Conditionalize python3-devel runtime dependencies on RPM packages

Installing python3-devel currently brings in many RPM-related packages.

For somebody who needs python3-devel to build extension modules,
those are all useless, so we conditionalize it on rpm-build.

(cherry picked from commit e9ba67b74b9849d00cfc8e332b711db142dfd3e3)

.fmf/version

@@ -0,0 +1 @@
+1

00001-rpath.patch

@@ -1,9 +1,10 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Wed, 13 Jan 2010 21:25:18 +0000
-Subject: [PATCH] 00001: Fixup distutils/unixccompiler.py to remove standard
- library path from rpath Was Patch0 in ivazquez' python3000 specfile
+Subject: 00001: Fixup distutils/unixccompiler.py to remove standard library
+ path from rpath
 
+Was Patch0 in ivazquez' python3000 specfile
 ---
  Lib/distutils/unixccompiler.py | 9 +++++++++
  1 file changed, 9 insertions(+)

00102-lib64.patch

@@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Wed, 13 Jan 2010 21:25:18 +0000
-Subject: [PATCH] 00102: Change the various install paths to use /usr/lib64/
- instead or /usr/lib/
+Subject: 00102: Change the various install paths to use /usr/lib64/ instead or
+ /usr/lib/
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

00111-no-static-lib.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Mon, 18 Jan 2010 17:59:07 +0000
-Subject: [PATCH] 00111: Don't try to build a libpythonMAJOR.MINOR.a
+Subject: 00111: Don't try to build a libpythonMAJOR.MINOR.a
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

00132-add-rpmbuild-hooks-to-unittest.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:54:05 +0200
-Subject: [PATCH] 00132: Add rpmbuild hooks to unittest
+Subject: 00132: Add rpmbuild hooks to unittest
 
 Add non-standard hooks to unittest for use in the "check" phase, when
 running selftests within the build:

00155-avoid-ctypes-thunks.patch

@@ -1,8 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:02:24 +0200
-Subject: [PATCH] 00155: avoid allocating thunks in ctypes unless absolutely
- necessary
+Subject: 00155: avoid allocating thunks in ctypes unless absolutely necessary
 
 Avoid allocating thunks in ctypes unless absolutely necessary, to avoid
 generating SELinux denials on "import ctypes" and "import uuid" when

00160-disable-test_fs_holes-in-rpm-build.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:57:09 +0200
-Subject: [PATCH] 00160: Disable test_fs_holes in RPM build
+Subject: 00160: Disable test_fs_holes in RPM build
 
 Python 3.3 added os.SEEK_DATA and os.SEEK_HOLE, which may be present in the
 header files in the build chroot, but may not be supported in the running

00163-disable-parts-of-test_socket-in-rpm-build.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:58:24 +0200
-Subject: [PATCH] 00163: Disable parts of test_socket in RPM build
+Subject: 00163: Disable parts of test_socket in RPM build
 
 Some tests within test_socket fail intermittently when run inside Koji;
 disable them using unittest._skipInRpmBuild

00170-gc-assertions.patch

@@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:05:07 +0200
-Subject: [PATCH] 00170: In debug builds, try to print repr() when a C-level
- assert fails
+Subject: 00170: In debug builds, try to print repr() when a C-level assert
+ fails
 
 In debug builds, try to print repr() when a C-level assert fails in the
 garbage collector (typically indicating a reference-counting error

00189-use-rpm-wheels.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
 Date: Wed, 15 Aug 2018 15:36:29 +0200
-Subject: [PATCH] 00189: Instead of bundled wheels, use our RPM packaged wheels
+Subject: 00189: Instead of bundled wheels, use our RPM packaged wheels
 
 We keep them in /usr/share/python-wheels
 ---

00251-change-user-install-location.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Michal Cyprian <m.cyprian@gmail.com>
 Date: Mon, 26 Jun 2017 16:32:56 +0200
-Subject: [PATCH] 00251: Change user install location
+Subject: 00251: Change user install location
 
 Set values of prefix and exec_prefix in distutils install command
 to /usr/local if executable is /usr/bin/python* and RPM build

00262-pep538_coerce_legacy_c_locale.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nick Coghlan <ncoghlan@redhat.com>
 Date: Fri, 19 Jun 2020 17:02:52 +0200
-Subject: [PATCH] 00262: PEP538 - Coerce legacy C locale
+Subject: 00262: PEP538 - Coerce legacy C locale
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

00292-restore-PyExc_RecursionErrorInst-symbol.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Fri, 19 Jun 2020 17:06:08 +0200
-Subject: [PATCH] 00292: Restore PyExc_RecursionErrorInst symbol
+Subject: 00292: Restore PyExc_RecursionErrorInst symbol
 
 Restore the public PyExc_RecursionErrorInst symbol that was removed
 from the 3.6.4 release upstream.

00294-define-TLS-cipher-suite-on-build-time.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Christian Heimes <christian@python.org>
 Date: Fri, 19 Jun 2020 17:13:03 +0200
-Subject: [PATCH] 00294: Define TLS cipher suite on build time
+Subject: 00294: Define TLS cipher suite on build time
 
 Define TLS cipher suite on build time depending
 on the OpenSSL default cipher suite selection.

00319-test_tarfile_ppc64.patch

@@ -2,7 +2,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
  <31488909+miss-islington@users.noreply.github.com>
 Date: Mon, 21 Jan 2019 01:44:30 -0800
-Subject: [PATCH] 00319: test_tarfile_ppc64
+Subject: 00319: test_tarfile_ppc64
 
 Fix sparse file tests of test_tarfile on ppc64le with the tmpfs
 filesystem.

00343-faulthandler-gcc10.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@python.org>
 Date: Fri, 19 Jun 2020 17:16:05 +0200
-Subject: [PATCH] 00343: Fix test_faulthandler on GCC 10
+Subject: 00343: Fix test_faulthandler on GCC 10
 
 bpo-21131: Fix faulthandler.register(chain=True) stack (GH-15276)
 https://bugs.python.org/issue21131

00353-architecture-names-upstream-downstream.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Lumir Balhar <lbalhar@redhat.com>
 Date: Tue, 4 Aug 2020 12:04:03 +0200
-Subject: [PATCH] 00353: Original names for architectures with different names
+Subject: 00353: Original names for architectures with different names
  downstream
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8

00358-align-allocations-and-pygc_head-to-16-bytes-on-64-bit-platforms.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Inada Naoki <songofacandy@gmail.com>
 Date: Mon, 3 Jun 2019 10:51:32 +0900
-Subject: [PATCH] 00358: align allocations and PyGC_Head to 16 bytes on 64-bit
+Subject: 00358: align allocations and PyGC_Head to 16 bytes on 64-bit
  platforms
 
 Upstream bug: https://bugs.python.org/issue27987

00375-fix-test_distance-to-enable-build-on-i686.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Karolina Surma <ksurma@redhat.com>
 Date: Mon, 24 Jan 2022 09:28:30 +0100
-Subject: [PATCH] 00375: Fix test_distance to enable build on i686
+Subject: 00375: Fix test_distance to enable build on i686
 
 Fix precision in test_distance (test.test_turtle.TestVec2D).
 See: https://bugzilla.redhat.com/show_bug.cgi?id=2038843

00378-support-expat-2-4-5.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Sebastian Pipping <sebastian@pipping.org>
 Date: Mon, 21 Feb 2022 15:48:32 +0100
-Subject: [PATCH] 00378: Support expat 2.4.5
+Subject: 00378: Support expat 2.4.5
 
 Curly brackets were never allowed in namespace URIs
 according to RFC 3986, and so-called namespace-validating

00382-cve-2015-20107.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <encukou@gmail.com>
 Date: Fri, 3 Jun 2022 11:43:35 +0200
-Subject: [PATCH] 00382: CVE-2015-20107
+Subject: 00382: CVE-2015-20107
 
 Make mailcap refuse to match unsafe filenames/types/params (GH-91993)
 

00386-cve-2021-28861.patch

@@ -2,7 +2,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
  <31488909+miss-islington@users.noreply.github.com>
 Date: Wed, 22 Jun 2022 15:05:00 -0700
-Subject: [PATCH] 00386: CVE-2021-28861
+Subject: 00386: CVE-2021-28861
 
 Fix an open redirection vulnerability in the `http.server` module when
 an URI path starts with `//` that could produce a 301 Location header

00387-cve-2020-10735-prevent-dos-by-very-large-int.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@python.org>
 Date: Thu, 15 Sep 2022 17:35:24 +0200
-Subject: [PATCH] 00387: CVE-2020-10735: Prevent DoS by very large int()
+Subject: 00387: CVE-2020-10735: Prevent DoS by very large int()
 
 gh-95778: CVE-2020-10735: Prevent DoS by very large int() (GH-96504)
 

00392-cve-2022-37454-fix-buffer-overflows-in-_sha3-module.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Theo Buehler <botovq@users.noreply.github.com>
 Date: Fri, 21 Oct 2022 20:37:54 -0700
-Subject: [PATCH] 00392: CVE-2022-37454: Fix buffer overflows in _sha3 module
+Subject: 00392: CVE-2022-37454: Fix buffer overflows in _sha3 module
 
 This is a port of the applicable part of XKCP's fix [1] for
 CVE-2022-37454 and avoids the segmentation fault and the infinite

00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decoder.patch

@@ -2,8 +2,8 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
  <31488909+miss-islington@users.noreply.github.com>
 Date: Mon, 7 Nov 2022 19:22:14 -0800
-Subject: [PATCH] 00394: CVE-2022-45061: CPU denial of service via inefficient
- IDNA decoder
+Subject: 00394: CVE-2022-45061: CPU denial of service via inefficient IDNA
+ decoder
 
 gh-98433: Fix quadratic time idna decoding.
 

00399-cve-2023-24329.patch

@@ -2,7 +2,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
  <31488909+miss-islington@users.noreply.github.com>
 Date: Mon, 22 May 2023 03:42:37 -0700
-Subject: [PATCH] 00399: CVE-2023-24329
+Subject: 00399: CVE-2023-24329
 
 gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-102508)
 

00407-gh-99086-fix-implicit-int-compiler-warning-in-configure-check-for-pthread_scope_system.patch

@@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Erlend E. Aasland" <erlend.aasland@protonmail.com>
 Date: Sun, 6 Nov 2022 22:39:34 +0100
-Subject: [PATCH] 00407: gh-99086: Fix implicit int compiler warning in
- configure check for PTHREAD_SCOPE_SYSTEM
+Subject: 00407: gh-99086: Fix implicit int compiler warning in configure check
+ for PTHREAD_SCOPE_SYSTEM
 
 Co-authored-by: Sam James <sam@cmpct.info>
 ---

00409-bpo-13497-fix-broken-nice-configure-test.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: ngie-eign <1574099+ngie-eign@users.noreply.github.com>
 Date: Mon, 25 Feb 2019 21:34:24 -0800
-Subject: [PATCH] 00409: bpo-13497: Fix `broken nice` configure test
+Subject: 00409: bpo-13497: Fix `broken nice` configure test
 
 Per POSIX, `nice(3)` requires `unistd.h` and `exit(3)` requires `stdlib.h`.
 

00410-bpo-42598-fix-implicit-function-declarations-in-configure.patch

@@ -1,8 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Joshua Root <jmr@macports.org>
 Date: Mon, 14 Dec 2020 07:56:34 +1100
-Subject: [PATCH] 00410: bpo-42598: Fix implicit function declarations in
- configure
+Subject: 00410: bpo-42598: Fix implicit function declarations in configure
 
 This is invalid in C99 and later and is an error with some compilers
 (e.g. clang in Xcode 12), and can thus cause configure checks to

00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch

@@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@python.org>
 Date: Fri, 15 Dec 2023 16:10:40 +0100
-Subject: [PATCH] 00415: [CVE-2023-27043] gh-102988: Reject malformed addresses
- in email.parseaddr() (#111116)
+Subject: 00415: [CVE-2023-27043] gh-102988: Reject malformed addresses in
+ email.parseaddr() (#111116)
 
 Detect email address parsing errors and return empty tuple to
 indicate the parsing error (old API). Add an optional 'strict'

00419-gh-112769-test_zlib-fix-comparison-of-zlib_runtime_version-with-non-int-suffix-gh-112771-gh-112774.patch

@@ -0,0 +1,66 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Tue, 5 Dec 2023 21:02:06 +0100
+Subject: 00419: gh-112769: test_zlib: Fix comparison of ZLIB_RUNTIME_VERSION
+ with non-int suffix (GH-112771) (GH-112774)
+
+zlib-ng defines the version as "1.3.0.zlib-ng".
+(cherry picked from commit d384813ff18b33280a90b6d2011654528a2b6ad1)
+---
+ Lib/test/test_zlib.py | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/Lib/test/test_zlib.py b/Lib/test/test_zlib.py
+index b7170b4ff5..93615e1e1e 100644
+--- a/Lib/test/test_zlib.py
++++ b/Lib/test/test_zlib.py
+@@ -16,6 +16,20 @@ requires_Decompress_copy = unittest.skipUnless(
+         'requires Decompress.copy()')
+ 
+ 
++def _zlib_runtime_version_tuple(zlib_version=zlib.ZLIB_RUNTIME_VERSION):
++    # Register "1.2.3" as "1.2.3.0"
++    # or "1.2.0-linux","1.2.0.f","1.2.0.f-linux"
++    v = zlib_version.split('-', 1)[0].split('.')
++    if len(v) < 4:
++        v.append('0')
++    elif not v[-1].isnumeric():
++        v[-1] = '0'
++    return tuple(map(int, v))
++
++
++ZLIB_RUNTIME_VERSION_TUPLE = _zlib_runtime_version_tuple()
++
++
+ class VersionTestCase(unittest.TestCase):
+ 
+     def test_library_version(self):
+@@ -437,9 +451,8 @@ class CompressObjectTestCase(BaseCompressTestCase, unittest.TestCase):
+         sync_opt = ['Z_NO_FLUSH', 'Z_SYNC_FLUSH', 'Z_FULL_FLUSH',
+                     'Z_PARTIAL_FLUSH']
+ 
+-        ver = tuple(int(v) for v in zlib.ZLIB_RUNTIME_VERSION.split('.'))
+         # Z_BLOCK has a known failure prior to 1.2.5.3
+-        if ver >= (1, 2, 5, 3):
++        if ZLIB_RUNTIME_VERSION_TUPLE >= (1, 2, 5, 3):
+             sync_opt.append('Z_BLOCK')
+ 
+         sync_opt = [getattr(zlib, opt) for opt in sync_opt
+@@ -762,16 +775,7 @@ class CompressObjectTestCase(BaseCompressTestCase, unittest.TestCase):
+ 
+     def test_wbits(self):
+         # wbits=0 only supported since zlib v1.2.3.5
+-        # Register "1.2.3" as "1.2.3.0"
+-        # or "1.2.0-linux","1.2.0.f","1.2.0.f-linux"
+-        v = zlib.ZLIB_RUNTIME_VERSION.split('-', 1)[0].split('.')
+-        if len(v) < 4:
+-            v.append('0')
+-        elif not v[-1].isnumeric():
+-            v[-1] = '0'
+-
+-        v = tuple(map(int, v))
+-        supports_wbits_0 = v >= (1, 2, 3, 5)
++        supports_wbits_0 = ZLIB_RUNTIME_VERSION_TUPLE >= (1, 2, 3, 5)
+ 
+         co = zlib.compressobj(level=1, wbits=15)
+         zlib15 = co.compress(HAMLET_SCENE) + co.flush()

00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch

@@ -0,0 +1,106 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Serhiy Storchaka <storchaka@gmail.com>
+Date: Sun, 11 Feb 2024 12:08:39 +0200
+Subject: 00422: gh-115133: Fix tests for XMLPullParser with Expat 2.6.0
+
+Feeding the parser by too small chunks defers parsing to prevent
+CVE-2023-52425. Future versions of Expat may be more reactive.
+
+(cherry picked from commit 4a08e7b3431cd32a0daf22a33421cd3035343dc4)
+---
+ Lib/test/test_xml_etree.py                    | 58 ++++++++++++-------
+ ...-02-08-14-21-28.gh-issue-115133.ycl4ko.rst |  2 +
+ 2 files changed, 38 insertions(+), 22 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+
+diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
+index acaa519f42..2195eb9485 100644
+--- a/Lib/test/test_xml_etree.py
++++ b/Lib/test/test_xml_etree.py
+@@ -10,6 +10,7 @@ import html
+ import io
+ import operator
+ import pickle
++import pyexpat
+ import sys
+ import types
+ import unittest
+@@ -97,6 +98,10 @@ EXTERNAL_ENTITY_XML = """\
+ <document>&entity;</document>
+ """
+ 
++fails_with_expat_2_6_0 = (unittest.expectedFailure
++                        if pyexpat.version_info >= (2, 6, 0) else
++                        lambda test: test)
++
+ class ModuleTest(unittest.TestCase):
+     def test_sanity(self):
+         # Import sanity.
+@@ -1044,28 +1049,37 @@ class XMLPullParserTest(unittest.TestCase):
+         self.assertEqual([(action, elem.tag) for action, elem in events],
+                          expected)
+ 
+-    def test_simple_xml(self):
+-        for chunk_size in (None, 1, 5):
+-            with self.subTest(chunk_size=chunk_size):
+-                parser = ET.XMLPullParser()
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser, "<!-- comment -->\n", chunk_size)
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser,
+-                           "<root>\n  <element key='value'>text</element",
+-                           chunk_size)
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser, ">\n", chunk_size)
+-                self.assert_event_tags(parser, [('end', 'element')])
+-                self._feed(parser, "<element>text</element>tail\n", chunk_size)
+-                self._feed(parser, "<empty-element/>\n", chunk_size)
+-                self.assert_event_tags(parser, [
+-                    ('end', 'element'),
+-                    ('end', 'empty-element'),
+-                    ])
+-                self._feed(parser, "</root>\n", chunk_size)
+-                self.assert_event_tags(parser, [('end', 'root')])
+-                self.assertIsNone(parser.close())
++    def test_simple_xml(self, chunk_size=None):
++        parser = ET.XMLPullParser()
++        self.assert_event_tags(parser, [])
++        self._feed(parser, "<!-- comment -->\n", chunk_size)
++        self.assert_event_tags(parser, [])
++        self._feed(parser,
++                   "<root>\n  <element key='value'>text</element",
++                   chunk_size)
++        self.assert_event_tags(parser, [])
++        self._feed(parser, ">\n", chunk_size)
++        self.assert_event_tags(parser, [('end', 'element')])
++        self._feed(parser, "<element>text</element>tail\n", chunk_size)
++        self._feed(parser, "<empty-element/>\n", chunk_size)
++        self.assert_event_tags(parser, [
++            ('end', 'element'),
++            ('end', 'empty-element'),
++            ])
++        self._feed(parser, "</root>\n", chunk_size)
++        self.assert_event_tags(parser, [('end', 'root')])
++        self.assertIsNone(parser.close())
++
++    @fails_with_expat_2_6_0
++    def test_simple_xml_chunk_1(self):
++        self.test_simple_xml(chunk_size=1)
++
++    @fails_with_expat_2_6_0
++    def test_simple_xml_chunk_5(self):
++        self.test_simple_xml(chunk_size=5)
++
++    def test_simple_xml_chunk_22(self):
++        self.test_simple_xml(chunk_size=22)
+ 
+     def test_feed_while_iterating(self):
+         parser = ET.XMLPullParser()
+diff --git a/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+new file mode 100644
+index 0000000000..6f1015235c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+@@ -0,0 +1,2 @@
++Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat
++2.6.0.

00423-bpo-33377-add-triplets-for-mips-r6-and-riscv.patch

@@ -0,0 +1,161 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Matthias Klose <doko42@users.noreply.github.com>
+Date: Mon, 30 Apr 2018 19:22:16 +0200
+Subject: 00423: bpo-33377: Add triplets for mips-r6 and riscv
+
+---
+ .../2018-04-30-16-53-00.bpo-33377.QBh6vP.rst  |  2 +
+ configure                                     | 42 ++++++++++++++++++-
+ configure.ac                                  | 28 +++++++++++++
+ 3 files changed, 71 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Build/2018-04-30-16-53-00.bpo-33377.QBh6vP.rst
+
+diff --git a/Misc/NEWS.d/next/Build/2018-04-30-16-53-00.bpo-33377.QBh6vP.rst b/Misc/NEWS.d/next/Build/2018-04-30-16-53-00.bpo-33377.QBh6vP.rst
+new file mode 100644
+index 0000000000..f5dbd23c7c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Build/2018-04-30-16-53-00.bpo-33377.QBh6vP.rst
+@@ -0,0 +1,2 @@
++Add new triplets for mips r6 and riscv variants (used in extension
++suffixes).
+diff --git a/configure b/configure
+index 68a46deef5..6ea6e7d742 100755
+--- a/configure
++++ b/configure
+@@ -785,6 +785,7 @@ infodir
+ docdir
+ oldincludedir
+ includedir
++runstatedir
+ localstatedir
+ sharedstatedir
+ sysconfdir
+@@ -898,6 +899,7 @@ datadir='${datarootdir}'
+ sysconfdir='${prefix}/etc'
+ sharedstatedir='${prefix}/com'
+ localstatedir='${prefix}/var'
++runstatedir='${localstatedir}/run'
+ includedir='${prefix}/include'
+ oldincludedir='/usr/include'
+ docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
+@@ -1150,6 +1152,15 @@ do
+   | -silent | --silent | --silen | --sile | --sil)
+     silent=yes ;;
+ 
++  -runstatedir | --runstatedir | --runstatedi | --runstated \
++  | --runstate | --runstat | --runsta | --runst | --runs \
++  | --run | --ru | --r)
++    ac_prev=runstatedir ;;
++  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
++  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
++  | --run=* | --ru=* | --r=*)
++    runstatedir=$ac_optarg ;;
++
+   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
+     ac_prev=sbindir ;;
+   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
+@@ -1287,7 +1298,7 @@ fi
+ for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
+ 		datadir sysconfdir sharedstatedir localstatedir includedir \
+ 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
+-		libdir localedir mandir
++		libdir localedir mandir runstatedir
+ do
+   eval ac_val=\$$ac_var
+   # Remove trailing slashes.
+@@ -1440,6 +1451,7 @@ Fine tuning of the installation directories:
+   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
+   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
+   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
++  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
+   --libdir=DIR            object code libraries [EPREFIX/lib]
+   --includedir=DIR        C header files [PREFIX/include]
+   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
+@@ -5261,6 +5273,26 @@ cat >> conftest.c <<EOF
+         ia64-linux-gnu
+ # elif defined(__m68k__) && !defined(__mcoldfire__)
+         m68k-linux-gnu
++# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6) && defined(_MIPSEL)
++#  if _MIPS_SIM == _ABIO32
++        mipsisa32r6el-linux-gnu
++#  elif _MIPS_SIM == _ABIN32
++        mipsisa64r6el-linux-gnuabin32
++#  elif _MIPS_SIM == _ABI64
++        mipsisa64r6el-linux-gnuabi64
++#  else
++#   error unknown platform triplet
++#  endif
++# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6)
++#  if _MIPS_SIM == _ABIO32
++        mipsisa32r6-linux-gnu
++#  elif _MIPS_SIM == _ABIN32
++        mipsisa64r6-linux-gnuabin32
++#  elif _MIPS_SIM == _ABI64
++        mipsisa64r6-linux-gnuabi64
++#  else
++#   error unknown platform triplet
++#  endif
+ # elif defined(__mips_hard_float) && defined(_MIPSEL)
+ #  if _MIPS_SIM == _ABIO32
+         mipsel-linux-gnu
+@@ -5303,6 +5335,14 @@ cat >> conftest.c <<EOF
+         sparc64-linux-gnu
+ # elif defined(__sparc__)
+         sparc-linux-gnu
++# elif defined(__riscv)
++#  if __riscv_xlen == 32
++        riscv32-linux-gnu
++#  elif __riscv_xlen == 64
++        riscv64-linux-gnu
++#  else
++#   error unknown platform triplet
++#  endif
+ # else
+ #   error unknown platform triplet
+ # endif
+diff --git a/configure.ac b/configure.ac
+index 9d2ad9afba..046aed9d7c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -804,6 +804,26 @@ cat >> conftest.c <<EOF
+         ia64-linux-gnu
+ # elif defined(__m68k__) && !defined(__mcoldfire__)
+         m68k-linux-gnu
++# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6) && defined(_MIPSEL)
++#  if _MIPS_SIM == _ABIO32
++        mipsisa32r6el-linux-gnu
++#  elif _MIPS_SIM == _ABIN32
++        mipsisa64r6el-linux-gnuabin32
++#  elif _MIPS_SIM == _ABI64
++        mipsisa64r6el-linux-gnuabi64
++#  else
++#   error unknown platform triplet
++#  endif
++# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6)
++#  if _MIPS_SIM == _ABIO32
++        mipsisa32r6-linux-gnu
++#  elif _MIPS_SIM == _ABIN32
++        mipsisa64r6-linux-gnuabin32
++#  elif _MIPS_SIM == _ABI64
++        mipsisa64r6-linux-gnuabi64
++#  else
++#   error unknown platform triplet
++#  endif
+ # elif defined(__mips_hard_float) && defined(_MIPSEL)
+ #  if _MIPS_SIM == _ABIO32
+         mipsel-linux-gnu
+@@ -846,6 +866,14 @@ cat >> conftest.c <<EOF
+         sparc64-linux-gnu
+ # elif defined(__sparc__)
+         sparc-linux-gnu
++# elif defined(__riscv)
++#  if __riscv_xlen == 32
++        riscv32-linux-gnu
++#  elif __riscv_xlen == 64
++        riscv64-linux-gnu
++#  else
++#   error unknown platform triplet
++#  endif
+ # else
+ #   error unknown platform triplet
+ # endif

00426-cve-2023-6597.patch

@@ -0,0 +1,295 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Wed, 24 Apr 2024 00:19:23 +0200
+Subject: 00426: CVE-2023-6597
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Combines Two fixes for tempfile.TemporaryDirectory:
+https://github.com/python/cpython/commit/e9b51c0ad81da1da11ae65840ac8b50a8521373c
+https://github.com/python/cpython/commit/02a9259c717738dfe6b463c44d7e17f2b6d2cb3a
+
+Co-authored-by: Søren Løvborg <sorenl@unity3d.com>
+Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
+---
+ Lib/tempfile.py           |  44 +++++++++-
+ Lib/test/test_tempfile.py | 166 +++++++++++++++++++++++++++++++++++---
+ 2 files changed, 199 insertions(+), 11 deletions(-)
+
+diff --git a/Lib/tempfile.py b/Lib/tempfile.py
+index 2cb5434ba7..8e401f548a 100644
+--- a/Lib/tempfile.py
++++ b/Lib/tempfile.py
+@@ -276,6 +276,23 @@ def _mkstemp_inner(dir, pre, suf, flags, output_type):
+                           "No usable temporary file name found")
+ 
+ 
++def _dont_follow_symlinks(func, path, *args):
++    # Pass follow_symlinks=False, unless not supported on this platform.
++    if func in _os.supports_follow_symlinks:
++        func(path, *args, follow_symlinks=False)
++    elif _os.name == 'nt' or not _os.path.islink(path):
++        func(path, *args)
++
++
++def _resetperms(path):
++    try:
++        chflags = _os.chflags
++    except AttributeError:
++        pass
++    else:
++        _dont_follow_symlinks(chflags, path, 0)
++    _dont_follow_symlinks(_os.chmod, path, 0o700)
++
+ # User visible interfaces.
+ 
+ def gettempprefix():
+@@ -794,9 +811,32 @@ class TemporaryDirectory(object):
+             self, self._cleanup, self.name,
+             warn_message="Implicitly cleaning up {!r}".format(self))
+ 
++    @classmethod
++    def _rmtree(cls, name):
++        def onerror(func, path, exc_info):
++            if issubclass(exc_info[0], PermissionError):
++                try:
++                    if path != name:
++                        _resetperms(_os.path.dirname(path))
++                    _resetperms(path)
++
++                    try:
++                        _os.unlink(path)
++                    # PermissionError is raised on FreeBSD for directories
++                    except (IsADirectoryError, PermissionError):
++                        cls._rmtree(path)
++                except FileNotFoundError:
++                    pass
++            elif issubclass(exc_info[0], FileNotFoundError):
++                pass
++            else:
++                raise
++
++        _shutil.rmtree(name, onerror=onerror)
++
+     @classmethod
+     def _cleanup(cls, name, warn_message):
+-        _shutil.rmtree(name)
++        cls._rmtree(name)
+         _warnings.warn(warn_message, ResourceWarning)
+ 
+     def __repr__(self):
+@@ -810,4 +850,4 @@ class TemporaryDirectory(object):
+ 
+     def cleanup(self):
+         if self._finalizer.detach():
+-            _shutil.rmtree(self.name)
++            self._rmtree(self.name)
+diff --git a/Lib/test/test_tempfile.py b/Lib/test/test_tempfile.py
+index 710756bde6..c5560e12e7 100644
+--- a/Lib/test/test_tempfile.py
++++ b/Lib/test/test_tempfile.py
+@@ -1298,19 +1298,25 @@ class NulledModules:
+ class TestTemporaryDirectory(BaseTestCase):
+     """Test TemporaryDirectory()."""
+ 
+-    def do_create(self, dir=None, pre="", suf="", recurse=1):
++    def do_create(self, dir=None, pre="", suf="", recurse=1, dirs=1, files=1):
+         if dir is None:
+             dir = tempfile.gettempdir()
+         tmp = tempfile.TemporaryDirectory(dir=dir, prefix=pre, suffix=suf)
+         self.nameCheck(tmp.name, dir, pre, suf)
+-        # Create a subdirectory and some files
+-        if recurse:
+-            d1 = self.do_create(tmp.name, pre, suf, recurse-1)
+-            d1.name = None
+-        with open(os.path.join(tmp.name, "test.txt"), "wb") as f:
+-            f.write(b"Hello world!")
++        self.do_create2(tmp.name, recurse, dirs, files)
+         return tmp
+ 
++    def do_create2(self, path, recurse=1, dirs=1, files=1):
++        # Create subdirectories and some files
++        if recurse:
++            for i in range(dirs):
++                name = os.path.join(path, "dir%d" % i)
++                os.mkdir(name)
++                self.do_create2(name, recurse-1, dirs, files)
++        for i in range(files):
++            with open(os.path.join(path, "test%d.txt" % i), "wb") as f:
++                f.write(b"Hello world!")
++
+     def test_mkdtemp_failure(self):
+         # Check no additional exception if mkdtemp fails
+         # Previously would raise AttributeError instead
+@@ -1350,11 +1356,108 @@ class TestTemporaryDirectory(BaseTestCase):
+                          "TemporaryDirectory %s exists after cleanup" % d1.name)
+         self.assertTrue(os.path.exists(d2.name),
+                         "Directory pointed to by a symlink was deleted")
+-        self.assertEqual(os.listdir(d2.name), ['test.txt'],
++        self.assertEqual(os.listdir(d2.name), ['test0.txt'],
+                          "Contents of the directory pointed to by a symlink "
+                          "were deleted")
+         d2.cleanup()
+ 
++    @support.skip_unless_symlink
++    def test_cleanup_with_symlink_modes(self):
++        # cleanup() should not follow symlinks when fixing mode bits (#91133)
++        with self.do_create(recurse=0) as d2:
++            file1 = os.path.join(d2, 'file1')
++            open(file1, 'wb').close()
++            dir1 = os.path.join(d2, 'dir1')
++            os.mkdir(dir1)
++            for mode in range(8):
++                mode <<= 6
++                with self.subTest(mode=format(mode, '03o')):
++                    def test(target, target_is_directory):
++                        d1 = self.do_create(recurse=0)
++                        symlink = os.path.join(d1.name, 'symlink')
++                        os.symlink(target, symlink,
++                                target_is_directory=target_is_directory)
++                        try:
++                            os.chmod(symlink, mode, follow_symlinks=False)
++                        except NotImplementedError:
++                            pass
++                        try:
++                            os.chmod(symlink, mode)
++                        except FileNotFoundError:
++                            pass
++                        os.chmod(d1.name, mode)
++                        d1.cleanup()
++                        self.assertFalse(os.path.exists(d1.name))
++
++                    with self.subTest('nonexisting file'):
++                        test('nonexisting', target_is_directory=False)
++                    with self.subTest('nonexisting dir'):
++                        test('nonexisting', target_is_directory=True)
++
++                    with self.subTest('existing file'):
++                        os.chmod(file1, mode)
++                        old_mode = os.stat(file1).st_mode
++                        test(file1, target_is_directory=False)
++                        new_mode = os.stat(file1).st_mode
++                        self.assertEqual(new_mode, old_mode,
++                                         '%03o != %03o' % (new_mode, old_mode))
++
++                    with self.subTest('existing dir'):
++                        os.chmod(dir1, mode)
++                        old_mode = os.stat(dir1).st_mode
++                        test(dir1, target_is_directory=True)
++                        new_mode = os.stat(dir1).st_mode
++                        self.assertEqual(new_mode, old_mode,
++                                         '%03o != %03o' % (new_mode, old_mode))
++
++    @unittest.skipUnless(hasattr(os, 'chflags'), 'requires os.chflags')
++    @support.skip_unless_symlink
++    def test_cleanup_with_symlink_flags(self):
++        # cleanup() should not follow symlinks when fixing flags (#91133)
++        flags = stat.UF_IMMUTABLE | stat.UF_NOUNLINK
++        self.check_flags(flags)
++
++        with self.do_create(recurse=0) as d2:
++            file1 = os.path.join(d2, 'file1')
++            open(file1, 'wb').close()
++            dir1 = os.path.join(d2, 'dir1')
++            os.mkdir(dir1)
++            def test(target, target_is_directory):
++                d1 = self.do_create(recurse=0)
++                symlink = os.path.join(d1.name, 'symlink')
++                os.symlink(target, symlink,
++                           target_is_directory=target_is_directory)
++                try:
++                    os.chflags(symlink, flags, follow_symlinks=False)
++                except NotImplementedError:
++                    pass
++                try:
++                    os.chflags(symlink, flags)
++                except FileNotFoundError:
++                    pass
++                os.chflags(d1.name, flags)
++                d1.cleanup()
++                self.assertFalse(os.path.exists(d1.name))
++
++            with self.subTest('nonexisting file'):
++                test('nonexisting', target_is_directory=False)
++            with self.subTest('nonexisting dir'):
++                test('nonexisting', target_is_directory=True)
++
++            with self.subTest('existing file'):
++                os.chflags(file1, flags)
++                old_flags = os.stat(file1).st_flags
++                test(file1, target_is_directory=False)
++                new_flags = os.stat(file1).st_flags
++                self.assertEqual(new_flags, old_flags)
++
++            with self.subTest('existing dir'):
++                os.chflags(dir1, flags)
++                old_flags = os.stat(dir1).st_flags
++                test(dir1, target_is_directory=True)
++                new_flags = os.stat(dir1).st_flags
++                self.assertEqual(new_flags, old_flags)
++
+     @support.cpython_only
+     def test_del_on_collection(self):
+         # A TemporaryDirectory is deleted when garbage collected
+@@ -1385,7 +1488,7 @@ class TestTemporaryDirectory(BaseTestCase):
+ 
+                     tmp2 = os.path.join(tmp.name, 'test_dir')
+                     os.mkdir(tmp2)
+-                    with open(os.path.join(tmp2, "test.txt"), "w") as f:
++                    with open(os.path.join(tmp2, "test0.txt"), "w") as f:
+                         f.write("Hello world!")
+ 
+                     {mod}.tmp = tmp
+@@ -1453,6 +1556,51 @@ class TestTemporaryDirectory(BaseTestCase):
+             self.assertEqual(name, d.name)
+         self.assertFalse(os.path.exists(name))
+ 
++    def test_modes(self):
++        for mode in range(8):
++            mode <<= 6
++            with self.subTest(mode=format(mode, '03o')):
++                d = self.do_create(recurse=3, dirs=2, files=2)
++                with d:
++                    # Change files and directories mode recursively.
++                    for root, dirs, files in os.walk(d.name, topdown=False):
++                        for name in files:
++                            os.chmod(os.path.join(root, name), mode)
++                        os.chmod(root, mode)
++                    d.cleanup()
++                self.assertFalse(os.path.exists(d.name))
++
++    def check_flags(self, flags):
++        # skip the test if these flags are not supported (ex: FreeBSD 13)
++        filename = support.TESTFN
++        try:
++            open(filename, "w").close()
++            try:
++                os.chflags(filename, flags)
++            except OSError as exc:
++                # "OSError: [Errno 45] Operation not supported"
++                self.skipTest(f"chflags() doesn't support flags "
++                              f"{flags:#b}: {exc}")
++            else:
++                os.chflags(filename, 0)
++        finally:
++            support.unlink(filename)
++
++    @unittest.skipUnless(hasattr(os, 'chflags'), 'requires os.lchflags')
++    def test_flags(self):
++        flags = stat.UF_IMMUTABLE | stat.UF_NOUNLINK
++        self.check_flags(flags)
++
++        d = self.do_create(recurse=3, dirs=2, files=2)
++        with d:
++            # Change files and directories flags recursively.
++            for root, dirs, files in os.walk(d.name, topdown=False):
++                for name in files:
++                    os.chflags(os.path.join(root, name), flags)
++                os.chflags(root, flags)
++            d.cleanup()
++        self.assertFalse(os.path.exists(d.name))
++
+ 
+ if __name__ == "__main__":
+     unittest.main()

00427-zipextfile-tell-and-seek-cve-2024-0450.patch

@@ -0,0 +1,314 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: John Jolly <john.jolly@gmail.com>
+Date: Tue, 30 Jan 2018 01:51:35 -0700
+Subject: 00427: ZipExtFile tell and seek, CVE-2024-0450
+
+Backport of seek and tell methods for ZipExtFile makes it
+possible to backport the fix for CVE-2024-0450.
+
+Combines:
+https://github.com/python/cpython/commit/066df4fd454d6ff9be66e80b2a65995b10af174f
+https://github.com/python/cpython/commit/66363b9a7b9fe7c99eba3a185b74c5fdbf842eba
+---
+ Doc/library/zipfile.rst                       |  6 +-
+ Lib/test/test_zipfile.py                      | 94 +++++++++++++++++++
+ Lib/zipfile.py                                | 94 +++++++++++++++++++
+ .../2017-12-21-22-00-11.bpo-22908.cVm89I.rst  |  2 +
+ ...-09-28-13-15-51.gh-issue-109858.43e2dg.rst |  3 +
+ 5 files changed, 196 insertions(+), 3 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2017-12-21-22-00-11.bpo-22908.cVm89I.rst
+ create mode 100644 Misc/NEWS.d/next/Library/2023-09-28-13-15-51.gh-issue-109858.43e2dg.rst
+
+diff --git a/Doc/library/zipfile.rst b/Doc/library/zipfile.rst
+index b65b61d8da..5c28ce52c2 100644
+--- a/Doc/library/zipfile.rst
++++ b/Doc/library/zipfile.rst
+@@ -230,9 +230,9 @@ ZipFile Objects
+    With *mode* ``'r'`` the file-like object
+    (``ZipExtFile``) is read-only and provides the following methods:
+    :meth:`~io.BufferedIOBase.read`, :meth:`~io.IOBase.readline`,
+-   :meth:`~io.IOBase.readlines`, :meth:`__iter__`,
+-   :meth:`~iterator.__next__`.  These objects can operate independently of
+-   the ZipFile.
++   :meth:`~io.IOBase.readlines`, :meth:`~io.IOBase.seek`,
++   :meth:`~io.IOBase.tell`, :meth:`__iter__`, :meth:`~iterator.__next__`.
++   These objects can operate independently of the ZipFile.
+ 
+    With ``mode='w'``, a writable file handle is returned, which supports the
+    :meth:`~io.BufferedIOBase.write` method.  While a writable file handle is open,
+diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py
+index e62b82e1d3..03799090b9 100644
+--- a/Lib/test/test_zipfile.py
++++ b/Lib/test/test_zipfile.py
+@@ -1610,6 +1610,100 @@ class OtherTests(unittest.TestCase):
+             self.assertEqual(zipf.read('baz'), msg3)
+             self.assertEqual(zipf.namelist(), ['foo', 'bar', 'baz'])
+ 
++    def test_seek_tell(self):
++        # Test seek functionality
++        txt = b"Where's Bruce?"
++        bloc = txt.find(b"Bruce")
++        # Check seek on a file
++        with zipfile.ZipFile(TESTFN, "w") as zipf:
++            zipf.writestr("foo.txt", txt)
++        with zipfile.ZipFile(TESTFN, "r") as zipf:
++            with zipf.open("foo.txt", "r") as fp:
++                fp.seek(bloc, os.SEEK_SET)
++                self.assertEqual(fp.tell(), bloc)
++                fp.seek(-bloc, os.SEEK_CUR)
++                self.assertEqual(fp.tell(), 0)
++                fp.seek(bloc, os.SEEK_CUR)
++                self.assertEqual(fp.tell(), bloc)
++                self.assertEqual(fp.read(5), txt[bloc:bloc+5])
++                fp.seek(0, os.SEEK_END)
++                self.assertEqual(fp.tell(), len(txt))
++        # Check seek on memory file
++        data = io.BytesIO()
++        with zipfile.ZipFile(data, mode="w") as zipf:
++            zipf.writestr("foo.txt", txt)
++        with zipfile.ZipFile(data, mode="r") as zipf:
++            with zipf.open("foo.txt", "r") as fp:
++                fp.seek(bloc, os.SEEK_SET)
++                self.assertEqual(fp.tell(), bloc)
++                fp.seek(-bloc, os.SEEK_CUR)
++                self.assertEqual(fp.tell(), 0)
++                fp.seek(bloc, os.SEEK_CUR)
++                self.assertEqual(fp.tell(), bloc)
++                self.assertEqual(fp.read(5), txt[bloc:bloc+5])
++                fp.seek(0, os.SEEK_END)
++                self.assertEqual(fp.tell(), len(txt))
++
++    @requires_zlib
++    def test_full_overlap(self):
++        data = (
++            b'PK\x03\x04\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2\x1e'
++            b'8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00a\xed'
++            b'\xc0\x81\x08\x00\x00\x00\xc00\xd6\xfbK\\d\x0b`P'
++            b'K\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2'
++            b'\x1e8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00\x00'
++            b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00aPK'
++            b'\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0lH\x05\xe2\x1e'
++            b'8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00\x00\x00\x00\x00'
++            b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00bPK\x05'
++            b'\x06\x00\x00\x00\x00\x02\x00\x02\x00^\x00\x00\x00/\x00\x00'
++            b'\x00\x00\x00'
++        )
++        with zipfile.ZipFile(io.BytesIO(data), 'r') as zipf:
++            self.assertEqual(zipf.namelist(), ['a', 'b'])
++            zi = zipf.getinfo('a')
++            self.assertEqual(zi.header_offset, 0)
++            self.assertEqual(zi.compress_size, 16)
++            self.assertEqual(zi.file_size, 1033)
++            zi = zipf.getinfo('b')
++            self.assertEqual(zi.header_offset, 0)
++            self.assertEqual(zi.compress_size, 16)
++            self.assertEqual(zi.file_size, 1033)
++            self.assertEqual(len(zipf.read('a')), 1033)
++            with self.assertRaisesRegex(zipfile.BadZipFile, 'File name.*differ'):
++                zipf.read('b')
++
++    @requires_zlib
++    def test_quoted_overlap(self):
++        data = (
++            b'PK\x03\x04\x14\x00\x00\x00\x08\x00\xa0lH\x05Y\xfc'
++            b'8\x044\x00\x00\x00(\x04\x00\x00\x01\x00\x00\x00a\x00'
++            b'\x1f\x00\xe0\xffPK\x03\x04\x14\x00\x00\x00\x08\x00\xa0l'
++            b'H\x05\xe2\x1e8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00'
++            b'\x00\x00b\xed\xc0\x81\x08\x00\x00\x00\xc00\xd6\xfbK\\'
++            b'd\x0b`PK\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0'
++            b'lH\x05Y\xfc8\x044\x00\x00\x00(\x04\x00\x00\x01'
++            b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
++            b'\x00aPK\x01\x02\x14\x00\x14\x00\x00\x00\x08\x00\xa0l'
++            b'H\x05\xe2\x1e8\xbb\x10\x00\x00\x00\t\x04\x00\x00\x01\x00'
++            b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\x00\x00\x00'
++            b'bPK\x05\x06\x00\x00\x00\x00\x02\x00\x02\x00^\x00\x00'
++            b'\x00S\x00\x00\x00\x00\x00'
++        )
++        with zipfile.ZipFile(io.BytesIO(data), 'r') as zipf:
++            self.assertEqual(zipf.namelist(), ['a', 'b'])
++            zi = zipf.getinfo('a')
++            self.assertEqual(zi.header_offset, 0)
++            self.assertEqual(zi.compress_size, 52)
++            self.assertEqual(zi.file_size, 1064)
++            zi = zipf.getinfo('b')
++            self.assertEqual(zi.header_offset, 36)
++            self.assertEqual(zi.compress_size, 16)
++            self.assertEqual(zi.file_size, 1033)
++            with self.assertRaisesRegex(zipfile.BadZipFile, 'Overlapped entries'):
++                zipf.read('a')
++            self.assertEqual(len(zipf.read('b')), 1033)
++
+     def tearDown(self):
+         unlink(TESTFN)
+         unlink(TESTFN2)
+diff --git a/Lib/zipfile.py b/Lib/zipfile.py
+index edde0c5fd4..e6d7676079 100644
+--- a/Lib/zipfile.py
++++ b/Lib/zipfile.py
+@@ -338,6 +338,7 @@ class ZipInfo (object):
+         'compress_size',
+         'file_size',
+         '_raw_time',
++        '_end_offset',
+     )
+ 
+     def __init__(self, filename="NoName", date_time=(1980,1,1,0,0,0)):
+@@ -376,6 +377,7 @@ class ZipInfo (object):
+         self.volume = 0                 # Volume number of file header
+         self.internal_attr = 0          # Internal attributes
+         self.external_attr = 0          # External file attributes
++        self._end_offset = None         # Start of the next local header or central directory
+         # Other attributes are set by class ZipFile:
+         # header_offset         Byte offset to the file header
+         # CRC                   CRC-32 of the uncompressed file
+@@ -718,6 +720,18 @@ class _SharedFile:
+         self._close = close
+         self._lock = lock
+         self._writing = writing
++        self.seekable = file.seekable
++        self.tell = file.tell
++
++    def seek(self, offset, whence=0):
++        with self._lock:
++            if self.writing():
++                raise ValueError("Can't reposition in the ZIP file while "
++                        "there is an open writing handle on it. "
++                        "Close the writing handle before trying to read.")
++            self._file.seek(self._pos)
++            self._pos = self._file.tell()
++            return self._pos
+ 
+     def read(self, n=-1):
+         with self._lock:
+@@ -768,6 +782,9 @@ class ZipExtFile(io.BufferedIOBase):
+     # Read from compressed files in 4k blocks.
+     MIN_READ_SIZE = 4096
+ 
++    # Chunk size to read during seek
++    MAX_SEEK_READ = 1 << 24
++
+     def __init__(self, fileobj, mode, zipinfo, decrypter=None,
+                  close_fileobj=False):
+         self._fileobj = fileobj
+@@ -800,6 +817,17 @@ class ZipExtFile(io.BufferedIOBase):
+         else:
+             self._expected_crc = None
+ 
++        self._seekable = False
++        try:
++            if fileobj.seekable():
++                self._orig_compress_start = fileobj.tell()
++                self._orig_compress_size = zipinfo.compress_size
++                self._orig_file_size = zipinfo.file_size
++                self._orig_start_crc = self._running_crc
++                self._seekable = True
++        except AttributeError:
++            pass
++
+     def __repr__(self):
+         result = ['<%s.%s' % (self.__class__.__module__,
+                               self.__class__.__qualname__)]
+@@ -985,6 +1013,62 @@ class ZipExtFile(io.BufferedIOBase):
+         finally:
+             super().close()
+ 
++    def seekable(self):
++        return self._seekable
++
++    def seek(self, offset, whence=0):
++        if not self._seekable:
++            raise io.UnsupportedOperation("underlying stream is not seekable")
++        curr_pos = self.tell()
++        if whence == 0: # Seek from start of file
++            new_pos = offset
++        elif whence == 1: # Seek from current position
++            new_pos = curr_pos + offset
++        elif whence == 2: # Seek from EOF
++            new_pos = self._orig_file_size + offset
++        else:
++            raise ValueError("whence must be os.SEEK_SET (0), "
++                             "os.SEEK_CUR (1), or os.SEEK_END (2)")
++
++        if new_pos > self._orig_file_size:
++            new_pos = self._orig_file_size
++
++        if new_pos < 0:
++            new_pos = 0
++
++        read_offset = new_pos - curr_pos
++        buff_offset = read_offset + self._offset
++
++        if buff_offset >= 0 and buff_offset < len(self._readbuffer):
++            # Just move the _offset index if the new position is in the _readbuffer
++            self._offset = buff_offset
++            read_offset = 0
++        elif read_offset < 0:
++            # Position is before the current position. Reset the ZipExtFile
++
++            self._fileobj.seek(self._orig_compress_start)
++            self._running_crc = self._orig_start_crc
++            self._compress_left = self._orig_compress_size
++            self._left = self._orig_file_size
++            self._readbuffer = b''
++            self._offset = 0
++            self._decompressor = zipfile._get_decompressor(self._compress_type)
++            self._eof = False
++            read_offset = new_pos
++
++        while read_offset > 0:
++            read_len = min(self.MAX_SEEK_READ, read_offset)
++            self.read(read_len)
++            read_offset -= read_len
++
++        return self.tell()
++
++    def tell(self):
++        if not self._seekable:
++            raise io.UnsupportedOperation("underlying stream is not seekable")
++        filepos = self._orig_file_size - self._left - len(self._readbuffer) + self._offset
++        return filepos
++
+ 
+ class _ZipWriteFile(io.BufferedIOBase):
+     def __init__(self, zf, zinfo, zip64):
+@@ -1264,6 +1348,12 @@ class ZipFile:
+             if self.debug > 2:
+                 print("total", total)
+ 
++        end_offset = self.start_dir
++        for zinfo in sorted(self.filelist,
++                            key=lambda zinfo: zinfo.header_offset,
++                            reverse=True):
++            zinfo._end_offset = end_offset
++            end_offset = zinfo.header_offset
+ 
+     def namelist(self):
+         """Return a list of file names in the archive."""
+@@ -1418,6 +1508,10 @@ class ZipFile:
+                     'File name in directory %r and header %r differ.'
+                     % (zinfo.orig_filename, fname))
+ 
++            if (zinfo._end_offset is not None and
++                zef_file.tell() + zinfo.compress_size > zinfo._end_offset):
++                raise BadZipFile(f"Overlapped entries: {zinfo.orig_filename!r} (possible zip bomb)")
++
+             # check for encrypted flag & handle password
+             is_encrypted = zinfo.flag_bits & 0x1
+             zd = None
+diff --git a/Misc/NEWS.d/next/Library/2017-12-21-22-00-11.bpo-22908.cVm89I.rst b/Misc/NEWS.d/next/Library/2017-12-21-22-00-11.bpo-22908.cVm89I.rst
+new file mode 100644
+index 0000000000..4f3cc01660
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2017-12-21-22-00-11.bpo-22908.cVm89I.rst
+@@ -0,0 +1,2 @@
++Added seek and tell to the ZipExtFile class. This only works if the file
++object used to open the zipfile is seekable.
+diff --git a/Misc/NEWS.d/next/Library/2023-09-28-13-15-51.gh-issue-109858.43e2dg.rst b/Misc/NEWS.d/next/Library/2023-09-28-13-15-51.gh-issue-109858.43e2dg.rst
+new file mode 100644
+index 0000000000..be279caffc
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2023-09-28-13-15-51.gh-issue-109858.43e2dg.rst
+@@ -0,0 +1,3 @@
++Protect :mod:`zipfile` from "quoted-overlap" zipbomb. It now raises
++BadZipFile when try to read an entry that overlaps with other entry or
++central directory.

00431-cve-2024-4032.patch

@@ -0,0 +1,356 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Tue, 7 May 2024 11:58:20 +0200
+Subject: 00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges
+
+Upstream issue: https://github.com/python/cpython/issues/113171
+
+Backported from 3.8.
+---
+ Doc/library/ipaddress.rst                     | 43 ++++++++-
+ Doc/tools/susp-ignored.csv                    |  8 ++
+ Lib/ipaddress.py                              | 95 +++++++++++++++----
+ Lib/test/test_ipaddress.py                    | 52 ++++++++++
+ ...-03-14-01-38-44.gh-issue-113171.VFnObz.rst |  9 ++
+ 5 files changed, 186 insertions(+), 21 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst
+
+diff --git a/Doc/library/ipaddress.rst b/Doc/library/ipaddress.rst
+index 4ce1ed1ced..18613babc9 100644
+--- a/Doc/library/ipaddress.rst
++++ b/Doc/library/ipaddress.rst
+@@ -166,18 +166,53 @@ write code that handles both IP versions correctly.  Address objects are
+ 
+    .. attribute:: is_private
+ 
+-      ``True`` if the address is allocated for private networks.  See
++      ``True`` if the address is defined as not globally reachable by
+       iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
+-      (for IPv6).
++      (for IPv6) with the following exceptions:
++
++      * ``is_private`` is ``False`` for the shared address space (``100.64.0.0/10``)
++      * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++        semantics of the underlying IPv4 addresses and the following condition holds
++        (see :attr:`IPv6Address.ipv4_mapped`)::
++
++            address.is_private == address.ipv4_mapped.is_private
++
++      ``is_private`` has value opposite to :attr:`is_global`, except for the shared address space
++      (``100.64.0.0/10`` range) where they are both ``False``.
++
++      .. versionchanged:: 3.8.20
++
++         Fixed some false positives and false negatives.
++
++         * ``192.0.0.0/24`` is considered private with the exception of ``192.0.0.9/32`` and
++           ``192.0.0.10/32`` (previously: only the ``192.0.0.0/29`` sub-range was considered private).
++         * ``64:ff9b:1::/48`` is considered private.
++         * ``2002::/16`` is considered private.
++         * There are exceptions within ``2001::/23`` (otherwise considered private): ``2001:1::1/128``,
++           ``2001:1::2/128``, ``2001:3::/32``, ``2001:4:112::/48``, ``2001:20::/28``, ``2001:30::/28``.
++           The exceptions are not considered private.
+ 
+    .. attribute:: is_global
+ 
+-      ``True`` if the address is allocated for public networks.  See
++      ``True`` if the address is defined as globally reachable by
+       iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
+-      (for IPv6).
++      (for IPv6) with the following exception:
++
++      For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++      semantics of the underlying IPv4 addresses and the following condition holds
++      (see :attr:`IPv6Address.ipv4_mapped`)::
++
++         address.is_global == address.ipv4_mapped.is_global
++
++      ``is_global`` has value opposite to :attr:`is_private`, except for the shared address space
++      (``100.64.0.0/10`` range) where they are both ``False``.
+ 
+       .. versionadded:: 3.4
+ 
++      .. versionchanged:: 3.8.20
++
++         Fixed some false positives and false negatives, see :attr:`is_private` for details.
++
+    .. attribute:: is_unspecified
+ 
+       ``True`` if the address is unspecified.  See :RFC:`5735` (for IPv4)
+diff --git a/Doc/tools/susp-ignored.csv b/Doc/tools/susp-ignored.csv
+index ed434ce77d..6bc0741b12 100644
+--- a/Doc/tools/susp-ignored.csv
++++ b/Doc/tools/susp-ignored.csv
+@@ -160,6 +160,14 @@ library/ipaddress,,:db00,2001:db00::0/24
+ library/ipaddress,,::,2001:db00::0/24
+ library/ipaddress,,:db00,2001:db00::0/ffff:ff00::
+ library/ipaddress,,::,2001:db00::0/ffff:ff00::
++library/ipaddress,,:ff9b,64:ff9b:1::/48
++library/ipaddress,,::,64:ff9b:1::/48
++library/ipaddress,,::,2001::
++library/ipaddress,,::,2001:1::
++library/ipaddress,,::,2001:3::
++library/ipaddress,,::,2001:4:112::
++library/ipaddress,,::,2001:20::
++library/ipaddress,,::,2001:30::
+ library/itertools,,:step,elements from seq[start:stop:step]
+ library/itertools,,:stop,elements from seq[start:stop:step]
+ library/logging.handlers,,:port,host:port
+diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
+index 98492136ca..55d4d62d70 100644
+--- a/Lib/ipaddress.py
++++ b/Lib/ipaddress.py
+@@ -1302,18 +1302,41 @@ class IPv4Address(_BaseV4, _BaseAddress):
+     @property
+     @functools.lru_cache()
+     def is_private(self):
+-        """Test if this address is allocated for private networks.
++        """``True`` if the address is defined as not globally reachable by
++        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
++        (for IPv6) with the following exceptions:
+ 
+-        Returns:
+-            A boolean, True if the address is reserved per
+-            iana-ipv4-special-registry.
++        * ``is_private`` is ``False`` for ``100.64.0.0/10``
++        * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++            semantics of the underlying IPv4 addresses and the following condition holds
++            (see :attr:`IPv6Address.ipv4_mapped`)::
+ 
++                address.is_private == address.ipv4_mapped.is_private
++
++        ``is_private`` has value opposite to :attr:`is_global`, except for the ``100.64.0.0/10``
++        IPv4 range where they are both ``False``.
+         """
+-        return any(self in net for net in self._constants._private_networks)
++        return (
++            any(self in net for net in self._constants._private_networks)
++            and all(self not in net for net in self._constants._private_networks_exceptions)
++        )
+ 
+     @property
+     @functools.lru_cache()
+     def is_global(self):
++        """``True`` if the address is defined as globally reachable by
++        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
++        (for IPv6) with the following exception:
++
++        For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++        semantics of the underlying IPv4 addresses and the following condition holds
++        (see :attr:`IPv6Address.ipv4_mapped`)::
++
++            address.is_global == address.ipv4_mapped.is_global
++
++        ``is_global`` has value opposite to :attr:`is_private`, except for the ``100.64.0.0/10``
++        IPv4 range where they are both ``False``.
++        """
+         return self not in self._constants._public_network and not self.is_private
+ 
+     @property
+@@ -1548,13 +1571,15 @@ class _IPv4Constants:
+ 
+     _public_network = IPv4Network('100.64.0.0/10')
+ 
++    # Not globally reachable address blocks listed on
++    # https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+     _private_networks = [
+         IPv4Network('0.0.0.0/8'),
+         IPv4Network('10.0.0.0/8'),
+         IPv4Network('127.0.0.0/8'),
+         IPv4Network('169.254.0.0/16'),
+         IPv4Network('172.16.0.0/12'),
+-        IPv4Network('192.0.0.0/29'),
++        IPv4Network('192.0.0.0/24'),
+         IPv4Network('192.0.0.170/31'),
+         IPv4Network('192.0.2.0/24'),
+         IPv4Network('192.168.0.0/16'),
+@@ -1565,6 +1590,11 @@ class _IPv4Constants:
+         IPv4Network('255.255.255.255/32'),
+         ]
+ 
++    _private_networks_exceptions = [
++        IPv4Network('192.0.0.9/32'),
++        IPv4Network('192.0.0.10/32'),
++    ]
++
+     _reserved_network = IPv4Network('240.0.0.0/4')
+ 
+     _unspecified_address = IPv4Address('0.0.0.0')
+@@ -1953,23 +1983,42 @@ class IPv6Address(_BaseV6, _BaseAddress):
+     @property
+     @functools.lru_cache()
+     def is_private(self):
+-        """Test if this address is allocated for private networks.
++        """``True`` if the address is defined as not globally reachable by
++        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
++        (for IPv6) with the following exceptions:
+ 
+-        Returns:
+-            A boolean, True if the address is reserved per
+-            iana-ipv6-special-registry.
++        * ``is_private`` is ``False`` for ``100.64.0.0/10``
++        * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++            semantics of the underlying IPv4 addresses and the following condition holds
++            (see :attr:`IPv6Address.ipv4_mapped`)::
+ 
++                address.is_private == address.ipv4_mapped.is_private
++
++        ``is_private`` has value opposite to :attr:`is_global`, except for the ``100.64.0.0/10``
++        IPv4 range where they are both ``False``.
+         """
+-        return any(self in net for net in self._constants._private_networks)
++        ipv4_mapped = self.ipv4_mapped
++        if ipv4_mapped is not None:
++            return ipv4_mapped.is_private
++        return (
++            any(self in net for net in self._constants._private_networks)
++            and all(self not in net for net in self._constants._private_networks_exceptions)
++        )
+ 
+     @property
+     def is_global(self):
+-        """Test if this address is allocated for public networks.
++        """``True`` if the address is defined as globally reachable by
++        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
++        (for IPv6) with the following exception:
+ 
+-        Returns:
+-            A boolean, true if the address is not reserved per
+-            iana-ipv6-special-registry.
++        For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++        semantics of the underlying IPv4 addresses and the following condition holds
++        (see :attr:`IPv6Address.ipv4_mapped`)::
+ 
++            address.is_global == address.ipv4_mapped.is_global
++
++        ``is_global`` has value opposite to :attr:`is_private`, except for the ``100.64.0.0/10``
++        IPv4 range where they are both ``False``.
+         """
+         return not self.is_private
+ 
+@@ -2236,19 +2285,31 @@ class _IPv6Constants:
+ 
+     _multicast_network = IPv6Network('ff00::/8')
+ 
++    # Not globally reachable address blocks listed on
++    # https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
+     _private_networks = [
+         IPv6Network('::1/128'),
+         IPv6Network('::/128'),
+         IPv6Network('::ffff:0:0/96'),
++        IPv6Network('64:ff9b:1::/48'),
+         IPv6Network('100::/64'),
+         IPv6Network('2001::/23'),
+-        IPv6Network('2001:2::/48'),
+         IPv6Network('2001:db8::/32'),
+-        IPv6Network('2001:10::/28'),
++        # IANA says N/A, let's consider it not globally reachable to be safe
++        IPv6Network('2002::/16'),
+         IPv6Network('fc00::/7'),
+         IPv6Network('fe80::/10'),
+         ]
+ 
++    _private_networks_exceptions = [
++        IPv6Network('2001:1::1/128'),
++        IPv6Network('2001:1::2/128'),
++        IPv6Network('2001:3::/32'),
++        IPv6Network('2001:4:112::/48'),
++        IPv6Network('2001:20::/28'),
++        IPv6Network('2001:30::/28'),
++    ]
++
+     _reserved_networks = [
+         IPv6Network('::/8'), IPv6Network('100::/8'),
+         IPv6Network('200::/7'), IPv6Network('400::/6'),
+diff --git a/Lib/test/test_ipaddress.py b/Lib/test/test_ipaddress.py
+index 7de444af4a..716846b2ae 100644
+--- a/Lib/test/test_ipaddress.py
++++ b/Lib/test/test_ipaddress.py
+@@ -1665,6 +1665,10 @@ class IpaddrUnitTest(unittest.TestCase):
+         self.assertEqual(True, ipaddress.ip_address(
+                 '172.31.255.255').is_private)
+         self.assertEqual(False, ipaddress.ip_address('172.32.0.0').is_private)
++        self.assertFalse(ipaddress.ip_address('192.0.0.0').is_global)
++        self.assertTrue(ipaddress.ip_address('192.0.0.9').is_global)
++        self.assertTrue(ipaddress.ip_address('192.0.0.10').is_global)
++        self.assertFalse(ipaddress.ip_address('192.0.0.255').is_global)
+ 
+         self.assertEqual(True,
+                          ipaddress.ip_address('169.254.100.200').is_link_local)
+@@ -1680,6 +1684,40 @@ class IpaddrUnitTest(unittest.TestCase):
+         self.assertEqual(False, ipaddress.ip_address('128.0.0.0').is_loopback)
+         self.assertEqual(True, ipaddress.ip_network('0.0.0.0').is_unspecified)
+ 
++    def testPrivateNetworks(self):
++        self.assertEqual(True, ipaddress.ip_network("0.0.0.0/0").is_private)
++        self.assertEqual(False, ipaddress.ip_network("1.0.0.0/8").is_private)
++
++        self.assertEqual(True, ipaddress.ip_network("0.0.0.0/8").is_private)
++        self.assertEqual(True, ipaddress.ip_network("10.0.0.0/8").is_private)
++        self.assertEqual(True, ipaddress.ip_network("127.0.0.0/8").is_private)
++        self.assertEqual(True, ipaddress.ip_network("169.254.0.0/16").is_private)
++        self.assertEqual(True, ipaddress.ip_network("172.16.0.0/12").is_private)
++        self.assertEqual(True, ipaddress.ip_network("192.0.0.0/29").is_private)
++        self.assertEqual(False, ipaddress.ip_network("192.0.0.9/32").is_private)
++        self.assertEqual(True, ipaddress.ip_network("192.0.0.170/31").is_private)
++        self.assertEqual(True, ipaddress.ip_network("192.0.2.0/24").is_private)
++        self.assertEqual(True, ipaddress.ip_network("192.168.0.0/16").is_private)
++        self.assertEqual(True, ipaddress.ip_network("198.18.0.0/15").is_private)
++        self.assertEqual(True, ipaddress.ip_network("198.51.100.0/24").is_private)
++        self.assertEqual(True, ipaddress.ip_network("203.0.113.0/24").is_private)
++        self.assertEqual(True, ipaddress.ip_network("240.0.0.0/4").is_private)
++        self.assertEqual(True, ipaddress.ip_network("255.255.255.255/32").is_private)
++
++        self.assertEqual(False, ipaddress.ip_network("::/0").is_private)
++        self.assertEqual(False, ipaddress.ip_network("::ff/128").is_private)
++
++        self.assertEqual(True, ipaddress.ip_network("::1/128").is_private)
++        self.assertEqual(True, ipaddress.ip_network("::/128").is_private)
++        self.assertEqual(True, ipaddress.ip_network("::ffff:0:0/96").is_private)
++        self.assertEqual(True, ipaddress.ip_network("100::/64").is_private)
++        self.assertEqual(True, ipaddress.ip_network("2001:2::/48").is_private)
++        self.assertEqual(False, ipaddress.ip_network("2001:3::/48").is_private)
++        self.assertEqual(True, ipaddress.ip_network("2001:db8::/32").is_private)
++        self.assertEqual(True, ipaddress.ip_network("2001:10::/28").is_private)
++        self.assertEqual(True, ipaddress.ip_network("fc00::/7").is_private)
++        self.assertEqual(True, ipaddress.ip_network("fe80::/10").is_private)
++
+     def testReservedIpv6(self):
+ 
+         self.assertEqual(True, ipaddress.ip_network('ffff::').is_multicast)
+@@ -1753,6 +1791,20 @@ class IpaddrUnitTest(unittest.TestCase):
+         self.assertEqual(True, ipaddress.ip_address('0::0').is_unspecified)
+         self.assertEqual(False, ipaddress.ip_address('::1').is_unspecified)
+ 
++        self.assertFalse(ipaddress.ip_address('64:ff9b:1::').is_global)
++        self.assertFalse(ipaddress.ip_address('2001::').is_global)
++        self.assertTrue(ipaddress.ip_address('2001:1::1').is_global)
++        self.assertTrue(ipaddress.ip_address('2001:1::2').is_global)
++        self.assertFalse(ipaddress.ip_address('2001:2::').is_global)
++        self.assertTrue(ipaddress.ip_address('2001:3::').is_global)
++        self.assertFalse(ipaddress.ip_address('2001:4::').is_global)
++        self.assertTrue(ipaddress.ip_address('2001:4:112::').is_global)
++        self.assertFalse(ipaddress.ip_address('2001:10::').is_global)
++        self.assertTrue(ipaddress.ip_address('2001:20::').is_global)
++        self.assertTrue(ipaddress.ip_address('2001:30::').is_global)
++        self.assertFalse(ipaddress.ip_address('2001:40::').is_global)
++        self.assertFalse(ipaddress.ip_address('2002::').is_global)
++
+         # some generic IETF reserved addresses
+         self.assertEqual(True, ipaddress.ip_address('100::').is_reserved)
+         self.assertEqual(True, ipaddress.ip_network('4000::1/128').is_reserved)
+diff --git a/Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst b/Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst
+new file mode 100644
+index 0000000000..f9a72473be
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst
+@@ -0,0 +1,9 @@
++Fixed various false positives and false negatives in
++
++* :attr:`ipaddress.IPv4Address.is_private` (see these docs for details)
++* :attr:`ipaddress.IPv4Address.is_global`
++* :attr:`ipaddress.IPv6Address.is_private`
++* :attr:`ipaddress.IPv6Address.is_global`
++
++Also in the corresponding :class:`ipaddress.IPv4Network` and :class:`ipaddress.IPv6Network`
++attributes.

00435-gh-121650-encode-newlines-in-headers-and-verify.patch

@@ -0,0 +1,381 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
+Date: Fri, 16 Aug 2024 14:12:58 +0200
+Subject: 00435: gh-121650: Encode newlines in headers, and verify headers are
+ sound (GH-122233)
+
+Per RFC 2047:
+
+> [...] these encoding schemes allow the
+> encoding of arbitrary octet values, mail readers that implement this
+> decoding should also ensure that display of the decoded data on the
+> recipient's terminal will not cause unwanted side-effects
+
+It seems that the "quoted-word" scheme is a valid way to include
+a newline character in a header value, just like we already allow
+undecodable bytes or control characters.
+They do need to be properly quoted when serialized to text, though.
+
+This should fail for custom fold() implementations that aren't careful
+about newlines.
+
+(cherry picked from commit 097633981879b3c9de9a1dd120d3aa585ecc2384)
+
+This patch also contains modified commit cherry picked from
+c5bba853d5e7836f6d4340e18721d3fb3a6ee0f7.
+
+This commit was backported to simplify the backport of the other commit
+fixing CVE. The only modification is a removal of one test case which
+tests multiple changes in Python 3.7 and it wasn't working properly
+with Python 3.6 where we backported only one change.
+
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+Co-authored-by: Bas Bloemsaat <bas@bloemsaat.org>
+Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
+Co-authored-by: bsiem <52461103+bsiem@users.noreply.github.com>
+---
+ Doc/library/email.errors.rst                  |  6 ++
+ Doc/library/email.policy.rst                  | 18 ++++++
+ Lib/email/_header_value_parser.py             |  9 +++
+ Lib/email/_policybase.py                      |  8 +++
+ Lib/email/errors.py                           |  4 ++
+ Lib/email/generator.py                        | 16 ++++-
+ Lib/test/test_email/test_generator.py         | 62 +++++++++++++++++++
+ Lib/test/test_email/test_headerregistry.py    | 16 +++++
+ Lib/test/test_email/test_policy.py            | 26 ++++++++
+ .../2019-07-09-11-20-21.bpo-37482.auzvev.rst  |  1 +
+ ...-07-27-16-10-41.gh-issue-121650.nf6oc9.rst |  5 ++
+ 11 files changed, 170 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2019-07-09-11-20-21.bpo-37482.auzvev.rst
+ create mode 100644 Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst
+
+diff --git a/Doc/library/email.errors.rst b/Doc/library/email.errors.rst
+index 511ad16358..7e51f74467 100644
+--- a/Doc/library/email.errors.rst
++++ b/Doc/library/email.errors.rst
+@@ -59,6 +59,12 @@ The following exception classes are defined in the :mod:`email.errors` module:
+    :class:`~email.mime.image.MIMEImage`).
+ 
+ 
++.. exception:: HeaderWriteError()
++
++   Raised when an error occurs when the :mod:`~email.generator` outputs
++   headers.
++
++
+ Here is the list of the defects that the :class:`~email.parser.FeedParser`
+ can find while parsing messages.  Note that the defects are added to the message
+ where the problem was found, so for example, if a message nested inside a
+diff --git a/Doc/library/email.policy.rst b/Doc/library/email.policy.rst
+index 8e70762598..8617b2ed5b 100644
+--- a/Doc/library/email.policy.rst
++++ b/Doc/library/email.policy.rst
+@@ -229,6 +229,24 @@ added matters.  To illustrate::
+ 
+       .. versionadded:: 3.6
+ 
++
++   .. attribute:: verify_generated_headers
++
++      If ``True`` (the default), the generator will raise
++      :exc:`~email.errors.HeaderWriteError` instead of writing a header
++      that is improperly folded or delimited, such that it would
++      be parsed as multiple headers or joined with adjacent data.
++      Such headers can be generated by custom header classes or bugs
++      in the ``email`` module.
++
++      As it's a security feature, this defaults to ``True`` even in the
++      :class:`~email.policy.Compat32` policy.
++      For backwards compatible, but unsafe, behavior, it must be set to
++      ``False`` explicitly.
++
++      .. versionadded:: 3.8.20
++
++
+    The following :class:`Policy` method is intended to be called by code using
+    the email library to create policy instances with custom settings:
+ 
+diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py
+index bc9c9b6241..04035b2612 100644
+--- a/Lib/email/_header_value_parser.py
++++ b/Lib/email/_header_value_parser.py
+@@ -92,6 +92,8 @@ TOKEN_ENDS = TSPECIALS | WSP
+ ASPECIALS = TSPECIALS | set("*'%")
+ ATTRIBUTE_ENDS = ASPECIALS | WSP
+ EXTENDED_ATTRIBUTE_ENDS = ATTRIBUTE_ENDS - set('%')
++NLSET = {'\n', '\r'}
++SPECIALSNL = SPECIALS | NLSET
+ 
+ def quote_string(value):
+     return '"'+str(value).replace('\\', '\\\\').replace('"', r'\"')+'"'
+@@ -2611,6 +2613,13 @@ def _refold_parse_tree(parse_tree, *, policy):
+             wrap_as_ew_blocked -= 1
+             continue
+         tstr = str(part)
++        if not want_encoding:
++            if part.token_type == 'ptext':
++                # Encode if tstr contains special characters.
++                want_encoding = not SPECIALSNL.isdisjoint(tstr)
++            else:
++                # Encode if tstr contains newlines.
++                want_encoding = not NLSET.isdisjoint(tstr)
+         try:
+             tstr.encode(encoding)
+             charset = encoding
+diff --git a/Lib/email/_policybase.py b/Lib/email/_policybase.py
+index c9cbadd2a8..d1f48211f9 100644
+--- a/Lib/email/_policybase.py
++++ b/Lib/email/_policybase.py
+@@ -157,6 +157,13 @@ class Policy(_PolicyBase, metaclass=abc.ABCMeta):
+     message_factory     -- the class to use to create new message objects.
+                            If the value is None, the default is Message.
+ 
++    verify_generated_headers
++                        -- if true, the generator verifies that each header
++                           they are properly folded, so that a parser won't
++                           treat it as multiple headers, start-of-body, or
++                           part of another header.
++                           This is a check against custom Header & fold()
++                           implementations.
+     """
+ 
+     raise_on_defect = False
+@@ -165,6 +172,7 @@ class Policy(_PolicyBase, metaclass=abc.ABCMeta):
+     max_line_length = 78
+     mangle_from_ = False
+     message_factory = None
++    verify_generated_headers = True
+ 
+     def handle_defect(self, obj, defect):
+         """Based on policy, either raise defect or call register_defect.
+diff --git a/Lib/email/errors.py b/Lib/email/errors.py
+index d28a680010..1a0d5c63e6 100644
+--- a/Lib/email/errors.py
++++ b/Lib/email/errors.py
+@@ -29,6 +29,10 @@ class CharsetError(MessageError):
+     """An illegal charset was given."""
+ 
+ 
++class HeaderWriteError(MessageError):
++    """Error while writing headers."""
++
++
+ # These are parsing defects which the parser was able to work around.
+ class MessageDefect(ValueError):
+     """Base class for a message defect."""
+diff --git a/Lib/email/generator.py b/Lib/email/generator.py
+index ae670c2353..6deb95ba8a 100644
+--- a/Lib/email/generator.py
++++ b/Lib/email/generator.py
+@@ -14,12 +14,14 @@ import random
+ from copy import deepcopy
+ from io import StringIO, BytesIO
+ from email.utils import _has_surrogates
++from email.errors import HeaderWriteError
+ 
+ UNDERSCORE = '_'
+ NL = '\n'  # XXX: no longer used by the code below.
+ 
+ NLCRE = re.compile(r'\r\n|\r|\n')
+ fcre = re.compile(r'^From ', re.MULTILINE)
++NEWLINE_WITHOUT_FWSP = re.compile(r'\r\n[^ \t]|\r[^ \n\t]|\n[^ \t]')
+ 
+ 
+ 
+@@ -219,7 +221,19 @@ class Generator:
+ 
+     def _write_headers(self, msg):
+         for h, v in msg.raw_items():
+-            self.write(self.policy.fold(h, v))
++            folded = self.policy.fold(h, v)
++            if self.policy.verify_generated_headers:
++                linesep = self.policy.linesep
++                if not folded.endswith(self.policy.linesep):
++                    raise HeaderWriteError(
++                        f'folded header does not end with {linesep!r}: {folded!r}')
++                folded_no_linesep = folded
++                if folded.endswith(linesep):
++                    folded_no_linesep = folded[:-len(linesep)]
++                if NEWLINE_WITHOUT_FWSP.search(folded_no_linesep):
++                    raise HeaderWriteError(
++                        f'folded header contains newline: {folded!r}')
++            self.write(folded)
+         # A blank line always separates headers from body
+         self.write(self._NL)
+ 
+diff --git a/Lib/test/test_email/test_generator.py b/Lib/test/test_email/test_generator.py
+index c1aeaefab7..cdf1075bab 100644
+--- a/Lib/test/test_email/test_generator.py
++++ b/Lib/test/test_email/test_generator.py
+@@ -5,6 +5,7 @@ from email import message_from_string, message_from_bytes
+ from email.message import EmailMessage
+ from email.generator import Generator, BytesGenerator
+ from email import policy
++import email.errors
+ from test.test_email import TestEmailBase, parameterize
+ 
+ 
+@@ -215,6 +216,44 @@ class TestGeneratorBase:
+         g.flatten(msg)
+         self.assertEqual(s.getvalue(), self.typ(expected))
+ 
++    def test_keep_encoded_newlines(self):
++        msg = self.msgmaker(self.typ(textwrap.dedent("""\
++            To: nobody
++            Subject: Bad subject=?UTF-8?Q?=0A?=Bcc: injection@example.com
++
++            None
++            """)))
++        expected = textwrap.dedent("""\
++            To: nobody
++            Subject: Bad subject=?UTF-8?Q?=0A?=Bcc: injection@example.com
++
++            None
++            """)
++        s = self.ioclass()
++        g = self.genclass(s, policy=self.policy.clone(max_line_length=80))
++        g.flatten(msg)
++        self.assertEqual(s.getvalue(), self.typ(expected))
++
++    def test_keep_long_encoded_newlines(self):
++        msg = self.msgmaker(self.typ(textwrap.dedent("""\
++            To: nobody
++            Subject: Bad subject =?UTF-8?Q?=0A?=Bcc: injection@example.com
++
++            None
++            """)))
++        expected = textwrap.dedent("""\
++            To: nobody
++            Subject: Bad subject \n\
++             =?utf-8?q?=0A?=Bcc:
++             injection@example.com
++
++            None
++            """)
++        s = self.ioclass()
++        g = self.genclass(s, policy=self.policy.clone(max_line_length=30))
++        g.flatten(msg)
++        self.assertEqual(s.getvalue(), self.typ(expected))
++
+ 
+ class TestGenerator(TestGeneratorBase, TestEmailBase):
+ 
+@@ -223,6 +262,29 @@ class TestGenerator(TestGeneratorBase, TestEmailBase):
+     ioclass = io.StringIO
+     typ = str
+ 
++    def test_verify_generated_headers(self):
++        """gh-121650: by default the generator prevents header injection"""
++        class LiteralHeader(str):
++            name = 'Header'
++            def fold(self, **kwargs):
++                return self
++
++        for text in (
++            'Value\r\nBad Injection\r\n',
++            'NoNewLine'
++        ):
++            with self.subTest(text=text):
++                message = message_from_string(
++                    "Header: Value\r\n\r\nBody",
++                    policy=self.policy,
++                )
++
++                del message['Header']
++                message['Header'] = LiteralHeader(text)
++
++                with self.assertRaises(email.errors.HeaderWriteError):
++                    message.as_string()
++
+ 
+ class TestBytesGenerator(TestGeneratorBase, TestEmailBase):
+ 
+diff --git a/Lib/test/test_email/test_headerregistry.py b/Lib/test/test_email/test_headerregistry.py
+index 08634daa7f..d7c1878940 100644
+--- a/Lib/test/test_email/test_headerregistry.py
++++ b/Lib/test/test_email/test_headerregistry.py
+@@ -1546,6 +1546,22 @@ class TestAddressAndGroup(TestEmailBase):
+ 
+ class TestFolding(TestHeaderBase):
+ 
++    def test_address_display_names(self):
++        """Test the folding and encoding of address headers."""
++        for name, result in (
++                ('Foo Bar, France', '"Foo Bar, France"'),
++                ('Foo Bar (France)', '"Foo Bar (France)"'),
++                ('Foo Bar, España', 'Foo =?utf-8?q?Bar=2C_Espa=C3=B1a?='),
++                ('Foo Bar (España)', 'Foo Bar =?utf-8?b?KEVzcGHDsWEp?='),
++                ('Foo, Bar España', '=?utf-8?q?Foo=2C_Bar_Espa=C3=B1a?='),
++                ('Foo, Bar [España]', '=?utf-8?q?Foo=2C_Bar_=5BEspa=C3=B1a=5D?='),
++                ('Foo Bär, France', 'Foo =?utf-8?q?B=C3=A4r=2C?= France'),
++                ('Foo Bär <France>', 'Foo =?utf-8?q?B=C3=A4r_=3CFrance=3E?='),
++                ):
++            h = self.make_header('To', Address(name, addr_spec='a@b.com'))
++            self.assertEqual(h.fold(policy=policy.default),
++                                    'To: %s <a@b.com>\n' % result)
++
+     def test_short_unstructured(self):
+         h = self.make_header('subject', 'this is a test')
+         self.assertEqual(h.fold(policy=policy.default),
+diff --git a/Lib/test/test_email/test_policy.py b/Lib/test/test_email/test_policy.py
+index 6999e4af10..76198392e5 100644
+--- a/Lib/test/test_email/test_policy.py
++++ b/Lib/test/test_email/test_policy.py
+@@ -26,6 +26,7 @@ class PolicyAPITests(unittest.TestCase):
+         'raise_on_defect':          False,
+         'mangle_from_':             True,
+         'message_factory':          None,
++        'verify_generated_headers': True,
+         }
+     # These default values are the ones set on email.policy.default.
+     # If any of these defaults change, the docs must be updated.
+@@ -265,6 +266,31 @@ class PolicyAPITests(unittest.TestCase):
+                 with self.assertRaises(email.errors.HeaderParseError):
+                     policy.fold("Subject", subject)
+ 
++    def test_verify_generated_headers(self):
++        """Turning protection off allows header injection"""
++        policy = email.policy.default.clone(verify_generated_headers=False)
++        for text in (
++            'Header: Value\r\nBad: Injection\r\n',
++            'Header: NoNewLine'
++        ):
++            with self.subTest(text=text):
++                message = email.message_from_string(
++                    "Header: Value\r\n\r\nBody",
++                    policy=policy,
++                )
++                class LiteralHeader(str):
++                    name = 'Header'
++                    def fold(self, **kwargs):
++                        return self
++
++                del message['Header']
++                message['Header'] = LiteralHeader(text)
++
++                self.assertEqual(
++                    message.as_string(),
++                    f"{text}\nBody",
++                )
++
+     # XXX: Need subclassing tests.
+     # For adding subclassed objects, make sure the usual rules apply (subclass
+     # wins), but that the order still works (right overrides left).
+diff --git a/Misc/NEWS.d/next/Library/2019-07-09-11-20-21.bpo-37482.auzvev.rst b/Misc/NEWS.d/next/Library/2019-07-09-11-20-21.bpo-37482.auzvev.rst
+new file mode 100644
+index 0000000000..e09ff63eed
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2019-07-09-11-20-21.bpo-37482.auzvev.rst
+@@ -0,0 +1 @@
++Fix serialization of display name in originator or destination address fields with both encoded words and special chars.
+diff --git a/Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst b/Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst
+new file mode 100644
+index 0000000000..83dd28d4ac
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst
+@@ -0,0 +1,5 @@
++:mod:`email` headers with embedded newlines are now quoted on output. The
++:mod:`~email.generator` will now refuse to serialize (write) headers that
++are unsafely folded or delimited; see
++:attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas
++Bloemsaat and Petr Viktorin in :gh:`121650`.)

00437-cve-2024-6232-remove-backtracking-when-parsing-tarfile-headers.patch

@@ -0,0 +1,248 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Wed, 4 Sep 2024 10:41:42 -0500
+Subject: 00437: CVE-2024-6232 Remove backtracking when parsing tarfile headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* Remove backtracking when parsing tarfile headers
+* Rewrite PAX header parsing to be stricter
+* Optimize parsing of GNU extended sparse headers v0.0
+
+(cherry picked from commit 34ddb64d088dd7ccc321f6103d23153256caa5d4)
+
+Co-authored-by: Seth Michael Larson <seth@python.org>
+Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
+---
+ Lib/tarfile.py                                | 104 +++++++++++-------
+ Lib/test/test_tarfile.py                      |  42 +++++++
+ ...-07-02-13-39-20.gh-issue-121285.hrl-yI.rst |   2 +
+ 3 files changed, 111 insertions(+), 37 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index c18590325a..ee1bf37bfd 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -846,6 +846,9 @@ _NAMED_FILTERS = {
+ # Sentinel for replace() defaults, meaning "don't change the attribute"
+ _KEEP = object()
+ 
++# Header length is digits followed by a space.
++_header_length_prefix_re = re.compile(br"([0-9]{1,20}) ")
++
+ class TarInfo(object):
+     """Informational class which holds the details about an
+        archive member given by a tar header block.
+@@ -1371,41 +1374,60 @@ class TarInfo(object):
+         else:
+             pax_headers = tarfile.pax_headers.copy()
+ 
+-        # Check if the pax header contains a hdrcharset field. This tells us
+-        # the encoding of the path, linkpath, uname and gname fields. Normally,
+-        # these fields are UTF-8 encoded but since POSIX.1-2008 tar
+-        # implementations are allowed to store them as raw binary strings if
+-        # the translation to UTF-8 fails.
+-        match = re.search(br"\d+ hdrcharset=([^\n]+)\n", buf)
+-        if match is not None:
+-            pax_headers["hdrcharset"] = match.group(1).decode("utf-8")
+-
+-        # For the time being, we don't care about anything other than "BINARY".
+-        # The only other value that is currently allowed by the standard is
+-        # "ISO-IR 10646 2000 UTF-8" in other words UTF-8.
+-        hdrcharset = pax_headers.get("hdrcharset")
+-        if hdrcharset == "BINARY":
+-            encoding = tarfile.encoding
+-        else:
+-            encoding = "utf-8"
+-
+         # Parse pax header information. A record looks like that:
+         # "%d %s=%s\n" % (length, keyword, value). length is the size
+         # of the complete record including the length field itself and
+-        # the newline. keyword and value are both UTF-8 encoded strings.
+-        regex = re.compile(br"(\d+) ([^=]+)=")
++        # the newline.
+         pos = 0
+-        while True:
+-            match = regex.match(buf, pos)
++        encoding = None
++        raw_headers = []
++        while len(buf) > pos and buf[pos] != 0x00:
++            match = _header_length_prefix_re.match(buf, pos)
+             if not match:
+-                break
++                raise InvalidHeaderError("invalid header")
++            try:
++                length = int(match.group(1))
++            except ValueError:
++                raise InvalidHeaderError("invalid header")
++            # Headers must be at least 5 bytes, shortest being '5 x=\n'.
++            # Value is allowed to be empty.
++            if length < 5:
++                raise InvalidHeaderError("invalid header")
++            if pos + length > len(buf):
++                raise InvalidHeaderError("invalid header")
+ 
+-            length, keyword = match.groups()
+-            length = int(length)
+-            if length == 0:
++            header_value_end_offset = match.start(1) + length - 1  # Last byte of the header
++            keyword_and_value = buf[match.end(1) + 1:header_value_end_offset]
++            raw_keyword, equals, raw_value = keyword_and_value.partition(b"=")
++
++            # Check the framing of the header. The last character must be '\n' (0x0A)
++            if not raw_keyword or equals != b"=" or buf[header_value_end_offset] != 0x0A:
+                 raise InvalidHeaderError("invalid header")
+-            value = buf[match.end(2) + 1:match.start(1) + length - 1]
++            raw_headers.append((length, raw_keyword, raw_value))
++
++            # Check if the pax header contains a hdrcharset field. This tells us
++            # the encoding of the path, linkpath, uname and gname fields. Normally,
++            # these fields are UTF-8 encoded but since POSIX.1-2008 tar
++            # implementations are allowed to store them as raw binary strings if
++            # the translation to UTF-8 fails. For the time being, we don't care about
++            # anything other than "BINARY". The only other value that is currently
++            # allowed by the standard is "ISO-IR 10646 2000 UTF-8" in other words UTF-8.
++            # Note that we only follow the initial 'hdrcharset' setting to preserve
++            # the initial behavior of the 'tarfile' module.
++            if raw_keyword == b"hdrcharset" and encoding is None:
++                if raw_value == b"BINARY":
++                    encoding = tarfile.encoding
++                else:  # This branch ensures only the first 'hdrcharset' header is used.
++                    encoding = "utf-8"
++
++            pos += length
++
++        # If no explicit hdrcharset is set, we use UTF-8 as a default.
++        if encoding is None:
++            encoding = "utf-8"
+ 
++        # After parsing the raw headers we can decode them to text.
++        for length, raw_keyword, raw_value in raw_headers:
+             # Normally, we could just use "utf-8" as the encoding and "strict"
+             # as the error handler, but we better not take the risk. For
+             # example, GNU tar <= 1.23 is known to store filenames it cannot
+@@ -1413,17 +1435,16 @@ class TarInfo(object):
+             # hdrcharset=BINARY header).
+             # We first try the strict standard encoding, and if that fails we
+             # fall back on the user's encoding and error handler.
+-            keyword = self._decode_pax_field(keyword, "utf-8", "utf-8",
++            keyword = self._decode_pax_field(raw_keyword, "utf-8", "utf-8",
+                     tarfile.errors)
+             if keyword in PAX_NAME_FIELDS:
+-                value = self._decode_pax_field(value, encoding, tarfile.encoding,
++                value = self._decode_pax_field(raw_value, encoding, tarfile.encoding,
+                         tarfile.errors)
+             else:
+-                value = self._decode_pax_field(value, "utf-8", "utf-8",
++                value = self._decode_pax_field(raw_value, "utf-8", "utf-8",
+                         tarfile.errors)
+ 
+             pax_headers[keyword] = value
+-            pos += length
+ 
+         # Fetch the next header.
+         try:
+@@ -1438,7 +1459,7 @@ class TarInfo(object):
+ 
+         elif "GNU.sparse.size" in pax_headers:
+             # GNU extended sparse format version 0.0.
+-            self._proc_gnusparse_00(next, pax_headers, buf)
++            self._proc_gnusparse_00(next, raw_headers)
+ 
+         elif pax_headers.get("GNU.sparse.major") == "1" and pax_headers.get("GNU.sparse.minor") == "0":
+             # GNU extended sparse format version 1.0.
+@@ -1460,15 +1481,24 @@ class TarInfo(object):
+ 
+         return next
+ 
+-    def _proc_gnusparse_00(self, next, pax_headers, buf):
++    def _proc_gnusparse_00(self, next, raw_headers):
+         """Process a GNU tar extended sparse header, version 0.0.
+         """
+         offsets = []
+-        for match in re.finditer(br"\d+ GNU.sparse.offset=(\d+)\n", buf):
+-            offsets.append(int(match.group(1)))
+         numbytes = []
+-        for match in re.finditer(br"\d+ GNU.sparse.numbytes=(\d+)\n", buf):
+-            numbytes.append(int(match.group(1)))
++        for _, keyword, value in raw_headers:
++            if keyword == b"GNU.sparse.offset":
++                try:
++                    offsets.append(int(value.decode()))
++                except ValueError:
++                    raise InvalidHeaderError("invalid header")
++
++            elif keyword == b"GNU.sparse.numbytes":
++                try:
++                    numbytes.append(int(value.decode()))
++                except ValueError:
++                    raise InvalidHeaderError("invalid header")
++
+         next.sparse = list(zip(offsets, numbytes))
+ 
+     def _proc_gnusparse_01(self, next, pax_headers):
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index f261048615..04ef000e71 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -1046,6 +1046,48 @@ class PaxReadTest(LongnameTest, ReadTest, unittest.TestCase):
+         finally:
+             tar.close()
+ 
++    def test_pax_header_bad_formats(self):
++        # The fields from the pax header have priority over the
++        # TarInfo.
++        pax_header_replacements = (
++            b" foo=bar\n",
++            b"0 \n",
++            b"1 \n",
++            b"2 \n",
++            b"3 =\n",
++            b"4 =a\n",
++            b"1000000 foo=bar\n",
++            b"0 foo=bar\n",
++            b"-12 foo=bar\n",
++            b"000000000000000000000000036 foo=bar\n",
++        )
++        pax_headers = {"foo": "bar"}
++
++        for replacement in pax_header_replacements:
++            with self.subTest(header=replacement):
++                tar = tarfile.open(tmpname, "w", format=tarfile.PAX_FORMAT,
++                                   encoding="iso8859-1")
++                try:
++                    t = tarfile.TarInfo()
++                    t.name = "pax"  # non-ASCII
++                    t.uid = 1
++                    t.pax_headers = pax_headers
++                    tar.addfile(t)
++                finally:
++                    tar.close()
++
++                with open(tmpname, "rb") as f:
++                    data = f.read()
++                    self.assertIn(b"11 foo=bar\n", data)
++                    data = data.replace(b"11 foo=bar\n", replacement)
++
++                with open(tmpname, "wb") as f:
++                    f.truncate()
++                    f.write(data)
++
++                with self.assertRaisesRegex(tarfile.ReadError, r"file could not be opened successfully"):
++                    tarfile.open(tmpname, encoding="iso8859-1")
++
+ 
+ class WriteTestBase(TarTest):
+     # Put all write tests in here that are supposed to be tested
+diff --git a/Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst b/Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst
+new file mode 100644
+index 0000000000..81f918bfe2
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst
+@@ -0,0 +1,2 @@
++Remove backtracking from tarfile header parsing for ``hdrcharset``, PAX, and
++GNU sparse headers.

00443-gh-124651-quote-template-strings-in-venv-activation-scripts.patch

@@ -0,0 +1,280 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Fri, 1 Nov 2024 14:11:47 +0100
+Subject: 00443: gh-124651: Quote template strings in `venv` activation scripts
+
+(cherry picked from 3.9)
+---
+ Lib/test/test_venv.py                         | 82 +++++++++++++++++++
+ Lib/venv/__init__.py                          | 42 ++++++++--
+ Lib/venv/scripts/common/activate              |  8 +-
+ Lib/venv/scripts/posix/activate.csh           |  8 +-
+ Lib/venv/scripts/posix/activate.fish          |  8 +-
+ ...-09-28-02-03-04.gh-issue-124651.bLBGtH.rst |  1 +
+ 6 files changed, 132 insertions(+), 17 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
+
+diff --git a/Lib/test/test_venv.py b/Lib/test/test_venv.py
+index 842470fef0..67fdcd86bb 100644
+--- a/Lib/test/test_venv.py
++++ b/Lib/test/test_venv.py
+@@ -13,6 +13,8 @@ import struct
+ import subprocess
+ import sys
+ import tempfile
++import shlex
++import shutil
+ from test.support import (captured_stdout, captured_stderr, requires_zlib,
+                           can_symlink, EnvironmentVarGuard, rmtree)
+ import unittest
+@@ -80,6 +82,10 @@ class BaseTest(unittest.TestCase):
+             result = f.read()
+         return result
+ 
++    def assertEndsWith(self, string, tail):
++        if not string.endswith(tail):
++            self.fail(f"String {string!r} does not end with {tail!r}")
++
+ class BasicTest(BaseTest):
+     """Test venv module functionality."""
+ 
+@@ -293,6 +299,82 @@ class BasicTest(BaseTest):
+             'import sys; print(sys.executable)'])
+         self.assertEqual(out.strip(), envpy.encode())
+ 
++    # gh-124651: test quoted strings
++    @unittest.skipIf(os.name == 'nt', 'contains invalid characters on Windows')
++    def test_special_chars_bash(self):
++        """
++        Test that the template strings are quoted properly (bash)
++        """
++        rmtree(self.env_dir)
++        bash = shutil.which('bash')
++        if bash is None:
++            self.skipTest('bash required for this test')
++        env_name = '"\';&&$e|\'"'
++        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
++        builder = venv.EnvBuilder(clear=True)
++        builder.create(env_dir)
++        activate = os.path.join(env_dir, self.bindir, 'activate')
++        test_script = os.path.join(self.env_dir, 'test_special_chars.sh')
++        with open(test_script, "w") as f:
++            f.write(f'source {shlex.quote(activate)}\n'
++                    'python -c \'import sys; print(sys.executable)\'\n'
++                    'python -c \'import os; print(os.environ["VIRTUAL_ENV"])\'\n'
++                    'deactivate\n')
++        out, err = check_output([bash, test_script])
++        lines = out.splitlines()
++        self.assertTrue(env_name.encode() in lines[0])
++        self.assertEndsWith(lines[1], env_name.encode())
++
++    # gh-124651: test quoted strings
++    @unittest.skipIf(os.name == 'nt', 'contains invalid characters on Windows')
++    def test_special_chars_csh(self):
++        """
++        Test that the template strings are quoted properly (csh)
++        """
++        rmtree(self.env_dir)
++        csh = shutil.which('tcsh') or shutil.which('csh')
++        if csh is None:
++            self.skipTest('csh required for this test')
++        env_name = '"\';&&$e|\'"'
++        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
++        builder = venv.EnvBuilder(clear=True)
++        builder.create(env_dir)
++        activate = os.path.join(env_dir, self.bindir, 'activate.csh')
++        test_script = os.path.join(self.env_dir, 'test_special_chars.csh')
++        with open(test_script, "w") as f:
++            f.write(f'source {shlex.quote(activate)}\n'
++                    'python -c \'import sys; print(sys.executable)\'\n'
++                    'python -c \'import os; print(os.environ["VIRTUAL_ENV"])\'\n'
++                    'deactivate\n')
++        out, err = check_output([csh, test_script])
++        lines = out.splitlines()
++        self.assertTrue(env_name.encode() in lines[0])
++        self.assertEndsWith(lines[1], env_name.encode())
++
++    # gh-124651: test quoted strings on Windows
++    @unittest.skipUnless(os.name == 'nt', 'only relevant on Windows')
++    def test_special_chars_windows(self):
++        """
++        Test that the template strings are quoted properly on Windows
++        """
++        rmtree(self.env_dir)
++        env_name = "'&&^$e"
++        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
++        builder = venv.EnvBuilder(clear=True)
++        builder.create(env_dir)
++        activate = os.path.join(env_dir, self.bindir, 'activate.bat')
++        test_batch = os.path.join(self.env_dir, 'test_special_chars.bat')
++        with open(test_batch, "w") as f:
++            f.write('@echo off\n'
++                    f'"{activate}" & '
++                    f'{self.exe} -c "import sys; print(sys.executable)" & '
++                    f'{self.exe} -c "import os; print(os.environ[\'VIRTUAL_ENV\'])" & '
++                    'deactivate')
++        out, err = check_output([test_batch])
++        lines = out.splitlines()
++        self.assertTrue(env_name.encode() in lines[0])
++        self.assertEndsWith(lines[1], env_name.encode())
++
+     @unittest.skipUnless(os.name == 'nt', 'only relevant on Windows')
+     def test_unicode_in_batch_file(self):
+         """
+diff --git a/Lib/venv/__init__.py b/Lib/venv/__init__.py
+index 716129d139..0c44dfd07d 100644
+--- a/Lib/venv/__init__.py
++++ b/Lib/venv/__init__.py
+@@ -10,6 +10,7 @@ import shutil
+ import subprocess
+ import sys
+ import types
++import shlex
+ 
+ logger = logging.getLogger(__name__)
+ 
+@@ -280,11 +281,41 @@ class EnvBuilder:
+         :param context: The information for the environment creation request
+                         being processed.
+         """
+-        text = text.replace('__VENV_DIR__', context.env_dir)
+-        text = text.replace('__VENV_NAME__', context.env_name)
+-        text = text.replace('__VENV_PROMPT__', context.prompt)
+-        text = text.replace('__VENV_BIN_NAME__', context.bin_name)
+-        text = text.replace('__VENV_PYTHON__', context.env_exe)
++        replacements = {
++            '__VENV_DIR__': context.env_dir,
++            '__VENV_NAME__': context.env_name,
++            '__VENV_PROMPT__': context.prompt,
++            '__VENV_BIN_NAME__': context.bin_name,
++            '__VENV_PYTHON__': context.env_exe,
++        }
++
++        def quote_ps1(s):
++            """
++            This should satisfy PowerShell quoting rules [1], unless the quoted
++            string is passed directly to Windows native commands [2].
++            [1]: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules
++            [2]: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_parsing#passing-arguments-that-contain-quote-characters
++            """
++            s = s.replace("'", "''")
++            return f"'{s}'"
++
++        def quote_bat(s):
++            return s
++
++        # gh-124651: need to quote the template strings properly
++        quote = shlex.quote
++        script_path = context.script_path
++        if script_path.endswith('.ps1'):
++            quote = quote_ps1
++        elif script_path.endswith('.bat'):
++            quote = quote_bat
++        else:
++            # fallbacks to POSIX shell compliant quote
++            quote = shlex.quote
++
++        replacements = {key: quote(s) for key, s in replacements.items()}
++        for key, quoted in replacements.items():
++            text = text.replace(key, quoted)
+         return text
+ 
+     def install_scripts(self, context, path):
+@@ -321,6 +352,7 @@ class EnvBuilder:
+                 with open(srcfile, 'rb') as f:
+                     data = f.read()
+                 if not srcfile.endswith('.exe'):
++                    context.script_path = srcfile
+                     try:
+                         data = data.decode('utf-8')
+                         data = self.replace_variables(data, context)
+diff --git a/Lib/venv/scripts/common/activate b/Lib/venv/scripts/common/activate
+index fff0765af5..c2e2f968fa 100644
+--- a/Lib/venv/scripts/common/activate
++++ b/Lib/venv/scripts/common/activate
+@@ -37,11 +37,11 @@ deactivate () {
+ # unset irrelevant variables
+ deactivate nondestructive
+ 
+-VIRTUAL_ENV="__VENV_DIR__"
++VIRTUAL_ENV=__VENV_DIR__
+ export VIRTUAL_ENV
+ 
+ _OLD_VIRTUAL_PATH="$PATH"
+-PATH="$VIRTUAL_ENV/__VENV_BIN_NAME__:$PATH"
++PATH="$VIRTUAL_ENV/"__VENV_BIN_NAME__":$PATH"
+ export PATH
+ 
+ # unset PYTHONHOME if set
+@@ -54,8 +54,8 @@ fi
+ 
+ if [ -z "${VIRTUAL_ENV_DISABLE_PROMPT:-}" ] ; then
+     _OLD_VIRTUAL_PS1="${PS1:-}"
+-    if [ "x__VENV_PROMPT__" != x ] ; then
+-	PS1="__VENV_PROMPT__${PS1:-}"
++    if [ "x"__VENV_PROMPT__ != x ] ; then
++	PS1=__VENV_PROMPT__"${PS1:-}"
+     else
+     if [ "`basename \"$VIRTUAL_ENV\"`" = "__" ] ; then
+         # special case for Aspen magic directories
+diff --git a/Lib/venv/scripts/posix/activate.csh b/Lib/venv/scripts/posix/activate.csh
+index b0c7028a92..0e90d54008 100644
+--- a/Lib/venv/scripts/posix/activate.csh
++++ b/Lib/venv/scripts/posix/activate.csh
+@@ -8,17 +8,17 @@ alias deactivate 'test $?_OLD_VIRTUAL_PATH != 0 && setenv PATH "$_OLD_VIRTUAL_PA
+ # Unset irrelevant variables.
+ deactivate nondestructive
+ 
+-setenv VIRTUAL_ENV "__VENV_DIR__"
++setenv VIRTUAL_ENV __VENV_DIR__
+ 
+ set _OLD_VIRTUAL_PATH="$PATH"
+-setenv PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__:$PATH"
++setenv PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__":$PATH"
+ 
+ 
+ set _OLD_VIRTUAL_PROMPT="$prompt"
+ 
+ if (! "$?VIRTUAL_ENV_DISABLE_PROMPT") then
+-    if ("__VENV_NAME__" != "") then
+-        set env_name = "__VENV_NAME__"
++    if (__VENV_NAME__ != "") then
++        set env_name = __VENV_NAME__
+     else
+         if (`basename "VIRTUAL_ENV"` == "__") then
+             # special case for Aspen magic directories
+diff --git a/Lib/venv/scripts/posix/activate.fish b/Lib/venv/scripts/posix/activate.fish
+index 4d4f0bd7a4..0407f9c7be 100644
+--- a/Lib/venv/scripts/posix/activate.fish
++++ b/Lib/venv/scripts/posix/activate.fish
+@@ -29,10 +29,10 @@ end
+ # unset irrelevant variables
+ deactivate nondestructive
+ 
+-set -gx VIRTUAL_ENV "__VENV_DIR__"
++set -gx VIRTUAL_ENV __VENV_DIR__
+ 
+ set -gx _OLD_VIRTUAL_PATH $PATH
+-set -gx PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__" $PATH
++set -gx PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__ $PATH
+ 
+ # unset PYTHONHOME if set
+ if set -q PYTHONHOME
+@@ -52,8 +52,8 @@ if test -z "$VIRTUAL_ENV_DISABLE_PROMPT"
+         set -l old_status $status
+ 
+         # Prompt override?
+-        if test -n "__VENV_PROMPT__"            
+-            printf "%s%s" "__VENV_PROMPT__" (set_color normal)
++        if test -n __VENV_PROMPT__            
++            printf "%s%s" __VENV_PROMPT__ (set_color normal)
+         else
+             # ...Otherwise, prepend env
+             set -l _checkbase (basename "$VIRTUAL_ENV")
+diff --git a/Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst b/Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
+new file mode 100644
+index 0000000000..17fc917139
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
+@@ -0,0 +1 @@
++Properly quote template strings in :mod:`venv` activation scripts.

00444-security-fix-for-cve-2024-11168.patch

@@ -0,0 +1,110 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Tue, 9 May 2023 23:35:24 -0700
+Subject: 00444: Security fix for CVE-2024-11168
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (GH-103849)
+
+Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.
+
+(cherry picked from commit 29f348e232e82938ba2165843c448c2b291504c5)
+
+Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
+---
+ Lib/test/test_urlparse.py                     | 26 +++++++++++++++++++
+ Lib/urllib/parse.py                           | 15 +++++++++++
+ ...-04-26-09-54-25.gh-issue-103848.aDSnpR.rst |  2 ++
+ 3 files changed, 43 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
+
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index 7fd61ffea9..090d2f17bf 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -1076,6 +1076,32 @@ class UrlParseTestCase(unittest.TestCase):
+         self.assertEqual(p2.scheme, 'tel')
+         self.assertEqual(p2.path, '+31641044153')
+ 
++    def test_invalid_bracketed_hosts(self):
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[192.0.2.146]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[important.com:8000]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123r.IP]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v12ae]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v.IP]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123.]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
++
++    def test_splitting_bracketed_hosts(self):
++        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
++        self.assertEqual(p1.hostname, 'v6a.ip')
++        self.assertEqual(p1.username, 'user')
++        self.assertEqual(p1.path, '/path')
++        p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7]/path?query')
++        self.assertEqual(p2.hostname, '0439:23af:2309::fae7')
++        self.assertEqual(p2.username, 'user')
++        self.assertEqual(p2.path, '/path')
++        p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146]/path?query')
++        self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146')
++        self.assertEqual(p3.username, 'user')
++        self.assertEqual(p3.path, '/path')
++
+     def test_telurl_params(self):
+         p1 = urllib.parse.urlparse('tel:123-4;phone-context=+1-650-516')
+         self.assertEqual(p1.scheme, 'tel')
+diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
+index 717e990997..bf186b7984 100644
+--- a/Lib/urllib/parse.py
++++ b/Lib/urllib/parse.py
+@@ -34,6 +34,7 @@ It serves as a useful guide when making changes.
+ import re
+ import sys
+ import collections
++import ipaddress
+ 
+ __all__ = ["urlparse", "urlunparse", "urljoin", "urldefrag",
+            "urlsplit", "urlunsplit", "urlencode", "parse_qs",
+@@ -425,6 +426,17 @@ def _remove_unsafe_bytes_from_url(url):
+         url = url.replace(b, "")
+     return url
+ 
++# Valid bracketed hosts are defined in
++# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
++def _check_bracketed_host(hostname):
++    if hostname.startswith('v'):
++        if not re.match(r"\Av[a-fA-F0-9]+\..+\Z", hostname):
++            raise ValueError(f"IPvFuture address is invalid")
++    else:
++        ip = ipaddress.ip_address(hostname) # Throws Value Error if not IPv6 or IPv4
++        if isinstance(ip, ipaddress.IPv4Address):
++            raise ValueError(f"An IPv4 address cannot be in brackets")
++
+ def urlsplit(url, scheme='', allow_fragments=True):
+     """Parse a URL into 5 components:
+     <scheme>://<netloc>/<path>?<query>#<fragment>
+@@ -480,6 +492,9 @@ def urlsplit(url, scheme='', allow_fragments=True):
+         if (('[' in netloc and ']' not in netloc) or
+                 (']' in netloc and '[' not in netloc)):
+             raise ValueError("Invalid IPv6 URL")
++        if '[' in netloc and ']' in netloc:
++            bracketed_host = netloc.partition('[')[2].partition(']')[0]
++            _check_bracketed_host(bracketed_host)
+     if allow_fragments and '#' in url:
+         url, fragment = url.split('#', 1)
+     if '?' in url:
+diff --git a/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst b/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
+new file mode 100644
+index 0000000000..81e5904aa6
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
+@@ -0,0 +1,2 @@
++Add checks to ensure that ``[`` bracketed ``]`` hosts found by
++:func:`urllib.parse.urlsplit` are of IPv6 or IPvFuture format.

00446-Resolve-sinpi-name-clash-with-libm.patch

@@ -0,0 +1,61 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dima Pasechnik <dimpase@gmail.com>
+Date: Wed, 18 Dec 2024 14:31:08 +0100
+Subject: 00446: Resolve sinpi name clash with libm
+
+bpo-36106: Resolve sinpi name clash with libm (IEEE-754 violation). (GH-12027)
+
+The standard math library (libm) may follow IEEE-754 recommendation to
+include an implementation of sinPi(), i.e. sinPi(x):=sin(pi*x).
+And this triggers a name clash, found by FreeBSD developer
+Steve Kargl, who worken on putting sinpi into libm used on FreeBSD
+(it has to be named "sinpi", not "sinPi", cf. e.g.
+https://en.cppreference.com/w/c/experimental/fpext4).
+
+(cherry picked from commit f57cd8288dbe6aba99c057f37ad6d58f8db75350)
+
+Co-authored-by: Victor Stinner <vstinner@python.org>
+---
+ Modules/mathmodule.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Modules/mathmodule.c b/Modules/mathmodule.c
+index 95ea4f7fef..670f1a04ad 100644
+--- a/Modules/mathmodule.c
++++ b/Modules/mathmodule.c
+@@ -67,7 +67,7 @@ static const double sqrtpi = 1.772453850905516027298167483341145182798;
+ static const double logpi = 1.144729885849400174143427351353058711647;
+ 
+ static double
+-sinpi(double x)
++m_sinpi(double x)
+ {
+     double y, r;
+     int n;
+@@ -296,7 +296,7 @@ m_tgamma(double x)
+        integer. */
+     if (absx > 200.0) {
+         if (x < 0.0) {
+-            return 0.0/sinpi(x);
++            return 0.0/m_sinpi(x);
+         }
+         else {
+             errno = ERANGE;
+@@ -320,7 +320,7 @@ m_tgamma(double x)
+     }
+     z = z * lanczos_g / y;
+     if (x < 0.0) {
+-        r = -pi / sinpi(absx) / absx * exp(y) / lanczos_sum(absx);
++        r = -pi / m_sinpi(absx) / absx * exp(y) / lanczos_sum(absx);
+         r -= z * r;
+         if (absx < 140.0) {
+             r /= pow(y, absx - 0.5);
+@@ -390,7 +390,7 @@ m_lgamma(double x)
+     r += (absx - 0.5) * (log(absx + lanczos_g - 0.5) - 1);
+     if (x < 0.0)
+         /* Use reflection formula to get value for negative x. */
+-        r = logpi - log(fabs(sinpi(absx))) - log(absx) - r;
++        r = logpi - log(fabs(m_sinpi(absx))) - log(absx) - r;
+     if (Py_IS_INFINITY(r))
+         errno = ERANGE;
+     return r;

00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch

@@ -0,0 +1,119 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Fri, 31 Jan 2025 11:41:34 -0600
+Subject: 00450: CVE-2025-0938: Disallow square brackets ([ and ]) in domain
+ names for parsed URLs
+
+Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
+---
+ Lib/test/test_urlparse.py                     | 37 ++++++++++++++++++-
+ Lib/urllib/parse.py                           | 20 +++++++++-
+ ...-01-28-14-08-03.gh-issue-105704.EnhHxu.rst |  4 ++
+ 3 files changed, 58 insertions(+), 3 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
+
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index 090d2f17bf..8b2f5ca50f 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -1087,16 +1087,51 @@ class UrlParseTestCase(unittest.TestCase):
+         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
+         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
+         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]/')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix/')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]?')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix?')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]/')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix/')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]?')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix?')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a1')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a1')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:1a')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:1a')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:/')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:?')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@prefix.[v6a.ip]')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@[v6a.ip].suffix')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip]')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip[')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip].suffix')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip')
++        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[suffix')
+ 
+     def test_splitting_bracketed_hosts(self):
+-        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
++        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
+         self.assertEqual(p1.hostname, 'v6a.ip')
+         self.assertEqual(p1.username, 'user')
+         self.assertEqual(p1.path, '/path')
++        self.assertEqual(p1.port, 1234)
+         p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7]/path?query')
+         self.assertEqual(p2.hostname, '0439:23af:2309::fae7')
+         self.assertEqual(p2.username, 'user')
+         self.assertEqual(p2.path, '/path')
++        self.assertIs(p2.port, None)
+         p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146]/path?query')
+         self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146')
+         self.assertEqual(p3.username, 'user')
+diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
+index bf186b7984..af41edf2ca 100644
+--- a/Lib/urllib/parse.py
++++ b/Lib/urllib/parse.py
+@@ -426,6 +426,23 @@ def _remove_unsafe_bytes_from_url(url):
+         url = url.replace(b, "")
+     return url
+ 
++def _check_bracketed_netloc(netloc):
++    # Note that this function must mirror the splitting
++    # done in NetlocResultMixins._hostinfo().
++    hostname_and_port = netloc.rpartition('@')[2]
++    before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
++    if have_open_br:
++        # No data is allowed before a bracket.
++        if before_bracket:
++            raise ValueError("Invalid IPv6 URL")
++        hostname, _, port = bracketed.partition(']')
++        # No data is allowed after the bracket but before the port delimiter.
++        if port and not port.startswith(":"):
++            raise ValueError("Invalid IPv6 URL")
++    else:
++        hostname, _, port = hostname_and_port.partition(':')
++    _check_bracketed_host(hostname)
++
+ # Valid bracketed hosts are defined in
+ # https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
+ def _check_bracketed_host(hostname):
+@@ -493,8 +510,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
+                 (']' in netloc and '[' not in netloc)):
+             raise ValueError("Invalid IPv6 URL")
+         if '[' in netloc and ']' in netloc:
+-            bracketed_host = netloc.partition('[')[2].partition(']')[0]
+-            _check_bracketed_host(bracketed_host)
++            _check_bracketed_netloc(netloc)
+     if allow_fragments and '#' in url:
+         url, fragment = url.split('#', 1)
+     if '?' in url:
+diff --git a/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst b/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
+new file mode 100644
+index 0000000000..bff1bc6b0d
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
+@@ -0,0 +1,4 @@
++When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse` host
++parsing would not reject domain names containing square brackets (``[`` and
++``]``). Square brackets are only valid for IPv6 and IPvFuture hosts according to
++`RFC 3986 Section 3.2.2 <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.

00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch

@@ -0,0 +1,49 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 31 Mar 2025 20:29:04 +0200
+Subject: 00452: Properly apply exported CFLAGS for dtrace/systemtap builds
+
+When using --with-dtrace the resulting object file could be missing
+specific CFLAGS exported by the build system due to the systemtap
+script using specific defaults.
+
+Exporting the CC and CFLAGS variables before the dtrace invocation
+allows us to properly apply CFLAGS exported by the build system
+even when cross-compiling.
+
+Co-authored-by: stratakis <cstratak@redhat.com>
+---
+ Makefile.pre.in                                               | 4 ++--
+ .../next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index b074b26039..825cefafd9 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -892,13 +892,13 @@ Python/frozen.o: $(srcdir)/Python/importlib.h $(srcdir)/Python/importlib_externa
+ # an include guard, so we can't use a pipeline to transform its output.
+ Include/pydtrace_probes.h: $(srcdir)/Include/pydtrace.d
+ 	$(MKDIR_P) Include
+-	$(DTRACE) $(DFLAGS) -o $@ -h -s $<
++	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -h -s $<
+ 	: sed in-place edit with POSIX-only tools
+ 	sed 's/PYTHON_/PyDTrace_/' $@ > $@.tmp
+ 	mv $@.tmp $@
+ 
+ Python/pydtrace.o: $(srcdir)/Include/pydtrace.d $(DTRACE_DEPS)
+-	$(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
++	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
+ 
+ Objects/typeobject.o: Objects/typeslots.inc
+ 
+diff --git a/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
+new file mode 100644
+index 0000000000..a287e0b228
+--- /dev/null
++++ b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
+@@ -0,0 +1,2 @@
++The DTrace build now properly passes the ``CC`` and ``CFLAGS`` variables
++to the ``dtrace`` command when utilizing SystemTap on Linux.

00457-ssl-raise-oserror-for-err_lib_sys.patch

@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <vstinner@python.org>
+Date: Thu, 3 Apr 2025 18:26:17 +0200
+Subject: 00457: ssl: Raise OSError for ERR_LIB_SYS
+
+The patch resolves the flakiness of test_ftplib
+
+Backported from upstream 3.10+:
+https://github.com/python/cpython/pull/127361
+
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+---
+ Modules/_ssl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/Modules/_ssl.c b/Modules/_ssl.c
+index 3375b2bf3f..ab8a327d10 100644
+--- a/Modules/_ssl.c
++++ b/Modules/_ssl.c
+@@ -638,6 +638,11 @@ PySSL_SetError(PySSLSocket *obj, int ret, const char *filename, int lineno)
+                     errstr = "Some I/O error occurred";
+                 }
+             } else {
++                if (ERR_GET_LIB(e) == ERR_LIB_SYS) {
++                    // A system error is being reported; reason is set to errno
++                    errno = ERR_GET_REASON(e);
++                    return PyErr_SetFromErrno(PyExc_OSError);
++                }
+                 p = PY_SSL_ERROR_SYSCALL;
+             }
+             break;
+@@ -648,6 +653,11 @@ PySSL_SetError(PySSLSocket *obj, int ret, const char *filename, int lineno)
+             if (e == 0)
+                 /* possible? */
+                 errstr = "A failure in the SSL library occurred";
++            if (ERR_GET_LIB(e) == ERR_LIB_SYS) {
++                // A system error is being reported; reason is set to errno
++                errno = ERR_GET_REASON(e);
++                return PyErr_SetFromErrno(PyExc_OSError);
++            }
+             break;
+         }
+         default:

00467-tarfile-cve-2025-8194.patch

@@ -0,0 +1,212 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alexander Urieles <aeurielesn@users.noreply.github.com>
+Date: Mon, 28 Jul 2025 17:37:26 +0200
+Subject: 00467: tarfile CVE-2025-8194
+
+tarfile now validates archives to ensure member offsets are non-negative (GH-137027)
+
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+---
+ Lib/tarfile.py                                |   3 +
+ Lib/test/test_tarfile.py                      | 156 ++++++++++++++++++
+ ...-07-23-00-35-29.gh-issue-130577.c7EITy.rst |   3 +
+ 3 files changed, 162 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index 1a7d5f772a..4f536cb002 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -1582,6 +1582,9 @@ class TarInfo(object):
+         """Round up a byte count by BLOCKSIZE and return it,
+            e.g. _block(834) => 1024.
+         """
++        # Only non-negative offsets are allowed
++        if count < 0:
++            raise InvalidHeaderError("invalid offset")
+         blocks, remainder = divmod(count, BLOCKSIZE)
+         if remainder:
+             blocks += 1
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index c5d837e716..484f114180 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -43,6 +43,7 @@ bz2name = os.path.join(TEMPDIR, "testtar.tar.bz2")
+ xzname = os.path.join(TEMPDIR, "testtar.tar.xz")
+ tmpname = os.path.join(TEMPDIR, "tmp.tar")
+ dotlessname = os.path.join(TEMPDIR, "testtar")
++SPACE = b" "
+ 
+ md5_regtype = "65f477c818ad9e15f7feab0c6d37742f"
+ md5_sparse = "a54fbc4ca4f4399a90e1b27164012fc6"
+@@ -4005,6 +4006,161 @@ class TestExtractionFilters(unittest.TestCase):
+             self.expect_exception(TypeError)  # errorlevel is not int
+ 
+ 
++class OffsetValidationTests(unittest.TestCase):
++    tarname = tmpname
++    invalid_posix_header = (
++        # name: 100 bytes
++        tarfile.NUL * tarfile.LENGTH_NAME
++        # mode, space, null terminator: 8 bytes
++        + b"000755" + SPACE + tarfile.NUL
++        # uid, space, null terminator: 8 bytes
++        + b"000001" + SPACE + tarfile.NUL
++        # gid, space, null terminator: 8 bytes
++        + b"000001" + SPACE + tarfile.NUL
++        # size, space: 12 bytes
++        + b"\xff" * 11 + SPACE
++        # mtime, space: 12 bytes
++        + tarfile.NUL * 11 + SPACE
++        # chksum: 8 bytes
++        + b"0011407" + tarfile.NUL
++        # type: 1 byte
++        + tarfile.REGTYPE
++        # linkname: 100 bytes
++        + tarfile.NUL * tarfile.LENGTH_LINK
++        # magic: 6 bytes, version: 2 bytes
++        + tarfile.POSIX_MAGIC
++        # uname: 32 bytes
++        + tarfile.NUL * 32
++        # gname: 32 bytes
++        + tarfile.NUL * 32
++        # devmajor, space, null terminator: 8 bytes
++        + tarfile.NUL * 6 + SPACE + tarfile.NUL
++        # devminor, space, null terminator: 8 bytes
++        + tarfile.NUL * 6 + SPACE + tarfile.NUL
++        # prefix: 155 bytes
++        + tarfile.NUL * tarfile.LENGTH_PREFIX
++        # padding: 12 bytes
++        + tarfile.NUL * 12
++    )
++    invalid_gnu_header = (
++        # name: 100 bytes
++        tarfile.NUL * tarfile.LENGTH_NAME
++        # mode, null terminator: 8 bytes
++        + b"0000755" + tarfile.NUL
++        # uid, null terminator: 8 bytes
++        + b"0000001" + tarfile.NUL
++        # gid, space, null terminator: 8 bytes
++        + b"0000001" + tarfile.NUL
++        # size, space: 12 bytes
++        + b"\xff" * 11 + SPACE
++        # mtime, space: 12 bytes
++        + tarfile.NUL * 11 + SPACE
++        # chksum: 8 bytes
++        + b"0011327" + tarfile.NUL
++        # type: 1 byte
++        + tarfile.REGTYPE
++        # linkname: 100 bytes
++        + tarfile.NUL * tarfile.LENGTH_LINK
++        # magic: 8 bytes
++        + tarfile.GNU_MAGIC
++        # uname: 32 bytes
++        + tarfile.NUL * 32
++        # gname: 32 bytes
++        + tarfile.NUL * 32
++        # devmajor, null terminator: 8 bytes
++        + tarfile.NUL * 8
++        # devminor, null terminator: 8 bytes
++        + tarfile.NUL * 8
++        # padding: 167 bytes
++        + tarfile.NUL * 167
++    )
++    invalid_v7_header = (
++        # name: 100 bytes
++        tarfile.NUL * tarfile.LENGTH_NAME
++        # mode, space, null terminator: 8 bytes
++        + b"000755" + SPACE + tarfile.NUL
++        # uid, space, null terminator: 8 bytes
++        + b"000001" + SPACE + tarfile.NUL
++        # gid, space, null terminator: 8 bytes
++        + b"000001" + SPACE + tarfile.NUL
++        # size, space: 12 bytes
++        + b"\xff" * 11 + SPACE
++        # mtime, space: 12 bytes
++        + tarfile.NUL * 11 + SPACE
++        # chksum: 8 bytes
++        + b"0010070" + tarfile.NUL
++        # type: 1 byte
++        + tarfile.REGTYPE
++        # linkname: 100 bytes
++        + tarfile.NUL * tarfile.LENGTH_LINK
++        # padding: 255 bytes
++        + tarfile.NUL * 255
++    )
++    valid_gnu_header = tarfile.TarInfo("filename").tobuf(tarfile.GNU_FORMAT)
++    data_block = b"\xff" * tarfile.BLOCKSIZE
++
++    def _write_buffer(self, buffer):
++        with open(self.tarname, "wb") as f:
++            f.write(buffer)
++
++    def _get_members(self, ignore_zeros=None):
++        with open(self.tarname, "rb") as f:
++            with tarfile.open(
++                mode="r", fileobj=f, ignore_zeros=ignore_zeros
++            ) as tar:
++                return tar.getmembers()
++
++    def _assert_raises_read_error_exception(self):
++        with self.assertRaisesRegex(
++            tarfile.ReadError, "file could not be opened successfully"
++        ):
++            self._get_members()
++
++    def test_invalid_offset_header_validations(self):
++        for tar_format, invalid_header in (
++            ("posix", self.invalid_posix_header),
++            ("gnu", self.invalid_gnu_header),
++            ("v7", self.invalid_v7_header),
++        ):
++            with self.subTest(format=tar_format):
++                self._write_buffer(invalid_header)
++                self._assert_raises_read_error_exception()
++
++    def test_early_stop_at_invalid_offset_header(self):
++        buffer = self.valid_gnu_header + self.invalid_gnu_header + self.valid_gnu_header
++        self._write_buffer(buffer)
++        members = self._get_members()
++        self.assertEqual(len(members), 1)
++        self.assertEqual(members[0].name, "filename")
++        self.assertEqual(members[0].offset, 0)
++
++    def test_ignore_invalid_archive(self):
++        # 3 invalid headers with their respective data
++        buffer = (self.invalid_gnu_header + self.data_block) * 3
++        self._write_buffer(buffer)
++        members = self._get_members(ignore_zeros=True)
++        self.assertEqual(len(members), 0)
++
++    def test_ignore_invalid_offset_headers(self):
++        for first_block, second_block, expected_offset in (
++            (
++                (self.valid_gnu_header),
++                (self.invalid_gnu_header + self.data_block),
++                0,
++            ),
++            (
++                (self.invalid_gnu_header + self.data_block),
++                (self.valid_gnu_header),
++                1024,
++            ),
++        ):
++            self._write_buffer(first_block + second_block)
++            members = self._get_members(ignore_zeros=True)
++            self.assertEqual(len(members), 1)
++            self.assertEqual(members[0].name, "filename")
++            self.assertEqual(members[0].offset, expected_offset)
++
++
+ def setUpModule():
+     support.unlink(TEMPDIR)
+     os.makedirs(TEMPDIR)
+diff --git a/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+new file mode 100644
+index 0000000000..342cabbc86
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+@@ -0,0 +1,3 @@
++:mod:`tarfile` now validates archives to ensure member offsets are
++non-negative.  (Contributed by Alexander Enrique Urieles Nieto in
++:gh:`130577`.)

pip-CVE-2007-4559.patch

@@ -0,0 +1,42 @@
+diff --git a/pip/_internal/utils/misc.py b/pip/_internal/utils/misc.py
+index 84a421f..fbdb654 100644
+--- a/pip/_internal/utils/misc.py
++++ b/pip/_internal/utils/misc.py
+@@ -532,6 +532,13 @@ def untar_file(filename, location):
+             if leading:
+                 fn = split_leading_dir(fn)[1]
+             path = os.path.join(location, fn)
++
++            # Call the `data` filter for its side effect (raising exception)
++            try:
++                tarfile.data_filter(member.replace(name=fn), location)
++            except tarfile.LinkOutsideDestinationError:
++                pass
++
+             if member.isdir():
+                 ensure_dir(path)
+             elif member.issym():
+diff --git a/pip/_vendor/distlib/util.py b/pip/_vendor/distlib/util.py
+index 0b14a93..8f3f12e 100644
+--- a/pip/_vendor/distlib/util.py
++++ b/pip/_vendor/distlib/util.py
+@@ -1238,6 +1238,19 @@ def unarchive(archive_filename, dest_dir, format=None, check=True):
+             for tarinfo in archive.getmembers():
+                 if not isinstance(tarinfo.name, text_type):
+                     tarinfo.name = tarinfo.name.decode('utf-8')
++
++        # Limit extraction of dangerous items, if this Python
++        # allows it easily. If not, just trust the input.
++        # See: https://docs.python.org/3/library/tarfile.html#extraction-filters
++        def extraction_filter(member, path):
++            """Run tarfile.tar_fillter, but raise the expected ValueError"""
++            # This is only called if the current Python has tarfile filters
++            try:
++                return tarfile.tar_filter(member, path)
++            except tarfile.FilterError as exc:
++                raise ValueError(str(exc))
++        archive.extraction_filter = extraction_filter
++
+         archive.extractall(dest_dir)
+ 
+     finally:

plan.fmf

@@ -0,0 +1,38 @@
+execute:
+  how: tmt
+
+environment:
+  pybasever: '3.6'
+
+discover:
+  - name: tests_python
+    how: shell
+    url: https://src.fedoraproject.org/tests/python.git
+    tests:
+    - name: smoke
+      path: /smoke
+      test: "VERSION=${pybasever} TOX_REQUIRES='virtualenv<20.22.0' ./venv.sh"
+    - name: debugsmoke
+      path: /smoke
+      test: "PYTHON=python${pybasever}dm TOX=false VERSION=${pybasever} INSTALL_OR_SKIP=true ./venv.sh"
+    - name: marshalparser
+      path: /marshalparser
+      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
+
+prepare:
+  - name: Install dependencies
+    how: install
+    package:
+    - gcc
+    - python3-tox
+    - python${pybasever}
+    - glibc-all-langpacks # for locale tests
+    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - dnf  # for upgrade
+  - name: Update packages
+    how: shell
+    script: dnf upgrade -y
+  - name: rpm_qa
+    order: 100
+    how: shell
+    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt

python3.6.spec

@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 22%{?dist}
+Release: 50%{?dist}
 # Python is Python
 # pip MIT is and bundles:
 #   appdirs: MIT
@@ -48,7 +48,8 @@ Release: 22%{?dist}
 #   pyparsing: MIT
 #   six: MIT
 #   appdirs: MIT
-License: Python and MIT and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)
+# Automatically converted from old format: Python and MIT and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) - review is highly recommended.
+License: LicenseRef-Callaway-Python AND LicenseRef-Callaway-MIT AND Apache-2.0 AND LicenseRef-Callaway-BSD AND ISC AND LicenseRef-Callaway-LGPLv2 AND MPL-2.0 AND (Apache-2.0 OR LicenseRef-Callaway-BSD)
 
 
 # ==================================
@@ -58,12 +59,22 @@ License: Python and MIT and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (
 # Note that the bcond macros are named for the CLI option they create.
 # "%%bcond_without" means "ENABLE by default and create a --without option"
 
+# Main Python, i.e. whether this is the main Python version in the distribution
+# that owns /usr/bin/python3 and other unique paths
+# This also means the built subpackages are called python3 rather than python3X
+# WARNING: This also influences the flatpackage bcond below.
+# By default, this is disabled.
+%bcond_with main_python
+
 # Flat package, i.e. python36, python37, python38 for tox etc.
-# warning: changes some other defaults
-# in Fedora, never turn this on for the python3 package
-# and always keep it on for python36 etc.
-# WARNING: This does not change the package name and summary above
+# Default (in Fedora >= 44): disabled
+# Default (in Fedora < 44): enabled when this is not the main Python
+# Not supported: Combination of flatpackage enabled and main_python enabled
+%if %{with main_python} || 0%{?fedora} >= 44
+%bcond_with flatpackage
+%else
 %bcond_without flatpackage
+%endif
 
 # Whether to use RPM build wheels from the python-{pip,setuptools}-wheel package
 # Uses upstream bundled prebuilt wheels otherwise
@@ -160,6 +171,8 @@ License: Python and MIT and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (
 # General global macros
 # =====================
 
+%global pkgname python%{pybasever}
+
 %global pylibdir %{_libdir}/python%{pybasever}
 %global dynload_dir %{pylibdir}/lib-dynload
 
@@ -265,6 +278,7 @@ BuildRequires: libffi-devel
 BuildRequires: libnsl2-devel
 BuildRequires: libtirpc-devel
 BuildRequires: libGL-devel
+BuildRequires: libxcrypt-devel
 BuildRequires: libX11-devel
 BuildRequires: make
 BuildRequires: ncurses-devel
@@ -275,12 +289,12 @@ BuildRequires: redhat-rpm-config >= 127
 BuildRequires: sqlite-devel
 BuildRequires: gdb
 
-BuildRequires: openssl1.1-devel
+BuildRequires: openssl-devel
 
 BuildRequires: tar
-BuildRequires: tcl-devel
+BuildRequires: tcl-devel < 1:9
 BuildRequires: tix-devel
-BuildRequires: tk-devel
+BuildRequires: tk-devel < 1:9
 
 %if %{with valgrind}
 BuildRequires: valgrind-devel
@@ -289,6 +303,7 @@ BuildRequires: valgrind-devel
 BuildRequires: xz-devel
 BuildRequires: zlib-devel
 
+BuildRequires: systemtap-sdt-devel
 BuildRequires: /usr/bin/dtrace
 
 # workaround http://bugs.python.org/issue19804 (test_uuid requires ifconfig)
@@ -297,6 +312,9 @@ BuildRequires: /usr/sbin/ifconfig
 %if %{with rpmwheels}
 BuildRequires: python-setuptools-wheel
 BuildRequires: python-pip-wheel
+%else
+# For %%python_wheel_inject_sbom
+BuildRequires: python-rpm-macros
 %endif
 
 
@@ -319,10 +337,23 @@ Source10: idle3.desktop
 # AppData file for idle3
 Source11: idle3.appdata.xml
 
+# Patches for bundled wheels
+
+# Patch for the bundled pip wheel for CVE-2007-4559
+Source101: pip-CVE-2007-4559.patch
+
+# Patch for the bundled setuptools wheel for CVE-2024-6345
+# Remote code execution via download functions in the package_index module
+# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=2297771
+# Upstream solution: https://github.com/pypa/setuptools/pull/4332
+# Patch simplified because upstream doesn't support SVN anymore.
+Source102: setuptools-CVE-2024-6345.patch
+
 # (Patches taken from github.com/fedora-python/cpython)
 
 # 00001 # d06a8853cf4bae9e115f45e1d531d2dc152c5cc8
 # Fixup distutils/unixccompiler.py to remove standard library path from rpath
+#
 # Was Patch0 in ivazquez' python3000 specfile
 Patch1: 00001-rpath.patch
 
@@ -495,6 +526,14 @@ Patch353: 00353-architecture-names-upstream-downstream.patch
 # - 8766cb74e186d3820db0a855ccd780d6d84461f7
 Patch358: 00358-align-allocations-and-pygc_head-to-16-bytes-on-64-bit-platforms.patch
 
+# 00361 # b3dd949b7947b1b44b358e0c30d080e5b16ca8bc
+# openssl-3-compatibility
+#
+# Backported from Python 3.8
+#
+# Based on https://github.com/stratakis/cpython/tree/fedora-3.6_openssl3_compat
+Patch361: 00361-openssl-3-compatibility.patch
+
 # 00375 # 5488ab84d2447aa8df8b3502e76f151ac2488947
 # Fix test_distance to enable build on i686
 #
@@ -614,6 +653,20 @@ Patch392: 00392-cve-2022-37454-fix-buffer-overflows-in-_sha3-module.patch
 # the behavior to linear.
 Patch394: 00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decoder.patch
 
+# 00397 # e867e27272cd259b76133784ef3f2811e671f3db
+# PEP 706, CVE-2007-4559: Filter API for tarfile.extractall
+#
+# Add API for allowing checks on the content of tar files, allowing callers to mitigate
+# directory traversal (CVE-2007-4559) and related issues.
+#
+# Python 3.12 will warn if this API is not used.
+# Python 3.14 will fail if it's not used.
+#
+# Backport from https://github.com/python/cpython/issues/102950
+#
+# Change document: https://peps.python.org/pep-0706/
+Patch397: 00397-pep-706-cve-2007-4559-filter-api-for-tarfile-extractall.patch
+
 # 00399 # dc0a803eea47d3b4f0657816b112b5a33491500f
 # CVE-2023-24329
 #
@@ -655,6 +708,165 @@ Patch410: 00410-bpo-42598-fix-implicit-function-declarations-in-configure.patch
 # Thomas Dwyer.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 
+# 00419 # f13682530cc7e4daec2e40acd56508846fdd3aad
+# gh-112769: test_zlib: Fix comparison of ZLIB_RUNTIME_VERSION with non-int suffix (GH-112771) (GH-112774)
+#
+# zlib-ng defines the version as "1.3.0.zlib-ng".
+Patch419: 00419-gh-112769-test_zlib-fix-comparison-of-zlib_runtime_version-with-non-int-suffix-gh-112771-gh-112774.patch
+
+# 00422 # fefea32e0c70109a5c88e3d22ec9ff554fcbc6ab
+# gh-115133: Fix tests for XMLPullParser with Expat 2.6.0
+#
+# Feeding the parser by too small chunks defers parsing to prevent
+# CVE-2023-52425. Future versions of Expat may be more reactive.
+Patch422: 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
+
+# 00423 # 81584d3af3b307c2aeede3ba8ae95c7efc81f5f7
+# bpo-33377: Add triplets for mips-r6 and riscv
+Patch423: 00423-bpo-33377-add-triplets-for-mips-r6-and-riscv.patch
+
+# 00426 # 05ddec93394a09199c3bbb2d71a4a2566fd50332
+# CVE-2023-6597
+#
+# Combines Two fixes for tempfile.TemporaryDirectory:
+# https://github.com/python/cpython/commit/e9b51c0ad81da1da11ae65840ac8b50a8521373c
+# https://github.com/python/cpython/commit/02a9259c717738dfe6b463c44d7e17f2b6d2cb3a
+Patch426: 00426-cve-2023-6597.patch
+
+# 00427 # 37c3b42b8931ed4eca0272bf53086eb28ca8544e
+# ZipExtFile tell and seek, CVE-2024-0450
+#
+# Backport of seek and tell methods for ZipExtFile makes it
+# possible to backport the fix for CVE-2024-0450.
+#
+# Combines:
+# https://github.com/python/cpython/commit/066df4fd454d6ff9be66e80b2a65995b10af174f
+# https://github.com/python/cpython/commit/66363b9a7b9fe7c99eba3a185b74c5fdbf842eba
+Patch427: 00427-zipextfile-tell-and-seek-cve-2024-0450.patch
+
+# 00431 # ee1b513c52ab7663f7d58b07a1df123ea551e7c4
+# CVE-2024-4032: incorrect IPv4 and IPv6 private ranges
+#
+# Upstream issue: https://github.com/python/cpython/issues/113171
+#
+# Backported from 3.8.
+Patch431: 00431-cve-2024-4032.patch
+
+# 00435 # f80b87e6a67eebe0693b895261bad2e9a58a4825
+# gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)
+#
+# Per RFC 2047:
+#
+# > [...] these encoding schemes allow the
+# > encoding of arbitrary octet values, mail readers that implement this
+# > decoding should also ensure that display of the decoded data on the
+# > recipient's terminal will not cause unwanted side-effects
+#
+# It seems that the "quoted-word" scheme is a valid way to include
+# a newline character in a header value, just like we already allow
+# undecodable bytes or control characters.
+# They do need to be properly quoted when serialized to text, though.
+#
+# This should fail for custom fold() implementations that aren't careful
+# about newlines.
+#
+#
+# This patch also contains modified commit cherry picked from
+# c5bba853d5e7836f6d4340e18721d3fb3a6ee0f7.
+#
+# This commit was backported to simplify the backport of the other commit
+# fixing CVE. The only modification is a removal of one test case which
+# tests multiple changes in Python 3.7 and it wasn't working properly
+# with Python 3.6 where we backported only one change.
+Patch435: 00435-gh-121650-encode-newlines-in-headers-and-verify.patch
+
+# 00437 # c1618bd3b415d9df1a2d050332220300d394ac5f
+# CVE-2024-6232 Remove backtracking when parsing tarfile headers
+#
+# * Remove backtracking when parsing tarfile headers
+# * Rewrite PAX header parsing to be stricter
+# * Optimize parsing of GNU extended sparse headers v0.0
+Patch437: 00437-cve-2024-6232-remove-backtracking-when-parsing-tarfile-headers.patch
+
+# 00443 # 49e939f29e3551ec4e7bdb2cc8b8745e3d1fca35
+# gh-124651: Quote template strings in `venv` activation scripts
+#
+# (cherry picked from 3.9)
+Patch443: 00443-gh-124651-quote-template-strings-in-venv-activation-scripts.patch
+
+# 00444 # fed0071c8c86599091f93967a5fa2cce42ceb840
+# Security fix for CVE-2024-11168
+#
+# gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (GH-103849)
+#
+# Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.
+Patch444: 00444-security-fix-for-cve-2024-11168.patch
+
+# 00446 # f5cc2c3be4273be70cdcdf9eb95abf425808f752
+# Resolve sinpi name clash with libm
+#
+# bpo-36106: Resolve sinpi name clash with libm (IEEE-754 violation). (GH-12027)
+#
+# The standard math library (libm) may follow IEEE-754 recommendation to
+# include an implementation of sinPi(), i.e. sinPi(x):=sin(pi*x).
+# And this triggers a name clash, found by FreeBSD developer
+# Steve Kargl, who worken on putting sinpi into libm used on FreeBSD
+# (it has to be named "sinpi", not "sinPi", cf. e.g.
+# https://en.cppreference.com/w/c/experimental/fpext4).
+Patch446: 00446-Resolve-sinpi-name-clash-with-libm.patch
+
+# 00450 # 31aa7c11975e890489e31d8b293c3f92d3ea1180
+# CVE-2025-0938: Disallow square brackets ([ and ]) in domain names for parsed URLs
+Patch450: 00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch
+
+# 00452 # dab1c136301f0beac6ec132a8e5b08206b698bc8
+# Properly apply exported CFLAGS for dtrace/systemtap builds
+#
+# When using --with-dtrace the resulting object file could be missing
+# specific CFLAGS exported by the build system due to the systemtap
+# script using specific defaults.
+#
+# Exporting the CC and CFLAGS variables before the dtrace invocation
+# allows us to properly apply CFLAGS exported by the build system
+# even when cross-compiling.
+Patch452: 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
+
+# 00457 # da99203f07d380d50ec780323bbebda00f227797
+# ssl: Raise OSError for ERR_LIB_SYS
+#
+# The patch resolves the flakiness of test_ftplib
+#
+# Backported from upstream 3.10+:
+# https://github.com/python/cpython/pull/127361
+Patch457: 00457-ssl-raise-oserror-for-err_lib_sys.patch
+
+# 00465 # 2224c823bcc1b62b85f516883151459ae51cdb7d
+# tarfile cves
+#
+# Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 on tarfile
+#
+# The backported fixes do not contain changes for ntpath.py and related tests,
+# because the support for symlinks and junctions were added later in Python 3.9,
+# and it does not make sense to backport them to 3.6 here.
+#
+# The patch is contains the following changes:
+# - https://github.com/python/cpython/commit/42deeab5b2efc2930d4eb73416e1dde9cf790dd2
+#   fixes symlink handling for tarfile.data_filter
+# - https://github.com/python/cpython/commit/9d2c2a8e3b8fe18ee1568bfa4a419847b3e78575
+#   fixes handling of existing files/symlinks in tarfile
+# - https://github.com/python/cpython/commit/00af9794dd118f7b835dd844b2b609a503ad951e
+#   adds a new "strict" argument to realpath()
+# - https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
+#   fixes mulriple CVE fixes in the tarfile module
+# - downstream only fixes that makes the changes work and compatible with Python 3.6
+Patch465: 00465-tarfile-cves.patch
+
+# 00467 # f0b2819ec35fe1f732f661aea68863a5e4dd829f
+# tarfile CVE-2025-8194
+#
+# tarfile now validates archives to ensure member offsets are non-negative (GH-137027)
+Patch467: 00467-tarfile-cve-2025-8194.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -673,12 +885,16 @@ Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-par
 Provides:  python%{pyshortver} = %{version}-%{release}
 Obsoletes: python%{pyshortver} < %{version}-%{release}
 
-%if %{without flatpackage}
-
 # Packages with Python modules in standard locations automatically
-# depend on python(abi). Provide that here.
+# depend on python(abi). Provide that here only for the main Python.
+%if %{with main_python}
 Provides: python(abi) = %{pybasever}
+%else
+%global __requires_exclude ^python\\(abi\\) = 3\\..+
+%global __provides_exclude ^python\\(abi\\) = 3\\..+
+%endif
 
+%if %{without flatpackage}
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 
 # In order to support multiple Python interpreters for development purposes,
@@ -693,18 +909,16 @@ Provides: python%{pyshortver} = %{version}-%{release}
 # replace python36-3.6.2.
 Obsoletes: python%{pyshortver}
 
-# Shall be removed in Fedora 31
-# The release is bumped to 20, so we can do f27 platform-python updates
-# If the release in f27 ever goes >= 20, raise it here
-# If platform-python is ever reintroduced, make it higher version than this:
-%global platpyver 3.6.2-20
-Obsoletes: platform-python < %{platpyver}
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
+Obsoletes: %{name} < 3.6.15-50
 
+%if %{with main_python}
 # Previously, this was required for our rewheel patch to work.
 # This is technically no longer needed, but we keep it recommended
 # for the developer experience.
 Recommends: python3-setuptools
 Recommends: python3-pip
+%endif
 
 # This prevents ALL subpackages built from this spec to require
 # /usr/bin/python3*. Granularity per subpackage is impossible.
@@ -787,9 +1001,8 @@ Provides: bundled(libmpdec) = %{libmpdec_version}
 # See https://bugzilla.redhat.com/show_bug.cgi?id=1547131
 Recommends: %{name}%{?_isa} = %{version}-%{release}
 
-# Shall be removed in Fedora 31
-Obsoletes: platform-python-libs < %{platpyver}
-Obsoletes: platform-python-libs-devel < %{platpyver}
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
+Obsoletes: %{name} < 3.6.15-50
 
 %description libs
 This package contains runtime libraries for use by Python:
@@ -803,17 +1016,21 @@ Summary: Libraries and header files needed for Python development
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 BuildRequires: python-rpm-macros
-Requires: python-rpm-macros
-Requires: python3-rpm-macros
-Requires: python3-rpm-generators
+# The RPM related dependencies bring nothing to a non-RPM Python developer
+# But we want them when packages BuildRequire python3-devel
+Requires: (python-rpm-macros if rpm-build)
+Requires: (python3-rpm-macros if rpm-build)
+Requires: (python3-rpm-generators if rpm-build)
 
 Provides: %{name}-2to3 = %{version}-%{release}
+%if %{with main_python}
 Provides: 2to3 = %{version}-%{release}
+%endif
 
 Conflicts: %{name} < %{version}-%{release}
 
-# Shall be removed in Fedora 31
-Obsoletes: platform-python-devel < %{platpyver}
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
+Obsoletes: %{name} < 3.6.15-50
 
 %description devel
 This package contains the header files and configuration needed to compile
@@ -829,14 +1046,16 @@ Summary: A basic graphical development environment for Python
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-tkinter = %{version}-%{release}
 
+%if %{with main_python}
 Provides: idle3 = %{version}-%{release}
+%endif
 
 Provides: %{name}-tools = %{version}-%{release}
 Provides: %{name}-tools%{?_isa} = %{version}-%{release}
 Obsoletes: %{name}-tools < %{version}-%{release}
 
-# Shall be removed in Fedora 31
-Obsoletes: platform-python-tools < %{platpyver}
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
+Obsoletes: %{name} < 3.6.15-50
 
 %description idle
 IDLE is Python’s Integrated Development and Learning Environment.
@@ -855,8 +1074,8 @@ configuration, browsers, and other dialogs.
 Summary: A GUI toolkit for Python
 Requires: %{name} = %{version}-%{release}
 
-# Shall be removed in Fedora 31
-Obsoletes: platform-python-tkinter < %{platpyver}
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
+Obsoletes: %{name} < 3.6.15-50
 
 %description tkinter
 The Tkinter (Tk interface) library is a graphical user interface toolkit for
@@ -867,8 +1086,8 @@ the Python programming language.
 Summary: The self-test suite for the main python3 package
 Requires: %{name} = %{version}-%{release}
 
-# Shall be removed in Fedora 31
-Obsoletes: platform-python-test < %{platpyver}
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
+Obsoletes: %{name} < 3.6.15-50
 
 %description test
 The self-test suite for the Python interpreter.
@@ -913,11 +1132,6 @@ so extensions for both versions can co-exist in the same directory.
 
 %else  # with flatpackage
 
-# We'll not provide this, on purpose
-# No package in Fedora shall ever depend on flatpackage via this
-%global __requires_exclude ^python\\(abi\\) = 3\\..$
-%global __provides_exclude ^python\\(abi\\) = 3\\..$
-
 %if %{with rpmwheels}
 Requires: python-setuptools-wheel
 Requires: python-pip-wheel
@@ -961,6 +1175,16 @@ Provides: bundled(python3dist(appdirs)) = 1.4.3
 Provides: bundled(mpdecimal) = %{libmpdec_version}
 Provides: bundled(libmpdec) = %{libmpdec_version}
 
+# Provides of the subpackages contained in flatpackage
+Provides: %{pkgname}-libs = %{version}-%{release}
+Provides: %{pkgname}-devel = %{version}-%{release}
+Provides: %{pkgname}-idle = %{version}-%{release}
+Provides: %{pkgname}-tkinter = %{version}-%{release}
+Provides: %{pkgname}-test = %{version}-%{release}
+%if %{with debug_build}
+Provides: %{pkgname}-debug = %{version}-%{release}
+%endif
+
 # The description for the flat package
 %description
 Python %{pybasever} package for developers.
@@ -998,6 +1222,18 @@ or older Fedora releases.
 %if %{with rpmwheels}
 %autopatch 189
 rm Lib/ensurepip/_bundled/*.whl
+%else
+# Patch the bundled pip wheel for CVE-2007-4559
+unzip -qq Lib/ensurepip/_bundled/pip-%{pip_version}-py2.py3-none-any.whl
+patch -p1 < %{SOURCE101}
+zip -rq Lib/ensurepip/_bundled/pip-%{pip_version}-py2.py3-none-any.whl pip pip-%{pip_version}.dist-info
+rm -rf pip/ pip-%{pip_version}.dist-info/
+
+# Patch the bundled setuptools wheel for CVE-2024-6345
+unzip -qq Lib/ensurepip/_bundled/setuptools-%{setuptools_version}-py2.py3-none-any.whl
+patch -p1 < %{SOURCE102}
+zip -rq Lib/ensurepip/_bundled/setuptools-%{setuptools_version}-py2.py3-none-any.whl easy_install.py pkg_resources setuptools setuptools-%{setuptools_version}.dist-info
+rm -rf easy_install.py pkg_resources/ setuptools/ setuptools-%{setuptools_version}.dist-info/
 %endif
 
 # Apply the remaining patches
@@ -1246,7 +1482,7 @@ install -d -m 0755 %{buildroot}%{pylibdir}/site-packages/__pycache__
 install -d -m 0755 %{buildroot}%{_prefix}/lib/python%{pybasever}/site-packages/__pycache__
 %endif
 
-%if %{without flatpackage}
+%if %{with main_python}
 # add idle3 to menu
 install -D -m 0644 Lib/idlelib/Icons/idle_16.png %{buildroot}%{_datadir}/icons/hicolor/16x16/apps/idle3.png
 install -D -m 0644 Lib/idlelib/Icons/idle_32.png %{buildroot}%{_datadir}/icons/hicolor/32x32/apps/idle3.png
@@ -1336,13 +1572,18 @@ find %{buildroot} -perm 555 -exec chmod 755 {} \;
 # Create "/usr/bin/python3-debug", a symlink to the python3 debug binary, to
 # avoid the user having to know the precise version and ABI flags.
 # See e.g. https://bugzilla.redhat.com/show_bug.cgi?id=676748
-%if %{with debug_build} && %{without flatpackage}
+%if %{with debug_build} && %{with main_python}
 ln -s \
   %{_bindir}/python%{LDVERSION_debug} \
   %{buildroot}%{_bindir}/python3-debug
 %endif
 
-%if %{with flatpackage}
+%if %{without rpmwheels}
+# Inject SBOM into the installed wheels (if the macro is available)
+%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl}
+%endif
+
+%if %{without main_python}
 # Remove stuff that would conflict with python3 package
 rm %{buildroot}%{_bindir}/python3
 rm %{buildroot}%{_bindir}/pydoc3
@@ -1459,11 +1700,15 @@ CheckPython optimized
 %doc README.rst
 
 %if %{without flatpackage}
+%if %{with main_python}
 %{_bindir}/pydoc*
 %{_bindir}/python3
 %{_bindir}/pyvenv
 %{_mandir}/*/*
-%{_bindir}/pyvenv
+%else
+%{_bindir}/pydoc%{pybasever}
+%{_mandir}/*/python%{pybasever}*
+%endif
 %else
 %{_bindir}/pydoc%{pybasever}
 %{_mandir}/*/python%{pybasever}*
@@ -1608,6 +1853,10 @@ CheckPython optimized
 %dir %{pylibdir}/site-packages/
 %dir %{pylibdir}/site-packages/__pycache__/
 %{pylibdir}/site-packages/README.txt
+
+%exclude %{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py
+%exclude %{pylibdir}/__pycache__/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}%{bytecode_suffixes}
+
 %{pylibdir}/*.py
 %dir %{pylibdir}/__pycache__/
 %{pylibdir}/__pycache__/*%{bytecode_suffixes}
@@ -1691,27 +1940,29 @@ CheckPython optimized
 %{_includedir}/python%{LDVERSION_optimized}/%{_pyconfig_h}
 
 %{_libdir}/%{py_INSTSONAME_optimized}
-%if %{without flatpackage}
+%if %{with main_python}
 %{_libdir}/libpython3.so
 %endif
 
 %if %{without flatpackage}
 %files devel
+%if %{with main_python}
 %{_bindir}/2to3
 # TODO: Remove 2to3-3.7 once rebased to 3.7
 %{_bindir}/2to3-%{pybasever}
 %endif
+%endif
 
 %{pylibdir}/config-%{LDVERSION_optimized}-%{platform_triplet}/*
 %if %{without flatpackage}
 %exclude %{pylibdir}/config-%{LDVERSION_optimized}-%{platform_triplet}/Makefile
 %exclude %{_includedir}/python%{LDVERSION_optimized}/%{_pyconfig_h}
 %endif
-%{pylibdir}/distutils/command/wininst-*.exe
+%exclude %{pylibdir}/distutils/command/wininst-*.exe
 %{_includedir}/python%{LDVERSION_optimized}/*.h
 %doc Misc/README.valgrind Misc/valgrind-python.supp Misc/gdbinit
 
-%if %{without flatpackage}
+%if %{with main_python}
 %{_bindir}/python3-config
 %{_libdir}/pkgconfig/python3.pc
 %{_bindir}/pathfix.py
@@ -1739,7 +1990,7 @@ CheckPython optimized
 
 %{pylibdir}/idlelib
 
-%if %{without flatpackage}
+%if %{with main_python}
 %{_metainfodir}/idle3.appdata.xml
 %{_datadir}/applications/idle3.desktop
 %{_datadir}/icons/hicolor/*/apps/idle3.*
@@ -1787,8 +2038,10 @@ CheckPython optimized
 %if %{with debug_build}
 %if %{without flatpackage}
 %files debug
+%if %{with main_python}
 %{_bindir}/python3-debug
 %endif
+%endif
 
 # Analog of the core subpackage's files:
 %{_bindir}/python%{LDVERSION_debug}
@@ -1861,6 +2114,9 @@ CheckPython optimized
 %{dynload_dir}/unicodedata.%{SOABI_debug}.so
 %{dynload_dir}/zlib.%{SOABI_debug}.so
 
+%{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py
+%{pylibdir}/__pycache__/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}%{bytecode_suffixes}
+
 # No need to split things out the "Makefile" and the config-32/64.h file as we
 # do for the regular build above (bug 531901), since they're all in one package
 # now; they're listed below, under "-devel":
@@ -1912,6 +2168,95 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Nov 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.6.15-50
+- On Fedora 44+, split this package into multiple subpackages
+- This mimics newer Python versions
+
+* Mon Aug 11 2025 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-49
+- Security fix for CVE-2025-8194
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-48
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Thu Jun 26 2025 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-47
+- Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
+
+* Wed Apr 23 2025 Miro Hrončok <mhroncok@redhat.com> - 3.6.15-46
+- Add RPM Provides for python3.6-libs, python3.6-devel, python3.6-idle, python3.6-tkinter, python3.6-test
+
+* Wed Apr 16 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-45
+- Fix the flakiness of test_ftplib
+
+* Tue Apr 01 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-44
+- Properly apply exported CFLAGS for dtrace/systemtap builds
+- Fixes: rhbz#2356306
+
+* Fri Feb 14 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-43
+- Security fix CVE-2025-0938
+- Fixes: rhbz#2343277
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.6.15-42
+- Add explicit BR: libxcrypt-devel
+
+* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-41
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Dec 18 2024 Victor Stinner <vstinner@python.org> - 3.6.15-40
+- Fix compatibility with glibc 2.41 (resolve sinpi name clash).
+
+* Thu Nov 14 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-39
+- Security fix for CVE-2024-11168
+
+* Mon Nov 04 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-38
+- Security fix for CVE-2024-9287 (rhbz#2321659)
+
+* Thu Sep 05 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-37
+- Security fix for CVE-2024-6232 (rhbz#2310092)
+
+* Wed Sep 04 2024 Miroslav Suchý <msuchy@redhat.com> - 3.6.15-36
+- convert license to SPDX
+
+* Fri Aug 16 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.6.15-35
+- Security fix for CVE-2024-6923 (rhbz#2303161)
+
+* Thu Aug 01 2024 Miro Hrončok <mhroncok@redhat.com> - 3.6.15-34
+- Security fix for CVE-2024-6345 (in bundled setuptools wheel)
+
+* Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-33
+- Require systemtap-sdt-devel for sys/sdt.h
+
+* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-32
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 02 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-31
+- Security fix for CVE-2024-4032 (rhbz#2293394)
+
+* Wed Apr 24 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-30
+- Security fix for CVE-2024-0450 and CVE-2023-6597
+
+* Mon Mar 11 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-29
+- Support OpenSSL 3
+- Fixes: rhbz#2254550
+
+* Thu Mar 07 2024 Miro Hrončok <mhroncok@redhat.com> - 3.6.15-28
+- Fix build on riscv64
+
+* Thu Feb 29 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-27
+- Security fix for CVE-2007-4559
+- Fixes: rhbz#2141080
+
+* Wed Feb 28 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-26
+- Fix tests for XMLPullParser with Expat 2.6.0
+
+* Mon Jan 29 2024 Karolina Surma <ksurma@redhat.com> - 3.6.15-25
+- Fix test_zlib when building with zlib-ng-compat
+
+* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-23
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Mon Dec 18 2023 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-22
 - Security fix for CVE-2023-27043 (rhbz#2196191)
 

setuptools-CVE-2024-6345.patch

@@ -0,0 +1,83 @@
+From 8af1b3e03edc8a38565558aff3bf1689c1ca3545 Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Fri, 26 Jul 2024 13:49:11 +0200
+Subject: [PATCH] CVE-2024-6345
+
+---
+ setuptools/package_index.py | 23 +++++++++--------------
+ 1 file changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/setuptools/package_index.py b/setuptools/package_index.py
+index bdcf4a6..1d3e5b4 100755
+--- a/setuptools/package_index.py
++++ b/setuptools/package_index.py
+@@ -1,4 +1,5 @@
+ """PyPI and direct package downloading"""
++import subprocess
+ import sys
+ import os
+ import re
+@@ -848,7 +849,7 @@ class PackageIndex(Environment):
+ 
+     def _download_svn(self, url, filename):
+         url = url.split('#', 1)[0]  # remove any fragment for svn's sake
+-        creds = ''
++        creds = []
+         if url.lower().startswith('svn:') and '@' in url:
+             scheme, netloc, path, p, q, f = urllib.parse.urlparse(url)
+             if not netloc and path.startswith('//') and '/' in path[2:]:
+@@ -857,14 +858,14 @@ class PackageIndex(Environment):
+                 if auth:
+                     if ':' in auth:
+                         user, pw = auth.split(':', 1)
+-                        creds = " --username=%s --password=%s" % (user, pw)
++                        creds = ["--username=" + user, "--password=" + pw]
+                     else:
+-                        creds = " --username=" + auth
++                        creds = ["--username=" + auth]
+                     netloc = host
+                     parts = scheme, netloc, url, p, q, f
+                     url = urllib.parse.urlunparse(parts)
+         self.info("Doing subversion checkout from %s to %s", url, filename)
+-        os.system("svn checkout%s -q %s %s" % (creds, url, filename))
++        subprocess.check_call(["svn", "checkout"] + creds + ["-q", url, filename])
+         return filename
+ 
+     @staticmethod
+@@ -890,14 +891,11 @@ class PackageIndex(Environment):
+         url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True)
+ 
+         self.info("Doing git clone from %s to %s", url, filename)
+-        os.system("git clone --quiet %s %s" % (url, filename))
++        subprocess.check_call(["git", "clone", "--quiet", url, filename])
+ 
+         if rev is not None:
+             self.info("Checking out %s", rev)
+-            os.system("(cd %s && git checkout --quiet %s)" % (
+-                filename,
+-                rev,
+-            ))
++            subprocess.check_call(["git", "-C", filename, "checkout", "--quiet", rev])
+ 
+         return filename
+ 
+@@ -906,14 +904,11 @@ class PackageIndex(Environment):
+         url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True)
+ 
+         self.info("Doing hg clone from %s to %s", url, filename)
+-        os.system("hg clone --quiet %s %s" % (url, filename))
++        subprocess.check_call(["hg", "clone", "--quiet", url, filename])
+ 
+         if rev is not None:
+             self.info("Updating to %s", rev)
+-            os.system("(cd %s && hg up -C -r %s -q)" % (
+-                filename,
+-                rev,
+-            ))
++            subprocess.check_call(["hg", "--cwd", filename, "up", "-C", "-r", rev, "-q"])
+ 
+         return filename
+ 
+-- 
+2.45.2
+

tests/tests.yml

@@ -1,22 +0,0 @@
----
-- hosts: localhost
-  roles:
-  - role: standard-test-basic
-    tags:
-    - classic
-    repositories:
-    - repo: "https://src.fedoraproject.org/tests/python.git"
-      dest: "python"
-    tests:
-    - smoke:
-        dir: python/smoke
-        run: VERSION=3.6 ./venv.sh
-    - marshalparser:
-        dir: python/marshalparser
-        run: VERSION=3.6 SAMPLE=10 test_marshalparser_compatibility.sh
-    required_packages:
-    - gcc
-    - python3-tox
-    - python3.6
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser