00251-change-user-install-location.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
 Date: Mon, 15 Feb 2021 12:19:27 +0100
-Subject: 00251: Change user install location
+Subject: [PATCH] 00251: Change user install location
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -25,15 +25,15 @@ Co-authored-by: Michal Cyprian <m.cyprian@gmail.com>
 Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
 ---
  Lib/site.py                |  9 ++++++-
- Lib/sysconfig/__init__.py  | 50 +++++++++++++++++++++++++++++++++++++-
+ Lib/sysconfig/__init__.py  | 49 +++++++++++++++++++++++++++++++++++++-
  Lib/test/test_sysconfig.py | 17 +++++++++++--
- 3 files changed, 72 insertions(+), 4 deletions(-)
+ 3 files changed, 71 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/site.py b/Lib/site.py
-index 041dca113a..ca6320df2f 100644
+index 672fa7b000..0a9c5be53e 100644
 --- a/Lib/site.py
 +++ b/Lib/site.py
-@@ -415,8 +415,15 @@ def getsitepackages(prefixes=None):
+@@ -377,8 +377,15 @@ def getsitepackages(prefixes=None):
      return sitepackages
  
  def addsitepackages(known_paths, prefixes=None):
@@ -51,10 +51,10 @@ index 041dca113a..ca6320df2f 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py
-index 43edebce34..40e85568ea 100644
+index 2a7fa45be0..7b75228fb3 100644
 --- a/Lib/sysconfig/__init__.py
 +++ b/Lib/sysconfig/__init__.py
-@@ -106,6 +106,12 @@
+@@ -104,6 +104,11 @@
  else:
      _INSTALL_SCHEMES['venv'] = _INSTALL_SCHEMES['posix_venv']
  
@@ -63,11 +63,10 @@ index 43edebce34..40e85568ea 100644
 +# For backwards compatibility, we keep it here (at least on 3.10 and 3.11).
 +_INSTALL_SCHEMES['rpm_prefix'] = _INSTALL_SCHEMES['posix_prefix']
 +
-+
- def _get_implementation():
-     return 'Python'
  
-@@ -167,6 +173,19 @@ def joinuser(*args):
+ # NOTE: site.py has copy of this function.
+ # Sync it when modify this function.
+@@ -163,6 +168,19 @@ def joinuser(*args):
              },
      }
  
@@ -87,7 +86,7 @@ index 43edebce34..40e85568ea 100644
  _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
                  'scripts', 'data')
  
-@@ -266,11 +285,40 @@ def _extend_dict(target_dict, other_dict):
+@@ -257,11 +275,40 @@ def _extend_dict(target_dict, other_dict):
          target_dict[key] = value
  
  
@@ -120,7 +119,7 @@ index 43edebce34..40e85568ea 100644
 +    # we only change the defaults here, so explicit --prefix will take precedence
 +    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
 +    if (scheme == 'posix_prefix' and
-+        sys.prefix == '/usr' and
++        _PREFIX == '/usr' and
 +        'RPM_BUILD_ROOT' not in os.environ):
 +            _extend_dict(vars, _config_vars_local())
 +    else:
@@ -130,10 +129,10 @@ index 43edebce34..40e85568ea 100644
          # On Windows we want to substitute 'lib' for schemes rather
          # than the native value (without modifying vars, in case it
 diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index ce17206a3c..fd95071099 100644
+index 2a6813f00b..00d7034801 100644
 --- a/Lib/test/test_sysconfig.py
 +++ b/Lib/test/test_sysconfig.py
-@@ -130,8 +130,19 @@ def test_get_path(self):
+@@ -113,8 +113,19 @@ def test_get_path(self):
          for scheme in _INSTALL_SCHEMES:
              for name in _INSTALL_SCHEMES[scheme]:
                  expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
@@ -154,7 +153,7 @@ index ce17206a3c..fd95071099 100644
                      os.path.normpath(expected),
                  )
  
-@@ -395,7 +406,7 @@ def test_get_config_h_filename(self):
+@@ -338,7 +349,7 @@ def test_get_config_h_filename(self):
          self.assertTrue(os.path.isfile(config_h), config_h)
  
      def test_get_scheme_names(self):
@@ -163,7 +162,7 @@ index ce17206a3c..fd95071099 100644
          if HAS_USER_BASE:
              wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
          self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
-@@ -407,6 +418,8 @@ def test_symlink(self): # Issue 7880
+@@ -350,6 +361,8 @@ def test_symlink(self): # Issue 7880
              cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
              self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
  

00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch

@@ -0,0 +1,109 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
+Date: Tue, 25 Oct 2022 12:02:33 +0200
+Subject: [PATCH] 00371: Revert "bpo-1596321: Fix threading._shutdown() for the
+ main thread (GH-28549) (GH-28589)"
+
+This reverts commit 38c67738c64304928c68d5c2bd78bbb01d979b94. It
+introduced regression causing FreeIPA's tests to fail.
+
+For more info see:
+https://bodhi.fedoraproject.org/updates/FEDORA-2021-e152ce5f31
+https://github.com/GrahamDumpleton/mod_wsgi/issues/730
+---
+ Lib/test/test_threading.py | 33 ---------------------------------
+ Lib/threading.py           | 31 +++++++++++--------------------
+ 2 files changed, 11 insertions(+), 53 deletions(-)
+
+diff --git a/Lib/test/test_threading.py b/Lib/test/test_threading.py
+index 146e2dbc0f..af63422c6c 100644
+--- a/Lib/test/test_threading.py
++++ b/Lib/test/test_threading.py
+@@ -1056,39 +1056,6 @@ def noop(): pass
+             threading.Thread(target=noop).start()
+             # Thread.join() is not called
+ 
+-    def test_import_from_another_thread(self):
+-        # bpo-1596321: If the threading module is first import from a thread
+-        # different than the main thread, threading._shutdown() must handle
+-        # this case without logging an error at Python exit.
+-        code = textwrap.dedent('''
+-            import _thread
+-            import sys
+-
+-            event = _thread.allocate_lock()
+-            event.acquire()
+-
+-            def import_threading():
+-                import threading
+-                event.release()
+-
+-            if 'threading' in sys.modules:
+-                raise Exception('threading is already imported')
+-
+-            _thread.start_new_thread(import_threading, ())
+-
+-            # wait until the threading module is imported
+-            event.acquire()
+-            event.release()
+-
+-            if 'threading' not in sys.modules:
+-                raise Exception('threading is not imported')
+-
+-            # don't wait until the thread completes
+-        ''')
+-        rc, out, err = assert_python_ok("-c", code)
+-        self.assertEqual(out, b'')
+-        self.assertEqual(err, b'')
+-
+     def test_start_new_thread_at_exit(self):
+         code = """if 1:
+             import atexit
+diff --git a/Lib/threading.py b/Lib/threading.py
+index 85aff58968..746c409c63 100644
+--- a/Lib/threading.py
++++ b/Lib/threading.py
+@@ -1616,32 +1616,23 @@ def _shutdown():
+ 
+     global _SHUTTING_DOWN
+     _SHUTTING_DOWN = True
++    # Main thread
++    tlock = _main_thread._tstate_lock
++    # The main thread isn't finished yet, so its thread state lock can't have
++    # been released.
++    assert tlock is not None
++    if tlock.locked():
++        # It should have been released already by
++        # _PyInterpreterState_SetNotRunningMain(), but there may be
++        # embedders that aren't calling that yet.
++        tlock.release()
++    _main_thread._stop()
+ 
+     # Call registered threading atexit functions before threads are joined.
+     # Order is reversed, similar to atexit.
+     for atexit_call in reversed(_threading_atexits):
+         atexit_call()
+ 
+-    # Main thread
+-    if _main_thread.ident == get_ident():
+-        tlock = _main_thread._tstate_lock
+-        # The main thread isn't finished yet, so its thread state lock can't
+-        # have been released.
+-        assert tlock is not None
+-        if tlock.locked():
+-            # It should have been released already by
+-            # _PyInterpreterState_SetNotRunningMain(), but there may be
+-            # embedders that aren't calling that yet.
+-            tlock.release()
+-        _main_thread._stop()
+-    else:
+-        # bpo-1596321: _shutdown() must be called in the main thread.
+-        # If the threading module was not imported by the main thread,
+-        # _main_thread is the thread which imported the threading module.
+-        # In this case, ignore _main_thread, similar behavior than for threads
+-        # spawned by C libraries or using _thread.start_new_thread().
+-        pass
+-
+     # Join all non-deamon threads
+     while True:
+         with _shutdown_locks_lock:

00466-downstream-only-lower-xml_combined_version-threshold-for-reparse-deferral.patch

@@ -1,133 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
-Date: Wed, 12 Aug 2026 15:18:39 +0200
-Subject: 00466: Downstream only: Lower XML_COMBINED_VERSION threshold for
- reparse deferral
-
-RHEL 9 expat 2.5.0 has XML_SetReparseDeferralEnabled backported
-via the CVE-2023-52425 fix, but XML_COMBINED_VERSION remains 20500.
-CPython's #if XML_COMBINED_VERSION >= 20600 guards compile the setter
-as a no-op, so SetReparseDeferralEnabled silently does nothing and
-GetReparseDeferralEnabled always returns False, even though the expat
-library actually supports (and enables) reparse deferral.
-
-Lower the threshold from 20600 to 20500 so that CPython uses the
-backported function. This makes the Python API actually work on RHEL 9
-and fixes test failures (test_reparse_deferral_disabled,
-test_flush_reparse_deferral_disabled, test_simple_xml_chunk_*).
-
-The spec file BuildRequires expat-devel >= 2.5.0-2 to ensure the
-backported function is available.
----
- Lib/test/test_pyexpat.py   | 6 +++---
- Lib/test/test_sax.py       | 4 ++--
- Lib/test/test_xml_etree.py | 4 ++--
- Modules/pyexpat.c          | 6 +++---
- 4 files changed, 10 insertions(+), 10 deletions(-)
-
-diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
-index ae7cec6540..7f73a8c5e7 100644
---- a/Lib/test/test_pyexpat.py
-+++ b/Lib/test/test_pyexpat.py
-@@ -1001,7 +1001,7 @@ def test_error_path_no_crash(self):
- class ReparseDeferralTest(unittest.TestCase):
-     def test_getter_setter_round_trip(self):
-         parser = expat.ParserCreate()
--        enabled = (expat.version_info >= (2, 6, 0))
-+        enabled = (expat.version_info >= (2, 5, 0))
- 
-         self.assertIs(parser.GetReparseDeferralEnabled(), enabled)
-         parser.SetReparseDeferralEnabled(False)
-@@ -1010,7 +1010,7 @@ def test_getter_setter_round_trip(self):
-         self.assertIs(parser.GetReparseDeferralEnabled(), enabled)
- 
-     def test_reparse_deferral_enabled(self):
--        if expat.version_info < (2, 6, 0):
-+        if expat.version_info < (2, 5, 0):
-             self.skipTest(f'Expat {expat.version_info} does not '
-                           'support reparse deferral')
- 
-@@ -1041,7 +1041,7 @@ def start_element(name, _):
- 
-         parser = expat.ParserCreate()
-         parser.StartElementHandler = start_element
--        if expat.version_info >= (2, 6, 0):
-+        if expat.version_info >= (2, 5, 0):
-             parser.SetReparseDeferralEnabled(False)
-         self.assertFalse(parser.GetReparseDeferralEnabled())
- 
-diff --git a/Lib/test/test_sax.py b/Lib/test/test_sax.py
-index 9b3014a94a..0e38c9488e 100644
---- a/Lib/test/test_sax.py
-+++ b/Lib/test/test_sax.py
-@@ -1215,7 +1215,7 @@ def test_expat_incremental_reset(self):
- 
-         self.assertEqual(result.getvalue(), start + b"<doc>text</doc>")
- 
--    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
-+    @unittest.skipIf(pyexpat.version_info < (2, 5, 0),
-                      f'Expat {pyexpat.version_info} does not '
-                      'support reparse deferral')
-     def test_flush_reparse_deferral_enabled(self):
-@@ -1249,7 +1249,7 @@ def test_flush_reparse_deferral_disabled(self):
-         for chunk in ("<doc", ">"):
-             parser.feed(chunk)
- 
--        if pyexpat.version_info >= (2, 6, 0):
-+        if pyexpat.version_info >= (2, 5, 0):
-             parser._parser.SetReparseDeferralEnabled(False)
-             self.assertEqual(result.getvalue(), start)  # i.e. no elements started
- 
-diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
-index 4a76a5be1e..effb899d7b 100644
---- a/Lib/test/test_xml_etree.py
-+++ b/Lib/test/test_xml_etree.py
-@@ -1804,7 +1804,7 @@ def test_unknown_event(self):
-         with self.assertRaisesRegex(ValueError, "unknown event 'bogus'"):
-             ET.XMLPullParser(events=(x.decode() for x in (b'start', b'end', b'bogus')))
- 
--    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
-+    @unittest.skipIf(pyexpat.version_info < (2, 5, 0),
-                      f'Expat {pyexpat.version_info} does not '
-                      'support reparse deferral')
-     def test_flush_reparse_deferral_enabled(self):
-@@ -1834,7 +1834,7 @@ def test_flush_reparse_deferral_disabled(self):
-         for chunk in ("<doc", ">"):
-             parser.feed(chunk)
- 
--        if pyexpat.version_info >= (2, 6, 0):
-+        if pyexpat.version_info >= (2, 5, 0):
-             if not ET is pyET:
-                 self.skipTest(f'XMLParser.(Get|Set)ReparseDeferralEnabled '
-                               'methods not available in C')
-diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
-index 9e5d84eb5e..b008fe66c1 100644
---- a/Modules/pyexpat.c
-+++ b/Modules/pyexpat.c
-@@ -781,7 +781,7 @@ pyexpat_xmlparser_SetReparseDeferralEnabled_impl(xmlparseobject *self,
-                                                  int enabled)
- /*[clinic end generated code: output=5ec539e3b63c8c49 input=021eb9e0bafc32c5]*/
- {
--#if XML_COMBINED_VERSION >= 20600
-+#if XML_COMBINED_VERSION >= 20500
-     XML_SetReparseDeferralEnabled(self->itself, enabled ? XML_TRUE : XML_FALSE);
-     self->reparse_deferral_enabled = (bool)enabled;
- #endif
-@@ -1446,7 +1446,7 @@ newxmlparseobject(pyexpat_state *state, const char *encoding,
-     self->ns_prefixes = 0;
-     self->handlers = NULL;
-     self->intern = Py_XNewRef(intern);
--#if XML_COMBINED_VERSION >= 20600
-+#if XML_COMBINED_VERSION >= 20500
-     self->reparse_deferral_enabled = true;
- #else
-     self->reparse_deferral_enabled = false;
-@@ -2332,7 +2332,7 @@ pyexpat_exec(PyObject *mod)
- #else
-     capi->SetHashSalt16Bytes = NULL;
- #endif
--#if XML_COMBINED_VERSION >= 20600
-+#if XML_COMBINED_VERSION >= 20500
-     capi->SetReparseDeferralEnabled = XML_SetReparseDeferralEnabled;
- #else
-     capi->SetReparseDeferralEnabled = NULL;

00475-cve-2025-15367.patch

@@ -1,59 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Tue, 20 Jan 2026 14:46:32 -0600
-Subject: 00475: CVE-2025-15367
-
-Reject control characters in POP3 commands
----
- Lib/poplib.py                                             | 2 ++
- Lib/test/test_poplib.py                                   | 8 ++++++++
- .../2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst        | 1 +
- 3 files changed, 11 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-
-diff --git a/Lib/poplib.py b/Lib/poplib.py
-index 4469bff44b..b97274c5c3 100644
---- a/Lib/poplib.py
-+++ b/Lib/poplib.py
-@@ -122,6 +122,8 @@ def _putline(self, line):
-     def _putcmd(self, line):
-         if self._debugging: print('*cmd*', repr(line))
-         line = bytes(line, self.encoding)
-+        if re.search(b'[\x00-\x1F\x7F]', line):
-+            raise ValueError('Control characters not allowed in commands')
-         self._putline(line)
- 
- 
-diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py
-index eb6dab4015..bd621caee4 100644
---- a/Lib/test/test_poplib.py
-+++ b/Lib/test/test_poplib.py
-@@ -18,6 +18,7 @@
- from test.support import asynchat
- from test.support import asyncore
- from test.support.testcase import ExtraAssertions
-+from test.support import control_characters_c0
- 
- 
- test_support.requires_working_socket(module=True)
-@@ -396,6 +397,13 @@ def test_quit(self):
-         self.assertIsNone(self.client.sock)
-         self.assertIsNone(self.client.file)
- 
-+    def test_control_characters(self):
-+        for c0 in control_characters_c0():
-+            with self.assertRaises(ValueError):
-+                self.client.user(f'user{c0}')
-+            with self.assertRaises(ValueError):
-+                self.client.pass_(f'{c0}pass')
-+
-     @requires_ssl
-     def test_stls_capa(self):
-         capa = self.client.capa()
-diff --git a/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-new file mode 100644
-index 0000000000..3cde4df3e0
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
-@@ -0,0 +1 @@
-+Reject control characters in POP3 commands.

00477-raise-an-error-when-importing-stdlib-modules-compiled-for-a-different-python-version.patch

@@ -1,173 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Petr Viktorin <encukou@gmail.com>
-Date: Mon, 9 Feb 2026 10:44:21 +0100
-Subject: 00477: Raise an error when importing stdlib modules compiled for a
- different Python version
-
-This is a downstream workaround "implementing" python#137212 -
-the mechanism for the check exists in Python 3.15+, where it needs to be
-added to the standard library modules.
-In Fedora, we need it also in previous Python versions, as we experience
-segmentation fault when importing stdlib modules after update while
-Python is running.
-
-_curses, _tkinter, _tracemalloc and readline are not calling PyModuleDef_Init,
-which is modified with this patch, hence they need a
-direct call to the check function.
-
-Co-Authored-By: Karolina Surma <ksurma@redhat.com>
----
- Include/moduleobject.h  | 43 +++++++++++++++++++++++++++++++++++++++++
- Makefile.pre.in         |  3 +++
- Modules/_cursesmodule.c |  6 ++++++
- Modules/_tkinter.c      |  6 ++++++
- Modules/_tracemalloc.c  |  6 ++++++
- Modules/readline.c      |  6 ++++++
- Objects/moduleobject.c  |  1 +
- 7 files changed, 71 insertions(+)
-
-diff --git a/Include/moduleobject.h b/Include/moduleobject.h
-index 2a17c891dd..64017c666c 100644
---- a/Include/moduleobject.h
-+++ b/Include/moduleobject.h
-@@ -116,6 +116,49 @@ struct PyModuleDef {
-   freefunc m_free;
- };
- 
-+#if defined(_PyHack_check_version_on_modinit) && defined(Py_BUILD_CORE)
-+/* The mechanism for the check has been implemented on Python 3.15+:
-+ * https://github.com/python/cpython/pull/137212.
-+ * In Fedora, we need this in older Pythons too:
-+ * if somebody attempts to import a module compiled for a different Python version,
-+ * instead of segmentation fault a meaningful error is raised.
-+ */
-+PyAPI_DATA(const unsigned long) Py_Version;
-+
-+static inline int
-+_PyHack_CheckInternalAPIVersion(const char *mod_name)
-+{
-+    if (PY_VERSION_HEX != Py_Version) {
-+        PyErr_Format(
-+            PyExc_ImportError,
-+            "internal Python C API version mismatch: "
-+            "module %s compiled with %lu.%lu.%lu; "
-+            "runtime version is %lu.%lu.%lu",
-+            mod_name,
-+            (const unsigned long)((PY_VERSION_HEX >> 24) & 0xFF),
-+            (const unsigned long)((PY_VERSION_HEX >> 16) & 0xFF),
-+            (const unsigned long)((PY_VERSION_HEX >> 8) & 0xFF),
-+            (const unsigned long)((Py_Version >> 24) & 0xFF),
-+            (const unsigned long)((Py_Version >> 16) & 0xFF),
-+            (const unsigned long)((Py_Version >> 8) & 0xFF)
-+        );
-+        return -1;
-+    }
-+    return 0;
-+}
-+
-+static inline PyObject *
-+PyModuleDef_Init_with_check(PyModuleDef *def)
-+{
-+    if (_PyHack_CheckInternalAPIVersion(def->m_name) < 0) {
-+        return NULL;
-+    }
-+    return PyModuleDef_Init(def);
-+}
-+
-+#define PyModuleDef_Init PyModuleDef_Init_with_check
-+#endif
-+
- #ifdef __cplusplus
- }
- #endif
-diff --git a/Makefile.pre.in b/Makefile.pre.in
-index 2363b99a25..f1a07645f0 100644
---- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -3159,3 +3159,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h
- # Local Variables:
- # mode: makefile
- # End:
-+
-+# Fedora-specific, downstream only
-+PY_STDMODULE_CFLAGS += -D_PyHack_check_version_on_modinit=1
-diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c
-index 1996488a0e..cfdffd8ec4 100644
---- a/Modules/_cursesmodule.c
-+++ b/Modules/_cursesmodule.c
-@@ -5011,6 +5011,12 @@ curses_destructor(PyObject *op)
- PyMODINIT_FUNC
- PyInit__curses(void)
- {
-+    #ifdef _PyHack_check_version_on_modinit
-+        if (_PyHack_CheckInternalAPIVersion("_curses") < 0) {
-+            return NULL;
-+        }
-+    #endif
-+
-     PyObject *m, *d, *v, *c_api_object;
- 
-     /* Initialize object type */
-diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c
-index 4e8d75e8e1..32e58755aa 100644
---- a/Modules/_tkinter.c
-+++ b/Modules/_tkinter.c
-@@ -3499,6 +3499,12 @@ static struct PyModuleDef _tkintermodule = {
- PyMODINIT_FUNC
- PyInit__tkinter(void)
- {
-+    #ifdef _PyHack_check_version_on_modinit
-+        if (_PyHack_CheckInternalAPIVersion("_tkinter") < 0) {
-+            return NULL;
-+        }
-+    #endif
-+
-     PyObject *m, *uexe, *cexe;
- 
-     tcl_lock = PyThread_allocate_lock();
-diff --git a/Modules/_tracemalloc.c b/Modules/_tracemalloc.c
-index 0b85187e5f..87f358ed07 100644
---- a/Modules/_tracemalloc.c
-+++ b/Modules/_tracemalloc.c
-@@ -215,6 +215,12 @@ static struct PyModuleDef module_def = {
- PyMODINIT_FUNC
- PyInit__tracemalloc(void)
- {
-+    #ifdef _PyHack_check_version_on_modinit
-+        if (_PyHack_CheckInternalAPIVersion("_tracemalloc") < 0) {
-+            return NULL;
-+        }
-+    #endif
-+
-     PyObject *m;
-     m = PyModule_Create(&module_def);
-     if (m == NULL)
-diff --git a/Modules/readline.c b/Modules/readline.c
-index 7a612deae4..8b2f47eec1 100644
---- a/Modules/readline.c
-+++ b/Modules/readline.c
-@@ -1548,6 +1548,12 @@ static struct PyModuleDef readlinemodule = {
- PyMODINIT_FUNC
- PyInit_readline(void)
- {
-+    #ifdef _PyHack_check_version_on_modinit
-+        if (_PyHack_CheckInternalAPIVersion("readline") < 0) {
-+            return NULL;
-+        }
-+    #endif
-+
-     const char *backend = "readline";
-     PyObject *m;
-     readlinestate *mod_state;
-diff --git a/Objects/moduleobject.c b/Objects/moduleobject.c
-index d787f29004..31175ceb3f 100644
---- a/Objects/moduleobject.c
-+++ b/Objects/moduleobject.c
-@@ -43,6 +43,7 @@ _PyModule_IsExtension(PyObject *obj)
- }
- 
- 
-+#undef PyModuleDef_Init
- PyObject*
- PyModuleDef_Init(PyModuleDef* def)
- {

plan.fmf

@@ -1,77 +0,0 @@
-execute:
-  how: tmt
-
-provision:
-  hardware:
-    memory: '>= 3 GB'
-
-environment:
-  pybasever: '3.13'
-
-discover:
-  - name: tests_python
-    how: shell
-    url: https://src.fedoraproject.org/tests/python.git
-    tests:
-    - name: smoke
-      path: /smoke
-      test: "VERSION=${pybasever} CYTHON=false ./venv.sh"
-    - name: smoke_virtualenv
-      path: /smoke
-      test: "VERSION=${pybasever} METHOD=virtualenv CYTHON=false ./venv.sh"
-    - name: debugsmoke
-      path: /smoke
-      test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} CYTHON=false ./venv.sh"
-    - name: selftest
-      path: /selftest
-      test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh"
-    - name: debugtest
-      path: /selftest
-      test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes' ./parallel.sh"
-    - name: optimizedflags
-      path: /flags
-      test: "python${pybasever} ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
-    - name: debugflags
-      path: /flags
-      test: "python${pybasever}d ./assertflags.py -O0  CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
-    - name: freethreadingflags
-      path: /flags
-      test: "python${pybasever}t ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
-    - name: freethreadingdebugflags
-      path: /flags
-      test: "python${pybasever}td ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
-    - name: marshalparser
-      path: /marshalparser
-      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
-    - name: required_symbols
-      path: /required-symbols
-      test: "VERSION=${pybasever} ./check.sh"
-
-prepare:
-  - name: Install dependencies
-    how: install
-    package:
-    - gcc  # for extension building in venv and selftest
-    - gcc-c++ # for test_cppext
-    - gdb  # for test_gdb
-    - "python${pybasever}"  # the test subject
-    - "python${pybasever}-debug"  # for leak testing
-    - "python${pybasever}-devel"  # for extension building in venv and selftest
-    - "python${pybasever}-tkinter"  # for selftest
-    - "python${pybasever}-test"  # for selftest
-    - "python${pybasever}-freethreading"  # for -O... flag test
-    - "python${pybasever}-freethreading-debug"  # for -O... flag test    
-    - tox  # for venv tests
-    - virtualenv  # for virtualenv tests
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
-    - binutils  # for nm (symbol inspection)
-    - rpm  # for debugging
-    - dnf  # for upgrade and downgrade
-  - name: Update packages
-    how: shell
-    script: dnf upgrade -y
-  - name: rpm_qa
-    order: 100
-    how: shell
-    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt

rpminspect.yaml

@@ -1,22 +1,22 @@
 # exclude test XML data (not always valid) from XML validity check:
 xml:
     ignore:
-        - '/usr/lib*/python*/test/xmltestdata/*'
+        - /usr/lib*/python*/test/xmltestdata/*
-        - '/usr/lib*/python*/test/xmltestdata/*/*'
+        - /usr/lib*/python*/test/xmltestdata/*/*
 
 # exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
 badfuncs:
     allowed:
-        '/usr/lib*/python*/lib-dynload/_socket.*':
+        /usr/lib*/python*/lib-dynload/_socket.*:
             - inet_aton
             - inet_ntoa
 
 # exclude the debug build from annocheck entirely
 annocheck:
     ignore:
-        - '/usr/bin/python*d'
+        - /usr/bin/python*d
-        - '/usr/lib*/libpython*d.so.1.0'
+        - /usr/lib*/libpython*d.so.1.0
-        - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so'
+        - /usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so
 
 # don't report changed content of compiled files
 # that is expected with every toolchain update and not reproducible yet

rpmlint.toml

@@ -6,7 +6,7 @@ Filters = [
 
 
     # TESTS:
-    '(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+t?/test',
+    '(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+/test',
 
 
     # OTHER DELIBERATES:
@@ -14,7 +14,7 @@ Filters = [
     'missing-call-to-chdir-with-chroot',
 
     # gethostbyname function calls gethostbyname
-    '(E|W): binary-or-shlib-calls-gethostbyname /usr/lib(64)?/python3\.\d+t?/lib-dynload/_socket\.',
+    '(E|W): binary-or-shlib-calls-gethostbyname /usr/lib(64)?/python3\.\d+/lib-dynload/_socket\.',
 
     # intentionally unversioned and selfobsoleted
     'unversioned-explicit-obsoletes python',
@@ -28,18 +28,18 @@ Filters = [
     'only-non-binary-in-usr-lib',
 
     # some devel files that are deliberately needed
-    'devel-file-in-non-devel-package /usr/include/python3\.\d+m?t?/pyconfig-(32|64)\.h',
+    'devel-file-in-non-devel-package /usr/include/python3\.\d+m?/pyconfig-(32|64)\.h',
-    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+t?/distutils/tests/xxmodule\.c',
+    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/distutils/tests/xxmodule\.c',
     # ...or are used as test data
-    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+t?/test',
+    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/test',
 
     # some bytecode is shipped without sources on purpose, as a space optimization
     # if this regex needs to be relaxed in the future, make sure it **does not** match pyc files in __pycache__
-    'python-bytecode-without-source /usr/lib(64)?/python3\.\d+t?/(encodings|pydoc_data)/[^/]+.pyc',
+    'python-bytecode-without-source /usr/lib(64)?/python3\.\d+/(encodings|pydoc_data)/[^/]+.pyc',
 
     # DUPLICATE FILES
     # test data are often duplicated
-    '(E|W): files-duplicate /usr/lib(64)?/python3\.\d+t?/(test|__phello__)/',
+    '(E|W): files-duplicate /usr/lib(64)?/python3\.\d+/(test|__phello__)/',
     # duplicated inits or mains are also common
     '(E|W): files-duplicate .+__init__\.py.+__init__\.py',
     '(E|W): files-duplicate .+__main__\.py.+__main__\.py',
@@ -52,10 +52,10 @@ Filters = [
     # manual pages
     'no-manual-page-for-binary (idle|pydoc|pyvenv|2to3|python3?-debug|pathfix|msgfmt|pygettext)',
     'no-manual-page-for-binary python3?.*-config$',
-    'no-manual-page-for-binary python3\.\d+t?dm?$',
+    'no-manual-page-for-binary python3\.\d+dm?$',
 
     # missing documentation from subpackages
-    '^python3(\.\d+)?-(freethreading(-debug)?|debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation',
+    '^python3(\.\d+)?-(debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation',
 
     # platform python is obsoleted, but not provided
     'obsolete-not-provided platform-python',
@@ -77,13 +77,13 @@ Filters = [
     # this is OK for F28+
     'library-without-ldconfig-post',
 
-    # freethreading/debug package contains devel and non-devel files
+    # debug package contains devel and non-devel files
-    'python3(\.\d+)?-(freethreading(-debug)?|debug)\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package',
+    'python3(\.\d+)?-debug\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package',
 
     # this goes to other subpackage, hence not actually dangling
     'dangling-relative-symlink /usr/bin/python python3',
     'dangling-relative-symlink /usr/share/man/man1/python\.1\.gz python3\.1\.gz',
-    'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+t?d?m?(-embed)?\.pc python-3\.\d+t?(-embed)?\.pc',
+    'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc python-3\.\d+(-embed)?\.pc',
 
     # the python-unversioned-command package contains dangling symlinks by design
     '^python-unversioned-command\.[^:]+: (E|W): dangling-relative-symlink (/usr/bin/python \./python3|/usr/share/man/man1/python\.1\S* ./python3\.1\S*)$',
@@ -101,6 +101,6 @@ Filters = [
     '\bpython3(\.\d+)?\.(src|spec): (E|W): specfile-error\s+$',
 
     # SPELLING ERRORS
-    'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest|unittest|gil) ',
+    'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest) ',
 
 ]

sources

@@ -1,2 +1,2 @@
-SHA512 (Python-3.13.15.tar.xz) = b0ab766a3de0b4cfdbf0b93300d7330c734d3f7057577bb03e95e39da4cdade81993e769c7fa6dfdcc13b9d43a3b399d9cd89b5477b413662e9e691c1b7886b8
+SHA512 (Python-3.13.0a2.tar.xz) = 2702f630ebb49a835c213656f2f0d41f87daf2dad6b856821f4011f4614c19279656eaa1dad9f1cbfd258992aa5f59d4571577057c6a4ad1cdcfa4d8ada3b607
-SHA512 (Python-3.13.15.tar.xz.asc) = 662c00be95f62e80db43cf42099fef91f764ff7a4433cadf7eb19dedb5e4775adb12878d5ed2295fcea187731de186163ad9672ab72cde62a2335ca58ec1ad86
+SHA512 (Python-3.13.0a2.tar.xz.asc) = c6a0101b844701fcd860a519ec4830bde0df486ea78377831544dbe0db25dd67c28360f46d5ef01db64aa4347cf7b0d489590f6dc91e768b16753228f2c93b25

tests/provision.fmf

@@ -0,0 +1,4 @@
+---
+standard-inventory-qcow2:
+  qemu:
+    m: 3G  # Amount of VM memory

tests/tests.yml

@@ -0,0 +1,56 @@
+---
+- hosts: localhost
+  tags:
+    - classic
+  tasks:
+    - dnf:
+        name: "*"
+        state: latest
+
+- hosts: localhost
+  roles:
+  - role: standard-test-basic
+    tags:
+    - classic
+    repositories:
+    - repo: "https://src.fedoraproject.org/tests/python.git"
+      dest: "python"
+    pybasever: "3.13"
+    tests:
+    - rpm_qa:
+        run: rpm -qa
+    - smoke:
+        dir: python/smoke
+        run: "VERSION={{ pybasever }} CYTHON=false ./venv.sh"
+    - smoke_virtualenv:
+        dir: python/smoke
+        run: "VERSION={{ pybasever }} METHOD=virtualenv CYTHON=false ./venv.sh"
+    - debugsmoke:
+        dir: python/smoke
+        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} CYTHON=false ./venv.sh"
+    - selftest:
+        dir: python/selftest
+        run: "VERSION={{ pybasever }} X='-i test_check_probes' ./parallel.sh"
+    - debugtest:
+        dir: python/selftest
+        run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='-i test_check_probes' ./parallel.sh"
+    - debugflags:
+        dir: python/flags
+        run: "python{{ pybasever }}d ./assertflags.py -O0"
+    - marshalparser:
+        dir: python/marshalparser
+        run: "VERSION={{ pybasever }} SAMPLE=10 test_marshalparser_compatibility.sh"
+    required_packages:
+    - gcc  # for extension building in venv and selftest
+    - gcc-c++ # for test_cppext
+    - gdb  # for test_gdb
+    - "python{{ pybasever }}"  # the test subject
+    - "python{{ pybasever }}-debug"  # for leak testing
+    - "python{{ pybasever }}-devel"  # for extension building in venv and selftest
+    - "python{{ pybasever }}-tkinter"  # for selftest
+    - "python{{ pybasever }}-test"  # for selftest
+    - tox  # for venv tests
+    - virtualenv  # for virtualenv tests
+    - glibc-all-langpacks # for locale tests
+    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - rpm  # for debugging