From a8ce422a93903af0224b0a222da98b7c77d3185f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 14 Oct 2024 12:00:50 +0200 Subject: [PATCH 01/60] CI: Explicitly lists flags to be checked for -O3/-O0 Not listing the flags skips the ones without -O. This way, we no longer assert -O3/-O2 is the only -O flag, but we also assert it is actually set. --- tests/tests.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/tests.yml b/tests/tests.yml index fb2659f..8a4ba6b 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -36,16 +36,16 @@ run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='-i test_check_probes' ./parallel.sh" - optimizedflags: dir: python/flags - run: "python{{ pybasever }} ./assertflags.py -O3" + run: "python{{ pybasever }} ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" - debugflags: dir: python/flags - run: "python{{ pybasever }}d ./assertflags.py -O0" + run: "python{{ pybasever }}d ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" - freethreadingflags: dir: python/flags - run: "python{{ pybasever }}t ./assertflags.py -O3" + run: "python{{ pybasever }}t ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" - freethreadingdebugflags: dir: python/flags - run: "python{{ pybasever }}td ./assertflags.py -O0" + run: "python{{ pybasever }}td ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" - marshalparser: dir: python/marshalparser run: "VERSION={{ pybasever }} SAMPLE=10 test_marshalparser_compatibility.sh" From 7fc2da03e52a52e09d2ca4aa52f2748f88e55ff7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 15 Oct 2024 18:16:01 +0200 Subject: [PATCH 02/60] Use new-style RPM bconds --- python3.13.spec | 45 +++++++++++++++------------------------------ 1 file changed, 15 insertions(+), 30 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index ca07111..cd7a33c 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -25,27 +25,16 @@ License: Python-2.0.1 # Conditionals controlling the build # ================================== -# Note that the bcond macros are named for the CLI option they create. -# "%%bcond_without" means "ENABLE by default and create a --without option" - # Main Python, i.e. whether this is the main Python version in the distribution # that owns /usr/bin/python3 and other unique paths # This also means the built subpackages are called python3 rather than python3X # By default, this is determined by the %%__default_python3_pkgversion value -%if "%{?__default_python3_pkgversion}" == "%{pybasever}" -%bcond_without main_python -%else -%bcond_with main_python -%endif +%bcond main_python %["%{?__default_python3_pkgversion}" == "%{pybasever}"] # If this is *not* Main Python, should it contain `Provides: python(abi) ...`? # In Fedora no package shall depend on an alternative Python via this tag, so we do not provide it. # In ELN/RHEL/CentOS we want to allow building against alternative stacks, so the Provide is enabled. -%if 0%{?fedora} -%bcond_with python_abi_provides_for_alt_pythons -%else -%bcond_without python_abi_provides_for_alt_pythons -%endif +%bcond python_abi_provides_for_alt_pythons %{undefined fedora} # When bootstrapping python3, we need to build python3-packaging. # but packaging BR python3-devel and that brings in python3-rpm-generators; @@ -58,11 +47,11 @@ License: Python-2.0.1 # IMPORTANT: When bootstrapping, it's very likely python-pip-wheel is # not available. Turn off the rpmwheels bcond until # python-pip is built with a wheel to get around the issue. -%bcond_with bootstrap +%bcond bootstrap 0 # Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages # Uses upstream bundled prebuilt wheels otherwise -%bcond_without rpmwheels +%bcond rpmwheels 1 # If the rpmwheels condition is disabled, we use the bundled wheel packages # from Python with the versions below. # This needs to be manually updated when we update Python. @@ -119,49 +108,45 @@ Provides: bundled(python3dist(packaging)) = 24 } # Expensive optimizations (mainly, profile-guided optimizations) -%bcond_without optimizations +%bcond optimizations 1 # Run the test suite in %%check -%bcond_without tests +%bcond tests 1 # Extra build for debugging the interpreter or C-API extensions # (the -debug subpackages) -%bcond_without debug_build +%bcond debug_build 1 # Extra build without GIL, the freethreading PEP 703 provisional way # (the -freethreading subpackage) -%bcond_without freethreading_build +%bcond freethreading_build 1 # PEP 744: JIT Compilation # Whether to build with the experimental JIT compiler # We can only have this on Fedora 40+, where clang 18+ is available # And only on certain architectures: https://peps.python.org/pep-0744/#support # The freethreading build (when enabled) does not support JIT yet -%bcond_with jit -%ifarch x86_64 aarch64 -%if 0%{?fedora} >= 40 || 0%{?rhel} >= 10 -%bcond_without jit -%endif -%endif +%bcond jit %[(0%{?fedora} >= 40 || 0%{?rhel} >= 10) && ("%{_arch}" == "x86_64" || "%{_arch}" == "aarch64")] %if %{with jit} # When built with JIT, it still needs to be enabled on runtime via PYTHON_JIT=1 %global jit_flag --enable-experimental-jit=yes-off %endif # Support for the GDB debugger -%bcond_without gdb_hooks +%bcond gdb_hooks 1 # The dbm.gnu module (key-value database) -%bcond_without gdbm +%bcond gdbm 1 # Main interpreter loop optimization -%bcond_without computed_gotos +%bcond computed_gotos 1 # Support for the Valgrind debugger/profiler +# (no way to use %%ifarch as an expression) %ifarch %{valgrind_arches} -%bcond_without valgrind +%bcond valgrind 1 %else -%bcond_with valgrind +%bcond valgrind 0 %endif # ===================== From 90ea69d66a261165ec6bbb911bb3c20970923e8e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 15 Oct 2024 18:18:17 +0200 Subject: [PATCH 03/60] Remove rarely used bconds I have not used those in ~12 years. --- python3.13.spec | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index cd7a33c..c9ff579 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -132,12 +132,6 @@ Provides: bundled(python3dist(packaging)) = 24 %global jit_flag --enable-experimental-jit=yes-off %endif -# Support for the GDB debugger -%bcond gdb_hooks 1 - -# The dbm.gnu module (key-value database) -%bcond gdbm 1 - # Main interpreter loop optimization %bcond computed_gotos 1 @@ -262,6 +256,7 @@ BuildRequires: bzip2-devel BuildRequires: expat-devel >= 2.6 BuildRequires: findutils BuildRequires: gcc +BuildRequires: gdbm-devel BuildRequires: git-core BuildRequires: glibc-devel BuildRequires: gnupg2 @@ -304,10 +299,6 @@ BuildRequires: llvm(major) = 18 BuildRequires: valgrind-devel %endif -%if %{with gdbm} -BuildRequires: gdbm-devel -%endif - %if %{with main_python} BuildRequires: desktop-file-utils BuildRequires: libappstream-glib @@ -962,10 +953,8 @@ topdir=$(pwd) # See https://fedoraproject.org/wiki/Features/EasierPythonDebugging for more # information -%if %{with gdb_hooks} DirHoldingGdbPy=%{_usr}/lib/debug/%{_libdir} mkdir -p %{buildroot}$DirHoldingGdbPy -%endif # with gdb_hooks # When the actual %%{dynload_dir} exists (it does when python3.X is installed for regen-all) # %%{buildroot}%%{dynload_dir} is not created by make install and the extension modules are missing @@ -1002,11 +991,9 @@ InstallPython() { popd -%if %{with gdb_hooks} # See comment on $DirHoldingGdbPy above PathOfGdbPy=$DirHoldingGdbPy/$PyInstSoName-%{version}-%{release}.%{_arch}.debug-gdb.py cp Tools/gdb/libpython.py %{buildroot}$PathOfGdbPy -%endif # with gdb_hooks # Rename the -devel script that differs on different arches to arch specific name mv %{buildroot}%{_bindir}/python${LDVersion}-{,`uname -m`-}config @@ -1113,7 +1100,7 @@ LD_LIBRARY_PATH=./build/optimized ./build/optimized/python \ -i "%{_bindir}/python%{pybasever}" -pn \ %{buildroot} \ %{buildroot}%{_bindir}/*%{pybasever}.py \ - %{?with_gdb_hooks:%{buildroot}$DirHoldingGdbPy/*.py} + %{buildroot}$DirHoldingGdbPy/*.py # Remove shebang lines from .py files that aren't executable, and # remove executability from .py files that don't have a shebang line: @@ -1423,9 +1410,7 @@ CheckPython freethreading %{1}/_curses_panel.%{2}.so\ %{1}/_datetime.%{2}.so\ %{1}/_dbm.%{2}.so\ -%if %{with gdbm}\ %{1}/_gdbm.%{2}.so\ -%endif\ %{1}/_decimal.%{2}.so\ %{1}/_elementtree.%{2}.so\ %{1}/_hashlib.%{2}.so\ From 461d9adf9eaa7713ecdca3fef949d4f01ba1563a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 15 Oct 2024 18:19:14 +0200 Subject: [PATCH 04/60] Turn valgrind bcond into in-place %ifarch There's no way to turn this bcond off on arches where it is not supported. There's no need to turn this bcond on on arches where it is supported. --- python3.13.spec | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index c9ff579..4cf7517 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -135,14 +135,6 @@ Provides: bundled(python3dist(packaging)) = 24 # Main interpreter loop optimization %bcond computed_gotos 1 -# Support for the Valgrind debugger/profiler -# (no way to use %%ifarch as an expression) -%ifarch %{valgrind_arches} -%bcond valgrind 1 -%else -%bcond valgrind 0 -%endif - # ===================== # General global macros # ===================== @@ -295,7 +287,7 @@ BuildRequires: clang(major) = 18 BuildRequires: llvm(major) = 18 %endif -%if %{with valgrind} +%ifarch %{valgrind_arches} BuildRequires: valgrind-devel %endif @@ -877,7 +869,7 @@ BuildPython() { %if %{with rpmwheels} --with-wheel-pkg-dir=%{python_wheel_dir} \ %endif -%if %{with valgrind} +%ifarch %{valgrind_arches} --with-valgrind \ %endif $ExtraConfigArgs \ From a5d0a1835edcf93e874638c799bbd995e44170f6 Mon Sep 17 00:00:00 2001 From: U2FsdGVkX1 Date: Wed, 13 Nov 2024 20:17:42 +0800 Subject: [PATCH 05/60] Increase the timeout for riscv64 because the current RISC-V CPU has slower performance. --- python3.13.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index 4cf7517..bee5a28 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -1255,7 +1255,12 @@ CheckPython() { # freethreading{,-debug} build, skipping it to shorten the build time # see: https://github.com/python/cpython/issues/121719 LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \ - -wW --slowest %{_smp_mflags} --timeout=2700 \ + -wW --slowest %{_smp_mflags} \ + %ifarch riscv64 + --timeout=8100 \ + %else + --timeout=2700 \ + %endif -i test_freeze_simple_script \ -i test_check_probes \ %ifarch %{mips64} From ae3b33f26602842b13f4410f72996e1eb11d48d4 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Wed, 4 Dec 2024 00:29:07 +0100 Subject: [PATCH 06/60] Update to 3.13.1 Security fix for CVE-2024-9287 Fixes: rhbz#2321657 --- 00251-change-user-install-location.patch | 16 ++++++++-------- python3.13.spec | 19 ++++++++++++------- sources | 4 ++-- 3 files changed, 22 insertions(+), 17 deletions(-) diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch index df3baea..8025f83 100644 --- a/00251-change-user-install-location.patch +++ b/00251-change-user-install-location.patch @@ -30,7 +30,7 @@ Co-authored-by: Lumír Balhar 3 files changed, 72 insertions(+), 4 deletions(-) diff --git a/Lib/site.py b/Lib/site.py -index 0a0dc47b17..bb42e1cf5a 100644 +index 89a81c55cb..950e2e337f 100644 --- a/Lib/site.py +++ b/Lib/site.py @@ -414,8 +414,15 @@ def getsitepackages(prefixes=None): @@ -51,7 +51,7 @@ index 0a0dc47b17..bb42e1cf5a 100644 if os.path.isdir(sitedir): addsitedir(sitedir, known_paths) diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py -index 80aef34471..4e4ea6aeea 100644 +index ec3b638f00..28ad8a2321 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py @@ -106,6 +106,12 @@ @@ -87,7 +87,7 @@ index 80aef34471..4e4ea6aeea 100644 _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include', 'scripts', 'data') -@@ -261,11 +280,40 @@ def _extend_dict(target_dict, other_dict): +@@ -259,11 +278,40 @@ def _extend_dict(target_dict, other_dict): target_dict[key] = value @@ -120,7 +120,7 @@ index 80aef34471..4e4ea6aeea 100644 + # we only change the defaults here, so explicit --prefix will take precedence + # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe + if (scheme == 'posix_prefix' and -+ _PREFIX == '/usr' and ++ get_config_vars('prefix')[0] == '/usr' and + 'RPM_BUILD_ROOT' not in os.environ): + _extend_dict(vars, _config_vars_local()) + else: @@ -130,10 +130,10 @@ index 80aef34471..4e4ea6aeea 100644 # On Windows we want to substitute 'lib' for schemes rather # than the native value (without modifying vars, in case it diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py -index 1ade49281b..e21ca34733 100644 +index bf53413021..33fa2feb28 100644 --- a/Lib/test/test_sysconfig.py +++ b/Lib/test/test_sysconfig.py -@@ -121,8 +121,19 @@ def test_get_path(self): +@@ -130,8 +130,19 @@ def test_get_path(self): for scheme in _INSTALL_SCHEMES: for name in _INSTALL_SCHEMES[scheme]: expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars) @@ -154,7 +154,7 @@ index 1ade49281b..e21ca34733 100644 os.path.normpath(expected), ) -@@ -377,7 +388,7 @@ def test_get_config_h_filename(self): +@@ -386,7 +397,7 @@ def test_get_config_h_filename(self): self.assertTrue(os.path.isfile(config_h), config_h) def test_get_scheme_names(self): @@ -163,7 +163,7 @@ index 1ade49281b..e21ca34733 100644 if HAS_USER_BASE: wanted.extend(['nt_user', 'osx_framework_user', 'posix_user']) self.assertEqual(get_scheme_names(), tuple(sorted(wanted))) -@@ -389,6 +400,8 @@ def test_symlink(self): # Issue 7880 +@@ -398,6 +409,8 @@ def test_symlink(self): # Issue 7880 cmd = "-c", "import sysconfig; print(sysconfig.get_platform())" self.assertEqual(py.call_real(*cmd), py.call_link(*cmd)) diff --git a/python3.13.spec b/python3.13.spec index bee5a28..816f38f 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -13,7 +13,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.0 +%global general_version %{pybasever}.1 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} @@ -57,7 +57,7 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 24.2 +%global pip_version 24.3.1 %global setuptools_version 67.6.1 %global wheel_version 0.43.0 # All of those also include a list of indirect bundled libs: @@ -65,8 +65,8 @@ License: Python-2.0.1 # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: Provides: bundled(python3dist(cachecontrol)) = 0.14 -Provides: bundled(python3dist(certifi)) = 2024.7.4 -Provides: bundled(python3dist(distlib)) = 0.3.8 +Provides: bundled(python3dist(certifi)) = 2024.8.30 +Provides: bundled(python3dist(distlib)) = 0.3.9 Provides: bundled(python3dist(distro)) = 1.9 Provides: bundled(python3dist(idna)) = 3.7 Provides: bundled(python3dist(msgpack)) = 1.0.8 @@ -79,9 +79,9 @@ Provides: bundled(python3dist(resolvelib)) = 1.0.1 Provides: bundled(python3dist(rich)) = 13.7.1 Provides: bundled(python3dist(setuptools)) = 70.3 Provides: bundled(python3dist(tomli)) = 2.0.1 -Provides: bundled(python3dist(truststore)) = 0.9.1 +Provides: bundled(python3dist(truststore)) = 0.10 Provides: bundled(python3dist(typing-extensions)) = 4.12.2 -Provides: bundled(python3dist(urllib3)) = 1.26.18 +Provides: bundled(python3dist(urllib3)) = 1.26.20 } # setuptools # vendor.txt files not in .whl @@ -341,7 +341,7 @@ Source11: idle3.appdata.xml # (Patches taken from github.com/fedora-python/cpython) -# 00251 # 60dd97be7bf3662ff65edd8471e948924b4175b2 +# 00251 # f5b56b9d4a79df04e9d90ceff7388554c5f818b6 # Change user install location # # Set values of base and platbase in sysconfig from /usr @@ -1699,6 +1699,11 @@ CheckPython freethreading # ====================================================== %changelog +* Tue Dec 03 2024 Charalampos Stratakis - 3.13.1-1 +- Update to 3.13.1 +- Security fix for CVE-2024-9287 +- Fixes: rhbz#2321657 + * Tue Oct 08 2024 Karolina Surma - 3.13.0-1 - Update to Python 3.13.0 diff --git a/sources b/sources index 9cf507c..25463a6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.0.tar.xz) = 44a143c9b96b55b01885ec020c3364265bda55289615cd7d5071915b0d0178a6f35e7551a89090001fcb7f3172d38177a56bf8b8532b15c9dbc50295c9210152 -SHA512 (Python-3.13.0.tar.xz.asc) = 1b8bb0fe4eb93e31ec1770e90b94d44b5864c0391aad5dcba3a30d8e505d9b17107385414353c0060007f8a536254f49b8e919f36ddf6421a6e4330f817f1a3e +SHA512 (Python-3.13.1.tar.xz) = 056c9b5fc0a6b540f41513d045f43c1ed463d15e0f345cecec703ec9c2335e53b4beb19de9c74ab2b236b023f934d5fd9ae7727a808634eaa01cfe66018a9a35 +SHA512 (Python-3.13.1.tar.xz.asc) = 1b56b7c2f547aa39c75c18978e174debb113444ce3f9da3829ba6842e3160051e0de70bd49d306b8014299aa8aa911d7c67efe71dd648c3528cf8d7535a01599 From f84c0fe12f2f65713058447122526557f4b46256 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 5 Dec 2024 11:53:48 +0100 Subject: [PATCH 07/60] Optimize patch 251 a tiny bit Before: $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()' 2000 loops, best of 5: 157 usec per loop $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()' 2000 loops, best of 5: 162 usec per loop $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()' 1000 loops, best of 5: 146 usec per loop After: $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()' 5000 loops, best of 5: 75.9 usec per loop $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()' 5000 loops, best of 5: 77.1 usec per loop $ python3.14 -m timeit -s 'import sysconfig' 'sysconfig.get_paths()' 5000 loops, best of 5: 76.2 usec per loop The results are inconclusive on 3.13, but we want the patch to be identical (if possible). This can be shipped with the next update. --- 00251-change-user-install-location.patch | 4 ++-- python3.13.spec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch index 8025f83..a3a121d 100644 --- a/00251-change-user-install-location.patch +++ b/00251-change-user-install-location.patch @@ -51,7 +51,7 @@ index 89a81c55cb..950e2e337f 100644 if os.path.isdir(sitedir): addsitedir(sitedir, known_paths) diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py -index ec3b638f00..28ad8a2321 100644 +index ec3b638f00..94a6c64aa2 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py @@ -106,6 +106,12 @@ @@ -120,7 +120,7 @@ index ec3b638f00..28ad8a2321 100644 + # we only change the defaults here, so explicit --prefix will take precedence + # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe + if (scheme == 'posix_prefix' and -+ get_config_vars('prefix')[0] == '/usr' and ++ sys.prefix == '/usr' and + 'RPM_BUILD_ROOT' not in os.environ): + _extend_dict(vars, _config_vars_local()) + else: diff --git a/python3.13.spec b/python3.13.spec index 816f38f..e44329f 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -341,7 +341,7 @@ Source11: idle3.appdata.xml # (Patches taken from github.com/fedora-python/cpython) -# 00251 # f5b56b9d4a79df04e9d90ceff7388554c5f818b6 +# 00251 # 5ac6e7781923cbb3e4606e3bca381a1167d322e5 # Change user install location # # Set values of base and platbase in sysconfig from /usr From 00aa424d30ed176d7fc8c7399e0037a6a6e70c34 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 9 Dec 2024 14:59:04 +0100 Subject: [PATCH 08/60] Security fix for CVE-2024-12254 - Fixes: rhbz#2330927 --- ...elines-pauses-the-protocol-if-needed.patch | 62 +++++++++++++++++++ python3.13.spec | 14 ++++- 2 files changed, 75 insertions(+), 1 deletion(-) create mode 100644 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch diff --git a/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch b/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch new file mode 100644 index 0000000..4daa28f --- /dev/null +++ b/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch @@ -0,0 +1,62 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Fri, 6 Dec 2024 06:12:40 +0100 +Subject: [PATCH] 00445: CVE-2024-12254: Ensure + _SelectorSocketTransport.writelines pauses the protocol if needed + +Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed. + +Resolved upstream: https://github.com/python/cpython/issues/127655 + +Co-authored-by: J. Nick Koston +Co-authored-by: Kumar Aditya +--- + Lib/asyncio/selector_events.py | 1 + + Lib/test/test_asyncio/test_selector_events.py | 12 ++++++++++++ + .../2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst | 1 + + 3 files changed, 14 insertions(+) + create mode 100644 Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst + +diff --git a/Lib/asyncio/selector_events.py b/Lib/asyncio/selector_events.py +index f94bf10b42..f1ab9b12d6 100644 +--- a/Lib/asyncio/selector_events.py ++++ b/Lib/asyncio/selector_events.py +@@ -1175,6 +1175,7 @@ def writelines(self, list_of_data): + # If the entire buffer couldn't be written, register a write handler + if self._buffer: + self._loop._add_writer(self._sock_fd, self._write_ready) ++ self._maybe_pause_protocol() + + def can_write_eof(self): + return True +diff --git a/Lib/test/test_asyncio/test_selector_events.py b/Lib/test/test_asyncio/test_selector_events.py +index aaeda33dd0..efca30f374 100644 +--- a/Lib/test/test_asyncio/test_selector_events.py ++++ b/Lib/test/test_asyncio/test_selector_events.py +@@ -805,6 +805,18 @@ def test_writelines_send_partial(self): + self.assertTrue(self.sock.send.called) + self.assertTrue(self.loop.writers) + ++ def test_writelines_pauses_protocol(self): ++ data = memoryview(b'data') ++ self.sock.send.return_value = 2 ++ self.sock.send.fileno.return_value = 7 ++ ++ transport = self.socket_transport() ++ transport._high_water = 1 ++ transport.writelines([data]) ++ self.assertTrue(self.protocol.pause_writing.called) ++ self.assertTrue(self.sock.send.called) ++ self.assertTrue(self.loop.writers) ++ + @unittest.skipUnless(selector_events._HAS_SENDMSG, 'no sendmsg') + def test_write_sendmsg_full(self): + data = memoryview(b'data') +diff --git a/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst +new file mode 100644 +index 0000000000..76cfc58121 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst +@@ -0,0 +1 @@ ++Fixed the :class:`!asyncio.selector_events._SelectorSocketTransport` transport not pausing writes for the protocol when the buffer reaches the high water mark when using :meth:`asyncio.WriteTransport.writelines`. diff --git a/python3.13.spec b/python3.13.spec index e44329f..aade60b 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -358,6 +358,14 @@ Source11: idle3.appdata.xml # pypa/distutils integration: https://github.com/pypa/distutils/pull/70 Patch251: 00251-change-user-install-location.patch +# 00445 # d1a32daddefad32ceb93155552858c0a0311b23e +# CVE-2024-12254: Ensure _SelectorSocketTransport.writelines pauses the protocol if needed +# +# Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed. +# +# Resolved upstream: https://github.com/python/cpython/issues/127655 +Patch445: 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1699,6 +1707,10 @@ CheckPython freethreading # ====================================================== %changelog +* Mon Dec 09 2024 Miro Hrončok - 3.13.1-2 +- Security fix for CVE-2024-12254 +- Fixes: rhbz#2330927 + * Tue Dec 03 2024 Charalampos Stratakis - 3.13.1-1 - Update to 3.13.1 - Security fix for CVE-2024-9287 From 027f189877041147b557341f0da19f8a32fc5d75 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 21:09:02 +0000 Subject: [PATCH 09/60] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- python3.13.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index aade60b..ae66d26 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 3%{?dist} License: Python-2.0.1 @@ -1707,6 +1707,9 @@ CheckPython freethreading # ====================================================== %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 3.13.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Mon Dec 09 2024 Miro Hrončok - 3.13.1-2 - Security fix for CVE-2024-12254 - Fixes: rhbz#2330927 From d6e1ac20e88bff672688379859251e916eadadc4 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 23 Jan 2025 01:50:33 +0100 Subject: [PATCH 10/60] Remove redundant --with-system-ffi configure option The option has been removed since Python 3.12 See: https://github.com/python/cpython/commit/25590eb5dee5176f3ac60916b19450f8198e7ffc --- python3.13.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index ae66d26..deaa1f4 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -867,7 +867,6 @@ BuildPython() { --with-computed-gotos=%{computed_gotos_flag} \ --with-dbmliborder=gdbm:ndbm:bdb \ --with-system-expat \ - --with-system-ffi \ --with-system-libmpdec \ --enable-loadable-sqlite-extensions \ --with-dtrace \ From 63816a4d7a2dc13ccfd50643d42ba57700da1601 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 29 Jan 2025 21:28:29 +0100 Subject: [PATCH 11/60] Ensure this package is built with Tk 8 - Fixes: rhbz#2337760 --- python3.13.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index deaa1f4..dbd82c5 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -265,8 +265,8 @@ BuildRequires: readline-devel BuildRequires: redhat-rpm-config >= 127 BuildRequires: sqlite-devel BuildRequires: systemtap-sdt-devel -BuildRequires: tcl-devel -BuildRequires: tk-devel +BuildRequires: tcl-devel < 1:9 +BuildRequires: tk-devel < 1:9 BuildRequires: xz-devel BuildRequires: zlib-devel BuildRequires: /usr/bin/dtrace From ef73f1e89cf8263fa696e43be9b54b7d41d163ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 29 Jan 2025 21:27:51 +0100 Subject: [PATCH 12/60] On Fedora 41 or older, statically build the _datetime module into libpython - This fixes a segfault when importng it from Python 3.13.0 updated to 3.13.1+ while running - Fixes: rhbz#2333852 --- python3.13.spec | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index dbd82c5..86e73cc 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 3%{?dist} +Release: 4%{?dist} License: Python-2.0.1 @@ -882,6 +882,17 @@ BuildPython() { $ExtraConfigArgs \ %{nil} +%if 0%{?fedora} && 0%{?fedora} < 42 + # Statically compile the _datetime module to mitigate: + # Segfault when updating from 3.13.0 to 3.13.1 while Python is running + # https://bugzilla.redhat.com/2333852 + # Note that this is an incomplete workaround for the case we know about, + # we'd like to see the cause fixed properly in Python 3.14 upstream: + # https://github.com/python/cpython/issues/128341 + # This is only carried on Fedoras released before Python 3.13.1. + echo -e '*static*\n_datetime _datetimemodule.c' > Modules/Setup.local +%endif + %global flags_override EXTRA_CFLAGS="$MoreCFlags" CFLAGS_NODIST="$CFLAGS_NODIST $MoreCFlags" %if %{without bootstrap} @@ -1412,7 +1423,9 @@ CheckPython freethreading %{1}/_ctypes.%{2}.so\ %{1}/_curses.%{2}.so\ %{1}/_curses_panel.%{2}.so\ +%if !(0%{?fedora} && 0%{?fedora} < 42)\ %{1}/_datetime.%{2}.so\ +%endif\ %{1}/_dbm.%{2}.so\ %{1}/_gdbm.%{2}.so\ %{1}/_decimal.%{2}.so\ @@ -1706,6 +1719,11 @@ CheckPython freethreading # ====================================================== %changelog +* Wed Jan 29 2025 Miro Hrončok - 3.13.1-4 +- On Fedora 41 or older, statically build the _datetime module into libpython +- This fixes a segfault when importng it from Python 3.13.0 updated to 3.13.1+ while running +- Fixes: rhbz#2333852 + * Sat Jan 18 2025 Fedora Release Engineering - 3.13.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From fd1e3b0098cb96ba3525b58dff2f0ec1ef32cb8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 3 Feb 2025 18:30:24 +0100 Subject: [PATCH 13/60] Changelog typo --- python3.13.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index 86e73cc..816a44a 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -1721,7 +1721,7 @@ CheckPython freethreading %changelog * Wed Jan 29 2025 Miro Hrončok - 3.13.1-4 - On Fedora 41 or older, statically build the _datetime module into libpython -- This fixes a segfault when importng it from Python 3.13.0 updated to 3.13.1+ while running +- This fixes a segfault when importing it from Python 3.13.0 updated to 3.13.1+ while running - Fixes: rhbz#2333852 * Sat Jan 18 2025 Fedora Release Engineering - 3.13.1-3 From 4f7875132ef5de299fb43bce0c6dc942870d5b4b Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Tue, 4 Feb 2025 22:44:24 +0100 Subject: [PATCH 14/60] Update to 3.13.2 Security fix for CVE-2025-0938 Fixes: rhbz#2343274 --- ...elines-pauses-the-protocol-if-needed.patch | 62 ------------------- python3.13.spec | 17 +++-- sources | 4 +- 3 files changed, 9 insertions(+), 74 deletions(-) delete mode 100644 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch diff --git a/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch b/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch deleted file mode 100644 index 4daa28f..0000000 --- a/00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: "Miss Islington (bot)" - <31488909+miss-islington@users.noreply.github.com> -Date: Fri, 6 Dec 2024 06:12:40 +0100 -Subject: [PATCH] 00445: CVE-2024-12254: Ensure - _SelectorSocketTransport.writelines pauses the protocol if needed - -Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed. - -Resolved upstream: https://github.com/python/cpython/issues/127655 - -Co-authored-by: J. Nick Koston -Co-authored-by: Kumar Aditya ---- - Lib/asyncio/selector_events.py | 1 + - Lib/test/test_asyncio/test_selector_events.py | 12 ++++++++++++ - .../2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst | 1 + - 3 files changed, 14 insertions(+) - create mode 100644 Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst - -diff --git a/Lib/asyncio/selector_events.py b/Lib/asyncio/selector_events.py -index f94bf10b42..f1ab9b12d6 100644 ---- a/Lib/asyncio/selector_events.py -+++ b/Lib/asyncio/selector_events.py -@@ -1175,6 +1175,7 @@ def writelines(self, list_of_data): - # If the entire buffer couldn't be written, register a write handler - if self._buffer: - self._loop._add_writer(self._sock_fd, self._write_ready) -+ self._maybe_pause_protocol() - - def can_write_eof(self): - return True -diff --git a/Lib/test/test_asyncio/test_selector_events.py b/Lib/test/test_asyncio/test_selector_events.py -index aaeda33dd0..efca30f374 100644 ---- a/Lib/test/test_asyncio/test_selector_events.py -+++ b/Lib/test/test_asyncio/test_selector_events.py -@@ -805,6 +805,18 @@ def test_writelines_send_partial(self): - self.assertTrue(self.sock.send.called) - self.assertTrue(self.loop.writers) - -+ def test_writelines_pauses_protocol(self): -+ data = memoryview(b'data') -+ self.sock.send.return_value = 2 -+ self.sock.send.fileno.return_value = 7 -+ -+ transport = self.socket_transport() -+ transport._high_water = 1 -+ transport.writelines([data]) -+ self.assertTrue(self.protocol.pause_writing.called) -+ self.assertTrue(self.sock.send.called) -+ self.assertTrue(self.loop.writers) -+ - @unittest.skipUnless(selector_events._HAS_SENDMSG, 'no sendmsg') - def test_write_sendmsg_full(self): - data = memoryview(b'data') -diff --git a/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst -new file mode 100644 -index 0000000000..76cfc58121 ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2024-12-05-21-35-19.gh-issue-127655.xpPoOf.rst -@@ -0,0 +1 @@ -+Fixed the :class:`!asyncio.selector_events._SelectorSocketTransport` transport not pausing writes for the protocol when the buffer reaches the high water mark when using :meth:`asyncio.WriteTransport.writelines`. diff --git a/python3.13.spec b/python3.13.spec index 816a44a..f06182a 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -13,11 +13,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.1 +%global general_version %{pybasever}.2 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 4%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -358,14 +358,6 @@ Source11: idle3.appdata.xml # pypa/distutils integration: https://github.com/pypa/distutils/pull/70 Patch251: 00251-change-user-install-location.patch -# 00445 # d1a32daddefad32ceb93155552858c0a0311b23e -# CVE-2024-12254: Ensure _SelectorSocketTransport.writelines pauses the protocol if needed -# -# Ensure _SelectorSocketTransport.writelines pauses the protocol if it reaches the high water mark as needed. -# -# Resolved upstream: https://github.com/python/cpython/issues/127655 -Patch445: 00445-cve-2024-12254-ensure-_selectorsockettransport-writelines-pauses-the-protocol-if-needed.patch - # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1719,6 +1711,11 @@ CheckPython freethreading # ====================================================== %changelog +* Tue Feb 04 2025 Charalampos Stratakis - 3.13.2-1 +- Update to 3.13.2 +- Security fix for CVE-2025-0938 +- Fixes: rhbz#2343274 + * Wed Jan 29 2025 Miro Hrončok - 3.13.1-4 - On Fedora 41 or older, statically build the _datetime module into libpython - This fixes a segfault when importing it from Python 3.13.0 updated to 3.13.1+ while running diff --git a/sources b/sources index 25463a6..e4c65e5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.1.tar.xz) = 056c9b5fc0a6b540f41513d045f43c1ed463d15e0f345cecec703ec9c2335e53b4beb19de9c74ab2b236b023f934d5fd9ae7727a808634eaa01cfe66018a9a35 -SHA512 (Python-3.13.1.tar.xz.asc) = 1b56b7c2f547aa39c75c18978e174debb113444ce3f9da3829ba6842e3160051e0de70bd49d306b8014299aa8aa911d7c67efe71dd648c3528cf8d7535a01599 +SHA512 (Python-3.13.2.tar.xz) = bb1c0598914c6d4326554faa568f660f10b20c701d0f36bf1fa58837b6498d728a407416b06ede39604caea1ca93f60545b83b01ae8ee65f55d4cc83242b63fe +SHA512 (Python-3.13.2.tar.xz.asc) = 5f019be530f688b0adf5d5cc9f2c2243e2f1dc7338559db14c1eedd12aadc85404d42c7aafd74e41828205d85f13f278876662ac30c8f3382a1ee081ba5f29f2 From 94a1f5627967375a953b927d1fff11586c0fc889 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 6 Feb 2025 12:04:28 +0100 Subject: [PATCH 15/60] Rebuilt with mpdecimal 4.0.0 --- python3.13.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index f06182a..0912d12 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -1711,6 +1711,9 @@ CheckPython freethreading # ====================================================== %changelog +* Thu Feb 06 2025 Miro Hrončok - 3.13.2-2 +- Rebuilt with mpdecimal 4.0.0 + * Tue Feb 04 2025 Charalampos Stratakis - 3.13.2-1 - Update to 3.13.2 - Security fix for CVE-2025-0938 From ee3b609ce717e6fb876293bd4c90791cdfb0f102 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Wed, 9 Apr 2025 09:54:51 +0200 Subject: [PATCH 16/60] Update to 3.13.3 --- 00251-change-user-install-location.patch | 6 +-- ...oken-rst-with-rstfile-as-an-argument.patch | 24 ++++++++++++ ...ame-in-test_group_no_follow_symlinks.patch | 24 ++++++++++++ python3.13.spec | 37 +++++++++++++------ sources | 4 +- 5 files changed, 79 insertions(+), 16 deletions(-) create mode 100644 00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch create mode 100644 00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch index a3a121d..8f0a321 100644 --- a/00251-change-user-install-location.patch +++ b/00251-change-user-install-location.patch @@ -51,7 +51,7 @@ index 89a81c55cb..950e2e337f 100644 if os.path.isdir(sitedir): addsitedir(sitedir, known_paths) diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py -index ec3b638f00..94a6c64aa2 100644 +index 510c7b9568..6e4e07e43b 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py @@ -106,6 +106,12 @@ @@ -87,7 +87,7 @@ index ec3b638f00..94a6c64aa2 100644 _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include', 'scripts', 'data') -@@ -259,11 +278,40 @@ def _extend_dict(target_dict, other_dict): +@@ -266,11 +285,40 @@ def _extend_dict(target_dict, other_dict): target_dict[key] = value @@ -130,7 +130,7 @@ index ec3b638f00..94a6c64aa2 100644 # On Windows we want to substitute 'lib' for schemes rather # than the native value (without modifying vars, in case it diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py -index bf53413021..33fa2feb28 100644 +index aca02c06bc..a4d0db0da8 100644 --- a/Lib/test/test_sysconfig.py +++ b/Lib/test/test_sysconfig.py @@ -130,8 +130,19 @@ def test_get_path(self): diff --git a/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch b/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch new file mode 100644 index 0000000..4e736ef --- /dev/null +++ b/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch @@ -0,0 +1,24 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Karolina Surma +Date: Wed, 9 Apr 2025 10:47:48 +0200 +Subject: [PATCH] 00454: Invoke regen-token rst with rstfile as an argument + +Proposed upstream: https://github.com/python/cpython/pull/132304 +--- + Makefile.pre.in | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/Makefile.pre.in b/Makefile.pre.in +index 3bd4495f95..d7a4e4b320 100644 +--- a/Makefile.pre.in ++++ b/Makefile.pre.in +@@ -1784,7 +1784,8 @@ regen-token: + # using Tools/build/generate_token.py + $(PYTHON_FOR_REGEN) $(srcdir)/Tools/build/generate_token.py rst \ + $(srcdir)/Grammar/Tokens \ +- $(srcdir)/Doc/library/token-list.inc ++ $(srcdir)/Doc/library/token-list.inc \ ++ $(srcdir)/Doc/library/token.rst + # Regenerate Include/internal/pycore_token.h from Grammar/Tokens + # using Tools/build/generate_token.py + $(PYTHON_FOR_REGEN) $(srcdir)/Tools/build/generate_token.py h \ diff --git a/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch b/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch new file mode 100644 index 0000000..0dd171e --- /dev/null +++ b/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch @@ -0,0 +1,24 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Karolina Surma +Date: Thu, 10 Apr 2025 15:11:41 +0200 +Subject: [PATCH] 00456: Find the correct group name in + test_group_no_follow_symlinks + +Proposed upstream: https://github.com/python/cpython/pull/132357 +--- + Lib/test/test_pathlib/test_pathlib.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Lib/test/test_pathlib/test_pathlib.py b/Lib/test/test_pathlib/test_pathlib.py +index 1f01ce40da..2b9aad1426 100644 +--- a/Lib/test/test_pathlib/test_pathlib.py ++++ b/Lib/test/test_pathlib/test_pathlib.py +@@ -781,7 +781,7 @@ def test_group_no_follow_symlinks(self): + os.chown(link, -1, gid_2, follow_symlinks=False) + + expected_gid = link.stat(follow_symlinks=False).st_gid +- expected_name = self._get_pw_name_or_skip_test(expected_gid) ++ expected_name = self._get_gr_name_or_skip_test(expected_gid) + + self.assertEqual(expected_gid, gid_2) + self.assertEqual(expected_name, link.group(follow_symlinks=False)) diff --git a/python3.13.spec b/python3.13.spec index 0912d12..6dbc504 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -13,11 +13,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.2 +%global general_version %{pybasever}.3 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -57,28 +57,28 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 24.3.1 +%global pip_version 25.0.1 %global setuptools_version 67.6.1 %global wheel_version 0.43.0 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: -Provides: bundled(python3dist(cachecontrol)) = 0.14 +Provides: bundled(python3dist(cachecontrol)) = 0.14.1 Provides: bundled(python3dist(certifi)) = 2024.8.30 Provides: bundled(python3dist(distlib)) = 0.3.9 Provides: bundled(python3dist(distro)) = 1.9 -Provides: bundled(python3dist(idna)) = 3.7 -Provides: bundled(python3dist(msgpack)) = 1.0.8 -Provides: bundled(python3dist(packaging)) = 24.1 -Provides: bundled(python3dist(platformdirs)) = 4.2.2 +Provides: bundled(python3dist(idna)) = 3.10 +Provides: bundled(python3dist(msgpack)) = 1.1 +Provides: bundled(python3dist(packaging)) = 24.2 +Provides: bundled(python3dist(platformdirs)) = 4.3.6 Provides: bundled(python3dist(pygments)) = 2.18 -Provides: bundled(python3dist(pyproject-hooks)) = 1 +Provides: bundled(python3dist(pyproject-hooks)) = 1.2 Provides: bundled(python3dist(requests)) = 2.32.3 Provides: bundled(python3dist(resolvelib)) = 1.0.1 -Provides: bundled(python3dist(rich)) = 13.7.1 +Provides: bundled(python3dist(rich)) = 13.9.4 Provides: bundled(python3dist(setuptools)) = 70.3 -Provides: bundled(python3dist(tomli)) = 2.0.1 +Provides: bundled(python3dist(tomli)) = 2.2.1 Provides: bundled(python3dist(truststore)) = 0.10 Provides: bundled(python3dist(typing-extensions)) = 4.12.2 Provides: bundled(python3dist(urllib3)) = 1.26.20 @@ -358,6 +358,18 @@ Source11: idle3.appdata.xml # pypa/distutils integration: https://github.com/pypa/distutils/pull/70 Patch251: 00251-change-user-install-location.patch +# 00454 # 1d5d7e9ce724fbbd89645d637303d12731c2a622 +# Invoke regen-token rst with rstfile as an argument +# +# Proposed upstream: https://github.com/python/cpython/pull/132304 +Patch454: 00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch + +# 00456 # 8f50cf7170e39c02d52cb5f99d647eeefad2f685 +# Find the correct group name in test_group_no_follow_symlinks +# +# Proposed upstream: https://github.com/python/cpython/pull/132357 +Patch456: 00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1711,6 +1723,9 @@ CheckPython freethreading # ====================================================== %changelog +* Wed Apr 09 2025 Tomáš Hrnčiar - 3.13.3-1 +- Update to 3.13.1 + * Thu Feb 06 2025 Miro Hrončok - 3.13.2-2 - Rebuilt with mpdecimal 4.0.0 diff --git a/sources b/sources index e4c65e5..f101eff 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.2.tar.xz) = bb1c0598914c6d4326554faa568f660f10b20c701d0f36bf1fa58837b6498d728a407416b06ede39604caea1ca93f60545b83b01ae8ee65f55d4cc83242b63fe -SHA512 (Python-3.13.2.tar.xz.asc) = 5f019be530f688b0adf5d5cc9f2c2243e2f1dc7338559db14c1eedd12aadc85404d42c7aafd74e41828205d85f13f278876662ac30c8f3382a1ee081ba5f29f2 +SHA512 (Python-3.13.3.tar.xz) = f7559b6dceae69f48742af0a6497fbec42cd1e5304f64b6eb9d89222a1171ccf12fa186cc0decabb4e98d05223184967a4a7537754c01083dacdc9073cb1a578 +SHA512 (Python-3.13.3.tar.xz.asc) = 54f8da5f4a4dcadc9830cb07aecf695a26a2de48ab98e1f42b09fdde1c70989476d07ce7ea81337216f1e5fcbf6b688e0608c88a2545ced416b01640108e94db From 8dd054a595e76b2cfe8f686b82308cffcd9438ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Thu, 17 Apr 2025 12:17:38 +0200 Subject: [PATCH 17/60] Regenerate patches with updated importpatches script --- 00251-change-user-install-location.patch | 2 +- 00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch | 2 +- ...e-correct-group-name-in-test_group_no_follow_symlinks.patch | 3 +-- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch index 8f0a321..2d2b66e 100644 --- a/00251-change-user-install-location.patch +++ b/00251-change-user-install-location.patch @@ -1,7 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 15 Feb 2021 12:19:27 +0100 -Subject: [PATCH] 00251: Change user install location +Subject: 00251: Change user install location MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch b/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch index 4e736ef..228a03a 100644 --- a/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch +++ b/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch @@ -1,7 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Wed, 9 Apr 2025 10:47:48 +0200 -Subject: [PATCH] 00454: Invoke regen-token rst with rstfile as an argument +Subject: 00454: Invoke regen-token rst with rstfile as an argument Proposed upstream: https://github.com/python/cpython/pull/132304 --- diff --git a/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch b/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch index 0dd171e..0627f0f 100644 --- a/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch +++ b/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch @@ -1,8 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Thu, 10 Apr 2025 15:11:41 +0200 -Subject: [PATCH] 00456: Find the correct group name in - test_group_no_follow_symlinks +Subject: 00456: Find the correct group name in test_group_no_follow_symlinks Proposed upstream: https://github.com/python/cpython/pull/132357 --- From d3f76dd9d51a0409238ddf76a34957177c727a0b Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Wed, 23 Apr 2025 01:11:41 +0200 Subject: [PATCH 18/60] Apply Intel's CET for mitigation against control-flow hijacking attacks --- ...l-control-flow-technology-for-x86-64.patch | 68 +++++++++++++++++++ python3.13.spec | 15 +++- 2 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 00459-apply-intel-control-flow-technology-for-x86-64.patch diff --git a/00459-apply-intel-control-flow-technology-for-x86-64.patch b/00459-apply-intel-control-flow-technology-for-x86-64.patch new file mode 100644 index 0000000..98d5eee --- /dev/null +++ b/00459-apply-intel-control-flow-technology-for-x86-64.patch @@ -0,0 +1,68 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Charalampos Stratakis +Date: Wed, 8 Jan 2025 04:58:22 +0100 +Subject: 00459: Apply Intel Control-flow Technology for x86-64 + +Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks + +Proposed upstream: https://github.com/python/cpython/pull/128606 + +See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html +--- + Python/asm_trampoline.S | 22 ++++++++++++++++++++++ + Python/perf_jit_trampoline.c | 4 ++++ + 2 files changed, 26 insertions(+) + +diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S +index 0a3265dfee..616752459b 100644 +--- a/Python/asm_trampoline.S ++++ b/Python/asm_trampoline.S +@@ -9,6 +9,9 @@ + # } + _Py_trampoline_func_start: + #ifdef __x86_64__ ++#if defined(__CET__) && (__CET__ & 1) ++ endbr64 ++#endif + sub $8, %rsp + call *%rcx + add $8, %rsp +@@ -34,3 +37,22 @@ _Py_trampoline_func_start: + .globl _Py_trampoline_func_end + _Py_trampoline_func_end: + .section .note.GNU-stack,"",@progbits ++# Note for indicating the assembly code supports CET ++#if defined(__x86_64__) && defined(__CET__) && (__CET__ & 1) ++ .section .note.gnu.property,"a" ++ .align 8 ++ .long 1f - 0f ++ .long 4f - 1f ++ .long 5 ++0: ++ .string "GNU" ++1: ++ .align 8 ++ .long 0xc0000002 ++ .long 3f - 2f ++2: ++ .long 0x3 ++3: ++ .align 8 ++4: ++#endif // __x86_64__ +diff --git a/Python/perf_jit_trampoline.c b/Python/perf_jit_trampoline.c +index 0a8945958b..e9cc7758ba 100644 +--- a/Python/perf_jit_trampoline.c ++++ b/Python/perf_jit_trampoline.c +@@ -472,7 +472,11 @@ elf_init_ehframe(ELFObjectContext* ctx) + DWRF_U8(0); /* Augmentation data. */ + /* Registers saved in CFRAME. */ + #ifdef __x86_64__ ++# if defined(__CET__) && (__CET__ & 1) ++ DWRF_U8(DWRF_CFA_advance_loc | 8); ++# else + DWRF_U8(DWRF_CFA_advance_loc | 4); ++# endif + DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(16); + DWRF_U8(DWRF_CFA_advance_loc | 6); + DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(8); diff --git a/python3.13.spec b/python3.13.spec index 6dbc504..0805a72 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -370,6 +370,16 @@ Patch454: 00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch # Proposed upstream: https://github.com/python/cpython/pull/132357 Patch456: 00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch +# 00459 # 9cf6fed17de184d2e17ace2b5063e782e7e186ba +# Apply Intel Control-flow Technology for x86-64 +# +# Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks +# +# Proposed upstream: https://github.com/python/cpython/pull/128606 +# +# See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html +Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1723,6 +1733,9 @@ CheckPython freethreading # ====================================================== %changelog +* Tue Apr 22 2025 Charalampos Stratakis - 3.13.3-2 +- Apply Intel's CET for mitigation against control-flow hijacking attacks + * Wed Apr 09 2025 Tomáš Hrnčiar - 3.13.3-1 - Update to 3.13.1 From 5336a4f623037a4e8df4f04ad1837036fcbf8962 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 6 May 2025 15:07:54 +0200 Subject: [PATCH 19/60] Drop requirement on python-wheel-wheel with setuptools >= 71 --- ...red-setuptools-in-lib-test-wheeldata.patch | 120 ++++++++++++++++++ ...eel-in-test-venvs-when-setuptools-71.patch | 32 +++++ python3.13.spec | 23 +++- 3 files changed, 171 insertions(+), 4 deletions(-) create mode 100644 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch create mode 100644 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch diff --git a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch new file mode 100644 index 0000000..b77c644 --- /dev/null +++ b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch @@ -0,0 +1,120 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Adam Turner <9087854+AA-Turner@users.noreply.github.com> +Date: Fri, 25 Apr 2025 00:46:20 +0100 +Subject: 00460: gh-132415: Update vendored setuptools in + ``Lib/test/wheeldata`` + +(cherry picked from commit c9f3f5b4ed52d7bed6073ffa39717ece47202558) +(actual changes in .whl files removed to make this patch smaller) + +gh-127906: Add missing sys import to test_cppext + +(cherry picked from commit 9cba14881b371b1e95d57877896169c4605f9b75) + +Co-Authored-By: Victor Stinner +--- + Lib/test/support/__init__.py | 14 +++++++------- + Lib/test/test_cext/__init__.py | 2 +- + Lib/test/test_cppext/__init__.py | 2 +- + Lib/test/test_cppext/setup.py | 1 + + Lib/test/test_peg_generator/test_c_parser.py | 2 +- + 5 files changed, 11 insertions(+), 10 deletions(-) + +diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py +index 78cf4b3ca8..bd8860b696 100644 +--- a/Lib/test/support/__init__.py ++++ b/Lib/test/support/__init__.py +@@ -2360,7 +2360,7 @@ def _findwheel(pkgname): + filenames = os.listdir(wheel_dir) + filenames = sorted(filenames, reverse=True) # approximate "newest" first + for filename in filenames: +- # filename is like 'setuptools-67.6.1-py3-none-any.whl' ++ # filename is like 'setuptools-{version}-py3-none-any.whl' + if not filename.endswith(".whl"): + continue + prefix = pkgname + '-' +@@ -2369,16 +2369,16 @@ def _findwheel(pkgname): + raise FileNotFoundError(f"No wheel for {pkgname} found in {wheel_dir}") + + +-# Context manager that creates a virtual environment, install setuptools and wheel in it +-# and returns the path to the venv directory and the path to the python executable ++# Context manager that creates a virtual environment, install setuptools in it, ++# and returns the paths to the venv directory and the python executable + @contextlib.contextmanager +-def setup_venv_with_pip_setuptools_wheel(venv_dir): +- import shlex ++def setup_venv_with_pip_setuptools(venv_dir): + import subprocess + from .os_helper import temp_cwd + + def run_command(cmd): + if verbose: ++ import shlex + print() + print('Run:', ' '.join(map(shlex.quote, cmd))) + subprocess.run(cmd, check=True) +@@ -2402,10 +2402,10 @@ def run_command(cmd): + else: + python = os.path.join(venv, 'bin', python_exe) + +- cmd = [python, '-X', 'dev', ++ cmd = (python, '-X', 'dev', + '-m', 'pip', 'install', + _findwheel('setuptools'), +- _findwheel('wheel')] ++ ) + run_command(cmd) + + yield python +diff --git a/Lib/test/test_cext/__init__.py b/Lib/test/test_cext/__init__.py +index 54859f9ff7..57f31c900d 100644 +--- a/Lib/test/test_cext/__init__.py ++++ b/Lib/test/test_cext/__init__.py +@@ -50,7 +50,7 @@ def test_build_limited_c11(self): + + def check_build(self, extension_name, std=None, limited=False): + venv_dir = 'env' +- with support.setup_venv_with_pip_setuptools_wheel(venv_dir) as python_exe: ++ with support.setup_venv_with_pip_setuptools(venv_dir) as python_exe: + self._check_build(extension_name, python_exe, + std=std, limited=limited) + +diff --git a/Lib/test/test_cppext/__init__.py b/Lib/test/test_cppext/__init__.py +index d519522730..e7130f6fc6 100644 +--- a/Lib/test/test_cppext/__init__.py ++++ b/Lib/test/test_cppext/__init__.py +@@ -47,7 +47,7 @@ def test_build_limited(self): + + def check_build(self, extension_name, std=None, limited=False): + venv_dir = 'env' +- with support.setup_venv_with_pip_setuptools_wheel(venv_dir) as python_exe: ++ with support.setup_venv_with_pip_setuptools(venv_dir) as python_exe: + self._check_build(extension_name, python_exe, + std=std, limited=limited) + +diff --git a/Lib/test/test_cppext/setup.py b/Lib/test/test_cppext/setup.py +index 019ff18446..25d71cd9a2 100644 +--- a/Lib/test/test_cppext/setup.py ++++ b/Lib/test/test_cppext/setup.py +@@ -3,6 +3,7 @@ + import os + import platform + import shlex ++import sys + import sysconfig + from test import support + +diff --git a/Lib/test/test_peg_generator/test_c_parser.py b/Lib/test/test_peg_generator/test_c_parser.py +index 1411e55dd0..1095e7303c 100644 +--- a/Lib/test/test_peg_generator/test_c_parser.py ++++ b/Lib/test/test_peg_generator/test_c_parser.py +@@ -99,7 +99,7 @@ def setUpClass(cls): + cls.addClassCleanup(shutil.rmtree, cls.library_dir) + + with contextlib.ExitStack() as stack: +- python_exe = stack.enter_context(support.setup_venv_with_pip_setuptools_wheel("venv")) ++ python_exe = stack.enter_context(support.setup_venv_with_pip_setuptools("venv")) + sitepackages = subprocess.check_output( + [python_exe, "-c", "import sysconfig; print(sysconfig.get_path('platlib'))"], + text=True, diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch new file mode 100644 index 0000000..d617a6f --- /dev/null +++ b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Fri, 25 Apr 2025 09:33:37 +0200 +Subject: 00461: Downstream only: Install wheel in test venvs when setuptools < + 71 + +--- + Lib/test/support/__init__.py | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py +index bd8860b696..785ca4c3d5 100644 +--- a/Lib/test/support/__init__.py ++++ b/Lib/test/support/__init__.py +@@ -2402,9 +2402,16 @@ def run_command(cmd): + else: + python = os.path.join(venv, 'bin', python_exe) + ++ setuptools_whl = _findwheel('setuptools') ++ whl_filename = os.path.basename(setuptools_whl) ++ setuptools_major = int(whl_filename.split('-')[1].split('.')[0]) ++ if setuptools_major >= 71: # we need 70.1+, but that's OK ++ wheels = (setuptools_whl,) ++ else: ++ wheels = (setuptools_whl, _findwheel('wheel')) + cmd = (python, '-X', 'dev', + '-m', 'pip', 'install', +- _findwheel('setuptools'), ++ *wheels, + ) + run_command(cmd) + diff --git a/python3.13.spec b/python3.13.spec index 0805a72..288c31b 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 3%{?dist} License: Python-2.0.1 @@ -302,7 +302,7 @@ BuildRequires: libappstream-glib BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2 %if %{with tests} BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel -BuildRequires: %{python_wheel_pkg_prefix}-wheel-wheel +BuildRequires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_prefix}-setuptools-wheel < 71) %endif %endif @@ -380,6 +380,18 @@ Patch456: 00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.pat # See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch +# 00460 # f876c748b89770cfee4148c3dd3acbc3dd527eb6 +# gh-132415: Update vendored setuptools in ``Lib/test/wheeldata`` +# +# (actual changes in .whl files removed to make this patch smaller) +# +# gh-127906: Add missing sys import to test_cppext +Patch460: 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch + +# 00461 # 920175020b21c0aff5edcc4c28d688b5061f591c +# Downstream only: Install wheel in test venvs when setuptools < 71 +Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -642,7 +654,7 @@ Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release} %if %{with rpmwheels} Requires: %{python_wheel_pkg_prefix}-setuptools-wheel -Requires: %{python_wheel_pkg_prefix}-wheel-wheel +Requires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_prefix}-setuptools-wheel < 71) %else Provides: bundled(python3dist(setuptools)) = %{setuptools_version} %setuptools_bundled_provides @@ -707,7 +719,7 @@ Summary: Free Threading (PEP 703) version of the Python runtime %if %{with rpmwheels} Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2 Requires: %{python_wheel_pkg_prefix}-setuptools-wheel -Requires: %{python_wheel_pkg_prefix}-wheel-wheel +Requires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_prefix}-setuptools-wheel < 71) License: %{libs_license} %else Provides: bundled(python3dist(pip)) = %{pip_version} @@ -1733,6 +1745,9 @@ CheckPython freethreading # ====================================================== %changelog +* Tue May 06 2025 Miro Hrončok - 3.13.3-3 +- Drop requirement on python-wheel-wheel with setuptools >= 71 + * Tue Apr 22 2025 Charalampos Stratakis - 3.13.3-2 - Apply Intel's CET for mitigation against control-flow hijacking attacks From 2198fa7927a99f739600915e909b2dfa50919285 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Tue, 6 May 2025 03:12:09 +0200 Subject: [PATCH 20/60] Add perf to the testing BuildRequires Perf profiling showing the Python functions is only supported on x86_64 and aarch64 at the moment. Adding perf as a BuildRequires allows tests that utilize the perf binary to run. --- python3.13.spec | 5 +++++ tests/tests.yml | 1 + 2 files changed, 6 insertions(+) diff --git a/python3.13.spec b/python3.13.spec index 288c31b..dac363e 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -280,6 +280,11 @@ BuildRequires: gcc-c++ BuildRequires: gdb BuildRequires: glibc-all-langpacks BuildRequires: tzdata + +# Perf support is only available on x86_64 and aarch64 right now +%ifarch x86_64 aarch64 +BuildRequires: perf +%endif %endif %if %{with jit} diff --git a/tests/tests.yml b/tests/tests.yml index 8a4ba6b..32fbb39 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -65,3 +65,4 @@ - glibc-all-langpacks # for locale tests - marshalparser # for testing compatibility (magic numbers) with marshalparser - rpm # for debugging + - perf # for test_perf_profiler From 093e433f0c24c41d1e0529633b3f9035cb2b3ea4 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 2 Jun 2025 14:02:26 +0200 Subject: [PATCH 21/60] Rebuilt as non-main Python on Fedora 43 --- python3.13.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index dac363e..b18040d 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 3%{?dist} +Release: 4%{?dist} License: Python-2.0.1 @@ -1750,6 +1750,9 @@ CheckPython freethreading # ====================================================== %changelog +* Mon Jun 02 2025 Python Maint - 3.13.3-4 +- Rebuilt as non-main Python on Fedora 43 + * Tue May 06 2025 Miro Hrončok - 3.13.3-3 - Drop requirement on python-wheel-wheel with setuptools >= 71 From b13a982a6263b25c13a83310551e6d13467e5f20 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Wed, 4 Jun 2025 08:47:43 +0200 Subject: [PATCH 22/60] Update to 3.13.4 --- 00251-change-user-install-location.patch | 4 +- ...oken-rst-with-rstfile-as-an-argument.patch | 24 ------- ...ame-in-test_group_no_follow_symlinks.patch | 23 ------- ...l-control-flow-technology-for-x86-64.patch | 68 ------------------- ...red-setuptools-in-lib-test-wheeldata.patch | 23 ++----- ...eel-in-test-venvs-when-setuptools-71.patch | 4 +- python3.13.spec | 53 +++++---------- sources | 4 +- 8 files changed, 29 insertions(+), 174 deletions(-) delete mode 100644 00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch delete mode 100644 00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch delete mode 100644 00459-apply-intel-control-flow-technology-for-x86-64.patch diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch index 2d2b66e..a4a78b6 100644 --- a/00251-change-user-install-location.patch +++ b/00251-change-user-install-location.patch @@ -30,10 +30,10 @@ Co-authored-by: Lumír Balhar 3 files changed, 72 insertions(+), 4 deletions(-) diff --git a/Lib/site.py b/Lib/site.py -index 89a81c55cb..950e2e337f 100644 +index aedf36399c..2ae49a8029 100644 --- a/Lib/site.py +++ b/Lib/site.py -@@ -414,8 +414,15 @@ def getsitepackages(prefixes=None): +@@ -415,8 +415,15 @@ def getsitepackages(prefixes=None): return sitepackages def addsitepackages(known_paths, prefixes=None): diff --git a/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch b/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch deleted file mode 100644 index 228a03a..0000000 --- a/00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Karolina Surma -Date: Wed, 9 Apr 2025 10:47:48 +0200 -Subject: 00454: Invoke regen-token rst with rstfile as an argument - -Proposed upstream: https://github.com/python/cpython/pull/132304 ---- - Makefile.pre.in | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/Makefile.pre.in b/Makefile.pre.in -index 3bd4495f95..d7a4e4b320 100644 ---- a/Makefile.pre.in -+++ b/Makefile.pre.in -@@ -1784,7 +1784,8 @@ regen-token: - # using Tools/build/generate_token.py - $(PYTHON_FOR_REGEN) $(srcdir)/Tools/build/generate_token.py rst \ - $(srcdir)/Grammar/Tokens \ -- $(srcdir)/Doc/library/token-list.inc -+ $(srcdir)/Doc/library/token-list.inc \ -+ $(srcdir)/Doc/library/token.rst - # Regenerate Include/internal/pycore_token.h from Grammar/Tokens - # using Tools/build/generate_token.py - $(PYTHON_FOR_REGEN) $(srcdir)/Tools/build/generate_token.py h \ diff --git a/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch b/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch deleted file mode 100644 index 0627f0f..0000000 --- a/00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch +++ /dev/null @@ -1,23 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Karolina Surma -Date: Thu, 10 Apr 2025 15:11:41 +0200 -Subject: 00456: Find the correct group name in test_group_no_follow_symlinks - -Proposed upstream: https://github.com/python/cpython/pull/132357 ---- - Lib/test/test_pathlib/test_pathlib.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Lib/test/test_pathlib/test_pathlib.py b/Lib/test/test_pathlib/test_pathlib.py -index 1f01ce40da..2b9aad1426 100644 ---- a/Lib/test/test_pathlib/test_pathlib.py -+++ b/Lib/test/test_pathlib/test_pathlib.py -@@ -781,7 +781,7 @@ def test_group_no_follow_symlinks(self): - os.chown(link, -1, gid_2, follow_symlinks=False) - - expected_gid = link.stat(follow_symlinks=False).st_gid -- expected_name = self._get_pw_name_or_skip_test(expected_gid) -+ expected_name = self._get_gr_name_or_skip_test(expected_gid) - - self.assertEqual(expected_gid, gid_2) - self.assertEqual(expected_name, link.group(follow_symlinks=False)) diff --git a/00459-apply-intel-control-flow-technology-for-x86-64.patch b/00459-apply-intel-control-flow-technology-for-x86-64.patch deleted file mode 100644 index 98d5eee..0000000 --- a/00459-apply-intel-control-flow-technology-for-x86-64.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Charalampos Stratakis -Date: Wed, 8 Jan 2025 04:58:22 +0100 -Subject: 00459: Apply Intel Control-flow Technology for x86-64 - -Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks - -Proposed upstream: https://github.com/python/cpython/pull/128606 - -See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html ---- - Python/asm_trampoline.S | 22 ++++++++++++++++++++++ - Python/perf_jit_trampoline.c | 4 ++++ - 2 files changed, 26 insertions(+) - -diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S -index 0a3265dfee..616752459b 100644 ---- a/Python/asm_trampoline.S -+++ b/Python/asm_trampoline.S -@@ -9,6 +9,9 @@ - # } - _Py_trampoline_func_start: - #ifdef __x86_64__ -+#if defined(__CET__) && (__CET__ & 1) -+ endbr64 -+#endif - sub $8, %rsp - call *%rcx - add $8, %rsp -@@ -34,3 +37,22 @@ _Py_trampoline_func_start: - .globl _Py_trampoline_func_end - _Py_trampoline_func_end: - .section .note.GNU-stack,"",@progbits -+# Note for indicating the assembly code supports CET -+#if defined(__x86_64__) && defined(__CET__) && (__CET__ & 1) -+ .section .note.gnu.property,"a" -+ .align 8 -+ .long 1f - 0f -+ .long 4f - 1f -+ .long 5 -+0: -+ .string "GNU" -+1: -+ .align 8 -+ .long 0xc0000002 -+ .long 3f - 2f -+2: -+ .long 0x3 -+3: -+ .align 8 -+4: -+#endif // __x86_64__ -diff --git a/Python/perf_jit_trampoline.c b/Python/perf_jit_trampoline.c -index 0a8945958b..e9cc7758ba 100644 ---- a/Python/perf_jit_trampoline.c -+++ b/Python/perf_jit_trampoline.c -@@ -472,7 +472,11 @@ elf_init_ehframe(ELFObjectContext* ctx) - DWRF_U8(0); /* Augmentation data. */ - /* Registers saved in CFRAME. */ - #ifdef __x86_64__ -+# if defined(__CET__) && (__CET__ & 1) -+ DWRF_U8(DWRF_CFA_advance_loc | 8); -+# else - DWRF_U8(DWRF_CFA_advance_loc | 4); -+# endif - DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(16); - DWRF_U8(DWRF_CFA_advance_loc | 6); - DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(8); diff --git a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch index b77c644..3553fb3 100644 --- a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch +++ b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch @@ -16,15 +16,14 @@ Co-Authored-By: Victor Stinner Lib/test/support/__init__.py | 14 +++++++------- Lib/test/test_cext/__init__.py | 2 +- Lib/test/test_cppext/__init__.py | 2 +- - Lib/test/test_cppext/setup.py | 1 + Lib/test/test_peg_generator/test_c_parser.py | 2 +- - 5 files changed, 11 insertions(+), 10 deletions(-) + 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py -index 78cf4b3ca8..bd8860b696 100644 +index f4cc51a918..6350d7c0a9 100644 --- a/Lib/test/support/__init__.py +++ b/Lib/test/support/__init__.py -@@ -2360,7 +2360,7 @@ def _findwheel(pkgname): +@@ -2361,7 +2361,7 @@ def _findwheel(pkgname): filenames = os.listdir(wheel_dir) filenames = sorted(filenames, reverse=True) # approximate "newest" first for filename in filenames: @@ -33,7 +32,7 @@ index 78cf4b3ca8..bd8860b696 100644 if not filename.endswith(".whl"): continue prefix = pkgname + '-' -@@ -2369,16 +2369,16 @@ def _findwheel(pkgname): +@@ -2370,16 +2370,16 @@ def _findwheel(pkgname): raise FileNotFoundError(f"No wheel for {pkgname} found in {wheel_dir}") @@ -54,7 +53,7 @@ index 78cf4b3ca8..bd8860b696 100644 print() print('Run:', ' '.join(map(shlex.quote, cmd))) subprocess.run(cmd, check=True) -@@ -2402,10 +2402,10 @@ def run_command(cmd): +@@ -2403,10 +2403,10 @@ def run_command(cmd): else: python = os.path.join(venv, 'bin', python_exe) @@ -93,18 +92,6 @@ index d519522730..e7130f6fc6 100644 self._check_build(extension_name, python_exe, std=std, limited=limited) -diff --git a/Lib/test/test_cppext/setup.py b/Lib/test/test_cppext/setup.py -index 019ff18446..25d71cd9a2 100644 ---- a/Lib/test/test_cppext/setup.py -+++ b/Lib/test/test_cppext/setup.py -@@ -3,6 +3,7 @@ - import os - import platform - import shlex -+import sys - import sysconfig - from test import support - diff --git a/Lib/test/test_peg_generator/test_c_parser.py b/Lib/test/test_peg_generator/test_c_parser.py index 1411e55dd0..1095e7303c 100644 --- a/Lib/test/test_peg_generator/test_c_parser.py diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch index d617a6f..b1d2620 100644 --- a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch +++ b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch @@ -9,10 +9,10 @@ Subject: 00461: Downstream only: Install wheel in test venvs when setuptools < 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py -index bd8860b696..785ca4c3d5 100644 +index 6350d7c0a9..64b3a8300e 100644 --- a/Lib/test/support/__init__.py +++ b/Lib/test/support/__init__.py -@@ -2402,9 +2402,16 @@ def run_command(cmd): +@@ -2403,9 +2403,16 @@ def run_command(cmd): else: python = os.path.join(venv, 'bin', python_exe) diff --git a/python3.13.spec b/python3.13.spec index b18040d..53262a4 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -13,11 +13,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.3 +%global general_version %{pybasever}.4 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 4%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -57,30 +57,32 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 25.0.1 +%global pip_version 25.1.1 %global setuptools_version 67.6.1 %global wheel_version 0.43.0 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: -Provides: bundled(python3dist(cachecontrol)) = 0.14.1 -Provides: bundled(python3dist(certifi)) = 2024.8.30 +Provides: bundled(python3dist(cachecontrol)) = 0.14.2 +Provides: bundled(python3dist(certifi)) = 2025.1.31 +Provides: bundled(python3dist(dependency-groups)) = 1.3.1 Provides: bundled(python3dist(distlib)) = 0.3.9 Provides: bundled(python3dist(distro)) = 1.9 Provides: bundled(python3dist(idna)) = 3.10 Provides: bundled(python3dist(msgpack)) = 1.1 -Provides: bundled(python3dist(packaging)) = 24.2 -Provides: bundled(python3dist(platformdirs)) = 4.3.6 -Provides: bundled(python3dist(pygments)) = 2.18 +Provides: bundled(python3dist(packaging)) = 25 +Provides: bundled(python3dist(platformdirs)) = 4.3.7 +Provides: bundled(python3dist(pygments)) = 2.19.1 Provides: bundled(python3dist(pyproject-hooks)) = 1.2 Provides: bundled(python3dist(requests)) = 2.32.3 -Provides: bundled(python3dist(resolvelib)) = 1.0.1 -Provides: bundled(python3dist(rich)) = 13.9.4 +Provides: bundled(python3dist(resolvelib)) = 1.1 +Provides: bundled(python3dist(rich)) = 14 Provides: bundled(python3dist(setuptools)) = 70.3 Provides: bundled(python3dist(tomli)) = 2.2.1 -Provides: bundled(python3dist(truststore)) = 0.10 -Provides: bundled(python3dist(typing-extensions)) = 4.12.2 +Provides: bundled(python3dist(tomli-w)) = 1.2 +Provides: bundled(python3dist(truststore)) = 0.10.1 +Provides: bundled(python3dist(typing-extensions)) = 4.13.2 Provides: bundled(python3dist(urllib3)) = 1.26.20 } # setuptools @@ -363,29 +365,7 @@ Source11: idle3.appdata.xml # pypa/distutils integration: https://github.com/pypa/distutils/pull/70 Patch251: 00251-change-user-install-location.patch -# 00454 # 1d5d7e9ce724fbbd89645d637303d12731c2a622 -# Invoke regen-token rst with rstfile as an argument -# -# Proposed upstream: https://github.com/python/cpython/pull/132304 -Patch454: 00454-invoke-regen-token-rst-with-rstfile-as-an-argument.patch - -# 00456 # 8f50cf7170e39c02d52cb5f99d647eeefad2f685 -# Find the correct group name in test_group_no_follow_symlinks -# -# Proposed upstream: https://github.com/python/cpython/pull/132357 -Patch456: 00456-find-the-correct-group-name-in-test_group_no_follow_symlinks.patch - -# 00459 # 9cf6fed17de184d2e17ace2b5063e782e7e186ba -# Apply Intel Control-flow Technology for x86-64 -# -# Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks -# -# Proposed upstream: https://github.com/python/cpython/pull/128606 -# -# See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html -Patch459: 00459-apply-intel-control-flow-technology-for-x86-64.patch - -# 00460 # f876c748b89770cfee4148c3dd3acbc3dd527eb6 +# 00460 # c0bff2b6359f503d3fc72bdba9f07a25519a4cdd # gh-132415: Update vendored setuptools in ``Lib/test/wheeldata`` # # (actual changes in .whl files removed to make this patch smaller) @@ -1750,6 +1730,9 @@ CheckPython freethreading # ====================================================== %changelog +* Wed Jun 04 2025 Tomáš Hrnčiar - 3.13.4-1 +- Update to 3.13.4 + * Mon Jun 02 2025 Python Maint - 3.13.3-4 - Rebuilt as non-main Python on Fedora 43 diff --git a/sources b/sources index f101eff..4d0dbd1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.3.tar.xz) = f7559b6dceae69f48742af0a6497fbec42cd1e5304f64b6eb9d89222a1171ccf12fa186cc0decabb4e98d05223184967a4a7537754c01083dacdc9073cb1a578 -SHA512 (Python-3.13.3.tar.xz.asc) = 54f8da5f4a4dcadc9830cb07aecf695a26a2de48ab98e1f42b09fdde1c70989476d07ce7ea81337216f1e5fcbf6b688e0608c88a2545ced416b01640108e94db +SHA512 (Python-3.13.4.tar.xz) = 91454bb4d04c192721d2df980a806858bd8aadb5cef92159c2844cc33e92b0386b1b33d5cfff0f69d449e9f978a5f67f6032155f7b1425ff38e36477637c0c68 +SHA512 (Python-3.13.4.tar.xz.asc) = ba9c1dee0f3bf564e6ac19cbe08cf4fdc3779a04ed8289654f6dda3fba9f07a0937764a12f1e7e2f6d7ff17bb5b86c05b8ea19296a2b98d1c81a48362ccf6104 From d1bf28e630a3b03e56030c61515392faa3a85d56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 5 Jun 2025 11:40:47 +0200 Subject: [PATCH 23/60] Revert "Add perf to the testing BuildRequires" This reverts commit 2198fa7927a99f739600915e909b2dfa50919285. The test fails for 3.13.4. --- python3.13.spec | 5 ----- tests/tests.yml | 1 - 2 files changed, 6 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index 53262a4..220f1e2 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -282,11 +282,6 @@ BuildRequires: gcc-c++ BuildRequires: gdb BuildRequires: glibc-all-langpacks BuildRequires: tzdata - -# Perf support is only available on x86_64 and aarch64 right now -%ifarch x86_64 aarch64 -BuildRequires: perf -%endif %endif %if %{with jit} diff --git a/tests/tests.yml b/tests/tests.yml index 32fbb39..8a4ba6b 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -65,4 +65,3 @@ - glibc-all-langpacks # for locale tests - marshalparser # for testing compatibility (magic numbers) with marshalparser - rpm # for debugging - - perf # for test_perf_profiler From 2eee834815374dd8365df1502f0ec75e7f78c1ea Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 12 Jun 2025 02:49:36 +0200 Subject: [PATCH 24/60] Enable PAC and BTI hardware protections for aarch64 --- ...-pac-and-bti-protections-for-aarch64.patch | 102 ++++++++++++++++++ python3.13.spec | 22 +++- 2 files changed, 123 insertions(+), 1 deletion(-) create mode 100644 00464-enable-pac-and-bti-protections-for-aarch64.patch diff --git a/00464-enable-pac-and-bti-protections-for-aarch64.patch b/00464-enable-pac-and-bti-protections-for-aarch64.patch new file mode 100644 index 0000000..9404072 --- /dev/null +++ b/00464-enable-pac-and-bti-protections-for-aarch64.patch @@ -0,0 +1,102 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Charalampos Stratakis +Date: Tue, 3 Jun 2025 03:02:15 +0200 +Subject: 00464: Enable PAC and BTI protections for aarch64 + +Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S + +The BTI flag must be applied in the assembler sources for this class +of attacks to be mitigated on newer aarch64 processors. + +Upstream PR: https://github.com/python/cpython/pull/130864/files + +The upstream patch is incomplete but only for the case where +frame pointers are not used on 3.13+. + +Since on Fedora we always compile with frame pointers the BTI/PAC +hardware protections can be enabled without losing Perf unwinding. +--- + Python/asm_trampoline.S | 4 +++ + Python/asm_trampoline_aarch64.h | 50 +++++++++++++++++++++++++++++++++ + 2 files changed, 54 insertions(+) + create mode 100644 Python/asm_trampoline_aarch64.h + +diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S +index 616752459b..ec205a08ef 100644 +--- a/Python/asm_trampoline.S ++++ b/Python/asm_trampoline.S +@@ -1,3 +1,5 @@ ++#include "asm_trampoline_aarch64.h" ++ + .text + .globl _Py_trampoline_func_start + # The following assembly is equivalent to: +@@ -20,10 +22,12 @@ _Py_trampoline_func_start: + #if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__) + // ARM64 little endian, 64bit ABI + // generate with aarch64-linux-gnu-gcc 12.1 ++ SIGN_LR + stp x29, x30, [sp, -16]! + mov x29, sp + blr x3 + ldp x29, x30, [sp], 16 ++ VERIFY_LR + ret + #endif + #ifdef __riscv +diff --git a/Python/asm_trampoline_aarch64.h b/Python/asm_trampoline_aarch64.h +new file mode 100644 +index 0000000000..4b0ec4a7dc +--- /dev/null ++++ b/Python/asm_trampoline_aarch64.h +@@ -0,0 +1,50 @@ ++#ifndef ASM_TRAMPOLINE_AARCH_64_H_ ++#define ASM_TRAMPOLINE_AARCH_64_H_ ++ ++/* ++ * References: ++ * - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros ++ * - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst ++ */ ++ ++#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1 ++ #define BTI_J hint 36 /* bti j: for jumps, IE br instructions */ ++ #define BTI_C hint 34 /* bti c: for calls, IE bl instructions */ ++ #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */ ++#else ++ #define BTI_J ++ #define BTI_C ++ #define GNU_PROPERTY_AARCH64_BTI 0 ++#endif ++ ++#if defined(__ARM_FEATURE_PAC_DEFAULT) ++ #if __ARM_FEATURE_PAC_DEFAULT & 1 ++ #define SIGN_LR hint 25 /* paciasp: sign with the A key */ ++ #define VERIFY_LR hint 29 /* autiasp: verify with the A key */ ++ #elif __ARM_FEATURE_PAC_DEFAULT & 2 ++ #define SIGN_LR hint 27 /* pacibsp: sign with the b key */ ++ #define VERIFY_LR hint 31 /* autibsp: verify with the b key */ ++ #endif ++ #define GNU_PROPERTY_AARCH64_POINTER_AUTH 2 /* bit 1 GNU Notes is for PAC support */ ++#else ++ #define SIGN_LR BTI_C ++ #define VERIFY_LR ++ #define GNU_PROPERTY_AARCH64_POINTER_AUTH 0 ++#endif ++ ++/* Add the BTI and PAC support to GNU Notes section */ ++#if GNU_PROPERTY_AARCH64_BTI != 0 || GNU_PROPERTY_AARCH64_POINTER_AUTH != 0 ++ .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */ ++ .balign 8; /* align it on a byte boundry */ ++ .long 4; /* size of "GNU\0" */ ++ .long 0x10; /* size of descriptor */ ++ .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */ ++ .asciz "GNU"; ++ .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */ ++ .long 4; /* Four bytes of data */ ++ .long (GNU_PROPERTY_AARCH64_BTI|GNU_PROPERTY_AARCH64_POINTER_AUTH); /* BTI or PAC is enabled */ ++ .long 0; /* padding for 8 byte alignment */ ++ .popsection; /* end the section */ ++#endif ++ ++#endif diff --git a/python3.13.spec b/python3.13.spec index 220f1e2..20ac6bb 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -372,6 +372,23 @@ Patch460: 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch # Downstream only: Install wheel in test venvs when setuptools < 71 Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch +# 00464 # 292acffec7a379cb6d1f3c47b9e5a2f170bbadb6 +# Enable PAC and BTI protections for aarch64 +# +# Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S +# +# The BTI flag must be applied in the assembler sources for this class +# of attacks to be mitigated on newer aarch64 processors. +# +# Upstream PR: https://github.com/python/cpython/pull/130864/files +# +# The upstream patch is incomplete but only for the case where +# frame pointers are not used on 3.13+. +# +# Since on Fedora we always compile with frame pointers the BTI/PAC +# hardware protections can be enabled without losing Perf unwinding. +Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1725,6 +1742,9 @@ CheckPython freethreading # ====================================================== %changelog +* Thu Jun 12 2025 Charalampos Stratakis - 3.13.4-2 +- Enable PAC and BTI hardware protections for aarch64 + * Wed Jun 04 2025 Tomáš Hrnčiar - 3.13.4-1 - Update to 3.13.4 From ae868353c389472f902f8709904dca98e6f3ea24 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 12 Jun 2025 12:10:14 +0200 Subject: [PATCH 25/60] Update to 3.13.5 --- ...red-setuptools-in-lib-test-wheeldata.patch | 107 ------------------ ...eel-in-test-venvs-when-setuptools-71.patch | 4 +- python3.13.spec | 65 +++++------ sources | 4 +- 4 files changed, 31 insertions(+), 149 deletions(-) delete mode 100644 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch diff --git a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch b/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch deleted file mode 100644 index 3553fb3..0000000 --- a/00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Adam Turner <9087854+AA-Turner@users.noreply.github.com> -Date: Fri, 25 Apr 2025 00:46:20 +0100 -Subject: 00460: gh-132415: Update vendored setuptools in - ``Lib/test/wheeldata`` - -(cherry picked from commit c9f3f5b4ed52d7bed6073ffa39717ece47202558) -(actual changes in .whl files removed to make this patch smaller) - -gh-127906: Add missing sys import to test_cppext - -(cherry picked from commit 9cba14881b371b1e95d57877896169c4605f9b75) - -Co-Authored-By: Victor Stinner ---- - Lib/test/support/__init__.py | 14 +++++++------- - Lib/test/test_cext/__init__.py | 2 +- - Lib/test/test_cppext/__init__.py | 2 +- - Lib/test/test_peg_generator/test_c_parser.py | 2 +- - 4 files changed, 10 insertions(+), 10 deletions(-) - -diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py -index f4cc51a918..6350d7c0a9 100644 ---- a/Lib/test/support/__init__.py -+++ b/Lib/test/support/__init__.py -@@ -2361,7 +2361,7 @@ def _findwheel(pkgname): - filenames = os.listdir(wheel_dir) - filenames = sorted(filenames, reverse=True) # approximate "newest" first - for filename in filenames: -- # filename is like 'setuptools-67.6.1-py3-none-any.whl' -+ # filename is like 'setuptools-{version}-py3-none-any.whl' - if not filename.endswith(".whl"): - continue - prefix = pkgname + '-' -@@ -2370,16 +2370,16 @@ def _findwheel(pkgname): - raise FileNotFoundError(f"No wheel for {pkgname} found in {wheel_dir}") - - --# Context manager that creates a virtual environment, install setuptools and wheel in it --# and returns the path to the venv directory and the path to the python executable -+# Context manager that creates a virtual environment, install setuptools in it, -+# and returns the paths to the venv directory and the python executable - @contextlib.contextmanager --def setup_venv_with_pip_setuptools_wheel(venv_dir): -- import shlex -+def setup_venv_with_pip_setuptools(venv_dir): - import subprocess - from .os_helper import temp_cwd - - def run_command(cmd): - if verbose: -+ import shlex - print() - print('Run:', ' '.join(map(shlex.quote, cmd))) - subprocess.run(cmd, check=True) -@@ -2403,10 +2403,10 @@ def run_command(cmd): - else: - python = os.path.join(venv, 'bin', python_exe) - -- cmd = [python, '-X', 'dev', -+ cmd = (python, '-X', 'dev', - '-m', 'pip', 'install', - _findwheel('setuptools'), -- _findwheel('wheel')] -+ ) - run_command(cmd) - - yield python -diff --git a/Lib/test/test_cext/__init__.py b/Lib/test/test_cext/__init__.py -index 54859f9ff7..57f31c900d 100644 ---- a/Lib/test/test_cext/__init__.py -+++ b/Lib/test/test_cext/__init__.py -@@ -50,7 +50,7 @@ def test_build_limited_c11(self): - - def check_build(self, extension_name, std=None, limited=False): - venv_dir = 'env' -- with support.setup_venv_with_pip_setuptools_wheel(venv_dir) as python_exe: -+ with support.setup_venv_with_pip_setuptools(venv_dir) as python_exe: - self._check_build(extension_name, python_exe, - std=std, limited=limited) - -diff --git a/Lib/test/test_cppext/__init__.py b/Lib/test/test_cppext/__init__.py -index d519522730..e7130f6fc6 100644 ---- a/Lib/test/test_cppext/__init__.py -+++ b/Lib/test/test_cppext/__init__.py -@@ -47,7 +47,7 @@ def test_build_limited(self): - - def check_build(self, extension_name, std=None, limited=False): - venv_dir = 'env' -- with support.setup_venv_with_pip_setuptools_wheel(venv_dir) as python_exe: -+ with support.setup_venv_with_pip_setuptools(venv_dir) as python_exe: - self._check_build(extension_name, python_exe, - std=std, limited=limited) - -diff --git a/Lib/test/test_peg_generator/test_c_parser.py b/Lib/test/test_peg_generator/test_c_parser.py -index 1411e55dd0..1095e7303c 100644 ---- a/Lib/test/test_peg_generator/test_c_parser.py -+++ b/Lib/test/test_peg_generator/test_c_parser.py -@@ -99,7 +99,7 @@ def setUpClass(cls): - cls.addClassCleanup(shutil.rmtree, cls.library_dir) - - with contextlib.ExitStack() as stack: -- python_exe = stack.enter_context(support.setup_venv_with_pip_setuptools_wheel("venv")) -+ python_exe = stack.enter_context(support.setup_venv_with_pip_setuptools("venv")) - sitepackages = subprocess.check_output( - [python_exe, "-c", "import sysconfig; print(sysconfig.get_path('platlib'))"], - text=True, diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch index b1d2620..6b071ad 100644 --- a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch +++ b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch @@ -9,10 +9,10 @@ Subject: 00461: Downstream only: Install wheel in test venvs when setuptools < 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py -index 6350d7c0a9..64b3a8300e 100644 +index c2b407159a..5c2efc4a51 100644 --- a/Lib/test/support/__init__.py +++ b/Lib/test/support/__init__.py -@@ -2403,9 +2403,16 @@ def run_command(cmd): +@@ -2428,9 +2428,16 @@ def run_command(cmd): else: python = os.path.join(venv, 'bin', python_exe) diff --git a/python3.13.spec b/python3.13.spec index 20ac6bb..3c8407e 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -13,11 +13,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.4 +%global general_version %{pybasever}.5 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -58,8 +58,7 @@ License: Python-2.0.1 # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl %global pip_version 25.1.1 -%global setuptools_version 67.6.1 -%global wheel_version 0.43.0 +%global setuptools_version 79.0.1 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) @@ -86,27 +85,28 @@ Provides: bundled(python3dist(typing-extensions)) = 4.13.2 Provides: bundled(python3dist(urllib3)) = 1.26.20 } # setuptools -# vendor.txt files not in .whl -# $ %%{_rpmconfigdir}/pythonbundles.py \ -# <(curl -L https://github.com/pypa/setuptools/raw/v%%{setuptools_version}/setuptools/_vendor/vendored.txt) \ -# <(curl -L https://github.com/pypa/setuptools/raw/v%%{setuptools_version}/pkg_resources/_vendor/vendored.txt) +# vendor.txt not in .whl +# Bundled packages are defined in multiple files. Generate the list with: +# git clone https://github.com/pypa/setuptools && git switch v%%{setuptools_version} +# pip freeze --path setuptools/_vendor > vendored.txt +# %%{_rpmconfigdir}/pythonbundles.py vendored.txt %global setuptools_bundled_provides %{expand: -Provides: bundled(python3dist(importlib-metadata)) = 6 -Provides: bundled(python3dist(importlib-resources)) = 5.10.2 -Provides: bundled(python3dist(jaraco-text)) = 3.7 -Provides: bundled(python3dist(more-itertools)) = 8.8 -Provides: bundled(python3dist(ordered-set)) = 3.1.1 -Provides: bundled(python3dist(packaging)) = 23 -Provides: bundled(python3dist(platformdirs)) = 2.6.2 +Provides: bundled(python3dist(autocommand)) = 2.2.2 +Provides: bundled(python3dist(backports-tarfile)) = 1.2 +Provides: bundled(python3dist(importlib-metadata)) = 8 +Provides: bundled(python3dist(inflect)) = 7.3.1 +Provides: bundled(python3dist(jaraco-collections)) = 5.1 +Provides: bundled(python3dist(jaraco-context)) = 5.3 +Provides: bundled(python3dist(jaraco-functools)) = 4.0.1 +Provides: bundled(python3dist(jaraco-text)) = 3.12.1 +Provides: bundled(python3dist(more-itertools)) = 10.3 +Provides: bundled(python3dist(packaging)) = 24.2 +Provides: bundled(python3dist(platformdirs)) = 4.2.2 Provides: bundled(python3dist(tomli)) = 2.0.1 -Provides: bundled(python3dist(typing-extensions)) = 4.0.1 -Provides: bundled(python3dist(typing-extensions)) = 4.4 -Provides: bundled(python3dist(zipp)) = 3.7 -} -# wheel -# $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheeldata/wheel-*.whl wheel/vendored/vendor.txt) -%global wheel_bundled_provides %{expand: -Provides: bundled(python3dist(packaging)) = 24 +Provides: bundled(python3dist(typeguard)) = 4.3 +Provides: bundled(python3dist(typing-extensions)) = 4.12.2 +Provides: bundled(python3dist(wheel)) = 0.45.1 +Provides: bundled(python3dist(zipp)) = 3.19.2 } # Expensive optimizations (mainly, profile-guided optimizations) @@ -360,14 +360,6 @@ Source11: idle3.appdata.xml # pypa/distutils integration: https://github.com/pypa/distutils/pull/70 Patch251: 00251-change-user-install-location.patch -# 00460 # c0bff2b6359f503d3fc72bdba9f07a25519a4cdd -# gh-132415: Update vendored setuptools in ``Lib/test/wheeldata`` -# -# (actual changes in .whl files removed to make this patch smaller) -# -# gh-127906: Add missing sys import to test_cppext -Patch460: 00460-gh-132415-update-vendored-setuptools-in-lib-test-wheeldata.patch - # 00461 # 920175020b21c0aff5edcc4c28d688b5061f591c # Downstream only: Install wheel in test venvs when setuptools < 71 Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch @@ -655,8 +647,6 @@ Requires: (%{python_wheel_pkg_prefix}-wheel-wheel if %{python_wheel_pkg_prefix}- %else Provides: bundled(python3dist(setuptools)) = %{setuptools_version} %setuptools_bundled_provides -Provides: bundled(python3dist(wheel)) = %{wheel_version} -%wheel_bundled_provides # License manually combined from Python + setuptools + wheel License: Python-2.0.1 AND MIT AND Apache-2.0 AND (Apache-2.0 OR BSD-2-Clause) %endif @@ -723,9 +713,7 @@ Provides: bundled(python3dist(pip)) = %{pip_version} %pip_bundled_provides Provides: bundled(python3dist(setuptools)) = %{setuptools_version} %setuptools_bundled_provides -Provides: bundled(python3dist(wheel)) = %{wheel_version} -%wheel_bundled_provides -# License combined from Python libs + pip + setuptools + wheel +# License combined from Python libs + pip + setuptools License: %{libs_license} AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause) %endif @@ -788,13 +776,11 @@ extension modules. # setuptools.whl does not contain the vendored.txt files if [ -f %{_rpmconfigdir}/pythonbundles.py ]; then %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) --compare-with '%pip_bundled_provides' - %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheeldata/wheel-*.whl wheel/vendored/vendor.txt) --compare-with '%wheel_bundled_provides' fi %if %{with rpmwheels} rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl rm Lib/test/wheeldata/setuptools-%{setuptools_version}-py3-none-any.whl -rm Lib/test/wheeldata/wheel-%{wheel_version}-py3-none-any.whl %endif # Remove all exe files to ensure we are not shipping prebuilt binaries @@ -1742,6 +1728,9 @@ CheckPython freethreading # ====================================================== %changelog +* Thu Jun 12 2025 Miro Hrončok - 3.13.5-1 +- Update to 3.13.5 + * Thu Jun 12 2025 Charalampos Stratakis - 3.13.4-2 - Enable PAC and BTI hardware protections for aarch64 diff --git a/sources b/sources index 4d0dbd1..0bc8e56 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.4.tar.xz) = 91454bb4d04c192721d2df980a806858bd8aadb5cef92159c2844cc33e92b0386b1b33d5cfff0f69d449e9f978a5f67f6032155f7b1425ff38e36477637c0c68 -SHA512 (Python-3.13.4.tar.xz.asc) = ba9c1dee0f3bf564e6ac19cbe08cf4fdc3779a04ed8289654f6dda3fba9f07a0937764a12f1e7e2f6d7ff17bb5b86c05b8ea19296a2b98d1c81a48362ccf6104 +SHA512 (Python-3.13.5.tar.xz) = 2a058072e87b614b204bd1321b2bfa9c4b6614dbd5ded98dc0ee51c0d6b81504f902b7c003ad14295b371a37918f6975dc37d5a9c836dd9c30f8b086e4759193 +SHA512 (Python-3.13.5.tar.xz.asc) = 07c1a2ec2d6ba2805680b7f1dc262fdc5dc3eec4503780ecdc08cd570ccbb5f1efa736ee03c83d36bdb33ce87db06be5892cf5a6eaf4018d5fe78fff99e615ae From 17339454efdbc520b2031c6c706f5f3495525a81 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 13 May 2025 17:29:44 +0000 Subject: [PATCH 26/60] Verify bundled() provides for setuptools.whl --- python3.13.spec | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index 3c8407e..0276039 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -86,10 +86,7 @@ Provides: bundled(python3dist(urllib3)) = 1.26.20 } # setuptools # vendor.txt not in .whl -# Bundled packages are defined in multiple files. Generate the list with: -# git clone https://github.com/pypa/setuptools && git switch v%%{setuptools_version} -# pip freeze --path setuptools/_vendor > vendored.txt -# %%{_rpmconfigdir}/pythonbundles.py vendored.txt +# %%{_rpmconfigdir}/pythonbundles.py <(unzip -l Lib/test/wheeldata/setuptools-*.whl | grep -E '_vendor/.+dist-info/RECORD' | sed -E 's@^.*/([^-]+)-([^-]+)\.dist-info/.*$@\1==\2@') %global setuptools_bundled_provides %{expand: Provides: bundled(python3dist(autocommand)) = 2.2.2 Provides: bundled(python3dist(backports-tarfile)) = 1.2 @@ -776,6 +773,7 @@ extension modules. # setuptools.whl does not contain the vendored.txt files if [ -f %{_rpmconfigdir}/pythonbundles.py ]; then %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) --compare-with '%pip_bundled_provides' + %{_rpmconfigdir}/pythonbundles.py <(unzip -l Lib/test/wheeldata/setuptools-*.whl | grep -E '_vendor/.+dist-info/RECORD' | sed -E 's@^.*/([^-]+)-([^-]+)\.dist-info/.*$@\1==\2@') --compare-with '%setuptools_bundled_provides' fi %if %{with rpmwheels} From 8df7c5a7363b09d52d3b08884bd8b6aa20816d2a Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Tue, 24 Jun 2025 11:22:52 +0200 Subject: [PATCH 27/60] Remove the upper version bound from expat library It's already greater than 2.6 in all Fedoras. --- python3.13.spec | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index 0276039..6f5dd91 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -243,8 +243,7 @@ Obsoletes: python%{pybasever}%{?1:-%{1}}\ BuildRequires: autoconf BuildRequires: bluez-libs-devel BuildRequires: bzip2-devel -# See the runtime requirement in the -libs subpackage -BuildRequires: expat-devel >= 2.6 +BuildRequires: expat-devel BuildRequires: findutils BuildRequires: gcc BuildRequires: gdbm-devel @@ -536,14 +535,6 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa}) # The zoneinfo module needs tzdata Requires: tzdata -# The requirement on libexpat is generated, but we need to version it. -# When built with expat >= 2.6, but installed with older expat, we get: -# ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so: -# undefined symbol: XML_SetReparseDeferralEnabled -# This breaks many things, including python -m venv. -# Other subpackages (like -debug) also need this, but they all depend on -libs. -Requires: expat >= 2.6 - %description -n %{pkgname}-libs This package contains runtime libraries for use by Python: - the majority of the Python standard library @@ -720,7 +711,6 @@ License: %{libs_license} AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND IS Provides: bundled(libb2) = 0.98.1 Provides: bundled(mimalloc) = 2.12 Requires: tzdata -Requires: expat >= 2.6 %description -n python%{pybasever}-freethreading The provisional Free Threading (PEP 703) build of Python. From c6f6c7c52282e22cf18ce8f299cdfa5d491842f5 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Tue, 24 Jun 2025 11:26:09 +0200 Subject: [PATCH 28/60] Define %python3_pkgversion based on the Python's status Main Python should retain the value '3', non-main the major-minor one. We need that to request the correctly versioned wheels for EPEL builds. --- python3.13.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/python3.13.spec b/python3.13.spec index 6f5dd91..ea7c16b 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -140,9 +140,11 @@ Provides: bundled(python3dist(zipp)) = 3.19.2 %if %{with main_python} %global pkgname python3 %global exename python3 +%global python3_pkgversion 3 %else %global pkgname python%{pybasever} %global exename python%{pybasever} +%global python3_pkgversion %{pybasever} %endif # ABIFLAGS, LDVERSION and SOABI are in the upstream configure.ac From a7e6af421eb682bba9f1bf41347a96f1efcdff6c Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Tue, 24 Jun 2025 13:22:09 +0200 Subject: [PATCH 29/60] Downstream patch: Skip tests not working with older expat version This will ensure the tests run in Fedoras and EPEL 10, but are skipped for EPEL 9. --- ...not-working-with-older-expat-version.patch | 69 +++++++++++++++++++ python3.13.spec | 14 +++- 2 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch new file mode 100644 index 0000000..1653ee5 --- /dev/null +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -0,0 +1,69 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Karolina Surma +Date: Tue, 24 Jun 2025 11:12:13 +0200 +Subject: 00466: Downstream only: Skip tests not working with older expat + version + +We want to run these tests in Fedora and EPEL 10, but not in EPEL 9, +which has too old version of expat. We set the upper bound version +in the conditionalized skip to a release available in CentOS Stream 10, +which is tested as working. +--- + Lib/test/test_pyexpat.py | 2 ++ + Lib/test/test_sax.py | 2 ++ + Lib/test/test_xml_etree.py | 6 ++++++ + 3 files changed, 10 insertions(+) + +diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py +index 1d56ccd71c..5ef5517828 100644 +--- a/Lib/test/test_pyexpat.py ++++ b/Lib/test/test_pyexpat.py +@@ -790,6 +790,8 @@ def start_element(name, _): + + self.assertEqual(started, ['doc']) + ++ @unittest.skipIf(expat.version_info < (2, 7, 1), ++ f"Skip for expat < 2.7.1 (version available in RHEL 10)") + def test_reparse_deferral_disabled(self): + started = [] + +diff --git a/Lib/test/test_sax.py b/Lib/test/test_sax.py +index 9b3014a94a..90401e0d8f 100644 +--- a/Lib/test/test_sax.py ++++ b/Lib/test/test_sax.py +@@ -1240,6 +1240,8 @@ def test_flush_reparse_deferral_enabled(self): + + self.assertEqual(result.getvalue(), start + b"") + ++ @unittest.skipIf(pyexpat.version_info < (2, 7, 1), ++ f"Skip for expat < 2.7.1 (version available in RHEL 10)") + def test_flush_reparse_deferral_disabled(self): + result = BytesIO() + xmlgen = XMLGenerator(result) +diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py +index bd75c00e50..9a1e020d24 100644 +--- a/Lib/test/test_xml_etree.py ++++ b/Lib/test/test_xml_etree.py +@@ -1521,9 +1521,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): + self.assert_event_tags(parser, [('end', 'root')]) + self.assertIsNone(parser.close()) + ++ @unittest.skipIf(pyexpat.version_info < (2, 7, 1), ++ f"Skip for expat < 2.7.1 (version available in RHEL 10)") + def test_simple_xml_chunk_1(self): + self.test_simple_xml(chunk_size=1, flush=True) + ++ @unittest.skipIf(pyexpat.version_info < (2, 7, 1), ++ f"Skip for expat < 2.7.1 (version available in RHEL 10)") + def test_simple_xml_chunk_5(self): + self.test_simple_xml(chunk_size=5, flush=True) + +@@ -1748,6 +1752,8 @@ def test_flush_reparse_deferral_enabled(self): + + self.assert_event_tags(parser, [('end', 'doc')]) + ++ @unittest.skipIf(pyexpat.version_info < (2, 7, 1), ++ f"Skip for expat < 2.7.1 (version available in RHEL 10)") + def test_flush_reparse_deferral_disabled(self): + parser = ET.XMLPullParser(events=('start', 'end')) + diff --git a/python3.13.spec b/python3.13.spec index ea7c16b..cad7545 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -379,6 +379,15 @@ Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.p # hardware protections can be enabled without losing Perf unwinding. Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch +# 00466 # e10760fb955ee33d2917f8a57bb4e24d71e5341c +# Downstream only: Skip tests not working with older expat version +# +# We want to run these tests in Fedora and EPEL 10, but not in EPEL 9, +# which has too old version of expat. We set the upper bound version +# in the conditionalized skip to a release available in CentOS Stream 10, +# which is tested as working. +Patch466: 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1718,6 +1727,9 @@ CheckPython freethreading # ====================================================== %changelog +* Wed Jun 25 2025 Karolina Surma - 3.13.5-2 +- Conditionally skip tests not working with the older expat version + * Thu Jun 12 2025 Miro Hrončok - 3.13.5-1 - Update to 3.13.5 From 1a07ebce6be219de2b079aacf639d4c64277e63b Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Wed, 25 Jun 2025 11:53:02 +0200 Subject: [PATCH 30/60] Move the bootstrapping conditionals above the global metadata We need to have it above the Release field, in order for the build NVR to contain the ~bootstrap suffix and sort correctly (lower than the main build). This enables bootstrapping the package directly in Koji side tag. --- python3.13.spec | 118 +++++++++++++++++++++++++----------------------- 1 file changed, 62 insertions(+), 56 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index cad7545..aefa7b6 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -1,3 +1,30 @@ +# ====================== +# Bootstrap conditionals +# ====================== + +# When bootstrapping python3, we need to build python3-packaging. +# but packaging BR python3-devel and that brings in python3-rpm-generators; +# python3-rpm-generators needs python3-packaging, so we cannot have it yet. +# +# We also use the previous build of Python in "make regen-all". +# +# Procedure: https://fedoraproject.org/wiki/SIGs/Python/UpgradingPython +# +# IMPORTANT: When bootstrapping, it's very likely python-pip-wheel is +# not available. Turn off the rpmwheels bcond until +# python-pip is built with a wheel to get around the issue. +%bcond bootstrap 0 + +# Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages +# Uses upstream bundled prebuilt wheels otherwise +%bcond rpmwheels 1 + +# Expensive optimizations (mainly, profile-guided optimizations) +%bcond optimizations 1 + +# Run the test suite in %%check +%bcond tests 1 + # ================== # Top-level metadata # ================== @@ -36,22 +63,42 @@ License: Python-2.0.1 # In ELN/RHEL/CentOS we want to allow building against alternative stacks, so the Provide is enabled. %bcond python_abi_provides_for_alt_pythons %{undefined fedora} -# When bootstrapping python3, we need to build python3-packaging. -# but packaging BR python3-devel and that brings in python3-rpm-generators; -# python3-rpm-generators needs python3-packaging, so we cannot have it yet. -# -# We also use the previous build of Python in "make regen-all". -# -# Procedure: https://fedoraproject.org/wiki/SIGs/Python/UpgradingPython -# -# IMPORTANT: When bootstrapping, it's very likely python-pip-wheel is -# not available. Turn off the rpmwheels bcond until -# python-pip is built with a wheel to get around the issue. -%bcond bootstrap 0 +# Extra build for debugging the interpreter or C-API extensions +# (the -debug subpackages) +%bcond debug_build 1 + +# Extra build without GIL, the freethreading PEP 703 provisional way +# (the -freethreading subpackage) +%bcond freethreading_build 1 + +# PEP 744: JIT Compilation +# Whether to build with the experimental JIT compiler +# We can only have this on Fedora 40+, where clang 18+ is available +# And only on certain architectures: https://peps.python.org/pep-0744/#support +# The freethreading build (when enabled) does not support JIT yet +%bcond jit %[(0%{?fedora} >= 40 || 0%{?rhel} >= 10) && ("%{_arch}" == "x86_64" || "%{_arch}" == "aarch64")] +%if %{with jit} +# When built with JIT, it still needs to be enabled on runtime via PYTHON_JIT=1 +%global jit_flag --enable-experimental-jit=yes-off +%endif + +# Main interpreter loop optimization +%bcond computed_gotos 1 + +# ===================== +# General global macros +# ===================== + +%if %{with main_python} +%global pkgname python3 +%global exename python3 +%global python3_pkgversion 3 +%else +%global pkgname python%{pybasever} +%global exename python%{pybasever} +%global python3_pkgversion %{pybasever} +%endif -# Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages -# Uses upstream bundled prebuilt wheels otherwise -%bcond rpmwheels 1 # If the rpmwheels condition is disabled, we use the bundled wheel packages # from Python with the versions below. # This needs to be manually updated when we update Python. @@ -106,47 +153,6 @@ Provides: bundled(python3dist(wheel)) = 0.45.1 Provides: bundled(python3dist(zipp)) = 3.19.2 } -# Expensive optimizations (mainly, profile-guided optimizations) -%bcond optimizations 1 - -# Run the test suite in %%check -%bcond tests 1 - -# Extra build for debugging the interpreter or C-API extensions -# (the -debug subpackages) -%bcond debug_build 1 - -# Extra build without GIL, the freethreading PEP 703 provisional way -# (the -freethreading subpackage) -%bcond freethreading_build 1 - -# PEP 744: JIT Compilation -# Whether to build with the experimental JIT compiler -# We can only have this on Fedora 40+, where clang 18+ is available -# And only on certain architectures: https://peps.python.org/pep-0744/#support -# The freethreading build (when enabled) does not support JIT yet -%bcond jit %[(0%{?fedora} >= 40 || 0%{?rhel} >= 10) && ("%{_arch}" == "x86_64" || "%{_arch}" == "aarch64")] -%if %{with jit} -# When built with JIT, it still needs to be enabled on runtime via PYTHON_JIT=1 -%global jit_flag --enable-experimental-jit=yes-off -%endif - -# Main interpreter loop optimization -%bcond computed_gotos 1 - -# ===================== -# General global macros -# ===================== -%if %{with main_python} -%global pkgname python3 -%global exename python3 -%global python3_pkgversion 3 -%else -%global pkgname python%{pybasever} -%global exename python%{pybasever} -%global python3_pkgversion %{pybasever} -%endif - # ABIFLAGS, LDVERSION and SOABI are in the upstream configure.ac # See PEP 3149 for some background: http://www.python.org/dev/peps/pep-3149/ %global ABIFLAGS_optimized %{nil} From f31a75016fe7968e5d51d016a9bd6640d9fc023e Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Wed, 25 Jun 2025 12:27:09 +0200 Subject: [PATCH 31/60] Switch the basic conditionals based on the bootstrap's value We always switch rpmswheels, optimizations and tests when bootstrapping new Python version, so they can be tied to the bootstrap conditional. With that, switching the bootstrap in Koji side tag will be possible, letting us to avoid separate "bootstrap" and "rebuild" commits. --- python3.13.spec | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index aefa7b6..dd4b3f5 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -10,20 +10,25 @@ # # Procedure: https://fedoraproject.org/wiki/SIGs/Python/UpgradingPython # -# IMPORTANT: When bootstrapping, it's very likely python-pip-wheel is -# not available. Turn off the rpmwheels bcond until -# python-pip is built with a wheel to get around the issue. +# Bootstrap enabled: +# - disables regen-all with the same Python version +# - disables dependency on python3-rpm-generators if we build with main_python +# - disables rpmwheels, optimizations and tests by default %bcond bootstrap 0 # Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages # Uses upstream bundled prebuilt wheels otherwise -%bcond rpmwheels 1 +%bcond rpmwheels %{without bootstrap} # Expensive optimizations (mainly, profile-guided optimizations) -%bcond optimizations 1 +# We don't have to switch it off for bootstrap, but it speeds up the first build, +# so we opt to only run them during the "full" build +%bcond optimizations %{without bootstrap} # Run the test suite in %%check -%bcond tests 1 +# Technically, we can run the tests even during the bootstrap build, but since +# we build Python 2x, it's better to just run it once with the "full" build +%bcond tests %{without bootstrap} # ================== # Top-level metadata From 1331394c24222bd740305ae777852bbcfb60a5ce Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Wed, 25 Jun 2025 13:53:06 +0200 Subject: [PATCH 32/60] Lower the minimal required autoconf version for EPEL 9 build --- python3.13.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/python3.13.spec b/python3.13.spec index dd4b3f5..546cae4 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -806,6 +806,8 @@ rm -r Modules/_decimal/libmpdec # (This is after patching, so that we can use patches directly from upstream) rm configure pyconfig.h.in +# Lower the minimal required version of autoconf to enable build for EPEL 9 +sed -i "s/AC_PREREQ(\[2\.71\])/AC_PREREQ([2.69])/" configure.ac # ====================================================== # Configuring and building the code: From aef12e770ac2072480655685eb708b37b29249e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 20 May 2025 11:54:21 +0000 Subject: [PATCH 33/60] Disable JIT on RHEL For now on, until we figure out a way of building the JIT with pre-built stencils, we disable the JIT on RHEL to avoid a dependency on a specific LLVM+clang version. https://discuss.python.org/t/building-the-jit-with-pre-built-stencils/91838 https://src.fedoraproject.org/rpms/python3.14/pull-request/40 https://github.com/fedora-eln/eln/issues/207 ---------- This was cherry-picked from https://src.fedoraproject.org/rpms/python3.14/c/ef2d703504cf0039fe5dc82e21e20053cc827c10 for https://github.com/fedora-eln/eln/issues/258#issuecomment-3085727051 With one difference: We build this package on EPEL and we have clang18 there. --- python3.13.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index 546cae4..ea80e26 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -81,7 +81,7 @@ License: Python-2.0.1 # We can only have this on Fedora 40+, where clang 18+ is available # And only on certain architectures: https://peps.python.org/pep-0744/#support # The freethreading build (when enabled) does not support JIT yet -%bcond jit %[(0%{?fedora} >= 40 || 0%{?rhel} >= 10) && ("%{_arch}" == "x86_64" || "%{_arch}" == "aarch64")] +%bcond jit %[(0%{?fedora} >= 40 || 0%{?epel} >= 10) && ("%{_arch}" == "x86_64" || "%{_arch}" == "aarch64")] %if %{with jit} # When built with JIT, it still needs to be enabled on runtime via PYTHON_JIT=1 %global jit_flag --enable-experimental-jit=yes-off From fc659cc8a29c43235a241352e39d5b636a9fa1b8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 11:19:24 +0000 Subject: [PATCH 34/60] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- python3.13.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index ea80e26..dce8653 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -49,7 +49,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 3%{?dist} License: Python-2.0.1 @@ -1740,6 +1740,9 @@ CheckPython freethreading # ====================================================== %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 3.13.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Wed Jun 25 2025 Karolina Surma - 3.13.5-2 - Conditionally skip tests not working with the older expat version From 7042c32c98c23476f333432a6ea23303f90d3adb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 28 Jul 2025 22:30:40 +0200 Subject: [PATCH 35/60] Fix CVE-2025-8194: Tarfile infinite loop during parsing with negative member offset --- 00467-CVE-2025-8194.patch | 214 ++++++++++++++++++++++++++++++++++++++ python3.13.spec | 9 +- 2 files changed, 222 insertions(+), 1 deletion(-) create mode 100644 00467-CVE-2025-8194.patch diff --git a/00467-CVE-2025-8194.patch b/00467-CVE-2025-8194.patch new file mode 100644 index 0000000..6d5ef78 --- /dev/null +++ b/00467-CVE-2025-8194.patch @@ -0,0 +1,214 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alexander Urieles +Date: Mon, 28 Jul 2025 17:37:26 +0200 +Subject: 00467: gh-130577: tarfile now validates archives to ensure member + offsets are non-negative + +(cherry picked from commit 7040aa54f14676938970e10c5f74ea93cd56aa38) + +Co-authored-by: Alexander Urieles +Co-authored-by: Gregory P. Smith +--- + Lib/tarfile.py | 3 + + Lib/test/test_tarfile.py | 156 ++++++++++++++++++ + ...-07-23-00-35-29.gh-issue-130577.c7EITy.rst | 3 + + 3 files changed, 162 insertions(+) + create mode 100644 Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst + +diff --git a/Lib/tarfile.py b/Lib/tarfile.py +index 0980f6a817..9ff9df696d 100755 +--- a/Lib/tarfile.py ++++ b/Lib/tarfile.py +@@ -1636,6 +1636,9 @@ def _block(self, count): + """Round up a byte count by BLOCKSIZE and return it, + e.g. _block(834) => 1024. + """ ++ # Only non-negative offsets are allowed ++ if count < 0: ++ raise InvalidHeaderError("invalid offset") + blocks, remainder = divmod(count, BLOCKSIZE) + if remainder: + blocks += 1 +diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py +index ac31be0f05..7024be46de 100644 +--- a/Lib/test/test_tarfile.py ++++ b/Lib/test/test_tarfile.py +@@ -50,6 +50,7 @@ def sha256sum(data): + xzname = os.path.join(TEMPDIR, "testtar.tar.xz") + tmpname = os.path.join(TEMPDIR, "tmp.tar") + dotlessname = os.path.join(TEMPDIR, "testtar") ++SPACE = b" " + + sha256_regtype = ( + "e09e4bc8b3c9d9177e77256353b36c159f5f040531bbd4b024a8f9b9196c71ce" +@@ -4578,6 +4579,161 @@ def extractall(self, ar): + ar.extractall(self.testdir, filter='fully_trusted') + + ++class OffsetValidationTests(unittest.TestCase): ++ tarname = tmpname ++ invalid_posix_header = ( ++ # name: 100 bytes ++ tarfile.NUL * tarfile.LENGTH_NAME ++ # mode, space, null terminator: 8 bytes ++ + b"000755" + SPACE + tarfile.NUL ++ # uid, space, null terminator: 8 bytes ++ + b"000001" + SPACE + tarfile.NUL ++ # gid, space, null terminator: 8 bytes ++ + b"000001" + SPACE + tarfile.NUL ++ # size, space: 12 bytes ++ + b"\xff" * 11 + SPACE ++ # mtime, space: 12 bytes ++ + tarfile.NUL * 11 + SPACE ++ # chksum: 8 bytes ++ + b"0011407" + tarfile.NUL ++ # type: 1 byte ++ + tarfile.REGTYPE ++ # linkname: 100 bytes ++ + tarfile.NUL * tarfile.LENGTH_LINK ++ # magic: 6 bytes, version: 2 bytes ++ + tarfile.POSIX_MAGIC ++ # uname: 32 bytes ++ + tarfile.NUL * 32 ++ # gname: 32 bytes ++ + tarfile.NUL * 32 ++ # devmajor, space, null terminator: 8 bytes ++ + tarfile.NUL * 6 + SPACE + tarfile.NUL ++ # devminor, space, null terminator: 8 bytes ++ + tarfile.NUL * 6 + SPACE + tarfile.NUL ++ # prefix: 155 bytes ++ + tarfile.NUL * tarfile.LENGTH_PREFIX ++ # padding: 12 bytes ++ + tarfile.NUL * 12 ++ ) ++ invalid_gnu_header = ( ++ # name: 100 bytes ++ tarfile.NUL * tarfile.LENGTH_NAME ++ # mode, null terminator: 8 bytes ++ + b"0000755" + tarfile.NUL ++ # uid, null terminator: 8 bytes ++ + b"0000001" + tarfile.NUL ++ # gid, space, null terminator: 8 bytes ++ + b"0000001" + tarfile.NUL ++ # size, space: 12 bytes ++ + b"\xff" * 11 + SPACE ++ # mtime, space: 12 bytes ++ + tarfile.NUL * 11 + SPACE ++ # chksum: 8 bytes ++ + b"0011327" + tarfile.NUL ++ # type: 1 byte ++ + tarfile.REGTYPE ++ # linkname: 100 bytes ++ + tarfile.NUL * tarfile.LENGTH_LINK ++ # magic: 8 bytes ++ + tarfile.GNU_MAGIC ++ # uname: 32 bytes ++ + tarfile.NUL * 32 ++ # gname: 32 bytes ++ + tarfile.NUL * 32 ++ # devmajor, null terminator: 8 bytes ++ + tarfile.NUL * 8 ++ # devminor, null terminator: 8 bytes ++ + tarfile.NUL * 8 ++ # padding: 167 bytes ++ + tarfile.NUL * 167 ++ ) ++ invalid_v7_header = ( ++ # name: 100 bytes ++ tarfile.NUL * tarfile.LENGTH_NAME ++ # mode, space, null terminator: 8 bytes ++ + b"000755" + SPACE + tarfile.NUL ++ # uid, space, null terminator: 8 bytes ++ + b"000001" + SPACE + tarfile.NUL ++ # gid, space, null terminator: 8 bytes ++ + b"000001" + SPACE + tarfile.NUL ++ # size, space: 12 bytes ++ + b"\xff" * 11 + SPACE ++ # mtime, space: 12 bytes ++ + tarfile.NUL * 11 + SPACE ++ # chksum: 8 bytes ++ + b"0010070" + tarfile.NUL ++ # type: 1 byte ++ + tarfile.REGTYPE ++ # linkname: 100 bytes ++ + tarfile.NUL * tarfile.LENGTH_LINK ++ # padding: 255 bytes ++ + tarfile.NUL * 255 ++ ) ++ valid_gnu_header = tarfile.TarInfo("filename").tobuf(tarfile.GNU_FORMAT) ++ data_block = b"\xff" * tarfile.BLOCKSIZE ++ ++ def _write_buffer(self, buffer): ++ with open(self.tarname, "wb") as f: ++ f.write(buffer) ++ ++ def _get_members(self, ignore_zeros=None): ++ with open(self.tarname, "rb") as f: ++ with tarfile.open( ++ mode="r", fileobj=f, ignore_zeros=ignore_zeros ++ ) as tar: ++ return tar.getmembers() ++ ++ def _assert_raises_read_error_exception(self): ++ with self.assertRaisesRegex( ++ tarfile.ReadError, "file could not be opened successfully" ++ ): ++ self._get_members() ++ ++ def test_invalid_offset_header_validations(self): ++ for tar_format, invalid_header in ( ++ ("posix", self.invalid_posix_header), ++ ("gnu", self.invalid_gnu_header), ++ ("v7", self.invalid_v7_header), ++ ): ++ with self.subTest(format=tar_format): ++ self._write_buffer(invalid_header) ++ self._assert_raises_read_error_exception() ++ ++ def test_early_stop_at_invalid_offset_header(self): ++ buffer = self.valid_gnu_header + self.invalid_gnu_header + self.valid_gnu_header ++ self._write_buffer(buffer) ++ members = self._get_members() ++ self.assertEqual(len(members), 1) ++ self.assertEqual(members[0].name, "filename") ++ self.assertEqual(members[0].offset, 0) ++ ++ def test_ignore_invalid_archive(self): ++ # 3 invalid headers with their respective data ++ buffer = (self.invalid_gnu_header + self.data_block) * 3 ++ self._write_buffer(buffer) ++ members = self._get_members(ignore_zeros=True) ++ self.assertEqual(len(members), 0) ++ ++ def test_ignore_invalid_offset_headers(self): ++ for first_block, second_block, expected_offset in ( ++ ( ++ (self.valid_gnu_header), ++ (self.invalid_gnu_header + self.data_block), ++ 0, ++ ), ++ ( ++ (self.invalid_gnu_header + self.data_block), ++ (self.valid_gnu_header), ++ 1024, ++ ), ++ ): ++ self._write_buffer(first_block + second_block) ++ members = self._get_members(ignore_zeros=True) ++ self.assertEqual(len(members), 1) ++ self.assertEqual(members[0].name, "filename") ++ self.assertEqual(members[0].offset, expected_offset) ++ ++ + def setUpModule(): + os_helper.unlink(TEMPDIR) + os.makedirs(TEMPDIR) +diff --git a/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst +new file mode 100644 +index 0000000000..342cabbc86 +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst +@@ -0,0 +1,3 @@ ++:mod:`tarfile` now validates archives to ensure member offsets are ++non-negative. (Contributed by Alexander Enrique Urieles Nieto in ++:gh:`130577`.) diff --git a/python3.13.spec b/python3.13.spec index dce8653..dc18f57 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -49,7 +49,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 3%{?dist} +Release: 4%{?dist} License: Python-2.0.1 @@ -399,6 +399,10 @@ Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch # which is tested as working. Patch466: 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +# 00467 # e4a33ed8bbb729606c58ba1e80bac5cfedf29147 +# gh-130577: tarfile now validates archives to ensure member offsets are non-negative +Patch467: 00467-CVE-2025-8194.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1740,6 +1744,9 @@ CheckPython freethreading # ====================================================== %changelog +* Mon Jul 28 2025 Miro Hrončok - 3.13.5-4 +- Fix CVE-2025-8194: Tarfile infinite loop during parsing with negative member offset + * Fri Jul 25 2025 Fedora Release Engineering - 3.13.5-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 2c3a2e93e22712fb82835a9c4269f2637dc60388 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zachar?= Date: Mon, 28 Jul 2025 09:59:54 +0200 Subject: [PATCH 36/60] Drop STI and use tmt instead Resolves: rhbz#2383059 --- {tests/.fmf => .fmf}/version | 0 plan.fmf | 73 ++++++++++++++++++++++++++++++++++++ tests/provision.fmf | 4 -- tests/tests.yml | 67 --------------------------------- 4 files changed, 73 insertions(+), 71 deletions(-) rename {tests/.fmf => .fmf}/version (100%) create mode 100644 plan.fmf delete mode 100644 tests/provision.fmf delete mode 100644 tests/tests.yml diff --git a/tests/.fmf/version b/.fmf/version similarity index 100% rename from tests/.fmf/version rename to .fmf/version diff --git a/plan.fmf b/plan.fmf new file mode 100644 index 0000000..432f1a3 --- /dev/null +++ b/plan.fmf @@ -0,0 +1,73 @@ +execute: + how: tmt + +provision: + hardware: + memory: '>= 3 GB' + +environment: + pybasever: '3.13' + +discover: + - name: tests_python + how: shell + url: https://src.fedoraproject.org/tests/python.git + tests: + - name: smoke + path: /smoke + test: "VERSION=${pybasever} CYTHON=false ./venv.sh" + - name: smoke_virtualenv + path: /smoke + test: "VERSION=${pybasever} METHOD=virtualenv CYTHON=false ./venv.sh" + - name: debugsmoke + path: /smoke + test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} CYTHON=false ./venv.sh" + - name: selftest + path: /selftest + test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh" + - name: debugtest + path: /selftest + test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes' ./parallel.sh" + - name: optimizedflags + path: /flags + test: "python${pybasever} ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" + - name: debugflags + path: /flags + test: "python${pybasever}d ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" + - name: freethreadingflags + path: /flags + test: "python${pybasever}t ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" + - name: freethreadingdebugflags + path: /flags + test: "python${pybasever}td ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" + - name: marshalparser + path: /marshalparser + test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh" + +prepare: + - name: Install dependencies + how: install + package: + - gcc # for extension building in venv and selftest + - gcc-c++ # for test_cppext + - gdb # for test_gdb + - "python${pybasever}" # the test subject + - "python${pybasever}-debug" # for leak testing + - "python${pybasever}-devel" # for extension building in venv and selftest + - "python${pybasever}-tkinter" # for selftest + - "python${pybasever}-test" # for selftest + - "python${pybasever}-freethreading" # for -O... flag test + - "python${pybasever}-freethreading-debug" # for -O... flag test + - tox # for venv tests + - virtualenv # for virtualenv tests + - glibc-all-langpacks # for locale tests + - marshalparser # for testing compatibility (magic numbers) with marshalparser + - rpm # for debugging + - dnf # for upgrade + - name: Update packages + how: shell + script: dnf upgrade -y + - name: rpm_qa + order: 100 + how: shell + script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt diff --git a/tests/provision.fmf b/tests/provision.fmf deleted file mode 100644 index 1a4f0f0..0000000 --- a/tests/provision.fmf +++ /dev/null @@ -1,4 +0,0 @@ ---- -standard-inventory-qcow2: - qemu: - m: 3G # Amount of VM memory diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 8a4ba6b..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,67 +0,0 @@ ---- -- hosts: localhost - tags: - - classic - tasks: - - dnf: - name: "*" - state: latest - -- hosts: localhost - roles: - - role: standard-test-basic - tags: - - classic - repositories: - - repo: "https://src.fedoraproject.org/tests/python.git" - dest: "python" - pybasever: "3.13" - tests: - - rpm_qa: - run: rpm -qa - - smoke: - dir: python/smoke - run: "VERSION={{ pybasever }} CYTHON=false ./venv.sh" - - smoke_virtualenv: - dir: python/smoke - run: "VERSION={{ pybasever }} METHOD=virtualenv CYTHON=false ./venv.sh" - - debugsmoke: - dir: python/smoke - run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} CYTHON=false ./venv.sh" - - selftest: - dir: python/selftest - run: "VERSION={{ pybasever }} X='-i test_check_probes' ./parallel.sh" - - debugtest: - dir: python/selftest - run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='-i test_check_probes' ./parallel.sh" - - optimizedflags: - dir: python/flags - run: "python{{ pybasever }} ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" - - debugflags: - dir: python/flags - run: "python{{ pybasever }}d ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" - - freethreadingflags: - dir: python/flags - run: "python{{ pybasever }}t ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" - - freethreadingdebugflags: - dir: python/flags - run: "python{{ pybasever }}td ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" - - marshalparser: - dir: python/marshalparser - run: "VERSION={{ pybasever }} SAMPLE=10 test_marshalparser_compatibility.sh" - required_packages: - - gcc # for extension building in venv and selftest - - gcc-c++ # for test_cppext - - gdb # for test_gdb - - "python{{ pybasever }}" # the test subject - - "python{{ pybasever }}-debug" # for leak testing - - "python{{ pybasever }}-devel" # for extension building in venv and selftest - - "python{{ pybasever }}-tkinter" # for selftest - - "python{{ pybasever }}-test" # for selftest - - "python{{ pybasever }}-freethreading" # for -O... flag test - - "python{{ pybasever }}-freethreading-debug" # for -O... flag test - - tox # for venv tests - - virtualenv # for virtualenv tests - - glibc-all-langpacks # for locale tests - - marshalparser # for testing compatibility (magic numbers) with marshalparser - - rpm # for debugging From 0f632505c6f1b49cc6a9de408c30d4d0392a0083 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Thu, 7 Aug 2025 09:44:15 +0200 Subject: [PATCH 37/60] Update to 3.13.6 --- ...eel-in-test-venvs-when-setuptools-71.patch | 4 +- ...-pac-and-bti-protections-for-aarch64.patch | 4 +- ...not-working-with-older-expat-version.patch | 6 +- 00467-CVE-2025-8194.patch | 214 ------------------ python3.13.spec | 32 ++- sources | 4 +- 6 files changed, 24 insertions(+), 240 deletions(-) delete mode 100644 00467-CVE-2025-8194.patch diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch index 6b071ad..e7ca5a2 100644 --- a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch +++ b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch @@ -9,10 +9,10 @@ Subject: 00461: Downstream only: Install wheel in test venvs when setuptools < 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py -index c2b407159a..5c2efc4a51 100644 +index c60fc03064..731828879f 100644 --- a/Lib/test/support/__init__.py +++ b/Lib/test/support/__init__.py -@@ -2428,9 +2428,16 @@ def run_command(cmd): +@@ -2434,9 +2434,16 @@ def run_command(cmd): else: python = os.path.join(venv, 'bin', python_exe) diff --git a/00464-enable-pac-and-bti-protections-for-aarch64.patch b/00464-enable-pac-and-bti-protections-for-aarch64.patch index 9404072..1a7acf3 100644 --- a/00464-enable-pac-and-bti-protections-for-aarch64.patch +++ b/00464-enable-pac-and-bti-protections-for-aarch64.patch @@ -22,7 +22,7 @@ hardware protections can be enabled without losing Perf unwinding. create mode 100644 Python/asm_trampoline_aarch64.h diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S -index 616752459b..ec205a08ef 100644 +index a14e68c0e8..2513cde4e7 100644 --- a/Python/asm_trampoline.S +++ b/Python/asm_trampoline.S @@ -1,3 +1,5 @@ @@ -31,7 +31,7 @@ index 616752459b..ec205a08ef 100644 .text .globl _Py_trampoline_func_start # The following assembly is equivalent to: -@@ -20,10 +22,12 @@ _Py_trampoline_func_start: +@@ -21,10 +23,12 @@ _Py_trampoline_func_start: #if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__) // ARM64 little endian, 64bit ABI // generate with aarch64-linux-gnu-gcc 12.1 diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch index 1653ee5..af1bf77 100644 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -41,10 +41,10 @@ index 9b3014a94a..90401e0d8f 100644 result = BytesIO() xmlgen = XMLGenerator(result) diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py -index bd75c00e50..9a1e020d24 100644 +index 12efa006cd..adcea4b204 100644 --- a/Lib/test/test_xml_etree.py +++ b/Lib/test/test_xml_etree.py -@@ -1521,9 +1521,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): +@@ -1548,9 +1548,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): self.assert_event_tags(parser, [('end', 'root')]) self.assertIsNone(parser.close()) @@ -58,7 +58,7 @@ index bd75c00e50..9a1e020d24 100644 def test_simple_xml_chunk_5(self): self.test_simple_xml(chunk_size=5, flush=True) -@@ -1748,6 +1752,8 @@ def test_flush_reparse_deferral_enabled(self): +@@ -1775,6 +1779,8 @@ def test_flush_reparse_deferral_enabled(self): self.assert_event_tags(parser, [('end', 'doc')]) diff --git a/00467-CVE-2025-8194.patch b/00467-CVE-2025-8194.patch deleted file mode 100644 index 6d5ef78..0000000 --- a/00467-CVE-2025-8194.patch +++ /dev/null @@ -1,214 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Alexander Urieles -Date: Mon, 28 Jul 2025 17:37:26 +0200 -Subject: 00467: gh-130577: tarfile now validates archives to ensure member - offsets are non-negative - -(cherry picked from commit 7040aa54f14676938970e10c5f74ea93cd56aa38) - -Co-authored-by: Alexander Urieles -Co-authored-by: Gregory P. Smith ---- - Lib/tarfile.py | 3 + - Lib/test/test_tarfile.py | 156 ++++++++++++++++++ - ...-07-23-00-35-29.gh-issue-130577.c7EITy.rst | 3 + - 3 files changed, 162 insertions(+) - create mode 100644 Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst - -diff --git a/Lib/tarfile.py b/Lib/tarfile.py -index 0980f6a817..9ff9df696d 100755 ---- a/Lib/tarfile.py -+++ b/Lib/tarfile.py -@@ -1636,6 +1636,9 @@ def _block(self, count): - """Round up a byte count by BLOCKSIZE and return it, - e.g. _block(834) => 1024. - """ -+ # Only non-negative offsets are allowed -+ if count < 0: -+ raise InvalidHeaderError("invalid offset") - blocks, remainder = divmod(count, BLOCKSIZE) - if remainder: - blocks += 1 -diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py -index ac31be0f05..7024be46de 100644 ---- a/Lib/test/test_tarfile.py -+++ b/Lib/test/test_tarfile.py -@@ -50,6 +50,7 @@ def sha256sum(data): - xzname = os.path.join(TEMPDIR, "testtar.tar.xz") - tmpname = os.path.join(TEMPDIR, "tmp.tar") - dotlessname = os.path.join(TEMPDIR, "testtar") -+SPACE = b" " - - sha256_regtype = ( - "e09e4bc8b3c9d9177e77256353b36c159f5f040531bbd4b024a8f9b9196c71ce" -@@ -4578,6 +4579,161 @@ def extractall(self, ar): - ar.extractall(self.testdir, filter='fully_trusted') - - -+class OffsetValidationTests(unittest.TestCase): -+ tarname = tmpname -+ invalid_posix_header = ( -+ # name: 100 bytes -+ tarfile.NUL * tarfile.LENGTH_NAME -+ # mode, space, null terminator: 8 bytes -+ + b"000755" + SPACE + tarfile.NUL -+ # uid, space, null terminator: 8 bytes -+ + b"000001" + SPACE + tarfile.NUL -+ # gid, space, null terminator: 8 bytes -+ + b"000001" + SPACE + tarfile.NUL -+ # size, space: 12 bytes -+ + b"\xff" * 11 + SPACE -+ # mtime, space: 12 bytes -+ + tarfile.NUL * 11 + SPACE -+ # chksum: 8 bytes -+ + b"0011407" + tarfile.NUL -+ # type: 1 byte -+ + tarfile.REGTYPE -+ # linkname: 100 bytes -+ + tarfile.NUL * tarfile.LENGTH_LINK -+ # magic: 6 bytes, version: 2 bytes -+ + tarfile.POSIX_MAGIC -+ # uname: 32 bytes -+ + tarfile.NUL * 32 -+ # gname: 32 bytes -+ + tarfile.NUL * 32 -+ # devmajor, space, null terminator: 8 bytes -+ + tarfile.NUL * 6 + SPACE + tarfile.NUL -+ # devminor, space, null terminator: 8 bytes -+ + tarfile.NUL * 6 + SPACE + tarfile.NUL -+ # prefix: 155 bytes -+ + tarfile.NUL * tarfile.LENGTH_PREFIX -+ # padding: 12 bytes -+ + tarfile.NUL * 12 -+ ) -+ invalid_gnu_header = ( -+ # name: 100 bytes -+ tarfile.NUL * tarfile.LENGTH_NAME -+ # mode, null terminator: 8 bytes -+ + b"0000755" + tarfile.NUL -+ # uid, null terminator: 8 bytes -+ + b"0000001" + tarfile.NUL -+ # gid, space, null terminator: 8 bytes -+ + b"0000001" + tarfile.NUL -+ # size, space: 12 bytes -+ + b"\xff" * 11 + SPACE -+ # mtime, space: 12 bytes -+ + tarfile.NUL * 11 + SPACE -+ # chksum: 8 bytes -+ + b"0011327" + tarfile.NUL -+ # type: 1 byte -+ + tarfile.REGTYPE -+ # linkname: 100 bytes -+ + tarfile.NUL * tarfile.LENGTH_LINK -+ # magic: 8 bytes -+ + tarfile.GNU_MAGIC -+ # uname: 32 bytes -+ + tarfile.NUL * 32 -+ # gname: 32 bytes -+ + tarfile.NUL * 32 -+ # devmajor, null terminator: 8 bytes -+ + tarfile.NUL * 8 -+ # devminor, null terminator: 8 bytes -+ + tarfile.NUL * 8 -+ # padding: 167 bytes -+ + tarfile.NUL * 167 -+ ) -+ invalid_v7_header = ( -+ # name: 100 bytes -+ tarfile.NUL * tarfile.LENGTH_NAME -+ # mode, space, null terminator: 8 bytes -+ + b"000755" + SPACE + tarfile.NUL -+ # uid, space, null terminator: 8 bytes -+ + b"000001" + SPACE + tarfile.NUL -+ # gid, space, null terminator: 8 bytes -+ + b"000001" + SPACE + tarfile.NUL -+ # size, space: 12 bytes -+ + b"\xff" * 11 + SPACE -+ # mtime, space: 12 bytes -+ + tarfile.NUL * 11 + SPACE -+ # chksum: 8 bytes -+ + b"0010070" + tarfile.NUL -+ # type: 1 byte -+ + tarfile.REGTYPE -+ # linkname: 100 bytes -+ + tarfile.NUL * tarfile.LENGTH_LINK -+ # padding: 255 bytes -+ + tarfile.NUL * 255 -+ ) -+ valid_gnu_header = tarfile.TarInfo("filename").tobuf(tarfile.GNU_FORMAT) -+ data_block = b"\xff" * tarfile.BLOCKSIZE -+ -+ def _write_buffer(self, buffer): -+ with open(self.tarname, "wb") as f: -+ f.write(buffer) -+ -+ def _get_members(self, ignore_zeros=None): -+ with open(self.tarname, "rb") as f: -+ with tarfile.open( -+ mode="r", fileobj=f, ignore_zeros=ignore_zeros -+ ) as tar: -+ return tar.getmembers() -+ -+ def _assert_raises_read_error_exception(self): -+ with self.assertRaisesRegex( -+ tarfile.ReadError, "file could not be opened successfully" -+ ): -+ self._get_members() -+ -+ def test_invalid_offset_header_validations(self): -+ for tar_format, invalid_header in ( -+ ("posix", self.invalid_posix_header), -+ ("gnu", self.invalid_gnu_header), -+ ("v7", self.invalid_v7_header), -+ ): -+ with self.subTest(format=tar_format): -+ self._write_buffer(invalid_header) -+ self._assert_raises_read_error_exception() -+ -+ def test_early_stop_at_invalid_offset_header(self): -+ buffer = self.valid_gnu_header + self.invalid_gnu_header + self.valid_gnu_header -+ self._write_buffer(buffer) -+ members = self._get_members() -+ self.assertEqual(len(members), 1) -+ self.assertEqual(members[0].name, "filename") -+ self.assertEqual(members[0].offset, 0) -+ -+ def test_ignore_invalid_archive(self): -+ # 3 invalid headers with their respective data -+ buffer = (self.invalid_gnu_header + self.data_block) * 3 -+ self._write_buffer(buffer) -+ members = self._get_members(ignore_zeros=True) -+ self.assertEqual(len(members), 0) -+ -+ def test_ignore_invalid_offset_headers(self): -+ for first_block, second_block, expected_offset in ( -+ ( -+ (self.valid_gnu_header), -+ (self.invalid_gnu_header + self.data_block), -+ 0, -+ ), -+ ( -+ (self.invalid_gnu_header + self.data_block), -+ (self.valid_gnu_header), -+ 1024, -+ ), -+ ): -+ self._write_buffer(first_block + second_block) -+ members = self._get_members(ignore_zeros=True) -+ self.assertEqual(len(members), 1) -+ self.assertEqual(members[0].name, "filename") -+ self.assertEqual(members[0].offset, expected_offset) -+ -+ - def setUpModule(): - os_helper.unlink(TEMPDIR) - os.makedirs(TEMPDIR) -diff --git a/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst -new file mode 100644 -index 0000000000..342cabbc86 ---- /dev/null -+++ b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst -@@ -0,0 +1,3 @@ -+:mod:`tarfile` now validates archives to ensure member offsets are -+non-negative. (Contributed by Alexander Enrique Urieles Nieto in -+:gh:`130577`.) diff --git a/python3.13.spec b/python3.13.spec index dc18f57..3d67881 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,11 +45,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.5 +%global general_version %{pybasever}.6 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 4%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -109,31 +109,30 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 25.1.1 +%global pip_version 25.2 %global setuptools_version 79.0.1 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: -Provides: bundled(python3dist(cachecontrol)) = 0.14.2 -Provides: bundled(python3dist(certifi)) = 2025.1.31 +Provides: bundled(python3dist(cachecontrol)) = 0.14.3 +Provides: bundled(python3dist(certifi)) = 2025.7.14 Provides: bundled(python3dist(dependency-groups)) = 1.3.1 -Provides: bundled(python3dist(distlib)) = 0.3.9 +Provides: bundled(python3dist(distlib)) = 0.4 Provides: bundled(python3dist(distro)) = 1.9 Provides: bundled(python3dist(idna)) = 3.10 -Provides: bundled(python3dist(msgpack)) = 1.1 +Provides: bundled(python3dist(msgpack)) = 1.1.1 Provides: bundled(python3dist(packaging)) = 25 -Provides: bundled(python3dist(platformdirs)) = 4.3.7 -Provides: bundled(python3dist(pygments)) = 2.19.1 +Provides: bundled(python3dist(platformdirs)) = 4.3.8 +Provides: bundled(python3dist(pygments)) = 2.19.2 Provides: bundled(python3dist(pyproject-hooks)) = 1.2 -Provides: bundled(python3dist(requests)) = 2.32.3 -Provides: bundled(python3dist(resolvelib)) = 1.1 -Provides: bundled(python3dist(rich)) = 14 +Provides: bundled(python3dist(requests)) = 2.32.4 +Provides: bundled(python3dist(resolvelib)) = 1.2 +Provides: bundled(python3dist(rich)) = 14.1 Provides: bundled(python3dist(setuptools)) = 70.3 Provides: bundled(python3dist(tomli)) = 2.2.1 Provides: bundled(python3dist(tomli-w)) = 1.2 Provides: bundled(python3dist(truststore)) = 0.10.1 -Provides: bundled(python3dist(typing-extensions)) = 4.13.2 Provides: bundled(python3dist(urllib3)) = 1.26.20 } # setuptools @@ -399,10 +398,6 @@ Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch # which is tested as working. Patch466: 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch -# 00467 # e4a33ed8bbb729606c58ba1e80bac5cfedf29147 -# gh-130577: tarfile now validates archives to ensure member offsets are non-negative -Patch467: 00467-CVE-2025-8194.patch - # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1744,6 +1739,9 @@ CheckPython freethreading # ====================================================== %changelog +* Thu Aug 07 2025 Tomáš Hrnčiar - 3.13.5-5 +- Update to 3.13.6 + * Mon Jul 28 2025 Miro Hrončok - 3.13.5-4 - Fix CVE-2025-8194: Tarfile infinite loop during parsing with negative member offset diff --git a/sources b/sources index 0bc8e56..ad0e635 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.5.tar.xz) = 2a058072e87b614b204bd1321b2bfa9c4b6614dbd5ded98dc0ee51c0d6b81504f902b7c003ad14295b371a37918f6975dc37d5a9c836dd9c30f8b086e4759193 -SHA512 (Python-3.13.5.tar.xz.asc) = 07c1a2ec2d6ba2805680b7f1dc262fdc5dc3eec4503780ecdc08cd570ccbb5f1efa736ee03c83d36bdb33ce87db06be5892cf5a6eaf4018d5fe78fff99e615ae +SHA512 (Python-3.13.6.tar.xz) = fca724dbb4f3fed889d0b51c86ee0559c70ee2c7aba1d8b089b08538d82411ec9e6bc9c7a39c1dc4bb4f13b5cf0d9a332f7759412fa540a1940477cb47052316 +SHA512 (Python-3.13.6.tar.xz.asc) = 133b2c017f9f8cf93209f11bb398908528dabf9b66ece034cb8a26fc9550b84a3589f85deb1acfe322b01db20da083c039ce91db1452bdda9fb885a948d53c50 From 666e5f924e88f8b789a4806e1b943135e7eb25d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 14 Aug 2025 23:01:00 +0200 Subject: [PATCH 38/60] Update to 3.13.7 --- python3.13.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index 3d67881..578adc4 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,7 +45,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.6 +%global general_version %{pybasever}.7 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} @@ -1739,6 +1739,9 @@ CheckPython freethreading # ====================================================== %changelog +* Thu Aug 14 2025 Miro Hrončok - 3.13.7-1 +- Update to 3.13.7 + * Thu Aug 07 2025 Tomáš Hrnčiar - 3.13.5-5 - Update to 3.13.6 diff --git a/sources b/sources index ad0e635..c08163a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.6.tar.xz) = fca724dbb4f3fed889d0b51c86ee0559c70ee2c7aba1d8b089b08538d82411ec9e6bc9c7a39c1dc4bb4f13b5cf0d9a332f7759412fa540a1940477cb47052316 -SHA512 (Python-3.13.6.tar.xz.asc) = 133b2c017f9f8cf93209f11bb398908528dabf9b66ece034cb8a26fc9550b84a3589f85deb1acfe322b01db20da083c039ce91db1452bdda9fb885a948d53c50 +SHA512 (Python-3.13.7.tar.xz) = 73fa04db860e8b98c204f84d403598fcb802b19bfc8f2675df2fddb6b153b1643daf081746a043f57c8fa71b950a439581aa5204c2bfadb8cfd8864ca4f42f0d +SHA512 (Python-3.13.7.tar.xz.asc) = 71cd002c18ebb47861abd3309c8cf38972d3d916cca5595d895ba3940719243c66fa28595c2370a8846d9d1c4b3cb4ac5baeda9e9cf94be30302892d01df5e87 From 66c0a64ef8eb09a16c023375e069bd36cb30ee43 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Tue, 26 Aug 2025 10:01:22 +0200 Subject: [PATCH 39/60] rpminspect: Wrap strings with globs with single quotes It seems to be required since rpminspect 2.0: https://github.com/rpminspect/rpminspect/commit/1593c38ce46980e0279150706d1f7c7bdd82de28 --- rpminspect.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index 83dfb5e..8cc18cb 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,22 +1,22 @@ # exclude test XML data (not always valid) from XML validity check: xml: ignore: - - /usr/lib*/python*/test/xmltestdata/* - - /usr/lib*/python*/test/xmltestdata/*/* + - '/usr/lib*/python*/test/xmltestdata/*' + - '/usr/lib*/python*/test/xmltestdata/*/*' # exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only badfuncs: allowed: - /usr/lib*/python*/lib-dynload/_socket.*: + '/usr/lib*/python*/lib-dynload/_socket.*': - inet_aton - inet_ntoa # exclude the debug build from annocheck entirely annocheck: ignore: - - /usr/bin/python*d - - /usr/lib*/libpython*d.so.1.0 - - /usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so + - '/usr/bin/python*d' + - '/usr/lib*/libpython*d.so.1.0' + - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so' # don't report changed content of compiled files # that is expected with every toolchain update and not reproducible yet From 3643baab9a24912545754b507eb80a73384e72a9 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Wed, 24 Sep 2025 16:42:29 +0200 Subject: [PATCH 40/60] Include licenses of incorporated software (rhbz#2133426) Python includes a lot of differently licensed functions and modules. We gather the list from https://docs.python.org/3.13/license.html. Detect changes to Doc/license.rst with file hash automatically in %prep. --- python3.13.spec | 47 ++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 42 insertions(+), 5 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index 578adc4..212f53b 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -518,9 +518,38 @@ This package contains /usr/bin/python - the "python" command that runs Python 3. %package -n %{pkgname}-libs Summary: Python runtime libraries -# Bundled libb2 is CC0, covered by grandfathering exception -# Bundled mimalloc is MIT -%global libs_license Python-2.0.1 AND CC0-1.0 AND MIT +# Python is generally licensed as Python-2.0.1 but also includes incorporated software +# Combined manually from https://docs.python.org/3.13/license.html +# Hash of Doc/license.rst which is compared in %%prep, generated with: +# $ sha256sum Doc/license.rst | cut -f1 -d" " +%global license_file_hash 62f2c9c2c75d511170eb464ad5f83b78cc1f37eb2eb49c2846c9aa6c4557ee99 +# Licenses of incorporated software: +# Mersenne Twister in _random C extension contains code under BSD-3-Clause +# socket.getaddrinfo() and socket.getnameinfo() are BSD-3-Clause +# test.support.asynchat and test.support.asyncore are MIT-CMU +# http.cookies is MIT-CMU +# trace is under temporary SPDX ref: https://gitlab.com/fedora/legal/fedora-license-data/-/issues/657 +# trace: LicenseRef-Fedora-Temporary-Python-trace +# uu is MIT-CMU +# xmlrpc.client is MIT-CMU +# test.test_epoll is MIT +# select kqueue interface is BSD-2-Clause +# SipHash algorithm in Python/pyhash.c is MIT +# strtod and dtoa are dtoa +# OpenSSL is not bundled +# expat is not bundled +# libffi is not bundled +# zlib is not bundled +# cfuhash used by tracemalloc is BSD-3-Clause +# libmpdec is not bundled +# C14N test suite in Lib/test/xmltestdata/c14n-20/ is BSD-3-Clause +# mimalloc is MIT +# parts of asyncio from uvloop are MIT +# Python/qsbr.c is adapted from code under BSD-2-Clause +# Bundled libb2 is not declared in the upstream document, but it's: +# CC0-1.0, covered by grandfathering exception +# We don't query upstream for changes, as 3.13 is the last Python version containing it. +%global libs_license Python-2.0.1 AND CC0-1.0 AND MIT AND BSD-3-Clause AND MIT-CMU AND LicenseRef-Fedora-Temporary-Python-trace AND BSD-2-Clause AND dtoa %if %{with rpmwheels} Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2 License: %{libs_license} @@ -528,7 +557,7 @@ License: %{libs_license} Provides: bundled(python3dist(pip)) = %{pip_version} %pip_bundled_provides # License combined from Python libs + pip -License: %{libs_license} AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause) +License: %{libs_license} AND Apache-2.0 AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause) %endif %unversioned_obsoletes_of_python3_X_if_main libs @@ -723,7 +752,7 @@ Provides: bundled(python3dist(pip)) = %{pip_version} Provides: bundled(python3dist(setuptools)) = %{setuptools_version} %setuptools_bundled_provides # License combined from Python libs + pip + setuptools -License: %{libs_license} AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause) +License: %{libs_license} AND Apache-2.0 AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause) %endif # This package doesn't depend on python3-libs, so we need to explicitly @@ -792,6 +821,14 @@ rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl rm Lib/test/wheeldata/setuptools-%{setuptools_version}-py3-none-any.whl %endif +# check if there were any changes to Doc/license.rst +# if so, a review of %%libs_license and %%license_file_hash is needed +found_hash=$(sha256sum Doc/license.rst | cut -f1 -d" ") +if [ "$found_hash" != %{license_file_hash} ]; then + echo "File hash mismatch: review Doc/license.rst for changes" + exit 1 +fi + # Remove all exe files to ensure we are not shipping prebuilt binaries # note that those are only used to create Microsoft Windows installers # and that functionality is broken on Linux anyway From a362f2a9e12e6ed3ce0aa106c1ae48a63316aa42 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Tue, 7 Oct 2025 17:28:26 +0200 Subject: [PATCH 41/60] Update to Python 3.13.8 --- 00251-change-user-install-location.patch | 8 ++++---- ...y-install-wheel-in-test-venvs-when-setuptools-71.patch | 4 ++-- ...-skip-tests-not-working-with-older-expat-version.patch | 8 ++++---- python3.13.spec | 5 ++++- sources | 4 ++-- 5 files changed, 16 insertions(+), 13 deletions(-) diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch index a4a78b6..7fc8844 100644 --- a/00251-change-user-install-location.patch +++ b/00251-change-user-install-location.patch @@ -51,7 +51,7 @@ index aedf36399c..2ae49a8029 100644 if os.path.isdir(sitedir): addsitedir(sitedir, known_paths) diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py -index 510c7b9568..6e4e07e43b 100644 +index f7bd675bb3..f1ff347c3d 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py @@ -106,6 +106,12 @@ @@ -130,7 +130,7 @@ index 510c7b9568..6e4e07e43b 100644 # On Windows we want to substitute 'lib' for schemes rather # than the native value (without modifying vars, in case it diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py -index aca02c06bc..a4d0db0da8 100644 +index 9723300f51..310706652a 100644 --- a/Lib/test/test_sysconfig.py +++ b/Lib/test/test_sysconfig.py @@ -130,8 +130,19 @@ def test_get_path(self): @@ -154,7 +154,7 @@ index aca02c06bc..a4d0db0da8 100644 os.path.normpath(expected), ) -@@ -386,7 +397,7 @@ def test_get_config_h_filename(self): +@@ -393,7 +404,7 @@ def test_get_config_h_filename(self): self.assertTrue(os.path.isfile(config_h), config_h) def test_get_scheme_names(self): @@ -163,7 +163,7 @@ index aca02c06bc..a4d0db0da8 100644 if HAS_USER_BASE: wanted.extend(['nt_user', 'osx_framework_user', 'posix_user']) self.assertEqual(get_scheme_names(), tuple(sorted(wanted))) -@@ -398,6 +409,8 @@ def test_symlink(self): # Issue 7880 +@@ -405,6 +416,8 @@ def test_symlink(self): # Issue 7880 cmd = "-c", "import sysconfig; print(sysconfig.get_platform())" self.assertEqual(py.call_real(*cmd), py.call_link(*cmd)) diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch index e7ca5a2..ee4cc9a 100644 --- a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch +++ b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch @@ -9,10 +9,10 @@ Subject: 00461: Downstream only: Install wheel in test venvs when setuptools < 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py -index c60fc03064..731828879f 100644 +index 4605938b87..a0055d6887 100644 --- a/Lib/test/support/__init__.py +++ b/Lib/test/support/__init__.py -@@ -2434,9 +2434,16 @@ def run_command(cmd): +@@ -2462,9 +2462,16 @@ def run_command(cmd): else: python = os.path.join(venv, 'bin', python_exe) diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch index af1bf77..a5c383a 100644 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -15,10 +15,10 @@ which is tested as working. 3 files changed, 10 insertions(+) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py -index 1d56ccd71c..5ef5517828 100644 +index a091430463..55ebf34c52 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py -@@ -790,6 +790,8 @@ def start_element(name, _): +@@ -826,6 +826,8 @@ def start_element(name, _): self.assertEqual(started, ['doc']) @@ -41,7 +41,7 @@ index 9b3014a94a..90401e0d8f 100644 result = BytesIO() xmlgen = XMLGenerator(result) diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py -index 12efa006cd..adcea4b204 100644 +index 78598b35da..802d1399ea 100644 --- a/Lib/test/test_xml_etree.py +++ b/Lib/test/test_xml_etree.py @@ -1548,9 +1548,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): @@ -58,7 +58,7 @@ index 12efa006cd..adcea4b204 100644 def test_simple_xml_chunk_5(self): self.test_simple_xml(chunk_size=5, flush=True) -@@ -1775,6 +1779,8 @@ def test_flush_reparse_deferral_enabled(self): +@@ -1777,6 +1781,8 @@ def test_flush_reparse_deferral_enabled(self): self.assert_event_tags(parser, [('end', 'doc')]) diff --git a/python3.13.spec b/python3.13.spec index 212f53b..c24a443 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,7 +45,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.7 +%global general_version %{pybasever}.8 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} @@ -1776,6 +1776,9 @@ CheckPython freethreading # ====================================================== %changelog +* Tue Oct 07 2025 Karolina Surma - 3.13.8-1 +- Update to Python 3.13.8 + * Thu Aug 14 2025 Miro Hrončok - 3.13.7-1 - Update to 3.13.7 diff --git a/sources b/sources index c08163a..858b07b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.7.tar.xz) = 73fa04db860e8b98c204f84d403598fcb802b19bfc8f2675df2fddb6b153b1643daf081746a043f57c8fa71b950a439581aa5204c2bfadb8cfd8864ca4f42f0d -SHA512 (Python-3.13.7.tar.xz.asc) = 71cd002c18ebb47861abd3309c8cf38972d3d916cca5595d895ba3940719243c66fa28595c2370a8846d9d1c4b3cb4ac5baeda9e9cf94be30302892d01df5e87 +SHA512 (Python-3.13.8.tar.xz) = 8569959f24083824f6644b839c6ebd587e67fb74b3c5fed9ef44bfbbba46076e98db33a27218b2d44edd15b3b05ae85e94b71491598cbb871d7d43a9d6fa2b84 +SHA512 (Python-3.13.8.tar.xz.asc) = ea5bae3f5a909d16526b614085cd4543153800348dd82ef90945ceed19acbab8db76f7c1279e39d26b9e69608aa0f7cf1eab9a562d00fd1c9badd5b0fafc5c21 From edb5d531040ec48f1c5e0773e513a08539da5896 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 14 Oct 2025 23:40:57 +0200 Subject: [PATCH 42/60] Update to Python 3.13.9 --- python3.13.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index c24a443..d13fd25 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,7 +45,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.8 +%global general_version %{pybasever}.9 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} @@ -1776,6 +1776,9 @@ CheckPython freethreading # ====================================================== %changelog +* Tue Oct 14 2025 Miro Hrončok - 3.13.9-1 +- Update to Python 3.13.9 + * Tue Oct 07 2025 Karolina Surma - 3.13.8-1 - Update to Python 3.13.8 diff --git a/sources b/sources index 858b07b..2959089 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.8.tar.xz) = 8569959f24083824f6644b839c6ebd587e67fb74b3c5fed9ef44bfbbba46076e98db33a27218b2d44edd15b3b05ae85e94b71491598cbb871d7d43a9d6fa2b84 -SHA512 (Python-3.13.8.tar.xz.asc) = ea5bae3f5a909d16526b614085cd4543153800348dd82ef90945ceed19acbab8db76f7c1279e39d26b9e69608aa0f7cf1eab9a562d00fd1c9badd5b0fafc5c21 +SHA512 (Python-3.13.9.tar.xz) = ffc9b6e545bf5cf8f3b945f85442eb4bd28cca9adb92d8c253f44078ec2e9758f802bf72c48e0d7e503c02b2dc754c58ee913cd3b7d8e8808fac2a0aa4e006a8 +SHA512 (Python-3.13.9.tar.xz.asc) = c33fba3a6b22dccc08beb7f13bd61a25a30f609a54da7c8dfd3b3b4a3490a7b24c11f9617a835388f22709fb09375d35febc417cf104a18f5bec3b43ec999e82 From 1f3785e7030deed72021a39b95b4e9b5208b7ebd Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Mon, 13 Oct 2025 10:16:25 +0200 Subject: [PATCH 43/60] trace is officially licensed as HPND-SMC https://gitlab.com/fedora/legal/fedora-license-data/-/issues/657#note_2815942473 --- python3.13.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index d13fd25..8965bf9 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -528,8 +528,7 @@ Summary: Python runtime libraries # socket.getaddrinfo() and socket.getnameinfo() are BSD-3-Clause # test.support.asynchat and test.support.asyncore are MIT-CMU # http.cookies is MIT-CMU -# trace is under temporary SPDX ref: https://gitlab.com/fedora/legal/fedora-license-data/-/issues/657 -# trace: LicenseRef-Fedora-Temporary-Python-trace +# trace is HPND-SMC # uu is MIT-CMU # xmlrpc.client is MIT-CMU # test.test_epoll is MIT @@ -549,7 +548,7 @@ Summary: Python runtime libraries # Bundled libb2 is not declared in the upstream document, but it's: # CC0-1.0, covered by grandfathering exception # We don't query upstream for changes, as 3.13 is the last Python version containing it. -%global libs_license Python-2.0.1 AND CC0-1.0 AND MIT AND BSD-3-Clause AND MIT-CMU AND LicenseRef-Fedora-Temporary-Python-trace AND BSD-2-Clause AND dtoa +%global libs_license Python-2.0.1 AND CC0-1.0 AND MIT AND BSD-3-Clause AND MIT-CMU AND HPND-SMC AND BSD-2-Clause AND dtoa %if %{with rpmwheels} Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2 License: %{libs_license} From f17c52832ba6d12d2e7f5b641fcdcedcdc264802 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Fri, 5 Sep 2025 13:26:16 +0000 Subject: [PATCH 44/60] Inject SBOM into the installed wheels (when using the bundled ones) --- python3.13.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/python3.13.spec b/python3.13.spec index 8965bf9..c93edf0 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -1263,6 +1263,11 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py' rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py} done +%if %{without rpmwheels} +# Inject SBOM into the installed wheels (if the macro is available) +%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl} +%endif + # ====================================================== # Checks for packaging issues # ====================================================== From efb1f534c5421c16f633bfa550ce8301f55aef9c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Wed, 3 Dec 2025 09:43:54 +0100 Subject: [PATCH 45/60] Update to 3.13.10 --- 00251-change-user-install-location.patch | 2 +- ...eel-in-test-venvs-when-setuptools-71.patch | 32 ------------------- ...not-working-with-older-expat-version.patch | 10 +++--- python3.13.spec | 27 ++++++++-------- sources | 4 +-- 5 files changed, 21 insertions(+), 54 deletions(-) delete mode 100644 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch index 7fc8844..89bc027 100644 --- a/00251-change-user-install-location.patch +++ b/00251-change-user-install-location.patch @@ -30,7 +30,7 @@ Co-authored-by: Lumír Balhar 3 files changed, 72 insertions(+), 4 deletions(-) diff --git a/Lib/site.py b/Lib/site.py -index aedf36399c..2ae49a8029 100644 +index 041dca113a..ca6320df2f 100644 --- a/Lib/site.py +++ b/Lib/site.py @@ -415,8 +415,15 @@ def getsitepackages(prefixes=None): diff --git a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch b/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch deleted file mode 100644 index ee4cc9a..0000000 --- a/00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= -Date: Fri, 25 Apr 2025 09:33:37 +0200 -Subject: 00461: Downstream only: Install wheel in test venvs when setuptools < - 71 - ---- - Lib/test/support/__init__.py | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py -index 4605938b87..a0055d6887 100644 ---- a/Lib/test/support/__init__.py -+++ b/Lib/test/support/__init__.py -@@ -2462,9 +2462,16 @@ def run_command(cmd): - else: - python = os.path.join(venv, 'bin', python_exe) - -+ setuptools_whl = _findwheel('setuptools') -+ whl_filename = os.path.basename(setuptools_whl) -+ setuptools_major = int(whl_filename.split('-')[1].split('.')[0]) -+ if setuptools_major >= 71: # we need 70.1+, but that's OK -+ wheels = (setuptools_whl,) -+ else: -+ wheels = (setuptools_whl, _findwheel('wheel')) - cmd = (python, '-X', 'dev', - '-m', 'pip', 'install', -- _findwheel('setuptools'), -+ *wheels, - ) - run_command(cmd) - diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch index a5c383a..493d7e2 100644 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -15,10 +15,10 @@ which is tested as working. 3 files changed, 10 insertions(+) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py -index a091430463..55ebf34c52 100644 +index cd98407c34..042a3bb9df 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py -@@ -826,6 +826,8 @@ def start_element(name, _): +@@ -846,6 +846,8 @@ def start_element(name, _): self.assertEqual(started, ['doc']) @@ -41,10 +41,10 @@ index 9b3014a94a..90401e0d8f 100644 result = BytesIO() xmlgen = XMLGenerator(result) diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py -index 78598b35da..802d1399ea 100644 +index fba36d5b57..ccda19fa07 100644 --- a/Lib/test/test_xml_etree.py +++ b/Lib/test/test_xml_etree.py -@@ -1548,9 +1548,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): +@@ -1574,9 +1574,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): self.assert_event_tags(parser, [('end', 'root')]) self.assertIsNone(parser.close()) @@ -58,7 +58,7 @@ index 78598b35da..802d1399ea 100644 def test_simple_xml_chunk_5(self): self.test_simple_xml(chunk_size=5, flush=True) -@@ -1777,6 +1781,8 @@ def test_flush_reparse_deferral_enabled(self): +@@ -1803,6 +1807,8 @@ def test_flush_reparse_deferral_enabled(self): self.assert_event_tags(parser, [('end', 'doc')]) diff --git a/python3.13.spec b/python3.13.spec index c93edf0..662ff00 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,7 +45,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.9 +%global general_version %{pybasever}.10 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} @@ -109,30 +109,30 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 25.2 +%global pip_version 25.3 %global setuptools_version 79.0.1 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: Provides: bundled(python3dist(cachecontrol)) = 0.14.3 -Provides: bundled(python3dist(certifi)) = 2025.7.14 +Provides: bundled(python3dist(certifi)) = 2025.10.5 Provides: bundled(python3dist(dependency-groups)) = 1.3.1 Provides: bundled(python3dist(distlib)) = 0.4 Provides: bundled(python3dist(distro)) = 1.9 Provides: bundled(python3dist(idna)) = 3.10 -Provides: bundled(python3dist(msgpack)) = 1.1.1 +Provides: bundled(python3dist(msgpack)) = 1.1.2 Provides: bundled(python3dist(packaging)) = 25 -Provides: bundled(python3dist(platformdirs)) = 4.3.8 +Provides: bundled(python3dist(platformdirs)) = 4.5 Provides: bundled(python3dist(pygments)) = 2.19.2 Provides: bundled(python3dist(pyproject-hooks)) = 1.2 -Provides: bundled(python3dist(requests)) = 2.32.4 -Provides: bundled(python3dist(resolvelib)) = 1.2 -Provides: bundled(python3dist(rich)) = 14.1 +Provides: bundled(python3dist(requests)) = 2.32.5 +Provides: bundled(python3dist(resolvelib)) = 1.2.1 +Provides: bundled(python3dist(rich)) = 14.2 Provides: bundled(python3dist(setuptools)) = 70.3 -Provides: bundled(python3dist(tomli)) = 2.2.1 +Provides: bundled(python3dist(tomli)) = 2.3 Provides: bundled(python3dist(tomli-w)) = 1.2 -Provides: bundled(python3dist(truststore)) = 0.10.1 +Provides: bundled(python3dist(truststore)) = 0.10.4 Provides: bundled(python3dist(urllib3)) = 1.26.20 } # setuptools @@ -368,10 +368,6 @@ Source11: idle3.appdata.xml # pypa/distutils integration: https://github.com/pypa/distutils/pull/70 Patch251: 00251-change-user-install-location.patch -# 00461 # 920175020b21c0aff5edcc4c28d688b5061f591c -# Downstream only: Install wheel in test venvs when setuptools < 71 -Patch461: 00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch - # 00464 # 292acffec7a379cb6d1f3c47b9e5a2f170bbadb6 # Enable PAC and BTI protections for aarch64 # @@ -1780,6 +1776,9 @@ CheckPython freethreading # ====================================================== %changelog +* Wed Dec 03 2025 Tomáš Hrnčiar - 3.13.10-1 +- Update to 3.13.10 + * Tue Oct 14 2025 Miro Hrončok - 3.13.9-1 - Update to Python 3.13.9 diff --git a/sources b/sources index 2959089..5e79178 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.9.tar.xz) = ffc9b6e545bf5cf8f3b945f85442eb4bd28cca9adb92d8c253f44078ec2e9758f802bf72c48e0d7e503c02b2dc754c58ee913cd3b7d8e8808fac2a0aa4e006a8 -SHA512 (Python-3.13.9.tar.xz.asc) = c33fba3a6b22dccc08beb7f13bd61a25a30f609a54da7c8dfd3b3b4a3490a7b24c11f9617a835388f22709fb09375d35febc417cf104a18f5bec3b43ec999e82 +SHA512 (Python-3.13.10.tar.xz) = 7edf3c1008b1df3a067bf03b8218fbd9f5da7226ba17d8ec54e54a30aca5051e6435eb447a999a9665097dbe65fde27356103c3ea5227b5605b233482e037b07 +SHA512 (Python-3.13.10.tar.xz.asc) = b7ef2e4fe9d206e1d20c166224401f6b9bd782323d424e996e0a1cd38a0b7407b994bcc13a63bfa3558482c6775470769c4f11f873b515b8072b75c4cf835011 From 98ab1346cf2914ceb5c18778f985c0f324c0f66e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Fri, 5 Dec 2025 22:38:46 +0100 Subject: [PATCH 46/60] Update to 3.13.11 --- python3.13.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/python3.13.spec b/python3.13.spec index 662ff00..e03320d 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,7 +45,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.10 +%global general_version %{pybasever}.11 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} @@ -1776,6 +1776,9 @@ CheckPython freethreading # ====================================================== %changelog +* Fri Dec 05 2025 Miro Hrončok - 3.13.11-1 +- Update to 3.13.11 + * Wed Dec 03 2025 Tomáš Hrnčiar - 3.13.10-1 - Update to 3.13.10 diff --git a/sources b/sources index 5e79178..9cba034 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.10.tar.xz) = 7edf3c1008b1df3a067bf03b8218fbd9f5da7226ba17d8ec54e54a30aca5051e6435eb447a999a9665097dbe65fde27356103c3ea5227b5605b233482e037b07 -SHA512 (Python-3.13.10.tar.xz.asc) = b7ef2e4fe9d206e1d20c166224401f6b9bd782323d424e996e0a1cd38a0b7407b994bcc13a63bfa3558482c6775470769c4f11f873b515b8072b75c4cf835011 +SHA512 (Python-3.13.11.tar.xz) = 11a910785bb3edeb3888331f29d2514d539f08b07d3125186364ab0e261dab29c7e7c70fe08d89718c38b6053cbe932ac4a6062ac291871e6f4173d29425264a +SHA512 (Python-3.13.11.tar.xz.asc) = 10beaba6d0e84f0335c0add480114e98a64133ec70d320593349de86091ccbdd69743559297f9c8c5e9926089890fd0e7881388e86084f46a413e9579c59d23c From 1b3b52c26453ea6ee7fb228db8b2de3e444b7159 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Tue, 6 Jan 2026 16:51:22 +0100 Subject: [PATCH 47/60] Require at least the same expat version as used during the build In the past we have had a versioned requirement on expat, e.g.: https://src.fedoraproject.org/rpms/python3.13/c/c686992b6c25a39d0e4117053ddb669fd5998723 The explanation is still valid: if Python is built with an expat version with new symbols, and used with an installed older expat, it won't work, preventing crating new venvs, and many more. This has happened again now with expat 2.7.2 introducing new symbols. Reintroduce the versioned requirement and make it future-proof - the generated version will always match at least the one present in the buildroot during the Python build. --- python3.13.spec | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index e03320d..2f3fdd8 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -49,7 +49,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -580,6 +580,22 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa}) # The zoneinfo module needs tzdata Requires: tzdata +# The requirement on libexpat is generated, but we need to version it. +# When built with a specific expat version, but installed with an older one, +# we sometimes get: +# ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so: +# undefined symbol: XML_... +# The pyexpat module has build-time checks for expat version to only use the +# available symbols. However, there is no runtime protection, so when the module +# is later installed with an older expat, it may error due to undefined symbols. +# This breaks many things, including python -m venv. +# We avoid this problem by requiring at least the same version of expat that +# was used during the build time. +# Other subpackages (like -debug) also need this, but they all depend on -libs. +%global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/') +Requires: expat >= %{expat_version} + + %description -n %{pkgname}-libs This package contains runtime libraries for use by Python: - the majority of the Python standard library @@ -756,6 +772,7 @@ License: %{libs_license} AND Apache-2.0 AND ISC AND LGPL-2.1-only AND MPL-2.0 AN Provides: bundled(libb2) = 0.98.1 Provides: bundled(mimalloc) = 2.12 Requires: tzdata +Requires: expat >= %{expat_version} %description -n python%{pybasever}-freethreading The provisional Free Threading (PEP 703) build of Python. @@ -1776,6 +1793,9 @@ CheckPython freethreading # ====================================================== %changelog +* Tue Jan 06 2026 Karolina Surma - 3.13.11-2 +- Require at least the same expat version as used during the build time + * Fri Dec 05 2025 Miro Hrončok - 3.13.11-1 - Update to 3.13.11 From faeed1b6c779b22d6e66a2ff2637599a0ae51732 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Mon, 12 Jan 2026 11:55:39 +0100 Subject: [PATCH 48/60] Extend the expat requirement to differentiate between 32 and 64 arches (cherry picked from python3.15 commit a5ca170d3f1e6e19f5df66f21482c2b10593af42) --- python3.13.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index 2f3fdd8..46ff0fa 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -593,7 +593,7 @@ Requires: tzdata # was used during the build time. # Other subpackages (like -debug) also need this, but they all depend on -libs. %global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/') -Requires: expat >= %{expat_version} +Requires: expat%{?_isa} >= %{expat_version} %description -n %{pkgname}-libs From 1045416eaccacfaf4fdbf54eb85c828c53450958 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 10:40:12 +0000 Subject: [PATCH 49/60] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- python3.13.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index 46ff0fa..d2625e6 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -49,7 +49,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 3%{?dist} License: Python-2.0.1 @@ -1793,6 +1793,9 @@ CheckPython freethreading # ====================================================== %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 3.13.11-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Tue Jan 06 2026 Karolina Surma - 3.13.11-2 - Require at least the same expat version as used during the build time From ad7f5eb68961f55108a6f19402bda4b761564660 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Fri, 6 Feb 2026 12:28:07 +0100 Subject: [PATCH 50/60] Update to 3.13.12 --- ...not-working-with-older-expat-version.patch | 2 +- ...piled-for-a-different-python-version.patch | 173 ++++++++++++++++++ python3.13.spec | 22 ++- sources | 4 +- 4 files changed, 196 insertions(+), 5 deletions(-) create mode 100644 00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch index 493d7e2..215ef31 100644 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -41,7 +41,7 @@ index 9b3014a94a..90401e0d8f 100644 result = BytesIO() xmlgen = XMLGenerator(result) diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py -index fba36d5b57..ccda19fa07 100644 +index 597ec83061..bf2db1779c 100644 --- a/Lib/test/test_xml_etree.py +++ b/Lib/test/test_xml_etree.py @@ -1574,9 +1574,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): diff --git a/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch b/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch new file mode 100644 index 0000000..2f47bac --- /dev/null +++ b/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch @@ -0,0 +1,173 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Petr Viktorin +Date: Mon, 9 Feb 2026 10:44:21 +0100 +Subject: 00477: Raise an error when importing stdlib modules compiled for a + different Python version + +This is a downstream workaround "implementing" python#137212 - +the mechanism for the check exists in Python 3.15+, where it needs to be +added to the standard library modules. +In Fedora, we need it also in previous Python versions, as we experience +segmentation fault when importing stdlib modules after update while +Python is running. + +_curses, _tkinter, _tracemalloc and readline are not calling PyModuleDef_Init, +which is modified with this patch, hence they need a +direct call to the check function. + +Co-Authored-By: Karolina Surma +--- + Include/moduleobject.h | 43 +++++++++++++++++++++++++++++++++++++++++ + Makefile.pre.in | 3 +++ + Modules/_cursesmodule.c | 6 ++++++ + Modules/_tkinter.c | 6 ++++++ + Modules/_tracemalloc.c | 6 ++++++ + Modules/readline.c | 6 ++++++ + Objects/moduleobject.c | 1 + + 7 files changed, 71 insertions(+) + +diff --git a/Include/moduleobject.h b/Include/moduleobject.h +index 2a17c891dd..64017c666c 100644 +--- a/Include/moduleobject.h ++++ b/Include/moduleobject.h +@@ -116,6 +116,49 @@ struct PyModuleDef { + freefunc m_free; + }; + ++#if defined(_PyHack_check_version_on_modinit) && defined(Py_BUILD_CORE) ++/* The mechanism for the check has been implemented on Python 3.15+: ++ * https://github.com/python/cpython/pull/137212. ++ * In Fedora, we need this in older Pythons too: ++ * if somebody attempts to import a module compiled for a different Python version, ++ * instead of segmentation fault a meaningful error is raised. ++ */ ++PyAPI_DATA(const unsigned long) Py_Version; ++ ++static inline int ++_PyHack_CheckInternalAPIVersion(const char *mod_name) ++{ ++ if (PY_VERSION_HEX != Py_Version) { ++ PyErr_Format( ++ PyExc_ImportError, ++ "internal Python C API version mismatch: " ++ "module %s compiled with %lu.%lu.%lu; " ++ "runtime version is %lu.%lu.%lu", ++ mod_name, ++ (const unsigned long)((PY_VERSION_HEX >> 24) & 0xFF), ++ (const unsigned long)((PY_VERSION_HEX >> 16) & 0xFF), ++ (const unsigned long)((PY_VERSION_HEX >> 8) & 0xFF), ++ (const unsigned long)((Py_Version >> 24) & 0xFF), ++ (const unsigned long)((Py_Version >> 16) & 0xFF), ++ (const unsigned long)((Py_Version >> 8) & 0xFF) ++ ); ++ return -1; ++ } ++ return 0; ++} ++ ++static inline PyObject * ++PyModuleDef_Init_with_check(PyModuleDef *def) ++{ ++ if (_PyHack_CheckInternalAPIVersion(def->m_name) < 0) { ++ return NULL; ++ } ++ return PyModuleDef_Init(def); ++} ++ ++#define PyModuleDef_Init PyModuleDef_Init_with_check ++#endif ++ + #ifdef __cplusplus + } + #endif +diff --git a/Makefile.pre.in b/Makefile.pre.in +index ecf77bdc41..91bfd06a78 100644 +--- a/Makefile.pre.in ++++ b/Makefile.pre.in +@@ -3153,3 +3153,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h + # Local Variables: + # mode: makefile + # End: ++ ++# Fedora-specific, downstream only ++PY_STDMODULE_CFLAGS += -D_PyHack_check_version_on_modinit=1 +diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c +index 0200f59020..bb647555c0 100644 +--- a/Modules/_cursesmodule.c ++++ b/Modules/_cursesmodule.c +@@ -4763,6 +4763,12 @@ curses_destructor(PyObject *op) + PyMODINIT_FUNC + PyInit__curses(void) + { ++ #ifdef _PyHack_check_version_on_modinit ++ if (_PyHack_CheckInternalAPIVersion("_curses") < 0) { ++ return NULL; ++ } ++ #endif ++ + PyObject *m, *d, *v, *c_api_object; + + /* Initialize object type */ +diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c +index 14efe18db5..70597c2815 100644 +--- a/Modules/_tkinter.c ++++ b/Modules/_tkinter.c +@@ -3431,6 +3431,12 @@ static struct PyModuleDef _tkintermodule = { + PyMODINIT_FUNC + PyInit__tkinter(void) + { ++ #ifdef _PyHack_check_version_on_modinit ++ if (_PyHack_CheckInternalAPIVersion("_tkinter") < 0) { ++ return NULL; ++ } ++ #endif ++ + PyObject *m, *uexe, *cexe; + + tcl_lock = PyThread_allocate_lock(); +diff --git a/Modules/_tracemalloc.c b/Modules/_tracemalloc.c +index 0b85187e5f..87f358ed07 100644 +--- a/Modules/_tracemalloc.c ++++ b/Modules/_tracemalloc.c +@@ -215,6 +215,12 @@ static struct PyModuleDef module_def = { + PyMODINIT_FUNC + PyInit__tracemalloc(void) + { ++ #ifdef _PyHack_check_version_on_modinit ++ if (_PyHack_CheckInternalAPIVersion("_tracemalloc") < 0) { ++ return NULL; ++ } ++ #endif ++ + PyObject *m; + m = PyModule_Create(&module_def); + if (m == NULL) +diff --git a/Modules/readline.c b/Modules/readline.c +index f9362c312d..66f1ec65a6 100644 +--- a/Modules/readline.c ++++ b/Modules/readline.c +@@ -1540,6 +1540,12 @@ static struct PyModuleDef readlinemodule = { + PyMODINIT_FUNC + PyInit_readline(void) + { ++ #ifdef _PyHack_check_version_on_modinit ++ if (_PyHack_CheckInternalAPIVersion("readline") < 0) { ++ return NULL; ++ } ++ #endif ++ + const char *backend = "readline"; + PyObject *m; + readlinestate *mod_state; +diff --git a/Objects/moduleobject.c b/Objects/moduleobject.c +index d787f29004..31175ceb3f 100644 +--- a/Objects/moduleobject.c ++++ b/Objects/moduleobject.c +@@ -43,6 +43,7 @@ _PyModule_IsExtension(PyObject *obj) + } + + ++#undef PyModuleDef_Init + PyObject* + PyModuleDef_Init(PyModuleDef* def) + { diff --git a/python3.13.spec b/python3.13.spec index d2625e6..49d4f5c 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,11 +45,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.11 +%global general_version %{pybasever}.12 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 3%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -394,6 +394,21 @@ Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch # which is tested as working. Patch466: 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +# 00477 # 9c62c492e7f2e3b152dbf287c08d307c3f013221 +# Raise an error when importing stdlib modules compiled for a different Python version +# +# This is a downstream workaround "implementing" python#137212 - +# the mechanism for the check exists in Python 3.15+, where it needs to be +# added to the standard library modules. +# In Fedora, we need it also in previous Python versions, as we experience +# segmentation fault when importing stdlib modules after update while +# Python is running. +# +# _curses, _tkinter, _tracemalloc and readline are not calling PyModuleDef_Init, +# which is modified with this patch, hence they need a +# direct call to the check function. +Patch477: 00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1793,6 +1808,9 @@ CheckPython freethreading # ====================================================== %changelog +* Wed Feb 04 2026 Tomáš Hrnčiar - 3.13.12-1 +- Update to 3.13.12 + * Sat Jan 17 2026 Fedora Release Engineering - 3.13.11-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild diff --git a/sources b/sources index 9cba034..67ba30c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.11.tar.xz) = 11a910785bb3edeb3888331f29d2514d539f08b07d3125186364ab0e261dab29c7e7c70fe08d89718c38b6053cbe932ac4a6062ac291871e6f4173d29425264a -SHA512 (Python-3.13.11.tar.xz.asc) = 10beaba6d0e84f0335c0add480114e98a64133ec70d320593349de86091ccbdd69743559297f9c8c5e9926089890fd0e7881388e86084f46a413e9579c59d23c +SHA512 (Python-3.13.12.tar.xz) = 5edecdf13999d8629f31543dffdcba521dbb5633577e481ee49275e377509a2f6d700624c26f95b57a8ff9501378d10d7c07c1d0e7e19be0d6c88f05b6315a13 +SHA512 (Python-3.13.12.tar.xz.asc) = 6d42bc51b3658e1b092e7ab44306f6fc968646a7a9aeb63a3c443d1f75e27153a2138e88c15cebf8d559ce6d7744acecd4e6026c6d0be6fde070f804042d4aea From b909398e15b11e691b444782103e3290985b908f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Fri, 6 Feb 2026 12:30:14 +0100 Subject: [PATCH 51/60] Backport patches to fix CVEs CVE-2025-15366, CVE-2025-15367 --- 00474-cve-2025-15366.patch | 59 ++++++++++++++++++++++++++++++++++++++ 00475-cve-2025-15367.patch | 59 ++++++++++++++++++++++++++++++++++++++ python3.13.spec | 12 ++++++++ 3 files changed, 130 insertions(+) create mode 100644 00474-cve-2025-15366.patch create mode 100644 00475-cve-2025-15367.patch diff --git a/00474-cve-2025-15366.patch b/00474-cve-2025-15366.patch new file mode 100644 index 0000000..32aa4c3 --- /dev/null +++ b/00474-cve-2025-15366.patch @@ -0,0 +1,59 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Seth Michael Larson +Date: Tue, 20 Jan 2026 14:45:42 -0600 +Subject: 00474: CVE-2025-15366 + +Reject control characters in IMAP commands +--- + Lib/imaplib.py | 4 +++- + Lib/test/test_imaplib.py | 6 ++++++ + .../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 + + 3 files changed, 10 insertions(+), 1 deletion(-) + create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst + +diff --git a/Lib/imaplib.py b/Lib/imaplib.py +index 141e639894..f282e5c061 100644 +--- a/Lib/imaplib.py ++++ b/Lib/imaplib.py +@@ -132,7 +132,7 @@ + # We compile these in _mode_xxx. + _Literal = br'.*{(?P\d+)}$' + _Untagged_status = br'\* (?P\d+) (?P[A-Z-]+)( (?P.*))?' +- ++_control_chars = re.compile(b'[\x00-\x1F\x7F]') + + + class IMAP4: +@@ -1000,6 +1000,8 @@ def _command(self, name, *args): + if arg is None: continue + if isinstance(arg, str): + arg = bytes(arg, self._encoding) ++ if _control_chars.search(arg): ++ raise ValueError("Control characters not allowed in commands") + data = data + b' ' + arg + + literal = self.literal +diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py +index 9f1f682d02..820c2a5db5 100644 +--- a/Lib/test/test_imaplib.py ++++ b/Lib/test/test_imaplib.py +@@ -515,6 +515,12 @@ def test_login(self): + self.assertEqual(data[0], b'LOGIN completed') + self.assertEqual(client.state, 'AUTH') + ++ def test_control_characters(self): ++ client, _ = self._setup(SimpleIMAPHandler) ++ for c0 in support.control_characters_c0(): ++ with self.assertRaises(ValueError): ++ client.login(f'user{c0}', 'pass') ++ + def test_logout(self): + client, _ = self._setup(SimpleIMAPHandler) + typ, data = client.login('user', 'pass') +diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst +new file mode 100644 +index 0000000000..4e13fe92bc +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst +@@ -0,0 +1 @@ ++Reject control characters in IMAP commands. diff --git a/00475-cve-2025-15367.patch b/00475-cve-2025-15367.patch new file mode 100644 index 0000000..2812c2d --- /dev/null +++ b/00475-cve-2025-15367.patch @@ -0,0 +1,59 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Seth Michael Larson +Date: Tue, 20 Jan 2026 14:46:32 -0600 +Subject: 00475: CVE-2025-15367 + +Reject control characters in POP3 commands +--- + Lib/poplib.py | 2 ++ + Lib/test/test_poplib.py | 8 ++++++++ + .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst | 1 + + 3 files changed, 11 insertions(+) + create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst + +diff --git a/Lib/poplib.py b/Lib/poplib.py +index 4469bff44b..b97274c5c3 100644 +--- a/Lib/poplib.py ++++ b/Lib/poplib.py +@@ -122,6 +122,8 @@ def _putline(self, line): + def _putcmd(self, line): + if self._debugging: print('*cmd*', repr(line)) + line = bytes(line, self.encoding) ++ if re.search(b'[\x00-\x1F\x7F]', line): ++ raise ValueError('Control characters not allowed in commands') + self._putline(line) + + +diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py +index eb6dab4015..bd621caee4 100644 +--- a/Lib/test/test_poplib.py ++++ b/Lib/test/test_poplib.py +@@ -18,6 +18,7 @@ + from test.support import asynchat + from test.support import asyncore + from test.support.testcase import ExtraAssertions ++from test.support import control_characters_c0 + + + test_support.requires_working_socket(module=True) +@@ -396,6 +397,13 @@ def test_quit(self): + self.assertIsNone(self.client.sock) + self.assertIsNone(self.client.file) + ++ def test_control_characters(self): ++ for c0 in control_characters_c0(): ++ with self.assertRaises(ValueError): ++ self.client.user(f'user{c0}') ++ with self.assertRaises(ValueError): ++ self.client.pass_(f'{c0}pass') ++ + @requires_ssl + def test_stls_capa(self): + capa = self.client.capa() +diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst +new file mode 100644 +index 0000000000..3cde4df3e0 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst +@@ -0,0 +1 @@ ++Reject control characters in POP3 commands. diff --git a/python3.13.spec b/python3.13.spec index 49d4f5c..df66054 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -394,6 +394,18 @@ Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch # which is tested as working. Patch466: 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +# 00474 # 837ddca0372fa87ff9cee47142200caa21e77def +# CVE-2025-15366 +# +# Reject control characters in IMAP commands +Patch474: 00474-cve-2025-15366.patch + +# 00475 # d44fac01037662db286449a78c8fb819788f764c +# CVE-2025-15367 +# +# Reject control characters in POP3 commands +Patch475: 00475-cve-2025-15367.patch + # 00477 # 9c62c492e7f2e3b152dbf287c08d307c3f013221 # Raise an error when importing stdlib modules compiled for a different Python version # From 007c7d59dd2e360c4aa0883ebb141042da71251f Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 26 Mar 2026 09:24:47 +0100 Subject: [PATCH 52/60] Security fix for CVE-2026-4519 (rhbz#2449729) --- 00478-cve-2026-4519.patch | 114 ++++++++++++++++++++++++++++++++++++++ python3.13.spec | 11 +++- 2 files changed, 124 insertions(+), 1 deletion(-) create mode 100644 00478-cve-2026-4519.patch diff --git a/00478-cve-2026-4519.patch b/00478-cve-2026-4519.patch new file mode 100644 index 0000000..aa4e921 --- /dev/null +++ b/00478-cve-2026-4519.patch @@ -0,0 +1,114 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Tue, 24 Mar 2026 00:17:50 +0100 +Subject: 00478: CVE-2026-4519 + +Reject leading dashes in webbrowser URLs (GH-146215) + +(cherry picked from commit 82a24a4442312bdcfc4c799885e8b3e00990f02b) + +Co-authored-by: Seth Michael Larson +--- + Lib/test/test_webbrowser.py | 5 +++++ + Lib/webbrowser.py | 13 +++++++++++++ + .../2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst | 1 + + 3 files changed, 19 insertions(+) + create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst + +diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py +index 4fcbc5c2e5..171388e64d 100644 +--- a/Lib/test/test_webbrowser.py ++++ b/Lib/test/test_webbrowser.py +@@ -65,6 +65,11 @@ def test_open(self): + options=[], + arguments=[URL]) + ++ def test_reject_dash_prefixes(self): ++ browser = self.browser_class(name=CMD_NAME) ++ with self.assertRaises(ValueError): ++ browser.open(f"--key=val {URL}") ++ + + class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase): + +diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py +index 2f9555ad60..e322cbf5d1 100755 +--- a/Lib/webbrowser.py ++++ b/Lib/webbrowser.py +@@ -164,6 +164,12 @@ def open_new(self, url): + def open_new_tab(self, url): + return self.open(url, 2) + ++ @staticmethod ++ def _check_url(url): ++ """Ensures that the URL is safe to pass to subprocesses as a parameter""" ++ if url and url.lstrip().startswith("-"): ++ raise ValueError(f"Invalid URL: {url}") ++ + + class GenericBrowser(BaseBrowser): + """Class for all browsers started with a command +@@ -181,6 +187,7 @@ def __init__(self, name): + + def open(self, url, new=0, autoraise=True): + sys.audit("webbrowser.open", url) ++ self._check_url(url) + cmdline = [self.name] + [arg.replace("%s", url) + for arg in self.args] + try: +@@ -201,6 +208,7 @@ def open(self, url, new=0, autoraise=True): + cmdline = [self.name] + [arg.replace("%s", url) + for arg in self.args] + sys.audit("webbrowser.open", url) ++ self._check_url(url) + try: + if sys.platform[:3] == 'win': + p = subprocess.Popen(cmdline) +@@ -267,6 +275,7 @@ def _invoke(self, args, remote, autoraise, url=None): + + def open(self, url, new=0, autoraise=True): + sys.audit("webbrowser.open", url) ++ self._check_url(url) + if new == 0: + action = self.remote_action + elif new == 1: +@@ -358,6 +367,7 @@ class Konqueror(BaseBrowser): + + def open(self, url, new=0, autoraise=True): + sys.audit("webbrowser.open", url) ++ self._check_url(url) + # XXX Currently I know no way to prevent KFM from opening a new win. + if new == 2: + action = "newTab" +@@ -576,6 +586,7 @@ def register_standard_browsers(): + class WindowsDefault(BaseBrowser): + def open(self, url, new=0, autoraise=True): + sys.audit("webbrowser.open", url) ++ self._check_url(url) + try: + os.startfile(url) + except OSError: +@@ -596,6 +607,7 @@ def __init__(self, name='default'): + + def open(self, url, new=0, autoraise=True): + sys.audit("webbrowser.open", url) ++ self._check_url(url) + url = url.replace('"', '%22') + if self.name == 'default': + script = f'open location "{url}"' # opens in default browser +@@ -627,6 +639,7 @@ def open(self, url, new=0, autoraise=True): + class IOSBrowser(BaseBrowser): + def open(self, url, new=0, autoraise=True): + sys.audit("webbrowser.open", url) ++ self._check_url(url) + # If ctypes isn't available, we can't open a browser + if objc is None: + return False +diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst +new file mode 100644 +index 0000000000..0f27eae99a +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst +@@ -0,0 +1 @@ ++Reject leading dashes in URLs passed to :func:`webbrowser.open` diff --git a/python3.13.spec b/python3.13.spec index df66054..c16bc56 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -49,7 +49,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -421,6 +421,12 @@ Patch475: 00475-cve-2025-15367.patch # direct call to the check function. Patch477: 00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch +# 00478 # 6f5526308e189515c79efb05770d4b2b5aefc0d0 +# CVE-2026-4519 +# +# Reject leading dashes in webbrowser URLs (GH-146215) +Patch478: 00478-cve-2026-4519.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1820,6 +1826,9 @@ CheckPython freethreading # ====================================================== %changelog +* Thu Mar 26 2026 Lumír Balhar - 3.13.12-2 +- Security fix for CVE-2026-4519 (rhbz#2449729) + * Wed Feb 04 2026 Tomáš Hrnčiar - 3.13.12-1 - Update to 3.13.12 From c444274dd9193f109a90b697558a386124bfa88f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 11 Mar 2026 19:39:18 +0100 Subject: [PATCH 53/60] Only explicitly require expat >= installed version when expat < 2.7.4 See https://src.fedoraproject.org/rpms/expat/c/4da0543472 (cherry picked from python3.15 commit ce1bde3e67443b7cf5df33bf58cb2ec75cc2c8e2) --- python3.13.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index c16bc56..7df50c8 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -625,8 +625,12 @@ Requires: tzdata # We avoid this problem by requiring at least the same version of expat that # was used during the build time. # Other subpackages (like -debug) also need this, but they all depend on -libs. +# Since expat 2.7.4, the library has versioned symbols and this is no longer needed, +# as the generated requirement will be in the form of libexpat.so.1(LIBEXPAT_2.7.2) etc. %global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/') +%if v"%{expat_version}" < v"2.7.4" Requires: expat%{?_isa} >= %{expat_version} +%endif %description -n %{pkgname}-libs @@ -805,7 +809,9 @@ License: %{libs_license} AND Apache-2.0 AND ISC AND LGPL-2.1-only AND MPL-2.0 AN Provides: bundled(libb2) = 0.98.1 Provides: bundled(mimalloc) = 2.12 Requires: tzdata -Requires: expat >= %{expat_version} +%if v"%{expat_version}" < v"2.7.4" +Requires: expat%{?_isa} >= %{expat_version} +%endif %description -n python%{pybasever}-freethreading The provisional Free Threading (PEP 703) build of Python. From c731000e1eb1c378524d3d69641757947bac08d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Wed, 8 Apr 2026 12:07:43 +0200 Subject: [PATCH 54/60] Update to 3.13.13 --- 00251-change-user-install-location.patch | 8 +- ...not-working-with-older-expat-version.patch | 4 +- 00478-cve-2026-4519.patch | 114 ------------------ python3.13.spec | 25 ++-- sources | 4 +- 5 files changed, 19 insertions(+), 136 deletions(-) delete mode 100644 00478-cve-2026-4519.patch diff --git a/00251-change-user-install-location.patch b/00251-change-user-install-location.patch index 89bc027..7289b79 100644 --- a/00251-change-user-install-location.patch +++ b/00251-change-user-install-location.patch @@ -51,7 +51,7 @@ index 041dca113a..ca6320df2f 100644 if os.path.isdir(sitedir): addsitedir(sitedir, known_paths) diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py -index f7bd675bb3..f1ff347c3d 100644 +index 43edebce34..40e85568ea 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py @@ -106,6 +106,12 @@ @@ -130,7 +130,7 @@ index f7bd675bb3..f1ff347c3d 100644 # On Windows we want to substitute 'lib' for schemes rather # than the native value (without modifying vars, in case it diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py -index 9723300f51..310706652a 100644 +index ce17206a3c..fd95071099 100644 --- a/Lib/test/test_sysconfig.py +++ b/Lib/test/test_sysconfig.py @@ -130,8 +130,19 @@ def test_get_path(self): @@ -154,7 +154,7 @@ index 9723300f51..310706652a 100644 os.path.normpath(expected), ) -@@ -393,7 +404,7 @@ def test_get_config_h_filename(self): +@@ -395,7 +406,7 @@ def test_get_config_h_filename(self): self.assertTrue(os.path.isfile(config_h), config_h) def test_get_scheme_names(self): @@ -163,7 +163,7 @@ index 9723300f51..310706652a 100644 if HAS_USER_BASE: wanted.extend(['nt_user', 'osx_framework_user', 'posix_user']) self.assertEqual(get_scheme_names(), tuple(sorted(wanted))) -@@ -405,6 +416,8 @@ def test_symlink(self): # Issue 7880 +@@ -407,6 +418,8 @@ def test_symlink(self): # Issue 7880 cmd = "-c", "import sysconfig; print(sysconfig.get_platform())" self.assertEqual(py.call_real(*cmd), py.call_link(*cmd)) diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch index 215ef31..643501b 100644 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -15,10 +15,10 @@ which is tested as working. 3 files changed, 10 insertions(+) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py -index cd98407c34..042a3bb9df 100644 +index 2309353503..fca62245d4 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py -@@ -846,6 +846,8 @@ def start_element(name, _): +@@ -901,6 +901,8 @@ def start_element(name, _): self.assertEqual(started, ['doc']) diff --git a/00478-cve-2026-4519.patch b/00478-cve-2026-4519.patch deleted file mode 100644 index aa4e921..0000000 --- a/00478-cve-2026-4519.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: "Miss Islington (bot)" - <31488909+miss-islington@users.noreply.github.com> -Date: Tue, 24 Mar 2026 00:17:50 +0100 -Subject: 00478: CVE-2026-4519 - -Reject leading dashes in webbrowser URLs (GH-146215) - -(cherry picked from commit 82a24a4442312bdcfc4c799885e8b3e00990f02b) - -Co-authored-by: Seth Michael Larson ---- - Lib/test/test_webbrowser.py | 5 +++++ - Lib/webbrowser.py | 13 +++++++++++++ - .../2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst | 1 + - 3 files changed, 19 insertions(+) - create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst - -diff --git a/Lib/test/test_webbrowser.py b/Lib/test/test_webbrowser.py -index 4fcbc5c2e5..171388e64d 100644 ---- a/Lib/test/test_webbrowser.py -+++ b/Lib/test/test_webbrowser.py -@@ -65,6 +65,11 @@ def test_open(self): - options=[], - arguments=[URL]) - -+ def test_reject_dash_prefixes(self): -+ browser = self.browser_class(name=CMD_NAME) -+ with self.assertRaises(ValueError): -+ browser.open(f"--key=val {URL}") -+ - - class BackgroundBrowserCommandTest(CommandTestMixin, unittest.TestCase): - -diff --git a/Lib/webbrowser.py b/Lib/webbrowser.py -index 2f9555ad60..e322cbf5d1 100755 ---- a/Lib/webbrowser.py -+++ b/Lib/webbrowser.py -@@ -164,6 +164,12 @@ def open_new(self, url): - def open_new_tab(self, url): - return self.open(url, 2) - -+ @staticmethod -+ def _check_url(url): -+ """Ensures that the URL is safe to pass to subprocesses as a parameter""" -+ if url and url.lstrip().startswith("-"): -+ raise ValueError(f"Invalid URL: {url}") -+ - - class GenericBrowser(BaseBrowser): - """Class for all browsers started with a command -@@ -181,6 +187,7 @@ def __init__(self, name): - - def open(self, url, new=0, autoraise=True): - sys.audit("webbrowser.open", url) -+ self._check_url(url) - cmdline = [self.name] + [arg.replace("%s", url) - for arg in self.args] - try: -@@ -201,6 +208,7 @@ def open(self, url, new=0, autoraise=True): - cmdline = [self.name] + [arg.replace("%s", url) - for arg in self.args] - sys.audit("webbrowser.open", url) -+ self._check_url(url) - try: - if sys.platform[:3] == 'win': - p = subprocess.Popen(cmdline) -@@ -267,6 +275,7 @@ def _invoke(self, args, remote, autoraise, url=None): - - def open(self, url, new=0, autoraise=True): - sys.audit("webbrowser.open", url) -+ self._check_url(url) - if new == 0: - action = self.remote_action - elif new == 1: -@@ -358,6 +367,7 @@ class Konqueror(BaseBrowser): - - def open(self, url, new=0, autoraise=True): - sys.audit("webbrowser.open", url) -+ self._check_url(url) - # XXX Currently I know no way to prevent KFM from opening a new win. - if new == 2: - action = "newTab" -@@ -576,6 +586,7 @@ def register_standard_browsers(): - class WindowsDefault(BaseBrowser): - def open(self, url, new=0, autoraise=True): - sys.audit("webbrowser.open", url) -+ self._check_url(url) - try: - os.startfile(url) - except OSError: -@@ -596,6 +607,7 @@ def __init__(self, name='default'): - - def open(self, url, new=0, autoraise=True): - sys.audit("webbrowser.open", url) -+ self._check_url(url) - url = url.replace('"', '%22') - if self.name == 'default': - script = f'open location "{url}"' # opens in default browser -@@ -627,6 +639,7 @@ def open(self, url, new=0, autoraise=True): - class IOSBrowser(BaseBrowser): - def open(self, url, new=0, autoraise=True): - sys.audit("webbrowser.open", url) -+ self._check_url(url) - # If ctypes isn't available, we can't open a browser - if objc is None: - return False -diff --git a/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst -new file mode 100644 -index 0000000000..0f27eae99a ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2026-01-16-12-04-49.gh-issue-143930.zYC5x3.rst -@@ -0,0 +1 @@ -+Reject leading dashes in URLs passed to :func:`webbrowser.open` diff --git a/python3.13.spec b/python3.13.spec index 7df50c8..0a196bb 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,11 +45,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.12 +%global general_version %{pybasever}.13 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -109,21 +109,21 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 25.3 +%global pip_version 26.0.1 %global setuptools_version 79.0.1 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: -Provides: bundled(python3dist(cachecontrol)) = 0.14.3 -Provides: bundled(python3dist(certifi)) = 2025.10.5 +Provides: bundled(python3dist(cachecontrol)) = 0.14.4 +Provides: bundled(python3dist(certifi)) = 2026.1.4 Provides: bundled(python3dist(dependency-groups)) = 1.3.1 Provides: bundled(python3dist(distlib)) = 0.4 Provides: bundled(python3dist(distro)) = 1.9 -Provides: bundled(python3dist(idna)) = 3.10 +Provides: bundled(python3dist(idna)) = 3.11 Provides: bundled(python3dist(msgpack)) = 1.1.2 -Provides: bundled(python3dist(packaging)) = 25 -Provides: bundled(python3dist(platformdirs)) = 4.5 +Provides: bundled(python3dist(packaging)) = 26 +Provides: bundled(python3dist(platformdirs)) = 4.5.1 Provides: bundled(python3dist(pygments)) = 2.19.2 Provides: bundled(python3dist(pyproject-hooks)) = 1.2 Provides: bundled(python3dist(requests)) = 2.32.5 @@ -421,12 +421,6 @@ Patch475: 00475-cve-2025-15367.patch # direct call to the check function. Patch477: 00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch -# 00478 # 6f5526308e189515c79efb05770d4b2b5aefc0d0 -# CVE-2026-4519 -# -# Reject leading dashes in webbrowser URLs (GH-146215) -Patch478: 00478-cve-2026-4519.patch - # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -1832,6 +1826,9 @@ CheckPython freethreading # ====================================================== %changelog +* Wed Apr 08 2026 Tomáš Hrnčiar - 3.13.13-1 +- Update to 3.13.13 + * Thu Mar 26 2026 Lumír Balhar - 3.13.12-2 - Security fix for CVE-2026-4519 (rhbz#2449729) diff --git a/sources b/sources index 67ba30c..8ca0534 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.12.tar.xz) = 5edecdf13999d8629f31543dffdcba521dbb5633577e481ee49275e377509a2f6d700624c26f95b57a8ff9501378d10d7c07c1d0e7e19be0d6c88f05b6315a13 -SHA512 (Python-3.13.12.tar.xz.asc) = 6d42bc51b3658e1b092e7ab44306f6fc968646a7a9aeb63a3c443d1f75e27153a2138e88c15cebf8d559ce6d7744acecd4e6026c6d0be6fde070f804042d4aea +SHA512 (Python-3.13.13.tar.xz) = 0ef615150a52865fe7ca0d0e106cf98488f113a56e5ae1b1437673f03880423839d04abe1999006f9835c77d8802d5ae94a1bdf63d18074a9a19c81e6f7b69e8 +SHA512 (Python-3.13.13.tar.xz.asc) = 21e5235cd9a9df3546370feb55ac32539e08601b79ee7b1e39006028f192be6be0434f2f8384fdcc993b70bde7471be3b36ce9850abf0473d1fe2c7cdc98304b From 58718512eda7b324fa61f424133a12d280f4f819 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 9 Apr 2026 13:16:25 +0200 Subject: [PATCH 55/60] Explicitly build with OpenSSL 3 for now https://fedoraproject.org/wiki/Changes/OpenSSL40 --- python3.13.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index 0a196bb..a0ddc22 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -268,7 +268,6 @@ BuildRequires: libuuid-devel BuildRequires: make BuildRequires: mpdecimal-devel BuildRequires: ncurses-devel -BuildRequires: openssl-devel BuildRequires: pkgconfig BuildRequires: python-rpm-macros BuildRequires: readline-devel @@ -281,6 +280,10 @@ BuildRequires: xz-devel BuildRequires: zlib-devel BuildRequires: /usr/bin/dtrace +# Support for OpenSSL 4 only landed in Python 3.15 for now +# https://github.com/python/cpython/issues/146207 +BuildRequires: (openssl-devel < 1:4 or openssl3-devel) + %if %{undefined rhel} BuildRequires: libb2-devel %endif From a5e28d44e7880e566f0217425f9750aea8467eb5 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Thu, 11 Jun 2026 16:05:46 +0200 Subject: [PATCH 56/60] Update to Python 3.13.14 --- ...-pac-and-bti-protections-for-aarch64.patch | 102 ------------------ ...not-working-with-older-expat-version.patch | 10 +- 00474-cve-2025-15366.patch | 6 +- ...piled-for-a-different-python-version.patch | 14 +-- python3.13.spec | 35 ++---- sources | 4 +- 6 files changed, 27 insertions(+), 144 deletions(-) delete mode 100644 00464-enable-pac-and-bti-protections-for-aarch64.patch diff --git a/00464-enable-pac-and-bti-protections-for-aarch64.patch b/00464-enable-pac-and-bti-protections-for-aarch64.patch deleted file mode 100644 index 1a7acf3..0000000 --- a/00464-enable-pac-and-bti-protections-for-aarch64.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Charalampos Stratakis -Date: Tue, 3 Jun 2025 03:02:15 +0200 -Subject: 00464: Enable PAC and BTI protections for aarch64 - -Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S - -The BTI flag must be applied in the assembler sources for this class -of attacks to be mitigated on newer aarch64 processors. - -Upstream PR: https://github.com/python/cpython/pull/130864/files - -The upstream patch is incomplete but only for the case where -frame pointers are not used on 3.13+. - -Since on Fedora we always compile with frame pointers the BTI/PAC -hardware protections can be enabled without losing Perf unwinding. ---- - Python/asm_trampoline.S | 4 +++ - Python/asm_trampoline_aarch64.h | 50 +++++++++++++++++++++++++++++++++ - 2 files changed, 54 insertions(+) - create mode 100644 Python/asm_trampoline_aarch64.h - -diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S -index a14e68c0e8..2513cde4e7 100644 ---- a/Python/asm_trampoline.S -+++ b/Python/asm_trampoline.S -@@ -1,3 +1,5 @@ -+#include "asm_trampoline_aarch64.h" -+ - .text - .globl _Py_trampoline_func_start - # The following assembly is equivalent to: -@@ -21,10 +23,12 @@ _Py_trampoline_func_start: - #if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__) - // ARM64 little endian, 64bit ABI - // generate with aarch64-linux-gnu-gcc 12.1 -+ SIGN_LR - stp x29, x30, [sp, -16]! - mov x29, sp - blr x3 - ldp x29, x30, [sp], 16 -+ VERIFY_LR - ret - #endif - #ifdef __riscv -diff --git a/Python/asm_trampoline_aarch64.h b/Python/asm_trampoline_aarch64.h -new file mode 100644 -index 0000000000..4b0ec4a7dc ---- /dev/null -+++ b/Python/asm_trampoline_aarch64.h -@@ -0,0 +1,50 @@ -+#ifndef ASM_TRAMPOLINE_AARCH_64_H_ -+#define ASM_TRAMPOLINE_AARCH_64_H_ -+ -+/* -+ * References: -+ * - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros -+ * - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst -+ */ -+ -+#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1 -+ #define BTI_J hint 36 /* bti j: for jumps, IE br instructions */ -+ #define BTI_C hint 34 /* bti c: for calls, IE bl instructions */ -+ #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */ -+#else -+ #define BTI_J -+ #define BTI_C -+ #define GNU_PROPERTY_AARCH64_BTI 0 -+#endif -+ -+#if defined(__ARM_FEATURE_PAC_DEFAULT) -+ #if __ARM_FEATURE_PAC_DEFAULT & 1 -+ #define SIGN_LR hint 25 /* paciasp: sign with the A key */ -+ #define VERIFY_LR hint 29 /* autiasp: verify with the A key */ -+ #elif __ARM_FEATURE_PAC_DEFAULT & 2 -+ #define SIGN_LR hint 27 /* pacibsp: sign with the b key */ -+ #define VERIFY_LR hint 31 /* autibsp: verify with the b key */ -+ #endif -+ #define GNU_PROPERTY_AARCH64_POINTER_AUTH 2 /* bit 1 GNU Notes is for PAC support */ -+#else -+ #define SIGN_LR BTI_C -+ #define VERIFY_LR -+ #define GNU_PROPERTY_AARCH64_POINTER_AUTH 0 -+#endif -+ -+/* Add the BTI and PAC support to GNU Notes section */ -+#if GNU_PROPERTY_AARCH64_BTI != 0 || GNU_PROPERTY_AARCH64_POINTER_AUTH != 0 -+ .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */ -+ .balign 8; /* align it on a byte boundry */ -+ .long 4; /* size of "GNU\0" */ -+ .long 0x10; /* size of descriptor */ -+ .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */ -+ .asciz "GNU"; -+ .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */ -+ .long 4; /* Four bytes of data */ -+ .long (GNU_PROPERTY_AARCH64_BTI|GNU_PROPERTY_AARCH64_POINTER_AUTH); /* BTI or PAC is enabled */ -+ .long 0; /* padding for 8 byte alignment */ -+ .popsection; /* end the section */ -+#endif -+ -+#endif diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch index 643501b..7105bf4 100644 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -15,10 +15,10 @@ which is tested as working. 3 files changed, 10 insertions(+) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py -index 2309353503..fca62245d4 100644 +index ebd8c955dc..678815596b 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py -@@ -901,6 +901,8 @@ def start_element(name, _): +@@ -1013,6 +1013,8 @@ def start_element(name, _): self.assertEqual(started, ['doc']) @@ -41,10 +41,10 @@ index 9b3014a94a..90401e0d8f 100644 result = BytesIO() xmlgen = XMLGenerator(result) diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py -index 597ec83061..bf2db1779c 100644 +index c306b7d036..476e6f7956 100644 --- a/Lib/test/test_xml_etree.py +++ b/Lib/test/test_xml_etree.py -@@ -1574,9 +1574,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): +@@ -1599,9 +1599,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): self.assert_event_tags(parser, [('end', 'root')]) self.assertIsNone(parser.close()) @@ -58,7 +58,7 @@ index 597ec83061..bf2db1779c 100644 def test_simple_xml_chunk_5(self): self.test_simple_xml(chunk_size=5, flush=True) -@@ -1803,6 +1807,8 @@ def test_flush_reparse_deferral_enabled(self): +@@ -1828,6 +1832,8 @@ def test_flush_reparse_deferral_enabled(self): self.assert_event_tags(parser, [('end', 'doc')]) diff --git a/00474-cve-2025-15366.patch b/00474-cve-2025-15366.patch index 32aa4c3..d055956 100644 --- a/00474-cve-2025-15366.patch +++ b/00474-cve-2025-15366.patch @@ -12,7 +12,7 @@ Reject control characters in IMAP commands create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst diff --git a/Lib/imaplib.py b/Lib/imaplib.py -index 141e639894..f282e5c061 100644 +index db16f3c802..e7fc0b55fd 100644 --- a/Lib/imaplib.py +++ b/Lib/imaplib.py @@ -132,7 +132,7 @@ @@ -34,10 +34,10 @@ index 141e639894..f282e5c061 100644 literal = self.literal diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py -index 9f1f682d02..820c2a5db5 100644 +index 6573b4e7f3..bc01ce9f13 100644 --- a/Lib/test/test_imaplib.py +++ b/Lib/test/test_imaplib.py -@@ -515,6 +515,12 @@ def test_login(self): +@@ -525,6 +525,12 @@ def test_login(self): self.assertEqual(data[0], b'LOGIN completed') self.assertEqual(client.state, 'AUTH') diff --git a/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch b/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch index 2f47bac..51fbe50 100644 --- a/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch +++ b/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch @@ -81,7 +81,7 @@ index 2a17c891dd..64017c666c 100644 } #endif diff --git a/Makefile.pre.in b/Makefile.pre.in -index ecf77bdc41..91bfd06a78 100644 +index 8589a28b72..9aaeb5e5b4 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in @@ -3153,3 +3153,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h @@ -92,10 +92,10 @@ index ecf77bdc41..91bfd06a78 100644 +# Fedora-specific, downstream only +PY_STDMODULE_CFLAGS += -D_PyHack_check_version_on_modinit=1 diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c -index 0200f59020..bb647555c0 100644 +index e6b5271357..e536ab51af 100644 --- a/Modules/_cursesmodule.c +++ b/Modules/_cursesmodule.c -@@ -4763,6 +4763,12 @@ curses_destructor(PyObject *op) +@@ -4783,6 +4783,12 @@ curses_destructor(PyObject *op) PyMODINIT_FUNC PyInit__curses(void) { @@ -109,10 +109,10 @@ index 0200f59020..bb647555c0 100644 /* Initialize object type */ diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c -index 14efe18db5..70597c2815 100644 +index de93994aa0..10f95215bd 100644 --- a/Modules/_tkinter.c +++ b/Modules/_tkinter.c -@@ -3431,6 +3431,12 @@ static struct PyModuleDef _tkintermodule = { +@@ -3432,6 +3432,12 @@ static struct PyModuleDef _tkintermodule = { PyMODINIT_FUNC PyInit__tkinter(void) { @@ -143,10 +143,10 @@ index 0b85187e5f..87f358ed07 100644 m = PyModule_Create(&module_def); if (m == NULL) diff --git a/Modules/readline.c b/Modules/readline.c -index f9362c312d..66f1ec65a6 100644 +index 7a612deae4..8b2f47eec1 100644 --- a/Modules/readline.c +++ b/Modules/readline.c -@@ -1540,6 +1540,12 @@ static struct PyModuleDef readlinemodule = { +@@ -1548,6 +1548,12 @@ static struct PyModuleDef readlinemodule = { PyMODINIT_FUNC PyInit_readline(void) { diff --git a/python3.13.spec b/python3.13.spec index a0ddc22..ba9fce7 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,7 +45,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.13 +%global general_version %{pybasever}.14 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} @@ -109,31 +109,30 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 26.0.1 +%global pip_version 26.1.2 %global setuptools_version 79.0.1 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: Provides: bundled(python3dist(cachecontrol)) = 0.14.4 -Provides: bundled(python3dist(certifi)) = 2026.1.4 -Provides: bundled(python3dist(dependency-groups)) = 1.3.1 +Provides: bundled(python3dist(certifi)) = 2026.2.25 Provides: bundled(python3dist(distlib)) = 0.4 Provides: bundled(python3dist(distro)) = 1.9 Provides: bundled(python3dist(idna)) = 3.11 Provides: bundled(python3dist(msgpack)) = 1.1.2 -Provides: bundled(python3dist(packaging)) = 26 +Provides: bundled(python3dist(packaging)) = 26.2 Provides: bundled(python3dist(platformdirs)) = 4.5.1 Provides: bundled(python3dist(pygments)) = 2.19.2 Provides: bundled(python3dist(pyproject-hooks)) = 1.2 -Provides: bundled(python3dist(requests)) = 2.32.5 +Provides: bundled(python3dist(requests)) = 2.33.1 Provides: bundled(python3dist(resolvelib)) = 1.2.1 Provides: bundled(python3dist(rich)) = 14.2 Provides: bundled(python3dist(setuptools)) = 70.3 -Provides: bundled(python3dist(tomli)) = 2.3 +Provides: bundled(python3dist(tomli)) = 2.3.1 Provides: bundled(python3dist(tomli-w)) = 1.2 Provides: bundled(python3dist(truststore)) = 0.10.4 -Provides: bundled(python3dist(urllib3)) = 1.26.20 +Provides: bundled(python3dist(urllib3)) = 2.6.3 } # setuptools # vendor.txt not in .whl @@ -371,23 +370,6 @@ Source11: idle3.appdata.xml # pypa/distutils integration: https://github.com/pypa/distutils/pull/70 Patch251: 00251-change-user-install-location.patch -# 00464 # 292acffec7a379cb6d1f3c47b9e5a2f170bbadb6 -# Enable PAC and BTI protections for aarch64 -# -# Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S -# -# The BTI flag must be applied in the assembler sources for this class -# of attacks to be mitigated on newer aarch64 processors. -# -# Upstream PR: https://github.com/python/cpython/pull/130864/files -# -# The upstream patch is incomplete but only for the case where -# frame pointers are not used on 3.13+. -# -# Since on Fedora we always compile with frame pointers the BTI/PAC -# hardware protections can be enabled without losing Perf unwinding. -Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch - # 00466 # e10760fb955ee33d2917f8a57bb4e24d71e5341c # Downstream only: Skip tests not working with older expat version # @@ -1829,6 +1811,9 @@ CheckPython freethreading # ====================================================== %changelog +* Thu Jun 11 2026 Karolina Surma - 3.13.14-1 +- Update to Python 3.13.14 + * Wed Apr 08 2026 Tomáš Hrnčiar - 3.13.13-1 - Update to 3.13.13 diff --git a/sources b/sources index 8ca0534..69e5ac7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.13.tar.xz) = 0ef615150a52865fe7ca0d0e106cf98488f113a56e5ae1b1437673f03880423839d04abe1999006f9835c77d8802d5ae94a1bdf63d18074a9a19c81e6f7b69e8 -SHA512 (Python-3.13.13.tar.xz.asc) = 21e5235cd9a9df3546370feb55ac32539e08601b79ee7b1e39006028f192be6be0434f2f8384fdcc993b70bde7471be3b36ce9850abf0473d1fe2c7cdc98304b +SHA512 (Python-3.13.14.tar.xz) = 0790da65f8ce88a13b06d3b287ace5a1f36b0a8f630a3af00fbbdf93b6ef0944dea05173a20c9e1336d280ef9a97ae2b95a44a4b487a7bbb71fda53b6331c0eb +SHA512 (Python-3.13.14.tar.xz.asc) = a5cfab862ac03447838d13c4d1a9b085a8c8a947c958fd42cecb42929817b1448c1b23a124c87456abd43a1cadfcfb427f394eead9eaf0b84f3296fa263dba6c From ae2158c990e6504c71f7c8428c5af8c7a25134f1 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 24 Jun 2026 22:07:41 +0200 Subject: [PATCH 57/60] Run a new test to monitor changes in required symbols --- plan.fmf | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plan.fmf b/plan.fmf index 432f1a3..9c9afb8 100644 --- a/plan.fmf +++ b/plan.fmf @@ -43,6 +43,9 @@ discover: - name: marshalparser path: /marshalparser test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh" + - name: required_symbols + path: /required-symbols + test: "VERSION=${pybasever} ./check.sh" prepare: - name: Install dependencies @@ -62,8 +65,9 @@ prepare: - virtualenv # for virtualenv tests - glibc-all-langpacks # for locale tests - marshalparser # for testing compatibility (magic numbers) with marshalparser + - binutils # for nm (symbol inspection) - rpm # for debugging - - dnf # for upgrade + - dnf # for upgrade and downgrade - name: Update packages how: shell script: dnf upgrade -y From 8cc71e2467fe13498edb67f60965a3f4c52b895f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 16 Jul 2026 22:48:21 +0000 Subject: [PATCH 58/60] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- python3.13.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python3.13.spec b/python3.13.spec index ba9fce7..0c163a2 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -49,7 +49,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -1811,6 +1811,9 @@ CheckPython freethreading # ====================================================== %changelog +* Thu Jul 16 2026 Fedora Release Engineering - 3.13.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Thu Jun 11 2026 Karolina Surma - 3.13.14-1 - Update to Python 3.13.14 From b93f3ee7d7c859567d3f017a008ec6c7fc83fe5b Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Mon, 10 Aug 2026 11:12:25 +0200 Subject: [PATCH 59/60] Update to Python 3.13.15 --- ...not-working-with-older-expat-version.patch | 6 +- 00474-cve-2025-15366.patch | 59 ------------------- ...piled-for-a-different-python-version.patch | 12 ++-- plan.fmf | 5 +- python3.13.spec | 40 +++++++------ sources | 4 +- 6 files changed, 35 insertions(+), 91 deletions(-) delete mode 100644 00474-cve-2025-15366.patch diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch index 7105bf4..349deeb 100644 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch @@ -15,10 +15,10 @@ which is tested as working. 3 files changed, 10 insertions(+) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py -index ebd8c955dc..678815596b 100644 +index ae7cec6540..4770c5cc4f 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py -@@ -1013,6 +1013,8 @@ def start_element(name, _): +@@ -1033,6 +1033,8 @@ def start_element(name, _): self.assertEqual(started, ['doc']) @@ -41,7 +41,7 @@ index 9b3014a94a..90401e0d8f 100644 result = BytesIO() xmlgen = XMLGenerator(result) diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py -index c306b7d036..476e6f7956 100644 +index 4a76a5be1e..d740e30123 100644 --- a/Lib/test/test_xml_etree.py +++ b/Lib/test/test_xml_etree.py @@ -1599,9 +1599,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): diff --git a/00474-cve-2025-15366.patch b/00474-cve-2025-15366.patch deleted file mode 100644 index d055956..0000000 --- a/00474-cve-2025-15366.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Seth Michael Larson -Date: Tue, 20 Jan 2026 14:45:42 -0600 -Subject: 00474: CVE-2025-15366 - -Reject control characters in IMAP commands ---- - Lib/imaplib.py | 4 +++- - Lib/test/test_imaplib.py | 6 ++++++ - .../Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst | 1 + - 3 files changed, 10 insertions(+), 1 deletion(-) - create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst - -diff --git a/Lib/imaplib.py b/Lib/imaplib.py -index db16f3c802..e7fc0b55fd 100644 ---- a/Lib/imaplib.py -+++ b/Lib/imaplib.py -@@ -132,7 +132,7 @@ - # We compile these in _mode_xxx. - _Literal = br'.*{(?P\d+)}$' - _Untagged_status = br'\* (?P\d+) (?P[A-Z-]+)( (?P.*))?' -- -+_control_chars = re.compile(b'[\x00-\x1F\x7F]') - - - class IMAP4: -@@ -1000,6 +1000,8 @@ def _command(self, name, *args): - if arg is None: continue - if isinstance(arg, str): - arg = bytes(arg, self._encoding) -+ if _control_chars.search(arg): -+ raise ValueError("Control characters not allowed in commands") - data = data + b' ' + arg - - literal = self.literal -diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py -index 6573b4e7f3..bc01ce9f13 100644 ---- a/Lib/test/test_imaplib.py -+++ b/Lib/test/test_imaplib.py -@@ -525,6 +525,12 @@ def test_login(self): - self.assertEqual(data[0], b'LOGIN completed') - self.assertEqual(client.state, 'AUTH') - -+ def test_control_characters(self): -+ client, _ = self._setup(SimpleIMAPHandler) -+ for c0 in support.control_characters_c0(): -+ with self.assertRaises(ValueError): -+ client.login(f'user{c0}', 'pass') -+ - def test_logout(self): - client, _ = self._setup(SimpleIMAPHandler) - typ, data = client.login('user', 'pass') -diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst -new file mode 100644 -index 0000000000..4e13fe92bc ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst -@@ -0,0 +1 @@ -+Reject control characters in IMAP commands. diff --git a/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch b/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch index 51fbe50..f860aa1 100644 --- a/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch +++ b/00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch @@ -81,10 +81,10 @@ index 2a17c891dd..64017c666c 100644 } #endif diff --git a/Makefile.pre.in b/Makefile.pre.in -index 8589a28b72..9aaeb5e5b4 100644 +index 2363b99a25..f1a07645f0 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -3153,3 +3153,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h +@@ -3159,3 +3159,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h # Local Variables: # mode: makefile # End: @@ -92,10 +92,10 @@ index 8589a28b72..9aaeb5e5b4 100644 +# Fedora-specific, downstream only +PY_STDMODULE_CFLAGS += -D_PyHack_check_version_on_modinit=1 diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c -index e6b5271357..e536ab51af 100644 +index 1996488a0e..cfdffd8ec4 100644 --- a/Modules/_cursesmodule.c +++ b/Modules/_cursesmodule.c -@@ -4783,6 +4783,12 @@ curses_destructor(PyObject *op) +@@ -5011,6 +5011,12 @@ curses_destructor(PyObject *op) PyMODINIT_FUNC PyInit__curses(void) { @@ -109,10 +109,10 @@ index e6b5271357..e536ab51af 100644 /* Initialize object type */ diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c -index de93994aa0..10f95215bd 100644 +index 4e8d75e8e1..32e58755aa 100644 --- a/Modules/_tkinter.c +++ b/Modules/_tkinter.c -@@ -3432,6 +3432,12 @@ static struct PyModuleDef _tkintermodule = { +@@ -3499,6 +3499,12 @@ static struct PyModuleDef _tkintermodule = { PyMODINIT_FUNC PyInit__tkinter(void) { diff --git a/plan.fmf b/plan.fmf index 9c9afb8..71d0124 100644 --- a/plan.fmf +++ b/plan.fmf @@ -24,10 +24,11 @@ discover: test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} CYTHON=false ./venv.sh" - name: selftest path: /selftest - test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh" + # test_subparser_inherits_reparse_deferral fails on EPEL9: https://github.com/python/cpython/issues/155485 + test: "VERSION=${pybasever} X='-i test_check_probes -i test_subparser_inherits_reparse_deferral' ./parallel.sh" - name: debugtest path: /selftest - test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes' ./parallel.sh" + test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes -i test_subparser_inherits_reparse_deferral' ./parallel.sh" - name: optimizedflags path: /flags test: "python${pybasever} ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" diff --git a/python3.13.spec b/python3.13.spec index 0c163a2..0879de7 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -45,11 +45,11 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well -%global general_version %{pybasever}.14 +%global general_version %{pybasever}.15 #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 2%{?dist} +Release: 1%{?dist} License: Python-2.0.1 @@ -109,30 +109,30 @@ License: Python-2.0.1 # This needs to be manually updated when we update Python. # Explore the sources tarball (you need the version before %%prep is executed): # $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl -%global pip_version 26.1.2 +%global pip_version 26.2.1 %global setuptools_version 79.0.1 # All of those also include a list of indirect bundled libs: # pip # $ %%{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) %global pip_bundled_provides %{expand: Provides: bundled(python3dist(cachecontrol)) = 0.14.4 -Provides: bundled(python3dist(certifi)) = 2026.2.25 -Provides: bundled(python3dist(distlib)) = 0.4 +Provides: bundled(python3dist(certifi)) = 2026.6.17 +Provides: bundled(python3dist(distlib)) = 0.4.2 Provides: bundled(python3dist(distro)) = 1.9 -Provides: bundled(python3dist(idna)) = 3.11 +Provides: bundled(python3dist(idna)) = 3.18 Provides: bundled(python3dist(msgpack)) = 1.1.2 Provides: bundled(python3dist(packaging)) = 26.2 -Provides: bundled(python3dist(platformdirs)) = 4.5.1 -Provides: bundled(python3dist(pygments)) = 2.19.2 +Provides: bundled(python3dist(platformdirs)) = 4.10 +Provides: bundled(python3dist(pygments)) = 2.20 Provides: bundled(python3dist(pyproject-hooks)) = 1.2 -Provides: bundled(python3dist(requests)) = 2.33.1 +Provides: bundled(python3dist(requests)) = 2.34.2 Provides: bundled(python3dist(resolvelib)) = 1.2.1 Provides: bundled(python3dist(rich)) = 14.2 Provides: bundled(python3dist(setuptools)) = 70.3 -Provides: bundled(python3dist(tomli)) = 2.3.1 +Provides: bundled(python3dist(tomli)) = 2.4.1 Provides: bundled(python3dist(tomli-w)) = 1.2 Provides: bundled(python3dist(truststore)) = 0.10.4 -Provides: bundled(python3dist(urllib3)) = 2.6.3 +Provides: bundled(python3dist(urllib3)) = 2.7 } # setuptools # vendor.txt not in .whl @@ -379,12 +379,6 @@ Patch251: 00251-change-user-install-location.patch # which is tested as working. Patch466: 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch -# 00474 # 837ddca0372fa87ff9cee47142200caa21e77def -# CVE-2025-15366 -# -# Reject control characters in IMAP commands -Patch474: 00474-cve-2025-15366.patch - # 00475 # d44fac01037662db286449a78c8fb819788f764c # CVE-2025-15367 # @@ -530,7 +524,7 @@ Summary: Python runtime libraries # Combined manually from https://docs.python.org/3.13/license.html # Hash of Doc/license.rst which is compared in %%prep, generated with: # $ sha256sum Doc/license.rst | cut -f1 -d" " -%global license_file_hash 62f2c9c2c75d511170eb464ad5f83b78cc1f37eb2eb49c2846c9aa6c4557ee99 +%global license_file_hash 952ac05720d7f1dcb63589b35eb0931b1442eb250230a4ad31198eddf0ad6abc # Licenses of incorporated software: # Mersenne Twister in _random C extension contains code under BSD-3-Clause # socket.getaddrinfo() and socket.getnameinfo() are BSD-3-Clause @@ -553,10 +547,11 @@ Summary: Python runtime libraries # mimalloc is MIT # parts of asyncio from uvloop are MIT # Python/qsbr.c is adapted from code under BSD-2-Clause +# An extract of the `Unicode Character Database` converted to an internal format is Unicode-3.0 # Bundled libb2 is not declared in the upstream document, but it's: # CC0-1.0, covered by grandfathering exception # We don't query upstream for changes, as 3.13 is the last Python version containing it. -%global libs_license Python-2.0.1 AND CC0-1.0 AND MIT AND BSD-3-Clause AND MIT-CMU AND HPND-SMC AND BSD-2-Clause AND dtoa +%global libs_license Python-2.0.1 AND CC0-1.0 AND MIT AND BSD-3-Clause AND MIT-CMU AND HPND-SMC AND BSD-2-Clause AND dtoa AND Unicode-3.0 %if %{with rpmwheels} Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2 License: %{libs_license} @@ -1364,6 +1359,7 @@ CheckPython() { # test.test_concurrent_futures.test_deadlock tends to time out on s390x and ppc64le in # freethreading{,-debug} build, skipping it to shorten the build time # see: https://github.com/python/cpython/issues/121719 + # test_subparser_inherits_reparse_deferral: https://github.com/python/cpython/issues/155485 LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \ -wW --slowest %{_smp_mflags} \ %ifarch riscv64 @@ -1380,6 +1376,9 @@ CheckPython() { -x test_signal \ -i test_deadlock \ %endif + %if 0%{?rhel} == 9 + -i test_subparser_inherits_reparse_deferral \ + %endif echo FINISHED: CHECKING OF PYTHON FOR CONFIGURATION: $ConfName @@ -1811,6 +1810,9 @@ CheckPython freethreading # ====================================================== %changelog +* Mon Aug 10 2026 Karolina Surma - 3.13.15-1 +- Update to Python 3.13.15 + * Thu Jul 16 2026 Fedora Release Engineering - 3.13.14-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild diff --git a/sources b/sources index 69e5ac7..d6a2436 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (Python-3.13.14.tar.xz) = 0790da65f8ce88a13b06d3b287ace5a1f36b0a8f630a3af00fbbdf93b6ef0944dea05173a20c9e1336d280ef9a97ae2b95a44a4b487a7bbb71fda53b6331c0eb -SHA512 (Python-3.13.14.tar.xz.asc) = a5cfab862ac03447838d13c4d1a9b085a8c8a947c958fd42cecb42929817b1448c1b23a124c87456abd43a1cadfcfb427f394eead9eaf0b84f3296fa263dba6c +SHA512 (Python-3.13.15.tar.xz) = b0ab766a3de0b4cfdbf0b93300d7330c734d3f7057577bb03e95e39da4cdade81993e769c7fa6dfdcc13b9d43a3b399d9cd89b5477b413662e9e691c1b7886b8 +SHA512 (Python-3.13.15.tar.xz.asc) = 662c00be95f62e80db43cf42099fef91f764ff7a4433cadf7eb19dedb5e4775adb12878d5ed2295fcea187731de186163ad9672ab72cde62a2335ca58ec1ad86 From 0ca3f59c07cb0d9bf01a0746d00773ed0c625755 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 12 Aug 2026 17:31:43 +0200 Subject: [PATCH 60/60] On EL 9, also supports reparse deferral in expat This replaces one downstream-only patch with another. Yet arguably, this is the safer thing to do. Read the patch description for details; won't copy paste them here. Also, require expat >= version-release when expat < 2.7.4. Assisted-By: Claude Opus 4.6 --- ...rsion-threshold-for-reparse-deferral.patch | 133 ++++++++++++++++++ ...not-working-with-older-expat-version.patch | 69 --------- plan.fmf | 5 +- python3.13.spec | 39 +++-- 4 files changed, 160 insertions(+), 86 deletions(-) create mode 100644 00466-downstream-only-lower-xml_combined_version-threshold-for-reparse-deferral.patch delete mode 100644 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch diff --git a/00466-downstream-only-lower-xml_combined_version-threshold-for-reparse-deferral.patch b/00466-downstream-only-lower-xml_combined_version-threshold-for-reparse-deferral.patch new file mode 100644 index 0000000..15de467 --- /dev/null +++ b/00466-downstream-only-lower-xml_combined_version-threshold-for-reparse-deferral.patch @@ -0,0 +1,133 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Wed, 12 Aug 2026 15:18:39 +0200 +Subject: 00466: Downstream only: Lower XML_COMBINED_VERSION threshold for + reparse deferral + +RHEL 9 expat 2.5.0 has XML_SetReparseDeferralEnabled backported +via the CVE-2023-52425 fix, but XML_COMBINED_VERSION remains 20500. +CPython's #if XML_COMBINED_VERSION >= 20600 guards compile the setter +as a no-op, so SetReparseDeferralEnabled silently does nothing and +GetReparseDeferralEnabled always returns False, even though the expat +library actually supports (and enables) reparse deferral. + +Lower the threshold from 20600 to 20500 so that CPython uses the +backported function. This makes the Python API actually work on RHEL 9 +and fixes test failures (test_reparse_deferral_disabled, +test_flush_reparse_deferral_disabled, test_simple_xml_chunk_*). + +The spec file BuildRequires expat-devel >= 2.5.0-2 to ensure the +backported function is available. +--- + Lib/test/test_pyexpat.py | 6 +++--- + Lib/test/test_sax.py | 4 ++-- + Lib/test/test_xml_etree.py | 4 ++-- + Modules/pyexpat.c | 6 +++--- + 4 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py +index ae7cec6540..7f73a8c5e7 100644 +--- a/Lib/test/test_pyexpat.py ++++ b/Lib/test/test_pyexpat.py +@@ -1001,7 +1001,7 @@ def test_error_path_no_crash(self): + class ReparseDeferralTest(unittest.TestCase): + def test_getter_setter_round_trip(self): + parser = expat.ParserCreate() +- enabled = (expat.version_info >= (2, 6, 0)) ++ enabled = (expat.version_info >= (2, 5, 0)) + + self.assertIs(parser.GetReparseDeferralEnabled(), enabled) + parser.SetReparseDeferralEnabled(False) +@@ -1010,7 +1010,7 @@ def test_getter_setter_round_trip(self): + self.assertIs(parser.GetReparseDeferralEnabled(), enabled) + + def test_reparse_deferral_enabled(self): +- if expat.version_info < (2, 6, 0): ++ if expat.version_info < (2, 5, 0): + self.skipTest(f'Expat {expat.version_info} does not ' + 'support reparse deferral') + +@@ -1041,7 +1041,7 @@ def start_element(name, _): + + parser = expat.ParserCreate() + parser.StartElementHandler = start_element +- if expat.version_info >= (2, 6, 0): ++ if expat.version_info >= (2, 5, 0): + parser.SetReparseDeferralEnabled(False) + self.assertFalse(parser.GetReparseDeferralEnabled()) + +diff --git a/Lib/test/test_sax.py b/Lib/test/test_sax.py +index 9b3014a94a..0e38c9488e 100644 +--- a/Lib/test/test_sax.py ++++ b/Lib/test/test_sax.py +@@ -1215,7 +1215,7 @@ def test_expat_incremental_reset(self): + + self.assertEqual(result.getvalue(), start + b"text") + +- @unittest.skipIf(pyexpat.version_info < (2, 6, 0), ++ @unittest.skipIf(pyexpat.version_info < (2, 5, 0), + f'Expat {pyexpat.version_info} does not ' + 'support reparse deferral') + def test_flush_reparse_deferral_enabled(self): +@@ -1249,7 +1249,7 @@ def test_flush_reparse_deferral_disabled(self): + for chunk in (""): + parser.feed(chunk) + +- if pyexpat.version_info >= (2, 6, 0): ++ if pyexpat.version_info >= (2, 5, 0): + parser._parser.SetReparseDeferralEnabled(False) + self.assertEqual(result.getvalue(), start) # i.e. no elements started + +diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py +index 4a76a5be1e..effb899d7b 100644 +--- a/Lib/test/test_xml_etree.py ++++ b/Lib/test/test_xml_etree.py +@@ -1804,7 +1804,7 @@ def test_unknown_event(self): + with self.assertRaisesRegex(ValueError, "unknown event 'bogus'"): + ET.XMLPullParser(events=(x.decode() for x in (b'start', b'end', b'bogus'))) + +- @unittest.skipIf(pyexpat.version_info < (2, 6, 0), ++ @unittest.skipIf(pyexpat.version_info < (2, 5, 0), + f'Expat {pyexpat.version_info} does not ' + 'support reparse deferral') + def test_flush_reparse_deferral_enabled(self): +@@ -1834,7 +1834,7 @@ def test_flush_reparse_deferral_disabled(self): + for chunk in (""): + parser.feed(chunk) + +- if pyexpat.version_info >= (2, 6, 0): ++ if pyexpat.version_info >= (2, 5, 0): + if not ET is pyET: + self.skipTest(f'XMLParser.(Get|Set)ReparseDeferralEnabled ' + 'methods not available in C') +diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c +index 9e5d84eb5e..b008fe66c1 100644 +--- a/Modules/pyexpat.c ++++ b/Modules/pyexpat.c +@@ -781,7 +781,7 @@ pyexpat_xmlparser_SetReparseDeferralEnabled_impl(xmlparseobject *self, + int enabled) + /*[clinic end generated code: output=5ec539e3b63c8c49 input=021eb9e0bafc32c5]*/ + { +-#if XML_COMBINED_VERSION >= 20600 ++#if XML_COMBINED_VERSION >= 20500 + XML_SetReparseDeferralEnabled(self->itself, enabled ? XML_TRUE : XML_FALSE); + self->reparse_deferral_enabled = (bool)enabled; + #endif +@@ -1446,7 +1446,7 @@ newxmlparseobject(pyexpat_state *state, const char *encoding, + self->ns_prefixes = 0; + self->handlers = NULL; + self->intern = Py_XNewRef(intern); +-#if XML_COMBINED_VERSION >= 20600 ++#if XML_COMBINED_VERSION >= 20500 + self->reparse_deferral_enabled = true; + #else + self->reparse_deferral_enabled = false; +@@ -2332,7 +2332,7 @@ pyexpat_exec(PyObject *mod) + #else + capi->SetHashSalt16Bytes = NULL; + #endif +-#if XML_COMBINED_VERSION >= 20600 ++#if XML_COMBINED_VERSION >= 20500 + capi->SetReparseDeferralEnabled = XML_SetReparseDeferralEnabled; + #else + capi->SetReparseDeferralEnabled = NULL; diff --git a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch b/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch deleted file mode 100644 index 349deeb..0000000 --- a/00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Karolina Surma -Date: Tue, 24 Jun 2025 11:12:13 +0200 -Subject: 00466: Downstream only: Skip tests not working with older expat - version - -We want to run these tests in Fedora and EPEL 10, but not in EPEL 9, -which has too old version of expat. We set the upper bound version -in the conditionalized skip to a release available in CentOS Stream 10, -which is tested as working. ---- - Lib/test/test_pyexpat.py | 2 ++ - Lib/test/test_sax.py | 2 ++ - Lib/test/test_xml_etree.py | 6 ++++++ - 3 files changed, 10 insertions(+) - -diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py -index ae7cec6540..4770c5cc4f 100644 ---- a/Lib/test/test_pyexpat.py -+++ b/Lib/test/test_pyexpat.py -@@ -1033,6 +1033,8 @@ def start_element(name, _): - - self.assertEqual(started, ['doc']) - -+ @unittest.skipIf(expat.version_info < (2, 7, 1), -+ f"Skip for expat < 2.7.1 (version available in RHEL 10)") - def test_reparse_deferral_disabled(self): - started = [] - -diff --git a/Lib/test/test_sax.py b/Lib/test/test_sax.py -index 9b3014a94a..90401e0d8f 100644 ---- a/Lib/test/test_sax.py -+++ b/Lib/test/test_sax.py -@@ -1240,6 +1240,8 @@ def test_flush_reparse_deferral_enabled(self): - - self.assertEqual(result.getvalue(), start + b"") - -+ @unittest.skipIf(pyexpat.version_info < (2, 7, 1), -+ f"Skip for expat < 2.7.1 (version available in RHEL 10)") - def test_flush_reparse_deferral_disabled(self): - result = BytesIO() - xmlgen = XMLGenerator(result) -diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py -index 4a76a5be1e..d740e30123 100644 ---- a/Lib/test/test_xml_etree.py -+++ b/Lib/test/test_xml_etree.py -@@ -1599,9 +1599,13 @@ def test_simple_xml(self, chunk_size=None, flush=False): - self.assert_event_tags(parser, [('end', 'root')]) - self.assertIsNone(parser.close()) - -+ @unittest.skipIf(pyexpat.version_info < (2, 7, 1), -+ f"Skip for expat < 2.7.1 (version available in RHEL 10)") - def test_simple_xml_chunk_1(self): - self.test_simple_xml(chunk_size=1, flush=True) - -+ @unittest.skipIf(pyexpat.version_info < (2, 7, 1), -+ f"Skip for expat < 2.7.1 (version available in RHEL 10)") - def test_simple_xml_chunk_5(self): - self.test_simple_xml(chunk_size=5, flush=True) - -@@ -1828,6 +1832,8 @@ def test_flush_reparse_deferral_enabled(self): - - self.assert_event_tags(parser, [('end', 'doc')]) - -+ @unittest.skipIf(pyexpat.version_info < (2, 7, 1), -+ f"Skip for expat < 2.7.1 (version available in RHEL 10)") - def test_flush_reparse_deferral_disabled(self): - parser = ET.XMLPullParser(events=('start', 'end')) - diff --git a/plan.fmf b/plan.fmf index 71d0124..9c9afb8 100644 --- a/plan.fmf +++ b/plan.fmf @@ -24,11 +24,10 @@ discover: test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} CYTHON=false ./venv.sh" - name: selftest path: /selftest - # test_subparser_inherits_reparse_deferral fails on EPEL9: https://github.com/python/cpython/issues/155485 - test: "VERSION=${pybasever} X='-i test_check_probes -i test_subparser_inherits_reparse_deferral' ./parallel.sh" + test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh" - name: debugtest path: /selftest - test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes -i test_subparser_inherits_reparse_deferral' ./parallel.sh" + test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes' ./parallel.sh" - name: optimizedflags path: /flags test: "python${pybasever} ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS" diff --git a/python3.13.spec b/python3.13.spec index 0879de7..4045e62 100644 --- a/python3.13.spec +++ b/python3.13.spec @@ -49,7 +49,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist} +Release: 2%{?dist} License: Python-2.0.1 @@ -254,7 +254,7 @@ Obsoletes: python%{pybasever}%{?1:-%{1}}\ BuildRequires: autoconf BuildRequires: bluez-libs-devel BuildRequires: bzip2-devel -BuildRequires: expat-devel +BuildRequires: expat-devel >= 2.5.0-2 BuildRequires: findutils BuildRequires: gcc BuildRequires: gdbm-devel @@ -370,14 +370,24 @@ Source11: idle3.appdata.xml # pypa/distutils integration: https://github.com/pypa/distutils/pull/70 Patch251: 00251-change-user-install-location.patch -# 00466 # e10760fb955ee33d2917f8a57bb4e24d71e5341c -# Downstream only: Skip tests not working with older expat version +# 00466 # 713a1368544eddd55088d67f88a23ce31722a4cb +# Downstream only: Lower XML_COMBINED_VERSION threshold for reparse deferral # -# We want to run these tests in Fedora and EPEL 10, but not in EPEL 9, -# which has too old version of expat. We set the upper bound version -# in the conditionalized skip to a release available in CentOS Stream 10, -# which is tested as working. -Patch466: 00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch +# RHEL 9 expat 2.5.0 has XML_SetReparseDeferralEnabled backported +# via the CVE-2023-52425 fix, but XML_COMBINED_VERSION remains 20500. +# CPython's #if XML_COMBINED_VERSION >= 20600 guards compile the setter +# as a no-op, so SetReparseDeferralEnabled silently does nothing and +# GetReparseDeferralEnabled always returns False, even though the expat +# library actually supports (and enables) reparse deferral. +# +# Lower the threshold from 20600 to 20500 so that CPython uses the +# backported function. This makes the Python API actually work on RHEL 9 +# and fixes test failures (test_reparse_deferral_disabled, +# test_flush_reparse_deferral_disabled, test_simple_xml_chunk_*). +# +# The spec file BuildRequires expat-devel >= 2.5.0-2 to ensure the +# backported function is available. +Patch466: 00466-downstream-only-lower-xml_combined_version-threshold-for-reparse-deferral.patch # 00475 # d44fac01037662db286449a78c8fb819788f764c # CVE-2025-15367 @@ -598,10 +608,12 @@ Requires: tzdata # This breaks many things, including python -m venv. # We avoid this problem by requiring at least the same version of expat that # was used during the build time. +# We also include release, in case pyxpat uses ABI that was backported +# (e.g. XML_SetReparseDeferralEnabled was added in c9s expat 2.5.0-2). # Other subpackages (like -debug) also need this, but they all depend on -libs. # Since expat 2.7.4, the library has versioned symbols and this is no longer needed, # as the generated requirement will be in the form of libexpat.so.1(LIBEXPAT_2.7.2) etc. -%global expat_version %(LANG=C rpm -q --qf '%%{version}' expat.%{_target_cpu} | sed 's/.*not installed/0/') +%global expat_version %(LANG=C rpm -q --qf '%%{version}-%%{release}' expat.%{_target_cpu} | sed 's/.*not installed/0/') %if v"%{expat_version}" < v"2.7.4" Requires: expat%{?_isa} >= %{expat_version} %endif @@ -1359,7 +1371,6 @@ CheckPython() { # test.test_concurrent_futures.test_deadlock tends to time out on s390x and ppc64le in # freethreading{,-debug} build, skipping it to shorten the build time # see: https://github.com/python/cpython/issues/121719 - # test_subparser_inherits_reparse_deferral: https://github.com/python/cpython/issues/155485 LD_LIBRARY_PATH=$ConfDir $ConfDir/python -m test.regrtest \ -wW --slowest %{_smp_mflags} \ %ifarch riscv64 @@ -1376,9 +1387,6 @@ CheckPython() { -x test_signal \ -i test_deadlock \ %endif - %if 0%{?rhel} == 9 - -i test_subparser_inherits_reparse_deferral \ - %endif echo FINISHED: CHECKING OF PYTHON FOR CONFIGURATION: $ConfName @@ -1810,6 +1818,9 @@ CheckPython freethreading # ====================================================== %changelog +* Wed Aug 12 2026 Miro Hrončok - 3.13.15-2 +- On EPEL 9, also supports reparse deferral in expat + * Mon Aug 10 2026 Karolina Surma - 3.13.15-1 - Update to Python 3.13.15