From 5d945b7395f2b3fee800e4596384d7d3caa8262c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 1 Sep 2025 13:10:15 +0200 Subject: [PATCH 1/4] Inject SBOM into the installed wheels --- python3.6.spec | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/python3.6.spec b/python3.6.spec index b4ed7e4..9ef03cf 100644 --- a/python3.6.spec +++ b/python3.6.spec @@ -302,6 +302,9 @@ BuildRequires: /usr/sbin/ifconfig %if %{with rpmwheels} BuildRequires: python-setuptools-wheel BuildRequires: python-pip-wheel +%else +# For %%python_wheel_inject_sbom +BuildRequires: python-rpm-macros %endif @@ -1563,6 +1566,11 @@ ln -s \ %{buildroot}%{_bindir}/python3-debug %endif +%if %{without rpmwheels} +# Inject SBOM into the installed wheels (if the macro is available) +%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl} +%endif + %if %{with flatpackage} # Remove stuff that would conflict with python3 package rm %{buildroot}%{_bindir}/python3 From 7b13c3ecf0b5b41619811d3598b9c0a4daa11af0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Thu, 6 Nov 2025 13:08:18 +0100 Subject: [PATCH 2/4] On Fedora 44+, split this package into multiple subpackages python3.9 and python3.6 were the only remaining Pythons that are "flatpackaged". As they are likely to stay around for a while, it makes no sense to wait this out (like we did with e.g. 3.7 and 3.8). This (together with similar change in python3.9) will make all the packaged Pythons packaged in the same way. Additionally, this also enables the debug build, which was added to CI. See https://src.fedoraproject.org/rpms/python3.9/c/7a81f94ccc Assisted-By: Cursor 2.0.38 with gpt-5 --- plan.fmf | 12 +++++-- python3.6.spec | 98 ++++++++++++++++++++++++++++++-------------------- 2 files changed, 69 insertions(+), 41 deletions(-) diff --git a/plan.fmf b/plan.fmf index 38d5410..8639a8d 100644 --- a/plan.fmf +++ b/plan.fmf @@ -1,6 +1,9 @@ execute: how: tmt +environment: + pybasever: '3.6' + discover: - name: tests_python how: shell @@ -8,10 +11,13 @@ discover: tests: - name: smoke path: /smoke - test: "VERSION=3.6 TOX_REQUIRES='virtualenv<20.22.0' ./venv.sh" + test: "VERSION=${pybasever} TOX_REQUIRES='virtualenv<20.22.0' ./venv.sh" + - name: debugsmoke + path: /smoke + test: "PYTHON=python${pybasever}dm TOX=false VERSION=${pybasever} INSTALL_OR_SKIP=true ./venv.sh" - name: marshalparser path: /marshalparser - test: "VERSION=3.6 SAMPLE=10 ./test_marshalparser_compatibility.sh" + test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh" prepare: - name: Install dependencies @@ -19,7 +25,7 @@ prepare: package: - gcc - python3-tox - - python3.6 + - python${pybasever} - glibc-all-langpacks # for locale tests - marshalparser # for testing compatibility (magic numbers) with marshalparser - dnf # for upgrade diff --git a/python3.6.spec b/python3.6.spec index 9ef03cf..4dcb391 100644 --- a/python3.6.spec +++ b/python3.6.spec @@ -17,7 +17,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 49%{?dist} +Release: 50%{?dist} # Python is Python # pip MIT is and bundles: # appdirs: MIT @@ -59,12 +59,22 @@ License: LicenseRef-Callaway-Python AND LicenseRef-Callaway-MIT AND Apache-2.0 A # Note that the bcond macros are named for the CLI option they create. # "%%bcond_without" means "ENABLE by default and create a --without option" +# Main Python, i.e. whether this is the main Python version in the distribution +# that owns /usr/bin/python3 and other unique paths +# This also means the built subpackages are called python3 rather than python3X +# WARNING: This also influences the flatpackage bcond below. +# By default, this is disabled. +%bcond_with main_python + # Flat package, i.e. python36, python37, python38 for tox etc. -# warning: changes some other defaults -# in Fedora, never turn this on for the python3 package -# and always keep it on for python36 etc. -# WARNING: This does not change the package name and summary above +# Default (in Fedora >= 44): disabled +# Default (in Fedora < 44): enabled when this is not the main Python +# Not supported: Combination of flatpackage enabled and main_python enabled +%if %{with main_python} || 0%{?fedora} >= 44 +%bcond_with flatpackage +%else %bcond_without flatpackage +%endif # Whether to use RPM build wheels from the python-{pip,setuptools}-wheel package # Uses upstream bundled prebuilt wheels otherwise @@ -875,12 +885,16 @@ Patch467: 00467-tarfile-cve-2025-8194.patch Provides: python%{pyshortver} = %{version}-%{release} Obsoletes: python%{pyshortver} < %{version}-%{release} -%if %{without flatpackage} - # Packages with Python modules in standard locations automatically -# depend on python(abi). Provide that here. +# depend on python(abi). Provide that here only for the main Python. +%if %{with main_python} Provides: python(abi) = %{pybasever} +%else +%global __requires_exclude ^python\\(abi\\) = 3\\..+ +%global __provides_exclude ^python\\(abi\\) = 3\\..+ +%endif +%if %{without flatpackage} Requires: %{name}-libs%{?_isa} = %{version}-%{release} # In order to support multiple Python interpreters for development purposes, @@ -895,18 +909,16 @@ Provides: python%{pyshortver} = %{version}-%{release} # replace python36-3.6.2. Obsoletes: python%{pyshortver} -# Shall be removed in Fedora 31 -# The release is bumped to 20, so we can do f27 platform-python updates -# If the release in f27 ever goes >= 20, raise it here -# If platform-python is ever reintroduced, make it higher version than this: -%global platpyver 3.6.2-20 -Obsoletes: platform-python < %{platpyver} +# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement +Obsoletes: %{name} < 3.6.15-50 +%if %{with main_python} # Previously, this was required for our rewheel patch to work. # This is technically no longer needed, but we keep it recommended # for the developer experience. Recommends: python3-setuptools Recommends: python3-pip +%endif # This prevents ALL subpackages built from this spec to require # /usr/bin/python3*. Granularity per subpackage is impossible. @@ -989,9 +1001,8 @@ Provides: bundled(libmpdec) = %{libmpdec_version} # See https://bugzilla.redhat.com/show_bug.cgi?id=1547131 Recommends: %{name}%{?_isa} = %{version}-%{release} -# Shall be removed in Fedora 31 -Obsoletes: platform-python-libs < %{platpyver} -Obsoletes: platform-python-libs-devel < %{platpyver} +# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement +Obsoletes: %{name} < 3.6.15-50 %description libs This package contains runtime libraries for use by Python: @@ -1010,12 +1021,14 @@ Requires: python3-rpm-macros Requires: python3-rpm-generators Provides: %{name}-2to3 = %{version}-%{release} +%if %{with main_python} Provides: 2to3 = %{version}-%{release} +%endif Conflicts: %{name} < %{version}-%{release} -# Shall be removed in Fedora 31 -Obsoletes: platform-python-devel < %{platpyver} +# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement +Obsoletes: %{name} < 3.6.15-50 %description devel This package contains the header files and configuration needed to compile @@ -1031,14 +1044,16 @@ Summary: A basic graphical development environment for Python Requires: %{name} = %{version}-%{release} Requires: %{name}-tkinter = %{version}-%{release} +%if %{with main_python} Provides: idle3 = %{version}-%{release} +%endif Provides: %{name}-tools = %{version}-%{release} Provides: %{name}-tools%{?_isa} = %{version}-%{release} Obsoletes: %{name}-tools < %{version}-%{release} -# Shall be removed in Fedora 31 -Obsoletes: platform-python-tools < %{platpyver} +# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement +Obsoletes: %{name} < 3.6.15-50 %description idle IDLE is Python’s Integrated Development and Learning Environment. @@ -1057,8 +1072,8 @@ configuration, browsers, and other dialogs. Summary: A GUI toolkit for Python Requires: %{name} = %{version}-%{release} -# Shall be removed in Fedora 31 -Obsoletes: platform-python-tkinter < %{platpyver} +# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement +Obsoletes: %{name} < 3.6.15-50 %description tkinter The Tkinter (Tk interface) library is a graphical user interface toolkit for @@ -1069,8 +1084,8 @@ the Python programming language. Summary: The self-test suite for the main python3 package Requires: %{name} = %{version}-%{release} -# Shall be removed in Fedora 31 -Obsoletes: platform-python-test < %{platpyver} +# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement +Obsoletes: %{name} < 3.6.15-50 %description test The self-test suite for the Python interpreter. @@ -1115,11 +1130,6 @@ so extensions for both versions can co-exist in the same directory. %else # with flatpackage -# We'll not provide this, on purpose -# No package in Fedora shall ever depend on flatpackage via this -%global __requires_exclude ^python\\(abi\\) = 3\\..$ -%global __provides_exclude ^python\\(abi\\) = 3\\..$ - %if %{with rpmwheels} Requires: python-setuptools-wheel Requires: python-pip-wheel @@ -1470,7 +1480,7 @@ install -d -m 0755 %{buildroot}%{pylibdir}/site-packages/__pycache__ install -d -m 0755 %{buildroot}%{_prefix}/lib/python%{pybasever}/site-packages/__pycache__ %endif -%if %{without flatpackage} +%if %{with main_python} # add idle3 to menu install -D -m 0644 Lib/idlelib/Icons/idle_16.png %{buildroot}%{_datadir}/icons/hicolor/16x16/apps/idle3.png install -D -m 0644 Lib/idlelib/Icons/idle_32.png %{buildroot}%{_datadir}/icons/hicolor/32x32/apps/idle3.png @@ -1560,7 +1570,7 @@ find %{buildroot} -perm 555 -exec chmod 755 {} \; # Create "/usr/bin/python3-debug", a symlink to the python3 debug binary, to # avoid the user having to know the precise version and ABI flags. # See e.g. https://bugzilla.redhat.com/show_bug.cgi?id=676748 -%if %{with debug_build} && %{without flatpackage} +%if %{with debug_build} && %{with main_python} ln -s \ %{_bindir}/python%{LDVERSION_debug} \ %{buildroot}%{_bindir}/python3-debug @@ -1571,7 +1581,7 @@ ln -s \ %{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl} %endif -%if %{with flatpackage} +%if %{without main_python} # Remove stuff that would conflict with python3 package rm %{buildroot}%{_bindir}/python3 rm %{buildroot}%{_bindir}/pydoc3 @@ -1688,11 +1698,15 @@ CheckPython optimized %doc README.rst %if %{without flatpackage} +%if %{with main_python} %{_bindir}/pydoc* %{_bindir}/python3 %{_bindir}/pyvenv %{_mandir}/*/* -%{_bindir}/pyvenv +%else +%{_bindir}/pydoc%{pybasever} +%{_mandir}/*/python%{pybasever}* +%endif %else %{_bindir}/pydoc%{pybasever} %{_mandir}/*/python%{pybasever}* @@ -1920,27 +1934,29 @@ CheckPython optimized %{_includedir}/python%{LDVERSION_optimized}/%{_pyconfig_h} %{_libdir}/%{py_INSTSONAME_optimized} -%if %{without flatpackage} +%if %{with main_python} %{_libdir}/libpython3.so %endif %if %{without flatpackage} %files devel +%if %{with main_python} %{_bindir}/2to3 # TODO: Remove 2to3-3.7 once rebased to 3.7 %{_bindir}/2to3-%{pybasever} %endif +%endif %{pylibdir}/config-%{LDVERSION_optimized}-%{platform_triplet}/* %if %{without flatpackage} %exclude %{pylibdir}/config-%{LDVERSION_optimized}-%{platform_triplet}/Makefile %exclude %{_includedir}/python%{LDVERSION_optimized}/%{_pyconfig_h} %endif -%{pylibdir}/distutils/command/wininst-*.exe +%exclude %{pylibdir}/distutils/command/wininst-*.exe %{_includedir}/python%{LDVERSION_optimized}/*.h %doc Misc/README.valgrind Misc/valgrind-python.supp Misc/gdbinit -%if %{without flatpackage} +%if %{with main_python} %{_bindir}/python3-config %{_libdir}/pkgconfig/python3.pc %{_bindir}/pathfix.py @@ -1968,7 +1984,7 @@ CheckPython optimized %{pylibdir}/idlelib -%if %{without flatpackage} +%if %{with main_python} %{_metainfodir}/idle3.appdata.xml %{_datadir}/applications/idle3.desktop %{_datadir}/icons/hicolor/*/apps/idle3.* @@ -2016,8 +2032,10 @@ CheckPython optimized %if %{with debug_build} %if %{without flatpackage} %files debug +%if %{with main_python} %{_bindir}/python3-debug %endif +%endif # Analog of the core subpackage's files: %{_bindir}/python%{LDVERSION_debug} @@ -2141,6 +2159,10 @@ CheckPython optimized # ====================================================== %changelog +* Thu Nov 06 2025 Miro Hrončok - 3.6.15-50 +- On Fedora 44+, split this package into multiple subpackages +- This mimics newer Python versions + * Mon Aug 11 2025 Lumír Balhar - 3.6.15-49 - Security fix for CVE-2025-8194 From c03d34a103ea91e38bf6d7689013c7cd164a6568 Mon Sep 17 00:00:00 2001 From: Tomas Orsava Date: Fri, 29 Apr 2022 10:24:01 +0000 Subject: [PATCH 3/4] Move _sysconfigdata_dm_linux*.py to the debug subpackage (cherry picked from python3.10 commit 55d25b67d6153038b462d312e40c083d965ed5dc) --- python3.6.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/python3.6.spec b/python3.6.spec index 4dcb391..c9217a2 100644 --- a/python3.6.spec +++ b/python3.6.spec @@ -1851,6 +1851,10 @@ CheckPython optimized %dir %{pylibdir}/site-packages/ %dir %{pylibdir}/site-packages/__pycache__/ %{pylibdir}/site-packages/README.txt + +%exclude %{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py +%exclude %{pylibdir}/__pycache__/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}%{bytecode_suffixes} + %{pylibdir}/*.py %dir %{pylibdir}/__pycache__/ %{pylibdir}/__pycache__/*%{bytecode_suffixes} @@ -2108,6 +2112,9 @@ CheckPython optimized %{dynload_dir}/unicodedata.%{SOABI_debug}.so %{dynload_dir}/zlib.%{SOABI_debug}.so +%{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py +%{pylibdir}/__pycache__/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}%{bytecode_suffixes} + # No need to split things out the "Makefile" and the config-32/64.h file as we # do for the regular build above (bug 531901), since they're all in one package # now; they're listed below, under "-devel": From b8f7f2f8f17ea27e06ece70132c99d8eca2af2bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Sun, 11 Aug 2019 11:23:07 +0200 Subject: [PATCH 4/4] Conditionalize python3-devel runtime dependencies on RPM packages Installing python3-devel currently brings in many RPM-related packages. For somebody who needs python3-devel to build extension modules, those are all useless, so we conditionalize it on rpm-build. (cherry picked from commit e9ba67b74b9849d00cfc8e332b711db142dfd3e3) --- python3.6.spec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/python3.6.spec b/python3.6.spec index c9217a2..190964f 100644 --- a/python3.6.spec +++ b/python3.6.spec @@ -1016,9 +1016,11 @@ Summary: Libraries and header files needed for Python development Requires: %{name} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} BuildRequires: python-rpm-macros -Requires: python-rpm-macros -Requires: python3-rpm-macros -Requires: python3-rpm-generators +# The RPM related dependencies bring nothing to a non-RPM Python developer +# But we want them when packages BuildRequire python3-devel +Requires: (python-rpm-macros if rpm-build) +Requires: (python3-rpm-macros if rpm-build) +Requires: (python3-rpm-generators if rpm-build) Provides: %{name}-2to3 = %{version}-%{release} %if %{with main_python}