rpms/python3.13
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update to Python 3.13.14

Browse source
This commit is contained in:
Karolina Surma 2026-06-11 16:05:46 +02:00
commit a5e28d44e7
6 changed files with 27 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

102
00464-enable-pac-and-bti-protections-for-aarch64.patch
View file

@ -1,102 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com>
Date: Tue, 3 Jun 2025 03:02:15 +0200
Subject: 00464: Enable PAC and BTI protections for aarch64
Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
The BTI flag must be applied in the assembler sources for this class
of attacks to be mitigated on newer aarch64 processors.
Upstream PR: https://github.com/python/cpython/pull/130864/files
The upstream patch is incomplete but only for the case where
frame pointers are not used on 3.13+.
Since on Fedora we always compile with frame pointers the BTI/PAC
hardware protections can be enabled without losing Perf unwinding.
---
Python/asm_trampoline.S | 4 +++
Python/asm_trampoline_aarch64.h | 50 +++++++++++++++++++++++++++++++++
2 files changed, 54 insertions(+)
create mode 100644 Python/asm_trampoline_aarch64.h
diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S
index a14e68c0e8..2513cde4e7 100644
--- a/Python/asm_trampoline.S
+++ b/Python/asm_trampoline.S
@@ -1,3 +1,5 @@
+#include "asm_trampoline_aarch64.h"
+
.text
.globl _Py_trampoline_func_start
# The following assembly is equivalent to:
@@ -21,10 +23,12 @@ _Py_trampoline_func_start:
#if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__)
// ARM64 little endian, 64bit ABI
// generate with aarch64-linux-gnu-gcc 12.1
+ SIGN_LR
stp x29, x30, [sp, -16]!
mov x29, sp
blr x3
ldp x29, x30, [sp], 16
+ VERIFY_LR
ret
#endif
#ifdef __riscv
diff --git a/Python/asm_trampoline_aarch64.h b/Python/asm_trampoline_aarch64.h
new file mode 100644
index 0000000000..4b0ec4a7dc
--- /dev/null
+++ b/Python/asm_trampoline_aarch64.h
@@ -0,0 +1,50 @@
+#ifndef ASM_TRAMPOLINE_AARCH_64_H_
+#define ASM_TRAMPOLINE_AARCH_64_H_
+
+/*
+ * References:
+ * - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros
+ * - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst
+ */
+
+#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
+ #define BTI_J hint 36 /* bti j: for jumps, IE br instructions */
+ #define BTI_C hint 34 /* bti c: for calls, IE bl instructions */
+ #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */
+#else
+ #define BTI_J
+ #define BTI_C
+ #define GNU_PROPERTY_AARCH64_BTI 0
+#endif
+
+#if defined(__ARM_FEATURE_PAC_DEFAULT)
+ #if __ARM_FEATURE_PAC_DEFAULT & 1
+ #define SIGN_LR hint 25 /* paciasp: sign with the A key */
+ #define VERIFY_LR hint 29 /* autiasp: verify with the A key */
+ #elif __ARM_FEATURE_PAC_DEFAULT & 2
+ #define SIGN_LR hint 27 /* pacibsp: sign with the b key */
+ #define VERIFY_LR hint 31 /* autibsp: verify with the b key */
+ #endif
+ #define GNU_PROPERTY_AARCH64_POINTER_AUTH 2 /* bit 1 GNU Notes is for PAC support */
+#else
+ #define SIGN_LR BTI_C
+ #define VERIFY_LR
+ #define GNU_PROPERTY_AARCH64_POINTER_AUTH 0
+#endif
+
+/* Add the BTI and PAC support to GNU Notes section */
+#if GNU_PROPERTY_AARCH64_BTI != 0 || GNU_PROPERTY_AARCH64_POINTER_AUTH != 0
+ .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */
+ .balign 8; /* align it on a byte boundry */
+ .long 4; /* size of "GNU\0" */
+ .long 0x10; /* size of descriptor */
+ .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */
+ .asciz "GNU";
+ .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
+ .long 4; /* Four bytes of data */
+ .long (GNU_PROPERTY_AARCH64_BTI|GNU_PROPERTY_AARCH64_POINTER_AUTH); /* BTI or PAC is enabled */
+ .long 0; /* padding for 8 byte alignment */
+ .popsection; /* end the section */
+#endif
+
+#endif

10
00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch
View file

@ -15,10 +15,10 @@ which is tested as working.
3 files changed, 10 insertions(+)
diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
index 2309353503..fca62245d4 100644
index ebd8c955dc..678815596b 100644
--- a/Lib/test/test_pyexpat.py
+++ b/Lib/test/test_pyexpat.py
@@ -901,6 +901,8 @@ def start_element(name, _):
@@ -1013,6 +1013,8 @@ def start_element(name, _):
self.assertEqual(started, ['doc'])
@ -41,10 +41,10 @@ index 9b3014a94a..90401e0d8f 100644
result = BytesIO()
xmlgen = XMLGenerator(result)
diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
index 597ec83061..bf2db1779c 100644
index c306b7d036..476e6f7956 100644
--- a/Lib/test/test_xml_etree.py
+++ b/Lib/test/test_xml_etree.py
@@ -1574,9 +1574,13 @@ def test_simple_xml(self, chunk_size=None, flush=False):
@@ -1599,9 +1599,13 @@ def test_simple_xml(self, chunk_size=None, flush=False):
self.assert_event_tags(parser, [('end', 'root')])
self.assertIsNone(parser.close())
@ -58,7 +58,7 @@ index 597ec83061..bf2db1779c 100644
def test_simple_xml_chunk_5(self):
self.test_simple_xml(chunk_size=5, flush=True)
@@ -1803,6 +1807,8 @@ def test_flush_reparse_deferral_enabled(self):
@@ -1828,6 +1832,8 @@ def test_flush_reparse_deferral_enabled(self):
self.assert_event_tags(parser, [('end', 'doc')])

6
00474-cve-2025-15366.patch
View file

@ -12,7 +12,7 @@ Reject control characters in IMAP commands
create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
diff --git a/Lib/imaplib.py b/Lib/imaplib.py
index 141e639894..f282e5c061 100644
index db16f3c802..e7fc0b55fd 100644
--- a/Lib/imaplib.py
+++ b/Lib/imaplib.py
@@ -132,7 +132,7 @@
@ -34,10 +34,10 @@ index 141e639894..f282e5c061 100644
literal = self.literal
diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py
index 9f1f682d02..820c2a5db5 100644
index 6573b4e7f3..bc01ce9f13 100644
--- a/Lib/test/test_imaplib.py
+++ b/Lib/test/test_imaplib.py
@@ -515,6 +515,12 @@ def test_login(self):
@@ -525,6 +525,12 @@ def test_login(self):
self.assertEqual(data[0], b'LOGIN completed')
self.assertEqual(client.state, 'AUTH')

14
00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch
View file

@ -81,7 +81,7 @@ index 2a17c891dd..64017c666c 100644
}
#endif
diff --git a/Makefile.pre.in b/Makefile.pre.in
index ecf77bdc41..91bfd06a78 100644
index 8589a28b72..9aaeb5e5b4 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
@@ -3153,3 +3153,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h
@ -92,10 +92,10 @@ index ecf77bdc41..91bfd06a78 100644
+# Fedora-specific, downstream only
+PY_STDMODULE_CFLAGS += -D_PyHack_check_version_on_modinit=1
diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c
index 0200f59020..bb647555c0 100644
index e6b5271357..e536ab51af 100644
--- a/Modules/_cursesmodule.c
+++ b/Modules/_cursesmodule.c
@@ -4763,6 +4763,12 @@ curses_destructor(PyObject *op)
@@ -4783,6 +4783,12 @@ curses_destructor(PyObject *op)
PyMODINIT_FUNC
PyInit__curses(void)
{
@ -109,10 +109,10 @@ index 0200f59020..bb647555c0 100644
/* Initialize object type */
diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c
index 14efe18db5..70597c2815 100644
index de93994aa0..10f95215bd 100644
--- a/Modules/_tkinter.c
+++ b/Modules/_tkinter.c
@@ -3431,6 +3431,12 @@ static struct PyModuleDef _tkintermodule = {
@@ -3432,6 +3432,12 @@ static struct PyModuleDef _tkintermodule = {
PyMODINIT_FUNC
PyInit__tkinter(void)
{
@ -143,10 +143,10 @@ index 0b85187e5f..87f358ed07 100644
m = PyModule_Create(&module_def);
if (m == NULL)
diff --git a/Modules/readline.c b/Modules/readline.c
index f9362c312d..66f1ec65a6 100644
index 7a612deae4..8b2f47eec1 100644
--- a/Modules/readline.c
+++ b/Modules/readline.c
@@ -1540,6 +1540,12 @@ static struct PyModuleDef readlinemodule = {
@@ -1548,6 +1548,12 @@ static struct PyModuleDef readlinemodule = {
PyMODINIT_FUNC
PyInit_readline(void)
{

35
python3.13.spec
View file

@ -45,7 +45,7 @@ URL: https://www.python.org/
# WARNING When rebasing to a new Python version,
# remember to update the python3-docs package as well
%global general_version %{pybasever}.13
%global general_version %{pybasever}.14
#global prerel ...
%global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}}
@ -109,31 +109,30 @@ License: Python-2.0.1
# This needs to be manually updated when we update Python.
# Explore the sources tarball (you need the version before %%prep is executed):
# $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl
%global pip_version 26.0.1
%global pip_version 26.1.2
%global setuptools_version 79.0.1
# All of those also include a list of indirect bundled libs:
# pip
# $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt)
%global pip_bundled_provides %{expand:
Provides: bundled(python3dist(cachecontrol)) = 0.14.4
Provides: bundled(python3dist(certifi)) = 2026.1.4
Provides: bundled(python3dist(dependency-groups)) = 1.3.1
Provides: bundled(python3dist(certifi)) = 2026.2.25
Provides: bundled(python3dist(distlib)) = 0.4
Provides: bundled(python3dist(distro)) = 1.9
Provides: bundled(python3dist(idna)) = 3.11
Provides: bundled(python3dist(msgpack)) = 1.1.2
Provides: bundled(python3dist(packaging)) = 26
Provides: bundled(python3dist(packaging)) = 26.2
Provides: bundled(python3dist(platformdirs)) = 4.5.1
Provides: bundled(python3dist(pygments)) = 2.19.2
Provides: bundled(python3dist(pyproject-hooks)) = 1.2
Provides: bundled(python3dist(requests)) = 2.32.5
Provides: bundled(python3dist(requests)) = 2.33.1
Provides: bundled(python3dist(resolvelib)) = 1.2.1
Provides: bundled(python3dist(rich)) = 14.2
Provides: bundled(python3dist(setuptools)) = 70.3
Provides: bundled(python3dist(tomli)) = 2.3
Provides: bundled(python3dist(tomli)) = 2.3.1
Provides: bundled(python3dist(tomli-w)) = 1.2
Provides: bundled(python3dist(truststore)) = 0.10.4
Provides: bundled(python3dist(urllib3)) = 1.26.20
Provides: bundled(python3dist(urllib3)) = 2.6.3
}
# setuptools
# vendor.txt not in .whl
@ -371,23 +370,6 @@ Source11: idle3.appdata.xml
# pypa/distutils integration: https://github.com/pypa/distutils/pull/70
Patch251: 00251-change-user-install-location.patch
# 00464 # 292acffec7a379cb6d1f3c47b9e5a2f170bbadb6
# Enable PAC and BTI protections for aarch64
#
# Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
#
# The BTI flag must be applied in the assembler sources for this class
# of attacks to be mitigated on newer aarch64 processors.
#
# Upstream PR: https://github.com/python/cpython/pull/130864/files
#
# The upstream patch is incomplete but only for the case where
# frame pointers are not used on 3.13+.
#
# Since on Fedora we always compile with frame pointers the BTI/PAC
# hardware protections can be enabled without losing Perf unwinding.
Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
# 00466 # e10760fb955ee33d2917f8a57bb4e24d71e5341c
# Downstream only: Skip tests not working with older expat version
#
@ -1829,6 +1811,9 @@ CheckPython freethreading
# ======================================================
%changelog
* Thu Jun 11 2026 Karolina Surma <ksurma@redhat.com> - 3.13.14-1
- Update to Python 3.13.14
* Wed Apr 08 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.13.13-1
- Update to 3.13.13

4
sources
View file

@ -1,2 +1,2 @@
SHA512 (Python-3.13.13.tar.xz) = 0ef615150a52865fe7ca0d0e106cf98488f113a56e5ae1b1437673f03880423839d04abe1999006f9835c77d8802d5ae94a1bdf63d18074a9a19c81e6f7b69e8
SHA512 (Python-3.13.13.tar.xz.asc) = 21e5235cd9a9df3546370feb55ac32539e08601b79ee7b1e39006028f192be6be0434f2f8384fdcc993b70bde7471be3b36ce9850abf0473d1fe2c7cdc98304b
SHA512 (Python-3.13.14.tar.xz) = 0790da65f8ce88a13b06d3b287ace5a1f36b0a8f630a3af00fbbdf93b6ef0944dea05173a20c9e1336d280ef9a97ae2b95a44a4b487a7bbb71fda53b6331c0eb
SHA512 (Python-3.13.14.tar.xz.asc) = a5cfab862ac03447838d13c4d1a9b085a8c8a947c958fd42cecb42929817b1448c1b23a124c87456abd43a1cadfcfb427f394eead9eaf0b84f3296fa263dba6c