Update to Python 3.14.6
This commit is contained in:
Karolina Surma
parent
576eed68c6
commit
f26b7fcd3a
7 changed files with 26 additions and 142 deletions
|
|
@ -1,102 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Charalampos Stratakis <cstratak@redhat.com>
|
||||
Date: Tue, 3 Jun 2025 03:02:15 +0200
|
||||
Subject: 00464: Enable PAC and BTI protections for aarch64
|
||||
|
||||
Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
|
||||
|
||||
The BTI flag must be applied in the assembler sources for this class
|
||||
of attacks to be mitigated on newer aarch64 processors.
|
||||
|
||||
Upstream PR: https://github.com/python/cpython/pull/130864/files
|
||||
|
||||
The upstream patch is incomplete but only for the case where
|
||||
frame pointers are not used on 3.13+.
|
||||
|
||||
Since on Fedora we always compile with frame pointers the BTI/PAC
|
||||
hardware protections can be enabled without losing Perf unwinding.
|
||||
---
|
||||
Python/asm_trampoline.S | 4 +++
|
||||
Python/asm_trampoline_aarch64.h | 50 +++++++++++++++++++++++++++++++++
|
||||
2 files changed, 54 insertions(+)
|
||||
create mode 100644 Python/asm_trampoline_aarch64.h
|
||||
|
||||
diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S
|
||||
index a14e68c0e8..2513cde4e7 100644
|
||||
--- a/Python/asm_trampoline.S
|
||||
+++ b/Python/asm_trampoline.S
|
||||
@@ -1,3 +1,5 @@
|
||||
+#include "asm_trampoline_aarch64.h"
|
||||
+
|
||||
.text
|
||||
.globl _Py_trampoline_func_start
|
||||
# The following assembly is equivalent to:
|
||||
@@ -21,10 +23,12 @@ _Py_trampoline_func_start:
|
||||
#if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__)
|
||||
// ARM64 little endian, 64bit ABI
|
||||
// generate with aarch64-linux-gnu-gcc 12.1
|
||||
+ SIGN_LR
|
||||
stp x29, x30, [sp, -16]!
|
||||
mov x29, sp
|
||||
blr x3
|
||||
ldp x29, x30, [sp], 16
|
||||
+ VERIFY_LR
|
||||
ret
|
||||
#endif
|
||||
#ifdef __riscv
|
||||
diff --git a/Python/asm_trampoline_aarch64.h b/Python/asm_trampoline_aarch64.h
|
||||
new file mode 100644
|
||||
index 0000000000..4b0ec4a7dc
|
||||
--- /dev/null
|
||||
+++ b/Python/asm_trampoline_aarch64.h
|
||||
@@ -0,0 +1,50 @@
|
||||
+#ifndef ASM_TRAMPOLINE_AARCH_64_H_
|
||||
+#define ASM_TRAMPOLINE_AARCH_64_H_
|
||||
+
|
||||
+/*
|
||||
+ * References:
|
||||
+ * - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros
|
||||
+ * - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst
|
||||
+ */
|
||||
+
|
||||
+#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
|
||||
+ #define BTI_J hint 36 /* bti j: for jumps, IE br instructions */
|
||||
+ #define BTI_C hint 34 /* bti c: for calls, IE bl instructions */
|
||||
+ #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */
|
||||
+#else
|
||||
+ #define BTI_J
|
||||
+ #define BTI_C
|
||||
+ #define GNU_PROPERTY_AARCH64_BTI 0
|
||||
+#endif
|
||||
+
|
||||
+#if defined(__ARM_FEATURE_PAC_DEFAULT)
|
||||
+ #if __ARM_FEATURE_PAC_DEFAULT & 1
|
||||
+ #define SIGN_LR hint 25 /* paciasp: sign with the A key */
|
||||
+ #define VERIFY_LR hint 29 /* autiasp: verify with the A key */
|
||||
+ #elif __ARM_FEATURE_PAC_DEFAULT & 2
|
||||
+ #define SIGN_LR hint 27 /* pacibsp: sign with the b key */
|
||||
+ #define VERIFY_LR hint 31 /* autibsp: verify with the b key */
|
||||
+ #endif
|
||||
+ #define GNU_PROPERTY_AARCH64_POINTER_AUTH 2 /* bit 1 GNU Notes is for PAC support */
|
||||
+#else
|
||||
+ #define SIGN_LR BTI_C
|
||||
+ #define VERIFY_LR
|
||||
+ #define GNU_PROPERTY_AARCH64_POINTER_AUTH 0
|
||||
+#endif
|
||||
+
|
||||
+/* Add the BTI and PAC support to GNU Notes section */
|
||||
+#if GNU_PROPERTY_AARCH64_BTI != 0 || GNU_PROPERTY_AARCH64_POINTER_AUTH != 0
|
||||
+ .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */
|
||||
+ .balign 8; /* align it on a byte boundry */
|
||||
+ .long 4; /* size of "GNU\0" */
|
||||
+ .long 0x10; /* size of descriptor */
|
||||
+ .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */
|
||||
+ .asciz "GNU";
|
||||
+ .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
|
||||
+ .long 4; /* Four bytes of data */
|
||||
+ .long (GNU_PROPERTY_AARCH64_BTI|GNU_PROPERTY_AARCH64_POINTER_AUTH); /* BTI or PAC is enabled */
|
||||
+ .long 0; /* padding for 8 byte alignment */
|
||||
+ .popsection; /* end the section */
|
||||
+#endif
|
||||
+
|
||||
+#endif
|
||||
|
|
@ -15,10 +15,10 @@ which is tested as working.
|
|||
3 files changed, 10 insertions(+)
|
||||
|
||||
diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
|
||||
index 465f65a03b..3379ab8aa9 100644
|
||||
index dea472335b..dfe41760af 100644
|
||||
--- a/Lib/test/test_pyexpat.py
|
||||
+++ b/Lib/test/test_pyexpat.py
|
||||
@@ -905,6 +905,8 @@ def start_element(name, _):
|
||||
@@ -1031,6 +1031,8 @@ def start_element(name, _):
|
||||
|
||||
self.assertEqual(started, ['doc'])
|
||||
|
||||
|
|
@ -41,10 +41,10 @@ index 5c10bcedc6..1fd7a273b5 100644
|
|||
result = BytesIO()
|
||||
xmlgen = XMLGenerator(result)
|
||||
diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
|
||||
index 1bd0fde844..f87134c11e 100644
|
||||
index 8c693bfbdb..a71f230b77 100644
|
||||
--- a/Lib/test/test_xml_etree.py
|
||||
+++ b/Lib/test/test_xml_etree.py
|
||||
@@ -1573,9 +1573,13 @@ def test_simple_xml(self, chunk_size=None, flush=False):
|
||||
@@ -1598,9 +1598,13 @@ def test_simple_xml(self, chunk_size=None, flush=False):
|
||||
self.assert_event_tags(parser, [('end', 'root')])
|
||||
self.assertIsNone(parser.close())
|
||||
|
||||
|
|
@ -58,7 +58,7 @@ index 1bd0fde844..f87134c11e 100644
|
|||
def test_simple_xml_chunk_5(self):
|
||||
self.test_simple_xml(chunk_size=5, flush=True)
|
||||
|
||||
@@ -1802,6 +1806,8 @@ def test_flush_reparse_deferral_enabled(self):
|
||||
@@ -1827,6 +1831,8 @@ def test_flush_reparse_deferral_enabled(self):
|
||||
|
||||
self.assert_event_tags(parser, [('end', 'doc')])
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ Downstream only: Reject control characters in IMAP commands
|
|||
create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
|
||||
|
||||
diff --git a/Lib/imaplib.py b/Lib/imaplib.py
|
||||
index cbe129b3e7..b9c691aacd 100644
|
||||
index e84ffb2eec..3465881270 100644
|
||||
--- a/Lib/imaplib.py
|
||||
+++ b/Lib/imaplib.py
|
||||
@@ -131,7 +131,7 @@
|
||||
|
|
@ -34,10 +34,10 @@ index cbe129b3e7..b9c691aacd 100644
|
|||
|
||||
literal = self.literal
|
||||
diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py
|
||||
index a03d7b8bb2..e26400b588 100644
|
||||
index f0b463949c..165390ee66 100644
|
||||
--- a/Lib/test/test_imaplib.py
|
||||
+++ b/Lib/test/test_imaplib.py
|
||||
@@ -663,6 +663,12 @@ def test_unselect(self):
|
||||
@@ -673,6 +673,12 @@ def test_unselect(self):
|
||||
self.assertEqual(data[0], b'Returned to authenticated state. (Success)')
|
||||
self.assertEqual(client.state, 'AUTH')
|
||||
|
||||
|
|
|
|||
|
|
@ -81,7 +81,7 @@ index 2a17c891dd..64017c666c 100644
|
|||
}
|
||||
#endif
|
||||
diff --git a/Makefile.pre.in b/Makefile.pre.in
|
||||
index da6d7c3315..92a6825b5e 100644
|
||||
index f86d7363e0..6aa97b0b6f 100644
|
||||
--- a/Makefile.pre.in
|
||||
+++ b/Makefile.pre.in
|
||||
@@ -3420,3 +3420,6 @@ MODULE__MULTIBYTECODEC_DEPS=$(srcdir)/Modules/cjkcodecs/multibytecodec.h
|
||||
|
|
@ -92,10 +92,10 @@ index da6d7c3315..92a6825b5e 100644
|
|||
+# Fedora-specific, downstream only
|
||||
+PY_STDMODULE_CFLAGS += -D_PyHack_check_version_on_modinit=1
|
||||
diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c
|
||||
index 2216de509e..a640496f7f 100644
|
||||
index 6c1af66408..2eb3665fa7 100644
|
||||
--- a/Modules/_tkinter.c
|
||||
+++ b/Modules/_tkinter.c
|
||||
@@ -3489,6 +3489,12 @@ static struct PyModuleDef _tkintermodule = {
|
||||
@@ -3490,6 +3490,12 @@ static struct PyModuleDef _tkintermodule = {
|
||||
PyMODINIT_FUNC
|
||||
PyInit__tkinter(void)
|
||||
{
|
||||
|
|
@ -126,10 +126,10 @@ index be71fc9fc9..67922098b2 100644
|
|||
if (mod == NULL) {
|
||||
return NULL;
|
||||
diff --git a/Modules/readline.c b/Modules/readline.c
|
||||
index 8475846eef..b3f5eb3a1f 100644
|
||||
index 7708f47d4d..7c0b70caa4 100644
|
||||
--- a/Modules/readline.c
|
||||
+++ b/Modules/readline.c
|
||||
@@ -1604,6 +1604,12 @@ static struct PyModuleDef readlinemodule = {
|
||||
@@ -1612,6 +1612,12 @@ static struct PyModuleDef readlinemodule = {
|
||||
PyMODINIT_FUNC
|
||||
PyInit_readline(void)
|
||||
{
|
||||
|
|
|
|||
|
|
@ -70,7 +70,7 @@ index a073300592..5580985974 100644
|
|||
)
|
||||
jit_stencils_h = args.output_dir / "jit_stencils.h"
|
||||
diff --git a/configure b/configure
|
||||
index 30590a397f..babde8c189 100755
|
||||
index 2088290f0e..fd960d9551 100755
|
||||
--- a/configure
|
||||
+++ b/configure
|
||||
@@ -1105,6 +1105,7 @@ with_strict_overflow
|
||||
|
|
@ -121,7 +121,7 @@ index 30590a397f..babde8c189 100755
|
|||
# GH-133171: This configuration builds the JIT but never actually uses it,
|
||||
# which is surprising (and strictly worse than not building it at all):
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 87c0ead45a..70f2c5cbb9 100644
|
||||
index aed1494673..10d78ae942 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -2822,6 +2822,19 @@ AC_SUBST([REGEN_JIT_COMMAND])
|
||||
|
|
|
|||
|
|
@ -45,11 +45,11 @@ URL: https://www.python.org/
|
|||
|
||||
# WARNING When rebasing to a new Python version,
|
||||
# remember to update the python3-docs package as well
|
||||
%global general_version %{pybasever}.5
|
||||
%global general_version %{pybasever}.6
|
||||
#global prerel ...
|
||||
%global upstream_version %{general_version}%{?prerel}
|
||||
Version: %{general_version}%{?prerel:~%{prerel}}
|
||||
Release: 2%{?dist}
|
||||
Release: 1%{?dist}
|
||||
License: Python-2.0.1
|
||||
|
||||
|
||||
|
|
@ -112,7 +112,7 @@ License: Python-2.0.1
|
|||
# This needs to be manually updated when we update Python.
|
||||
# Explore the sources tarball (you need the version before %%prep is executed):
|
||||
# $ tar -tf Python-%%{upstream_version}.tar.xz | grep whl
|
||||
%global pip_version 26.1.1
|
||||
%global pip_version 26.1.2
|
||||
%global setuptools_version 79.0.1
|
||||
# All of those also include a list of indirect bundled libs:
|
||||
# pip
|
||||
|
|
@ -392,23 +392,6 @@ Source34: Python-%{upstream_version}-x86_64-optimized-jit_stencils.h
|
|||
# pypa/distutils integration: https://github.com/pypa/distutils/pull/70
|
||||
Patch251: 00251-change-user-install-location.patch
|
||||
|
||||
# 00464 # 292acffec7a379cb6d1f3c47b9e5a2f170bbadb6
|
||||
# Enable PAC and BTI protections for aarch64
|
||||
#
|
||||
# Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
|
||||
#
|
||||
# The BTI flag must be applied in the assembler sources for this class
|
||||
# of attacks to be mitigated on newer aarch64 processors.
|
||||
#
|
||||
# Upstream PR: https://github.com/python/cpython/pull/130864/files
|
||||
#
|
||||
# The upstream patch is incomplete but only for the case where
|
||||
# frame pointers are not used on 3.13+.
|
||||
#
|
||||
# Since on Fedora we always compile with frame pointers the BTI/PAC
|
||||
# hardware protections can be enabled without losing Perf unwinding.
|
||||
Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
|
||||
|
||||
# 00466 # e10760fb955ee33d2917f8a57bb4e24d71e5341c
|
||||
# Downstream only: Skip tests not working with older expat version
|
||||
#
|
||||
|
|
@ -2004,6 +1987,9 @@ CheckPython freethreading
|
|||
# ======================================================
|
||||
|
||||
%changelog
|
||||
* Thu Jun 11 2026 Karolina Surma <ksurma@redhat.com> - 3.14.6-1
|
||||
- Update to Python 3.14.6
|
||||
|
||||
* Wed Jun 03 2026 Python Maint <python-maint@redhat.com> - 3.14.5-2
|
||||
- Rebuilt as non-main Python on Fedora 45+
|
||||
|
||||
|
|
|
|||
10
sources
10
sources
|
|
@ -1,5 +1,5 @@
|
|||
SHA512 (Python-3.14.5.tar.xz) = efbaf629703cd004f6b7bc75fb16df794185589adaf8807cd45928f212271045a399df3cd9573e47c8708fb5c5002f9d4efe4e41dde4313b81a3e9d73158769f
|
||||
SHA512 (Python-3.14.5-aarch64-debug-jit_stencils.h) = 302563ab4fa858bcd49889b391e2970b9a5b1c5f69f74abc59524cd848f3eb89888117a3ea5f98e1d67bae86e8f491a895d2c23cf561b88ddf23bd4d8abb2597
|
||||
SHA512 (Python-3.14.5-aarch64-optimized-jit_stencils.h) = 0db85e77dcbd9318916845e927a3aecd43294c779e1d23f246e3adc49b339a819ab071d15fbd14d7352b95f8a314adeafdced14891762351478ce37588d25df4
|
||||
SHA512 (Python-3.14.5-x86_64-debug-jit_stencils.h) = 89ef636b138c2d176af23cadfa6f141d6190735e5ebe67335276a7c1f7afdea674ff39dd1eb6cc14ac0e6a12e9a9b1bc879457b4af60c8f1795166eda69f312a
|
||||
SHA512 (Python-3.14.5-x86_64-optimized-jit_stencils.h) = 0bed1d68f3567b52b6b47802edbfd65ade48f993d857cca516fb4224811dca992f4740fe10acf13c63ad95dbd80ee093893fe56f6f89cd60c90452743f2a502d
|
||||
SHA512 (Python-3.14.6.tar.xz) = 90a82f46c28f0fca613b67358fdc57c145ab05d20fb56bf3bc0c9e4e54947c7d30fbaa6856c41a41909237a9e601d1a7d19579d4b25c7a784ebcfe9012defc41
|
||||
SHA512 (Python-3.14.6-aarch64-debug-jit_stencils.h) = f56cbdadc5448636257aa17998886b83d4e7dbf848827e08cf393fc61d0522e6976f7d2799c35e250013629b85f242e3647114ce8d0281b9ed67b45475c2cab2
|
||||
SHA512 (Python-3.14.6-aarch64-optimized-jit_stencils.h) = 6fa83d156d4bc73a49d1c03af88c00624dc6dd36fb7b28bf8642e310560a8c4a9bf7059102f2e9827ec30152efdcff839bc9dcf9a2a83e24c86207286c2dda7b
|
||||
SHA512 (Python-3.14.6-x86_64-debug-jit_stencils.h) = b1edbd82f6e33f58211e00d862d407f1463d12263aa3386ad7e2f1a9c235226edb6ec11fdff1be8260914859e6089bd4b4a792e5cc5e3d5362cd80b383355b05
|
||||
SHA512 (Python-3.14.6-x86_64-optimized-jit_stencils.h) = b28575a1c8a3c5cdd6c7860136501359c5cfea92c645d3970b64c75359976a360e3213a68e6a9d589c9f72609b5152093bf10977d31e38ac9110db91e2054634
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue