- 
- static PyObject *
--PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-+PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno)
- {
-     PyObject *type;
-     char *errstr = NULL;
-@@ -586,7 +586,6 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-     _sslmodulestate *state = get_state_sock(sslsock);
-     type = state->PySSLErrorObject;
- 
--    assert(ret <= 0);
-     e = ERR_peek_last_error();
- 
-     if (sslsock->ssl != NULL) {
-@@ -619,32 +618,21 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-         case SSL_ERROR_SYSCALL:
-         {
-             if (e == 0) {
--                PySocketSockObject *s = GET_SOCKET(sslsock);
--                if (ret == 0 || (((PyObject *)s) == Py_None)) {
-+                /* underlying BIO reported an I/O error */
-+                ERR_clear_error();
-+#ifdef MS_WINDOWS
-+                if (err.ws) {
-+                    return PyErr_SetFromWindowsErr(err.ws);
-+                }
-+#endif
-+                if (err.c) {
-+                    errno = err.c;
-+                    return PyErr_SetFromErrno(PyExc_OSError);
-+                }
-+                else {
-                     p = PY_SSL_ERROR_EOF;
-                     type = state->PySSLEOFErrorObject;
-                     errstr = "EOF occurred in violation of protocol";
--                } else if (s && ret == -1) {
--                    /* underlying BIO reported an I/O error */
--                    ERR_clear_error();
--#ifdef MS_WINDOWS
--                    if (err.ws) {
--                        return PyErr_SetFromWindowsErr(err.ws);
--                    }
--#endif
--                    if (err.c) {
--                        errno = err.c;
--                        return PyErr_SetFromErrno(PyExc_OSError);
--                    }
--                    else {
--                        p = PY_SSL_ERROR_EOF;
--                        type = state->PySSLEOFErrorObject;
--                        errstr = "EOF occurred in violation of protocol";
--                    }
--                } else { /* possible? */
--                    p = PY_SSL_ERROR_SYSCALL;
--                    type = state->PySSLSyscallErrorObject;
--                    errstr = "Some I/O error occurred";
-                 }
-             } else {
-                 if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
-@@ -1007,7 +995,7 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
-              err.ssl == SSL_ERROR_WANT_WRITE);
-     Py_XDECREF(sock);
-     if (ret < 1)
--        return PySSL_SetError(self, ret, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     if (PySSL_ChainExceptions(self) < 0)
-         return NULL;
-     Py_RETURN_NONE;
-@@ -2424,7 +2412,7 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
- 
-     Py_XDECREF(sock);
-     if (retval == 0)
--        return PySSL_SetError(self, retval, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     if (PySSL_ChainExceptions(self) < 0)
-         return NULL;
-     return PyLong_FromSize_t(count);
-@@ -2454,7 +2442,7 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
-     self->err = err;
- 
-     if (count < 0)
--        return PySSL_SetError(self, count, __FILE__, __LINE__);
-+        return PySSL_SetError(self, __FILE__, __LINE__);
-     else
-         return PyLong_FromLong(count);
- }
-@@ -2577,7 +2565,7 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
-              err.ssl == SSL_ERROR_WANT_WRITE);
- 
-     if (retval == 0) {
--        PySSL_SetError(self, retval, __FILE__, __LINE__);
-+        PySSL_SetError(self, __FILE__, __LINE__);
-         goto error;
-     }
-     if (self->exc != NULL)
-@@ -2703,7 +2691,7 @@ _ssl__SSLSocket_shutdown_impl(PySSLSocket *self)
-     }
-     if (ret < 0) {
-         Py_XDECREF(sock);
--        PySSL_SetError(self, ret, __FILE__, __LINE__);
-+        PySSL_SetError(self, __FILE__, __LINE__);
-         return NULL;
-     }
-     if (self->exc != NULL)

00474-cve-2025-15366.patch

@@ -1,61 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Tue, 20 Jan 2026 14:45:42 -0600
-Subject: 00474: CVE-2025-15366
-
-gh-143921: Reject control characters in IMAP commands
-
-(cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
----
- Lib/imaplib.py                                              | 4 +++-
- Lib/test/test_imaplib.py                                    | 6 ++++++
- .../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 +
- 3 files changed, 10 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-
-diff --git a/Lib/imaplib.py b/Lib/imaplib.py
-index e337fe6471..c7f44f05b1 100644
---- a/Lib/imaplib.py
-+++ b/Lib/imaplib.py
-@@ -132,7 +132,7 @@
- # We compile these in _mode_xxx.
- _Literal = br'.*{(?P<size>\d+)}$'
- _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
--
-+_control_chars = re.compile(b'[\x00-\x1F\x7F]')
- 
- 
- class IMAP4:
-@@ -994,6 +994,8 @@ def _command(self, name, *args):
-             if arg is None: continue
-             if isinstance(arg, str):
-                 arg = bytes(arg, self._encoding)
-+            if _control_chars.search(arg):
-+                raise ValueError("Control characters not allowed in commands")
-             data = data + b' ' + arg
- 
-         literal = self.literal
-diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py
-index 4429a90050..73c25bc733 100644
---- a/Lib/test/test_imaplib.py
-+++ b/Lib/test/test_imaplib.py
-@@ -504,6 +504,12 @@ def test_login(self):
-         self.assertEqual(data[0], b'LOGIN completed')
-         self.assertEqual(client.state, 'AUTH')
- 
-+    def test_control_characters(self):
-+        client, _ = self._setup(SimpleIMAPHandler)
-+        for c0 in support.control_characters_c0():
-+            with self.assertRaises(ValueError):
-+                client.login(f'user{c0}', 'pass')
-+
-     def test_logout(self):
-         client, _ = self._setup(SimpleIMAPHandler)
-         typ, data = client.login('user', 'pass')
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-new file mode 100644
-index 0000000000..4e13fe92bc
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
-@@ -0,0 +1 @@
-+Reject control characters in IMAP commands.

00475-cve-2025-15367.patch

@@ -1,61 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Tue, 20 Jan 2026 14:46:32 -0600
-Subject: 00475: CVE-2025-15367
-
-gh-143923: Reject control characters in POP3 commands
-
-(cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
----
- Lib/poplib.py                                             | 2 ++
- Lib/test/test_poplib.py                                   | 8 ++++++++
- .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst        | 1 +
- 3 files changed, 11 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-
-diff --git a/Lib/poplib.py b/Lib/poplib.py
-index 9eb662d000..5c83522504 100644
---- a/Lib/poplib.py
-+++ b/Lib/poplib.py
-@@ -122,6 +122,8 @@ def _putline(self, line):
-     def _putcmd(self, line):
-         if self._debugging: print('*cmd*', repr(line))
-         line = bytes(line, self.encoding)
-+        if re.search(b'[\x00-\x1F\x7F]', line):
-+            raise ValueError('Control characters not allowed in commands')
-         self._putline(line)
- 
- 
-diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
-index f1ebbeafe0..50d8c255d6 100644
---- a/Lib/test/test_poplib.py
-+++ b/Lib/test/test_poplib.py
-@@ -12,6 +12,7 @@
- import unittest
- from unittest import TestCase, skipUnless
- from test import support as test_support
-+from test.support import control_characters_c0
- from test.support import hashlib_helper
- from test.support import socket_helper
- from test.support import threading_helper
-@@ -395,6 +396,13 @@ def test_quit(self):
-         self.assertIsNone(self.client.sock)
-         self.assertIsNone(self.client.file)
- 
-+    def test_control_characters(self):
-+        for c0 in control_characters_c0():
-+            with self.assertRaises(ValueError):
-+                self.client.user(f'user{c0}')
-+            with self.assertRaises(ValueError):
-+                self.client.pass_(f'{c0}pass')
-+
-     @requires_ssl
-     def test_stls_capa(self):
-         capa = self.client.capa()
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-new file mode 100644
-index 0000000000..3cde4df3e0
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-@@ -0,0 +1 @@
-+Reject control characters in POP3 commands.

00494-increase-the-timeout-of-test_large_content_length_truncated.patch

@@ -1,23 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Karolina Surma <ksurma@redhat.com>
-Date: Fri, 14 Aug 2026 09:38:26 +0200
-Subject: 00494: Increase the timeout of test_large_content_length_truncated
-
-It has started to fail randomly when run on s390x architecture.
----
- Lib/test/test_httpservers.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Lib/test/test_httpservers.py b/Lib/test/test_httpservers.py
-index 96fc9ca574..6a3f5731a4 100644
---- a/Lib/test/test_httpservers.py
-+++ b/Lib/test/test_httpservers.py
-@@ -907,7 +907,7 @@ def test_large_content_length(self):
-             self.assertEqual(res.read(), b'%d %d' % (size, size) + self.linesep)
- 
-     def test_large_content_length_truncated(self):
--        with support.swap_attr(self.request_handler, 'timeout', 0.001):
-+        with support.swap_attr(self.request_handler, 'timeout', support.LOOPBACK_TIMEOUT):
-             for w in range(18, 65):
-                 size = 1 << w
-                 headers = {'Content-Length' : str(size)}

check-pyc-timestamps.py

@@ -16,14 +16,14 @@ LEVELS = (None, 1, 2)
 # list of globs of test and other files that we expect not to have bytecode
 not_compiled = [
     '/usr/bin/*',
+    '*/test/bad_coding.py',
+    '*/test/bad_coding2.py',
     '*/test/badsyntax_*.py',
-    '*/tokenizedata/bad_coding.py',
+    '*/test_lib2to3/data/bom.py',
-    '*/tokenizedata/bad_coding2.py',
+    '*/test_lib2to3/data/crlf.py',
-    '*/tokenizedata/badsyntax_*.py',
+    '*/test_lib2to3/data/different_encoding.py',
-    '*/test_future_stmt/badsyntax_*.py',
+    '*/test_lib2to3/data/false_encoding.py',
-    '*/test_lib2to3/data/*.py',
+    '*/test_lib2to3/data/py2_test_grammar.py',
-    '*/test_lib2to3/data/*/*.py',
-    '*/test_lib2to3/data/*/*/*.py',
     '*.debug-gdb.py',
 ]
 

plan.fmf

@@ -1,67 +0,0 @@
-execute:
-  how: tmt
-
-provision:
-  hardware:
-    memory: '>= 3 GB'
-
-environment:
-  pybasever: '3.12'
-
-discover:
-  - name: tests_python
-    how: shell
-    url: https://src.fedoraproject.org/tests/python.git
-    tests:
-    - name: smoke
-      path: /smoke
-      test: "VERSION=${pybasever} ./venv.sh"
-    - name: smoke_virtualenv
-      path: /smoke
-      test: "VERSION=${pybasever} METHOD=virtualenv ./venv.sh"
-    - name: debugsmoke
-      path: /smoke
-      test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} ./venv.sh"
-    - name: selftest
-      path: /selftest
-      test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh"
-    - name: debugtest
-      path: /selftest
-      test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes' ./parallel.sh"
-    - name: debugflags
-      path: /flags
-      test: "python${pybasever}d ./assertflags.py -O0"
-    - name: marshalparser
-      path: /marshalparser
-      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
-    - name: required_symbols
-      path: /required-symbols
-      test: "VERSION=${pybasever} ./check.sh"
-
-prepare:
-  - name: Install dependencies
-    how: install
-    package:
-    - gcc  # for extension building in venv and selftest
-    - gcc-c++ # for test_cppext
-    - gdb  # for test_gdb
-    - "python${pybasever}"  # the test subject
-    - "python${pybasever}-debug"  # for leak testing
-    - "python${pybasever}-devel"  # for extension building in venv and selftest
-    - "python${pybasever}-tkinter"  # for selftest
-    - "python${pybasever}-test"  # for selftest
-    - tox  # for venv tests
-    - virtualenv  # for virtualenv tests
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
-    - binutils  # for nm (symbol inspection)
-    - rpm  # for debugging
-    - dnf  # for upgrade and downgrade
-    - perf # for test_perf_profiler
-  - name: Update packages
-    how: shell
-    script: dnf upgrade -y
-  - name: rpm_qa
-    order: 100
-    how: shell
-    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt

python3.12.spec

@@ -13,13 +13,24 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.14
+%global general_version %{pybasever}.0
-#global prerel ...
+%global prerel a2
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
 Release: 1%{?dist}
 License: Python-2.0.1
 
+# Getting this build in Koji on 32bit ARM is frustrating due to technical problems
+# https://pagure.io/releng/issue/11095
+# Fedora 37+ dropped that architecture
+# https://fedoraproject.org/wiki/Changes/RetireARMv7
+# Upstream does not support it anyway
+# https://peps.python.org/pep-0011/
+# Hence, we exclude it starting with Python 3.12
+# https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/4QWRWUYQOLCVC5D5YHXFXFOGPEIIPYSJ/
+# Once Fedora 36 goes EOL, this line can be dropped.
+ExcludeArch: %{arm}
+
 
 # ==================================
 # Conditionals controlling the build
@@ -55,74 +66,19 @@ License: Python-2.0.1
 #
 # Procedure: https://fedoraproject.org/wiki/SIGs/Python/UpgradingPython
 #
-#   IMPORTANT: When bootstrapping, it's very likely python-pip-wheel is
+#   IMPORTANT: When bootstrapping, it's very likely the wheels for pip and
-#   not available. Turn off the rpmwheels bcond until
+#   setuptools are not available. Turn off the rpmwheels bcond until
-#   python-pip is built with a wheel to get around the issue.
+#   the two packages are built with wheels to get around the issue.
 %bcond_with bootstrap
 
-# Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages
+# Whether to use RPM build wheels from the python-{pip,setuptools}-wheel package
 # Uses upstream bundled prebuilt wheels otherwise
-# Only F39+ has a pip new enough to work with Python 3.12
-%if 0%{?fedora} >= 39 || 0%{?rhel} >= 10
-%bcond_without rpmwheels
-%else
 %bcond_with rpmwheels
-%endif
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 25.0.1
+%global pip_version 22.3.1
-%global setuptools_version 79.0.1
+%global setuptools_version 65.5.0
-%global wheel_version 0.40.0
-# All of those also include a list of indirect bundled libs:
-# pip
-#  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
-%global pip_bundled_provides %{expand:
-Provides: bundled(python3dist(cachecontrol)) = 0.14.1
-Provides: bundled(python3dist(certifi)) = 2024.8.30
-Provides: bundled(python3dist(distlib)) = 0.3.9
-Provides: bundled(python3dist(distro)) = 1.9
-Provides: bundled(python3dist(idna)) = 3.10
-Provides: bundled(python3dist(msgpack)) = 1.1
-Provides: bundled(python3dist(packaging)) = 24.2
-Provides: bundled(python3dist(platformdirs)) = 4.3.6
-Provides: bundled(python3dist(pygments)) = 2.18
-Provides: bundled(python3dist(pyproject-hooks)) = 1.2
-Provides: bundled(python3dist(requests)) = 2.32.3
-Provides: bundled(python3dist(resolvelib)) = 1.0.1
-Provides: bundled(python3dist(rich)) = 13.9.4
-Provides: bundled(python3dist(setuptools)) = 70.3
-Provides: bundled(python3dist(tomli)) = 2.2.1
-Provides: bundled(python3dist(truststore)) = 0.10
-Provides: bundled(python3dist(typing-extensions)) = 4.12.2
-Provides: bundled(python3dist(urllib3)) = 1.26.20
-}
-# setuptools
-# vendor.txt not in .whl
-# %%{_rpmconfigdir}/pythonbundles.py <(unzip -l Lib/test/wheeldata/setuptools-*.whl | grep -E '_vendor/.+dist-info/RECORD' | sed -E 's@^.*/([^-]+)-([^-]+)\.dist-info/.*$@\1==\2@')
-%global setuptools_bundled_provides %{expand:
-Provides: bundled(python3dist(autocommand)) = 2.2.2
-Provides: bundled(python3dist(backports-tarfile)) = 1.2
-Provides: bundled(python3dist(importlib-metadata)) = 8
-Provides: bundled(python3dist(inflect)) = 7.3.1
-Provides: bundled(python3dist(jaraco-collections)) = 5.1
-Provides: bundled(python3dist(jaraco-context)) = 5.3
-Provides: bundled(python3dist(jaraco-functools)) = 4.0.1
-Provides: bundled(python3dist(jaraco-text)) = 3.12.1
-Provides: bundled(python3dist(more-itertools)) = 10.3
-Provides: bundled(python3dist(packaging)) = 24.2
-Provides: bundled(python3dist(platformdirs)) = 4.2.2
-Provides: bundled(python3dist(tomli)) = 2.0.1
-Provides: bundled(python3dist(typeguard)) = 4.3
-Provides: bundled(python3dist(typing-extensions)) = 4.12.2
-Provides: bundled(python3dist(wheel)) = 0.45.1
-Provides: bundled(python3dist(zipp)) = 3.19.2
-}
-# wheel
-#  $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheeldata/wheel-*.whl wheel/vendored/vendor.txt)
-%global wheel_bundled_provides %{expand:
-Provides: bundled(python3dist(packaging)) = 23
-}
 
 # Expensive optimizations (mainly, profile-guided optimizations)
 %bcond_without optimizations
@@ -253,20 +209,18 @@ BuildRequires: glibc-devel
 BuildRequires: gmp-devel
 BuildRequires: gnupg2
 BuildRequires: libappstream-glib
-%if %{undefined rhel}
 BuildRequires: libb2-devel
-%endif
 BuildRequires: libffi-devel
 BuildRequires: libnsl2-devel
 BuildRequires: libtirpc-devel
 BuildRequires: libGL-devel
 BuildRequires: libuuid-devel
-BuildRequires: libxcrypt-devel
 BuildRequires: libX11-devel
 BuildRequires: make
 BuildRequires: mpdecimal-devel
 BuildRequires: ncurses-devel
 
+BuildRequires: openssl-devel
 BuildRequires: pkgconfig
 BuildRequires: python-rpm-macros
 BuildRequires: readline-devel
@@ -275,20 +229,11 @@ BuildRequires: sqlite-devel
 BuildRequires: gdb
 
 BuildRequires: tar
-BuildRequires: tcl-devel < 1:9
+BuildRequires: tcl-devel
 BuildRequires: tix-devel
-BuildRequires: tk-devel < 1:9
+BuildRequires: tk-devel
 BuildRequires: tzdata
 
-# Support for OpenSSL 4 only landed in Python 3.15 for now
-# https://github.com/python/cpython/issues/146207
-BuildRequires: (openssl-devel < 1:4 or openssl3-devel)
-
-# Perf support is only available on x86_64 and aarch64 right now
-%ifarch x86_64 aarch64
-BuildRequires: perf
-%endif
-
 %if %{with valgrind}
 BuildRequires: valgrind-devel
 %endif
@@ -296,20 +241,16 @@ BuildRequires: valgrind-devel
 BuildRequires: xz-devel
 BuildRequires: zlib-devel
 
-BuildRequires: systemtap-sdt-devel
 BuildRequires: /usr/bin/dtrace
 
 # workaround http://bugs.python.org/issue19804 (test_uuid requires ifconfig)
 BuildRequires: /usr/sbin/ifconfig
 
 %if %{with rpmwheels}
-# Python 3.12 removed the deprecated imp module,
+# Newer versions in Fedora 37 support Python 3.12
-# the first compatible version of pip is 23.1.2.
+# Versions in Fedora 36 were patched to add the support, in the versions listed bellow
-BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
+BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel >= 59.6.0-3
-%if %{with tests}
+BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel >= 21.3.1-4
-BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel
-BuildRequires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_prefix}-setuptools-wheel < 71)
-%endif
 %endif
 
 %if %{without bootstrap}
@@ -318,9 +259,6 @@ BuildRequires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_pre
 # upgrading the main python3 to a new Python version, this would pull in the
 # old version instead.
 BuildRequires: python%{pybasever}
-%endif
-
-%if %{without bootstrap} || %{without main_python}
 # for proper automatic provides
 BuildRequires: python3-rpm-generators
 %endif
@@ -347,7 +285,7 @@ Source11: idle3.appdata.xml
 
 # (Patches taken from github.com/fedora-python/cpython)
 
-# 00251 # 6a4ec74157aa01f1ada9f29f30a371cd9e5369e8
+# 00251 # cae5a6abc5df08239c85b83e4e250b6f2702e4f5
 # Change user install location
 #
 # Set values of base and platbase in sysconfig from /usr
@@ -364,7 +302,21 @@ Source11: idle3.appdata.xml
 # pypa/distutils integration: https://github.com/pypa/distutils/pull/70
 Patch251: 00251-change-user-install-location.patch
 
-# 00371 # 0e580d52dd79a1973e9b363ad7487e7b9334f2a2
+# 00328 # 318e500c98f5e59eb1f23e0fcd32db69b9bd17e1
+# Restore pyc to TIMESTAMP invalidation mode as default in rpmbuild
+#
+# Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
+# %%changelog date. This makes Python default to the CHECKED_HASH pyc
+# invalidation mode, bringing more reproducible builds traded for an import
+# performance decrease. To avoid that, we don't default to CHECKED_HASH
+# when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
+#
+# See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
+# Downstream only: only used when building RPM packages
+# Ideally, we should talk to upstream and explain why we don't want this
+Patch328: 00328-pyc-timestamp-invalidation-mode.patch
+
+# 00371 # 1fc313929648e9b543542de09f59c55e175ac45a
 # Revert "bpo-1596321: Fix threading._shutdown() for the main thread (GH-28549) (GH-28589)"
 #
 # This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
@@ -375,53 +327,6 @@ Patch251: 00251-change-user-install-location.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 
-# 00460 # 1da89114f7ee7e7f392128a9861d9c2b41c0ddeb
-# gh-132415: Update vendored setuptools in ``Lib/test/wheeldata``
-#
-# (actual changes in .whl files removed to make this patch smaller)
-#
-# gh-127906: Add missing sys import to test_cppext
-Patch460: 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch
-
-# 00461 # f7bc103c7bcc6e48789b225e06daf835793e1086
-# Downstream only: Install wheel in test venvs when setuptools < 71
-Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch
-
-# 00462 # 5324dc5f57e0068f7e4f7b2f20006e88ff5f4e47
-# Fix PySSL_SetError handling SSL_ERROR_SYSCALL
-#
-# Python 3.10 changed from using SSL_write() and SSL_read() to SSL_write_ex() and
-# SSL_read_ex(), but did not update handling of the return value.
-#
-# Change error handling so that the return value is not examined.
-# OSError (not EOF) is now returned when retval is 0.
-#
-# This resolves the issue of failing tests when a system is
-# stressed on OpenSSL 3.5.
-Patch462: 00462-fix-pyssl_seterror-handling-ssl_error_syscall.patch
-
-# 00474 # 837ddca0372fa87ff9cee47142200caa21e77def
-# CVE-2025-15366
-#
-# gh-143921: Reject control characters in IMAP commands
-#
-# (cherry-picked from commit 6262704b134db2a4ba12e85ecfbd968534f28b45)
-Patch474: 00474-cve-2025-15366.patch
-
-# 00475 # 3748209a316662d4e85981ca1a7418547a1d25c6
-# CVE-2025-15367
-#
-# gh-143923: Reject control characters in POP3 commands
-#
-# (cherry-picked from commit b234a2b67539f787e191d2ef19a7cbdce32874e7)
-Patch475: 00475-cve-2025-15367.patch
-
-# 00494 # 430aab133397ed44cc9ee621fd311e02fee317b5
-# Increase the timeout of test_large_content_length_truncated
-#
-# It has started to fail randomly when run on s390x architecture.
-Patch494: 00494-increase-the-timeout-of-test_large_content_length_truncated.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -543,22 +448,59 @@ This package contains /usr/bin/python - the "python" command that runs Python 3.
 Summary:        Python runtime libraries
 
 %if %{with rpmwheels}
-Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
+Requires: %{python_wheel_pkg_prefix}-setuptools-wheel >= 59.6.0-3
-# Bundled libb2 is CC0, covered by grandfathering exception
+Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 21.3.1-4
-License: Python-2.0.1 AND CC0-1.0
 %else
+# Versions of bundled libs are based on:
+# https://github.com/pypa/pip/blob/22.3.1/src/pip/_vendor/vendor.txt
+# https://github.com/pypa/setuptools/blob/v65.5.0/pkg_resources/_vendor/vendored.txt
+# https://github.com/pypa/setuptools/blob/v65.5.0/setuptools/_vendor/vendored.txt
 Provides: bundled(python3dist(pip)) = %{pip_version}
-%pip_bundled_provides
+Provides: bundled(python3dist(cachecontrol)) = 0.12.11
-# License manually combined form Python + pip
+Provides: bundled(python3dist(certifi)) = 2022.9.24
-License: Python-2.0.1 AND CC0-1.0 AND MIT AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
+Provides: bundled(python3dist(chardet)) = 5
+Provides: bundled(python3dist(colorama)) = 0.4.5
+Provides: bundled(python3dist(distlib)) = 0.3.6
+Provides: bundled(python3dist(distro)) = 1.7
+Provides: bundled(python3dist(idna)) = 3.4
+Provides: bundled(python3dist(msgpack)) = 1.0.4
+Provides: bundled(python3dist(packaging)) = 21.3
+Provides: bundled(python3dist(pep517)) = 0.13
+Provides: bundled(python3dist(platformdirs)) = 2.5.2
+Provides: bundled(python3dist(pygments)) = 2.13
+Provides: bundled(python3dist(pyparsing)) = 3.0.9
+Provides: bundled(python3dist(requests)) = 2.28.1
+Provides: bundled(python3dist(resolvelib)) = 0.8.1
+Provides: bundled(python3dist(rich)) = 12.5.1
+Provides: bundled(python3dist(setuptools)) = 44
+Provides: bundled(python3dist(six)) = 1.16
+Provides: bundled(python3dist(tenacity)) = 8.1
+Provides: bundled(python3dist(tomli)) = 2.0.1
+Provides: bundled(python3dist(typing-extensions)) = 4.4
+Provides: bundled(python3dist(urllib3)) = 1.26.12
+Provides: bundled(python3dist(webencodings)) = 0.5.1
+
+Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
+Provides: bundled(python3dist(appdirs)) = 1.4.3
+Provides: bundled(python3dist(importlib-metadata)) = 4.11.1
+Provides: bundled(python3dist(importlib-resources)) = 5.4
+Provides: bundled(python3dist(jaraco-text)) = 3.7
+Provides: bundled(python3dist(more-itertools)) = 8.8
+Provides: bundled(python3dist(ordered-set)) = 3.1.1
+Provides: bundled(python3dist(packaging)) = 21.3
+Provides: bundled(python3dist(pyparsing)) = 3.0.9
+Provides: bundled(python3dist(tomli)) = 2.0.1
+Provides: bundled(python3dist(typing-extensions)) = 4.0.1
+Provides: bundled(python3dist(zipp)) = 3.7
+
+# Combined from python-setuptools-65.5.0-1.fc38 and python-pip-22.3.1-1.fc38
+# The license tag of pip is a superset of the license tag of setuptools
+# See the specs for license breakdown
+License: Python-2.0.1 AND MIT AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause) 
 %endif
 
 %unversioned_obsoletes_of_python3_X_if_main libs
 
-# Bundled internal headers are used even when building with system libb2
-# last updated by https://github.com/python/cpython/pull/6286
-Provides: bundled(libb2) = 0.98.1
-
 # There are files in the standard library that have python shebang.
 # We've filtered the automatic requirement out so libs are installable without
 # the main package. This however makes it pulled in by default.
@@ -573,26 +515,6 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa})
 # The zoneinfo module needs tzdata
 Requires: tzdata
 
-# The requirement on libexpat is generated, but we need to version it.
-# When built with a specific expat version, but installed with an older one,
-# we sometimes get:
-#   ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so:
-#   undefined symbol: XML_...
-# The pyexpat module has build-time checks for expat version to only use the
-# available symbols. However, there is no runtime protection, so when the module
-# is later installed with an older expat, it may error due to undefined symbols.
-# This breaks many things, including python -m venv.
-# We avoid this problem by requiring at least the same version of expat that
-# was used during the build time.
-# Other subpackages (like -debug) also need this, but they all depend on -libs.
-# Since expat 2.7.4, the library has versioned symbols and this is no longer needed,
-# as the generated requirement will be in the form of libexpat.so.1(LIBEXPAT_2.7.2) etc.
-%global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/')
-%if v"%{expat_version}" < v"2.7.4"
-Requires: expat%{?_isa} >= %{expat_version}
-%endif
-
-
 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
 - the majority of the Python standard library
@@ -608,11 +530,7 @@ Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 # But we want them when packages BuildRequire python3-devel
 Requires: (python-rpm-macros if rpm-build)
 Requires: (python3-rpm-macros if rpm-build)
-# We omit this dependency on RHEL to avoid pulling the macros to AppStream:
+Requires: (pyproject-rpm-macros if rpm-build)
-# RHEL users can use the minimal implementation of %%pyproject_buildrequires
-# from pyproject-srpm-macros instead.
-# On Fedora, we keep this to avoid one additional round of %%generate_buildrequires.
-%{!?rhel:Requires: (pyproject-rpm-macros if rpm-build)}
 
 %unversioned_obsoletes_of_python3_X_if_main devel
 
@@ -624,8 +542,7 @@ Recommends: %{pkgname}-pip
 # tox users are likely to need the devel subpackage
 Supplements: tox
 
-%if %{without bootstrap} || %{without main_python}
+%if %{without bootstrap}
-# Generators run on the main Python 3 so we cannot require them when bootstrapping it
 Requires: (python3-rpm-generators if rpm-build)
 %endif
 
@@ -694,18 +611,6 @@ Summary: The self-test suite for the main python3 package
 Requires: %{pkgname} = %{version}-%{release}
 Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 
-%if %{with rpmwheels}
-Requires: %{python_wheel_pkg_prefix}-setuptools-wheel
-Requires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_prefix}-setuptools-wheel < 71)
-%else
-Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
-%setuptools_bundled_provides
-Provides: bundled(python3dist(wheel)) = %{wheel_version}
-%wheel_bundled_provides
-# License manually combined from Python + setuptools + wheel
-License: Python-2.0.1 AND MIT AND Apache-2.0 AND (Apache-2.0 OR BSD-2-Clause)
-%endif
-
 %unversioned_obsoletes_of_python3_X_if_main test
 
 %description -n %{pkgname}-test
@@ -758,19 +663,9 @@ The debug runtime additionally supports debug builds of C-API extensions
 %gpgverify -k2 -s1 -d0
 %autosetup -S git_am -n Python-%{upstream_version}
 
-# Verify the second level of bundled provides is up to date
-# Arguably this should be done in %%check, but %%prep has a faster feedback loop
-# setuptools.whl does not contain the vendored.txt files
-if [ -f %{_rpmconfigdir}/pythonbundles.py ]; then
-  %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) --compare-with '%pip_bundled_provides'
-  %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheeldata/wheel-*.whl wheel/vendored/vendor.txt) --compare-with '%wheel_bundled_provides'
-  %{_rpmconfigdir}/pythonbundles.py <(unzip -l Lib/test/wheeldata/setuptools-*.whl | grep -E '_vendor/.+dist-info/RECORD' | sed -E 's@^.*/([^-]+)-([^-]+)\.dist-info/.*$@\1==\2@') --compare-with '%setuptools_bundled_provides'
-fi
-
 %if %{with rpmwheels}
 rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
-rm Lib/test/wheeldata/setuptools-%{setuptools_version}-py3-none-any.whl
+rm Lib/ensurepip/_bundled/setuptools-%{setuptools_version}-py3-none-any.whl
-rm Lib/test/wheeldata/wheel-%{wheel_version}-py3-none-any.whl
 %endif
 
 # Remove all exe files to ensure we are not shipping prebuilt binaries
@@ -827,15 +722,14 @@ topdir=$(pwd)
 # Standard library built here will still use the %%build_...flags,
 # Fedora packages utilizing %%py3_build will use them as well
 # https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
-# https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
+export CFLAGS="%{extension_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
-export CFLAGS="%{extension_cflags}"
 export CFLAGS_NODIST="%{build_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
-export CXXFLAGS="%{extension_cxxflags}"
+export CXXFLAGS="%{extension_cxxflags} -D_GNU_SOURCE -fPIC -fwrapv"
 export CPPFLAGS="$(pkg-config --cflags-only-I libffi)"
-export OPT="%{extension_cflags}"
+export OPT="%{extension_cflags} -D_GNU_SOURCE -fPIC -fwrapv"
 export LINKCC="gcc"
 export CFLAGS="$CFLAGS $(pkg-config --cflags openssl)"
-export LDFLAGS="%{extension_ldflags} $(pkg-config --libs-only-L openssl)"
+export LDFLAGS="%{extension_ldflags} -g $(pkg-config --libs-only-L openssl)"
 export LDFLAGS_NODIST="%{build_ldflags} -g $(pkg-config --libs-only-L openssl)"
 
 # We can build several different configurations of Python: regular and debug.
@@ -866,6 +760,7 @@ BuildPython() {
   --with-computed-gotos=%{computed_gotos_flag} \
   --with-dbmliborder=gdbm:ndbm:bdb \
   --with-system-expat \
+  --with-system-ffi \
   --with-system-libmpdec \
   --enable-loadable-sqlite-extensions \
   --with-dtrace \
@@ -1094,25 +989,15 @@ find . -name "*~" -exec rm -f {} \;
 # Python CMD line options:
 # -s - don't add user site directory to sys.path
 # -B - don't write .pyc files on import
-# Clamp the source mtime first, see https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes
-# The clamp_source_mtime module is only guaranteed to exist on Fedoras that enabled this option:
-%if 0%{?clamp_mtime_to_source_date_epoch}
-LD_LIBRARY_PATH="%{buildroot}%{dynload_dir}/:%{buildroot}%{_libdir}" \
-PYTHONPATH="%{_rpmconfigdir}/redhat" \
-%{buildroot}%{_bindir}/python%{pybasever} -s -B -m clamp_source_mtime %{buildroot}%{pylibdir}
-%endif
 # compileall CMD line options:
 # -f - force rebuild even if timestamps are up to date
 # -o - optimization levels to run compilation with
 # -s - part of path to left-strip from path to source file (buildroot)
 # -p - path to add as prefix to path to source file (/ to make it absolute)
 # --hardlink-dupes - hardlink different optimization level pycs together if identical (saves space)
-# --invalidation-mode - we prefer the timestamp invalidation mode for performance reasons
-# -x - skip test modules with SyntaxErrors (taken from the Makefile)
 LD_LIBRARY_PATH="%{buildroot}%{dynload_dir}/:%{buildroot}%{_libdir}" \
 %{buildroot}%{_bindir}/python%{pybasever} -s -B -m compileall \
--f %{_smp_mflags} -o 0 -o 1 -o 2 -s %{buildroot} -p / %{buildroot} --hardlink-dupes --invalidation-mode=timestamp \
+-f %{_smp_mflags} -o 0 -o 1 -o 2 -s %{buildroot} -p / %{buildroot} --hardlink-dupes || :
--x 'bad_coding|badsyntax|site-packages|test/test_lib2to3/data'
 
 # Turn this BRP off, it is done by compileall2 --hardlink-dupes above
 %global __brp_python_hardlink %{nil}
@@ -1169,11 +1054,6 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
     rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done
 
-%if %{without rpmwheels}
-# Inject SBOM into the installed wheels (if the macro is available)
-%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl}
-%endif
-
 # ======================================================
 # Checks for packaging issues
 # ======================================================
@@ -1228,20 +1108,14 @@ CheckPython() {
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.pythoninfo
 
   # Run the upstream test suite
-  # --timeout=2700: kill test running for longer than 45 minutes
+  # --timeout=1800: kill test running for longer than 30 minutes
   # test_freeze_simple_script is skipped, because it fails without bundled libs.
   #  the freeze tool is only usable from the source checkout anyway,
   #  we don't ship it in the RPM package.
-  # test_check_probes is failing since it was introduced in 3.12.0rc1,
-  # the test is skipped until it is fixed in upstream.
-  # see: https://github.com/python/cpython/issues/104280#issuecomment-1669249980
-  # test_gdb is skipped due to https://bugzilla.redhat.com/2275274#c11
 
   LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \
-    -wW --slowest %{_smp_mflags} --timeout=2700 \
+    -wW --slowest -j0 --timeout=1800 \
     -i test_freeze_simple_script \
-    -i test_check_probes \
-    -x test_gdb \
     %ifarch %{mips64}
     -x test_ctypes \
     %endif
@@ -1321,6 +1195,7 @@ CheckPython optimized
 %else
 %dir %{pylibdir}/ensurepip/_bundled
 %{pylibdir}/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
+%{pylibdir}/ensurepip/_bundled/setuptools-%{setuptools_version}-py3-none-any.whl
 %endif
 
 %dir %{pylibdir}/concurrent/
@@ -1338,8 +1213,9 @@ CheckPython optimized
 %{dynload_dir}/_blake2.%{SOABI_optimized}.so
 %{dynload_dir}/_md5.%{SOABI_optimized}.so
 %{dynload_dir}/_sha1.%{SOABI_optimized}.so
-%{dynload_dir}/_sha2.%{SOABI_optimized}.so
+%{dynload_dir}/_sha256.%{SOABI_optimized}.so
 %{dynload_dir}/_sha3.%{SOABI_optimized}.so
+%{dynload_dir}/_sha512.%{SOABI_optimized}.so
 
 %{dynload_dir}/_asyncio.%{SOABI_optimized}.so
 %{dynload_dir}/_bisect.%{SOABI_optimized}.so
@@ -1379,6 +1255,7 @@ CheckPython optimized
 %{dynload_dir}/_ssl.%{SOABI_optimized}.so
 %{dynload_dir}/_statistics.%{SOABI_optimized}.so
 %{dynload_dir}/_struct.%{SOABI_optimized}.so
+%{dynload_dir}/_typing.%{SOABI_optimized}.so
 %{dynload_dir}/array.%{SOABI_optimized}.so
 %{dynload_dir}/audioop.%{SOABI_optimized}.so
 %{dynload_dir}/binascii.%{SOABI_optimized}.so
@@ -1400,6 +1277,10 @@ CheckPython optimized
 %{dynload_dir}/termios.%{SOABI_optimized}.so
 %{dynload_dir}/unicodedata.%{SOABI_optimized}.so
 %{dynload_dir}/_uuid.%{SOABI_optimized}.so
+%{dynload_dir}/xxlimited.%{SOABI_optimized}.so
+%{dynload_dir}/xxlimited_35.%{SOABI_optimized}.so
+%{dynload_dir}/_xxsubinterpreters.%{SOABI_optimized}.so
+%{dynload_dir}/xxsubtype.%{SOABI_optimized}.so
 %{dynload_dir}/zlib.%{SOABI_optimized}.so
 %{dynload_dir}/_zoneinfo.%{SOABI_optimized}.so
 
@@ -1470,7 +1351,6 @@ CheckPython optimized
 %{pylibdir}/multiprocessing
 
 %dir %{pylibdir}/re/
-%dir %{pylibdir}/re/__pycache__/
 %{pylibdir}/re/*.py
 %{pylibdir}/re/__pycache__/*%{bytecode_suffixes}
 
@@ -1480,7 +1360,6 @@ CheckPython optimized
 %{pylibdir}/sqlite3/__pycache__/*%{bytecode_suffixes}
 
 %dir %{pylibdir}/tomllib/
-%dir %{pylibdir}/tomllib/__pycache__/
 %{pylibdir}/tomllib/*.py
 %{pylibdir}/tomllib/__pycache__/*%{bytecode_suffixes}
 %exclude %{pylibdir}/turtle.py
@@ -1488,18 +1367,13 @@ CheckPython optimized
 
 %{pylibdir}/urllib
 %{pylibdir}/xml
-
-%dir %{pylibdir}/zipfile/
-%dir %{pylibdir}/zipfile/__pycache__/
-%{pylibdir}/zipfile/*.py
-%{pylibdir}/zipfile/__pycache__/*%{bytecode_suffixes}
-%dir %{pylibdir}/zipfile/_path/
-%dir %{pylibdir}/zipfile/_path/__pycache__/
-%{pylibdir}/zipfile/_path/*.py
-%{pylibdir}/zipfile/_path/__pycache__/*%{bytecode_suffixes}
-
 %{pylibdir}/zoneinfo
 
+%dir %{pylibdir}/__phello__
+%{pylibdir}/__phello__/__init__.py
+%{pylibdir}/__phello__/spam.py
+%{pylibdir}/__phello__/__pycache__/*%{bytecode_suffixes}
+
 %if "%{_lib}" == "lib64"
 %attr(0755,root,root) %dir %{_prefix}/lib/python%{pybasever}
 %attr(0755,root,root) %dir %{_prefix}/lib/python%{pybasever}/site-packages
@@ -1527,7 +1401,7 @@ CheckPython optimized
 %{_includedir}/python%{LDVERSION_optimized}/*.h
 %{_includedir}/python%{LDVERSION_optimized}/internal/
 %{_includedir}/python%{LDVERSION_optimized}/cpython/
-%doc Misc/README.valgrind Misc/valgrind-python.supp
+%doc Misc/README.valgrind Misc/valgrind-python.supp Misc/gdbinit
 
 %if %{with main_python}
 %{_bindir}/2to3
@@ -1588,23 +1462,11 @@ CheckPython optimized
 %{dynload_dir}/_ctypes_test.%{SOABI_optimized}.so
 %{dynload_dir}/_testbuffer.%{SOABI_optimized}.so
 %{dynload_dir}/_testcapi.%{SOABI_optimized}.so
-%{dynload_dir}/_testclinic.%{SOABI_optimized}.so
 %{dynload_dir}/_testimportmultiple.%{SOABI_optimized}.so
 %{dynload_dir}/_testinternalcapi.%{SOABI_optimized}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_optimized}.so
 %{dynload_dir}/_testsinglephase.%{SOABI_optimized}.so
-%{dynload_dir}/_xxinterpchannels.%{SOABI_optimized}.so
-%{dynload_dir}/_xxsubinterpreters.%{SOABI_optimized}.so
 %{dynload_dir}/_xxtestfuzz.%{SOABI_optimized}.so
-%{dynload_dir}/xxlimited.%{SOABI_optimized}.so
-%{dynload_dir}/xxlimited_35.%{SOABI_optimized}.so
-%{dynload_dir}/xxsubtype.%{SOABI_optimized}.so
-
-%dir %{pylibdir}/__phello__/
-%dir %{pylibdir}/__phello__/__pycache__/
-%{pylibdir}/__phello__/__init__.py
-%{pylibdir}/__phello__/spam.py
-%{pylibdir}/__phello__/__pycache__/*%{bytecode_suffixes}
 
 # We don't bother splitting the debug build out into further subpackages:
 # if you need it, you're probably a developer.
@@ -1628,8 +1490,9 @@ CheckPython optimized
 %{dynload_dir}/_blake2.%{SOABI_debug}.so
 %{dynload_dir}/_md5.%{SOABI_debug}.so
 %{dynload_dir}/_sha1.%{SOABI_debug}.so
-%{dynload_dir}/_sha2.%{SOABI_debug}.so
+%{dynload_dir}/_sha256.%{SOABI_debug}.so
 %{dynload_dir}/_sha3.%{SOABI_debug}.so
+%{dynload_dir}/_sha512.%{SOABI_debug}.so
 
 %{dynload_dir}/_asyncio.%{SOABI_debug}.so
 %{dynload_dir}/_bisect.%{SOABI_debug}.so
@@ -1669,6 +1532,7 @@ CheckPython optimized
 %{dynload_dir}/_ssl.%{SOABI_debug}.so
 %{dynload_dir}/_statistics.%{SOABI_debug}.so
 %{dynload_dir}/_struct.%{SOABI_debug}.so
+%{dynload_dir}/_typing.%{SOABI_debug}.so
 %{dynload_dir}/array.%{SOABI_debug}.so
 %{dynload_dir}/audioop.%{SOABI_debug}.so
 %{dynload_dir}/binascii.%{SOABI_debug}.so
@@ -1690,6 +1554,10 @@ CheckPython optimized
 %{dynload_dir}/termios.%{SOABI_debug}.so
 %{dynload_dir}/unicodedata.%{SOABI_debug}.so
 %{dynload_dir}/_uuid.%{SOABI_debug}.so
+%{dynload_dir}/xxlimited.%{SOABI_debug}.so
+%{dynload_dir}/xxlimited_35.%{SOABI_debug}.so
+%{dynload_dir}/_xxsubinterpreters.%{SOABI_debug}.so
+%{dynload_dir}/xxsubtype.%{SOABI_debug}.so
 %{dynload_dir}/zlib.%{SOABI_debug}.so
 %{dynload_dir}/_zoneinfo.%{SOABI_debug}.so
 
@@ -1720,17 +1588,11 @@ CheckPython optimized
 %{dynload_dir}/_ctypes_test.%{SOABI_debug}.so
 %{dynload_dir}/_testbuffer.%{SOABI_debug}.so
 %{dynload_dir}/_testcapi.%{SOABI_debug}.so
-%{dynload_dir}/_testclinic.%{SOABI_debug}.so
 %{dynload_dir}/_testimportmultiple.%{SOABI_debug}.so
 %{dynload_dir}/_testinternalcapi.%{SOABI_debug}.so
 %{dynload_dir}/_testmultiphase.%{SOABI_debug}.so
 %{dynload_dir}/_testsinglephase.%{SOABI_debug}.so
-%{dynload_dir}/_xxinterpchannels.%{SOABI_debug}.so
-%{dynload_dir}/_xxsubinterpreters.%{SOABI_debug}.so
 %{dynload_dir}/_xxtestfuzz.%{SOABI_debug}.so
-%{dynload_dir}/xxlimited.%{SOABI_debug}.so
-%{dynload_dir}/xxlimited_35.%{SOABI_debug}.so
-%{dynload_dir}/xxsubtype.%{SOABI_debug}.so
 
 %{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py
 %{pylibdir}/__pycache__/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}%{bytecode_suffixes}
@@ -1758,224 +1620,6 @@ CheckPython optimized
 # ======================================================
 
 %changelog
-* Thu Aug 13 2026 Karolina Surma <ksurma@redhat.com> - 3.12.14-1
-- Update to Python 3.12.14
-
-* Tue Jul 28 2026 Lukáš Zachar <lzachar@redhat.com> - 3.12.13-6
-- Security fix for CVE-2026-15308
-Resolves: rhbz#2498688
-
-* Tue Jul 28 2026 Miro Hrončok <mhroncok@redhat.com> - 3.12.13-5
-- Skip UDP Lite tests if it's not supported
-- Fixes FTBFS on Linux kernel 7.1 and newer
-
-* Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.13-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-3
-- Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
-Resolves: rhbz#2444705, rhbz#2448189, rhbz#2448205, rhbz#2457942, rhbz#2458014, rhbz#2458222
-
-* Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.13-2
-- Security fix for CVE-2026-4519 (rhbz#2449728)
-
-* Tue Mar 03 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
-- Update to 3.12.13
-
-* Fri Feb 06 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-4
-- Security fixes for CVE-2026-0865, CVE-2025-15366 and CVE-2025-15367
-
-* Fri Jan 16 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-3
-- Security fix for CVE-2025-13836
-
-* Tue Jan 06 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-2
-- Security fix for CVE-2025-12084
-- Require at least the same expat version as used during the build time
-
-* Fri Oct 10 2025 Karolina Surma <ksurma@redhat.com> - 3.12.12-1
-- Update to 3.12.12
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.11-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Thu Jun 12 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.11-2
-- Enable PAC and BTI hardware protections for aarch64
-
-* Wed Jun 04 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
-- Update to 3.12.11
-
-* Fri May 09 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-4
-- Fix PySSL_SetError handling SSL_ERROR_SYSCALL
-- This fixes random flakiness of test_ssl on stressed machines
-
-* Tue May 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.10-3
-- Drop requirement on python-wheel-wheel with setuptools >= 71
-
-* Tue Apr 22 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-2
-- Apply Intel's CET for mitigation against control-flow hijacking attacks
-
-* Wed Apr 09 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.10-1
-- Update to 3.12.10
-
-* Mon Mar 31 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.9-3
-- Properly apply exported CFLAGS for dtrace/systemtap builds
-- Fixes: rhbz#2356301
-
-* Thu Feb 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.12.9-2
-- Rebuilt with mpdecimal 4.0.0
-
-* Tue Feb 04 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.12.9-1
-- Update to 3.12.9
-- Security fix for CVE-2025-0938
-- Fixes: rhbz#2343275
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.12.8-4
-- Add explicit BR: libxcrypt-devel
-
-* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.8-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Fri Dec 06 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-2
-- Security fix for CVE-2024-12254
-- Fixes: rhbz#2330926
-
-* Tue Dec 03 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
-- Update to 3.12.8
-- Security fix for CVE-2024-9287
-- Fixes: rhbz#2321656
-
-* Tue Oct 01 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.7-1
-- Update to 3.12.7
-
-* Mon Sep 09 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.6-1
-- Update to 3.12.6
-- Fixes: rhbz#2310090
-
-* Fri Aug 23 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.5-2
-- Security fix for CVE-2024-8088
-- Fixes: rhbz#2307461
-
-* Wed Aug 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.5-1
-- Update to 3.12.5
-- Fixes: rhbz#2303159 (email header injection)
-
-* Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.12.4-3
-- Require systemtap-sdt-devel for sys/sdt.h
-
-* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.4-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Fri Jun 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.4-1
-- Update to 3.12.4
-
-* Thu Jun 06 2024 Python Maint <python-maint@redhat.com> - 3.12.3-3
-- Build as non-main Python
-
-* Wed Apr 17 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.3-2
-- Require expat >= 2.6 to prevent errors when creating venvs with older expat
-
-* Wed Apr 10 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.3-1
-- Update to 3.12.3
-
-* Thu Mar 21 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.2-3
-- Move all test modules to the python3-test package, namely:
-   - __phello__
-   - _xxsubinterpreters
-   - xxlimited
-   - xxlimited_35
-   - xxsubtype
-
-* Wed Feb 21 2024 Miro Hrončok <mhroncok@redhat.com> - 3.12.2-2
-- Fix tests for XMLPullParser with Expat 2.6.0
-
-* Wed Feb 07 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.2-1
-- Update to 3.12.2
-
-* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.1-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.1-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Dec 18 2023 Lumír Balhar <lbalhar@redhat.com> - 3.12.1-2
-- Security fix for CVE-2023-27043 (rhbz#2196190)
-
-* Fri Dec 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.1-1
-- Update to 3.12.1
-- Own stray directories in /usr/lib64/python3.12
-- Fixes: rhbz#2252143
-
-* Thu Oct 05 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 3.12.0-2
-- Use bundled libb2 in RHEL builds
-
-* Mon Oct 02 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0-1
-- Update to 3.12.0 final
-
-* Tue Sep 19 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~rc3-1
-- Update to 3.12.0rc3
-
-* Wed Sep 06 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~rc2-1
-- Update to 3.12.0rc2
-
-* Mon Aug 07 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~rc1-1
-- Update to 3.12.0rc1
-
-* Wed Aug 02 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.12.0~b4-3
-- Remove extra distro-applied CFLAGS passed to user built C extensions
-- https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction
-
-* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0~b4-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Wed Jul 12 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~b4-1
-- Update to 3.12.0b4
-
-* Wed Jun 21 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b3-2
-- Backport upstream patch to add PyType_GetDict() function
-
-* Tue Jun 20 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b3-1
-- Update to 3.12.0b3
-
-* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.12.0~b2-3
-- Rebuilt for Python 3.12
-
-* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.12.0~b2-2
-- Bootstrap for Python 3.12
-
-* Wed Jun 07 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b2-1
-- Update to 3.12.0b2
-
-* Mon May 29 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~b1-2
-- Use wheels from RPMs, at least on Fedora 39+
-- On older Fedora releases, declare bundled() provides and a complex License tag
-
-* Tue May 23 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~b1-1
-- Update to 3.12.0b1
-
-* Wed Apr 05 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a7-1
-- Update to 3.12.0a7
-
-* Thu Mar 23 2023 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~a6-2
-- Increase the test timeout during package build
-
-* Wed Mar 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a6-1
-- Update to 3.12.0a6
-
-* Wed Feb 08 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a5-1
-- Update to 3.12.0a5
-
-* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0~a4-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Wed Jan 11 2023 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a4-1
-- Update to 3.12.0a4
-
-* Mon Dec 19 2022 Miro Hrončok <mhroncok@redhat.com> - 3.12.0~a3-2
-- No longer patch the default bytecode cache invalidation policy
-
-* Wed Dec 07 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a3-1
-- Update to 3.12.0a3
-
 * Tue Nov 15 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.0~a2-1
 - Update to 3.12.0a2
 - Fixes: rhbz#2133847

rpminspect.yaml

@@ -1,22 +1,22 @@
 # exclude test XML data (not always valid) from XML validity check:
 xml:
     ignore:
-        - '/usr/lib*/python*/test/xmltestdata/*'
+        - /usr/lib*/python*/test/xmltestdata/*
-        - '/usr/lib*/python*/test/xmltestdata/*/*'
+        - /usr/lib*/python*/test/xmltestdata/*/*
 
 # exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
 badfuncs:
     allowed:
-        '/usr/lib*/python*/lib-dynload/_socket.*':
+        /usr/lib*/python*/lib-dynload/_socket.*:
             - inet_aton
             - inet_ntoa
 
 # exclude the debug build from annocheck entirely
 annocheck:
     ignore:
-        - '/usr/bin/python*d'
+        - /usr/bin/python*d
-        - '/usr/lib*/libpython*d.so.1.0'
+        - /usr/lib*/libpython*d.so.1.0
-        - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so'
+        - /usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so
 
 # don't report changed content of compiled files
 # that is expected with every toolchain update and not reproducible yet

sources

@@ -1,2 +1,2 @@
-SHA512 (Python-3.12.14.tar.xz) = 9007399ffdd3a493c91a98cd7a6cb93acfb8de80f3be2f5480cda36f134d49b5043a60bc6b5c62ed18cc6a2e4e3c81cb7556ac5f337e2cd58ff3449a8099ed22
+SHA512 (Python-3.12.0a2.tar.xz) = 0f830fdb514078c5403727b31fd81912382eca4decb52ae9bfb0f00b8a007be9f8e29bad349034ec97e2229f60fe0baae417227413350485d747d31f4567d5c1
-SHA512 (Python-3.12.14.tar.xz.asc) = 69cc4757f5d79ea46f9b632d5b34f9f16855cb1f767f77c827ad65546ba8f77b68e75a661ebc4e4f453edd7a98a73d916491597f67d4fed9c891aa599a869324
+SHA512 (Python-3.12.0a2.tar.xz.asc) = f0c22e071c68d648c8cf2823647f0c807db41b81b94b8100b50d2049a47f19475a4323c5ac488eb5a3798f942978054f358090c1e460804232bb46093fb3fd55

tests/provision.fmf

@@ -0,0 +1,4 @@
+---
+standard-inventory-qcow2:
+  qemu:
+    m: 3G  # Amount of VM memory

tests/tests.yml

@@ -0,0 +1,56 @@
+---
+- hosts: localhost
+  tags:
+    - classic
+  tasks:
+    - dnf:
+        name: "*"
+        state: latest
+
+- hosts: localhost
+  roles:
+  - role: standard-test-basic
+    tags:
+    - classic
+    repositories:
+    - repo: "https://src.fedoraproject.org/tests/python.git"
+      dest: "python"
+    pybasever: "3.12"
+    tests:
+    - rpm_qa:
+        run: rpm -qa
+    - smoke:
+        dir: python/smoke
+        run: "VERSION={{ pybasever }} ./venv.sh"
+    - smoke_virtualenv:
+        dir: python/smoke
+        run: "VERSION={{ pybasever }} METHOD=virtualenv ./venv.sh"
+    - debugsmoke:
+        dir: python/smoke
+        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} ./venv.sh"
+    - selftest:
+        dir: python/selftest
+        run: "VERSION={{ pybasever }} X='' ./parallel.sh"
+    - debugtest:
+        dir: python/selftest
+        run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='' ./parallel.sh"
+    - debugflags:
+        dir: python/flags
+        run: "python{{ pybasever }}d ./assertflags.py -O0"
+    - marshalparser:
+        dir: python/marshalparser
+        run: "VERSION={{ pybasever }} SAMPLE=10 test_marshalparser_compatibility.sh"
+    required_packages:
+    - gcc  # for extension building in venv and selftest
+    - gcc-c++ # for test_cppext
+    - gdb  # for test_gdb
+    - "python{{ pybasever }}"  # the test subject
+    - "python{{ pybasever }}-debug"  # for leak testing
+    - "python{{ pybasever }}-devel"  # for extension building in venv and selftest
+    - "python{{ pybasever }}-tkinter"  # for selftest
+    - "python{{ pybasever }}-test"  # for selftest
+    - tox  # for venv tests
+    - virtualenv  # for virtualenv tests
+    - glibc-all-langpacks # for locale tests
+    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - rpm  # for debugging