Security fix for CVE-2024-6232 (rhbz#2310092)

Security fix for CVE-2024-6923 (rhbz#2303161)
Security fix for CVE-2024-6345 (in bundled setuptools wheel)
2024-09-05 22:27:43 +02:00 · 2024-08-16 16:29:30 +02:00 · 2024-08-02 18:39:05 +02:00 · 2024-08-02 18:37:33 +02:00 · 2024-07-03 23:08:45 +02:00 · 2024-05-22 16:04:44 +02:00
51 changed files with 123 additions and 19306 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/00001-rpath.patch
+++ b/00001-rpath.patch
@ -1,10 +1,9 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Wed, 13 Jan 2010 21:25:18 +0000
-Subject: 00001: Fixup distutils/unixccompiler.py to remove standard library
- path from rpath
+Subject: [PATCH] 00001: Fixup distutils/unixccompiler.py to remove standard
+ library path from rpath Was Patch0 in ivazquez' python3000 specfile

-Was Patch0 in ivazquez' python3000 specfile
 ---
 Lib/distutils/unixccompiler.py | 9 +++++++++
 1 file changed, 9 insertions(+)
--- a/00102-lib64.patch
+++ b/00102-lib64.patch
@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Wed, 13 Jan 2010 21:25:18 +0000
-Subject: 00102: Change the various install paths to use /usr/lib64/ instead or
- /usr/lib/
+Subject: [PATCH] 00102: Change the various install paths to use /usr/lib64/
+ instead or /usr/lib/
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
--- a/00111-no-static-lib.patch
+++ b/00111-no-static-lib.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Mon, 18 Jan 2010 17:59:07 +0000
-Subject: 00111: Don't try to build a libpythonMAJOR.MINOR.a
+Subject: [PATCH] 00111: Don't try to build a libpythonMAJOR.MINOR.a
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
--- a/00132-add-rpmbuild-hooks-to-unittest.patch
+++ b/00132-add-rpmbuild-hooks-to-unittest.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:54:05 +0200
-Subject: 00132: Add rpmbuild hooks to unittest
+Subject: [PATCH] 00132: Add rpmbuild hooks to unittest

 Add non-standard hooks to unittest for use in the "check" phase, when
 running selftests within the build:
--- a/00155-avoid-ctypes-thunks.patch
+++ b/00155-avoid-ctypes-thunks.patch
@ -1,7 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:02:24 +0200
-Subject: 00155: avoid allocating thunks in ctypes unless absolutely necessary
+Subject: [PATCH] 00155: avoid allocating thunks in ctypes unless absolutely
+ necessary

 Avoid allocating thunks in ctypes unless absolutely necessary, to avoid
 generating SELinux denials on "import ctypes" and "import uuid" when
--- a/00160-disable-test_fs_holes-in-rpm-build.patch
+++ b/00160-disable-test_fs_holes-in-rpm-build.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:57:09 +0200
-Subject: 00160: Disable test_fs_holes in RPM build
+Subject: [PATCH] 00160: Disable test_fs_holes in RPM build

 Python 3.3 added os.SEEK_DATA and os.SEEK_HOLE, which may be present in the
 header files in the build chroot, but may not be supported in the running
--- a/00163-disable-parts-of-test_socket-in-rpm-build.patch
+++ b/00163-disable-parts-of-test_socket-in-rpm-build.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:58:24 +0200
-Subject: 00163: Disable parts of test_socket in RPM build
+Subject: [PATCH] 00163: Disable parts of test_socket in RPM build

 Some tests within test_socket fail intermittently when run inside Koji;
 disable them using unittest._skipInRpmBuild
--- a/00170-gc-assertions.patch
+++ b/00170-gc-assertions.patch
@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: David Malcolm <dmalcolm@redhat.com>
 Date: Fri, 19 Jun 2020 16:05:07 +0200
-Subject: 00170: In debug builds, try to print repr() when a C-level assert
- fails
+Subject: [PATCH] 00170: In debug builds, try to print repr() when a C-level
+ assert fails

 In debug builds, try to print repr() when a C-level assert fails in the
 garbage collector (typically indicating a reference-counting error
--- a/00189-use-rpm-wheels.patch
+++ b/00189-use-rpm-wheels.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
 Date: Wed, 15 Aug 2018 15:36:29 +0200
-Subject: 00189: Instead of bundled wheels, use our RPM packaged wheels
+Subject: [PATCH] 00189: Instead of bundled wheels, use our RPM packaged wheels

 We keep them in /usr/share/python-wheels
 ---
--- a/00251-change-user-install-location.patch
+++ b/00251-change-user-install-location.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Michal Cyprian <m.cyprian@gmail.com>
 Date: Mon, 26 Jun 2017 16:32:56 +0200
-Subject: 00251: Change user install location
+Subject: [PATCH] 00251: Change user install location

 Set values of prefix and exec_prefix in distutils install command
 to /usr/local if executable is /usr/bin/python* and RPM build
--- a/00262-pep538_coerce_legacy_c_locale.patch
+++ b/00262-pep538_coerce_legacy_c_locale.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nick Coghlan <ncoghlan@redhat.com>
 Date: Fri, 19 Jun 2020 17:02:52 +0200
-Subject: 00262: PEP538 - Coerce legacy C locale
+Subject: [PATCH] 00262: PEP538 - Coerce legacy C locale
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
--- a/00292-restore-PyExc_RecursionErrorInst-symbol.patch
+++ b/00292-restore-PyExc_RecursionErrorInst-symbol.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Fri, 19 Jun 2020 17:06:08 +0200
-Subject: 00292: Restore PyExc_RecursionErrorInst symbol
+Subject: [PATCH] 00292: Restore PyExc_RecursionErrorInst symbol

 Restore the public PyExc_RecursionErrorInst symbol that was removed
 from the 3.6.4 release upstream.
--- a/00294-define-TLS-cipher-suite-on-build-time.patch
+++ b/00294-define-TLS-cipher-suite-on-build-time.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Christian Heimes <christian@python.org>
 Date: Fri, 19 Jun 2020 17:13:03 +0200
-Subject: 00294: Define TLS cipher suite on build time
+Subject: [PATCH] 00294: Define TLS cipher suite on build time

 Define TLS cipher suite on build time depending
 on the OpenSSL default cipher suite selection.
--- a/00319-test_tarfile_ppc64.patch
+++ b/00319-test_tarfile_ppc64.patch
@ -2,7 +2,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
 Date: Mon, 21 Jan 2019 01:44:30 -0800
-Subject: 00319: test_tarfile_ppc64
+Subject: [PATCH] 00319: test_tarfile_ppc64

 Fix sparse file tests of test_tarfile on ppc64le with the tmpfs
 filesystem.
--- a/00343-faulthandler-gcc10.patch
+++ b/00343-faulthandler-gcc10.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@python.org>
 Date: Fri, 19 Jun 2020 17:16:05 +0200
-Subject: 00343: Fix test_faulthandler on GCC 10
+Subject: [PATCH] 00343: Fix test_faulthandler on GCC 10

 bpo-21131: Fix faulthandler.register(chain=True) stack (GH-15276)
 https://bugs.python.org/issue21131
--- a/00353-architecture-names-upstream-downstream.patch
+++ b/00353-architecture-names-upstream-downstream.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Lumir Balhar <lbalhar@redhat.com>
 Date: Tue, 4 Aug 2020 12:04:03 +0200
-Subject: 00353: Original names for architectures with different names
+Subject: [PATCH] 00353: Original names for architectures with different names
 downstream
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
--- a/00358-align-allocations-and-pygc_head-to-16-bytes-on-64-bit-platforms.patch
+++ b/00358-align-allocations-and-pygc_head-to-16-bytes-on-64-bit-platforms.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Inada Naoki <songofacandy@gmail.com>
 Date: Mon, 3 Jun 2019 10:51:32 +0900
-Subject: 00358: align allocations and PyGC_Head to 16 bytes on 64-bit
+Subject: [PATCH] 00358: align allocations and PyGC_Head to 16 bytes on 64-bit
 platforms

 Upstream bug: https://bugs.python.org/issue27987
--- a/00361-openssl-3-compatibility.patch
+++ b/00361-openssl-3-compatibility.patch
--- a/00375-fix-test_distance-to-enable-build-on-i686.patch
+++ b/00375-fix-test_distance-to-enable-build-on-i686.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Karolina Surma <ksurma@redhat.com>
 Date: Mon, 24 Jan 2022 09:28:30 +0100
-Subject: 00375: Fix test_distance to enable build on i686
+Subject: [PATCH] 00375: Fix test_distance to enable build on i686

 Fix precision in test_distance (test.test_turtle.TestVec2D).
 See: https://bugzilla.redhat.com/show_bug.cgi?id=2038843
--- a/00378-support-expat-2-4-5.patch
+++ b/00378-support-expat-2-4-5.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Sebastian Pipping <sebastian@pipping.org>
 Date: Mon, 21 Feb 2022 15:48:32 +0100
-Subject: 00378: Support expat 2.4.5
+Subject: [PATCH] 00378: Support expat 2.4.5

 Curly brackets were never allowed in namespace URIs
 according to RFC 3986, and so-called namespace-validating
--- a/00382-cve-2015-20107.patch
+++ b/00382-cve-2015-20107.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <encukou@gmail.com>
 Date: Fri, 3 Jun 2022 11:43:35 +0200
-Subject: 00382: CVE-2015-20107
+Subject: [PATCH] 00382: CVE-2015-20107

 Make mailcap refuse to match unsafe filenames/types/params (GH-91993)

--- a/00386-cve-2021-28861.patch
+++ b/00386-cve-2021-28861.patch
@ -2,7 +2,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
 Date: Wed, 22 Jun 2022 15:05:00 -0700
-Subject: 00386: CVE-2021-28861
+Subject: [PATCH] 00386: CVE-2021-28861

 Fix an open redirection vulnerability in the `http.server` module when
 an URI path starts with `//` that could produce a 301 Location header
--- a/00387-cve-2020-10735-prevent-dos-by-very-large-int.patch
+++ b/00387-cve-2020-10735-prevent-dos-by-very-large-int.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@python.org>
 Date: Thu, 15 Sep 2022 17:35:24 +0200
-Subject: 00387: CVE-2020-10735: Prevent DoS by very large int()
+Subject: [PATCH] 00387: CVE-2020-10735: Prevent DoS by very large int()

 gh-95778: CVE-2020-10735: Prevent DoS by very large int() (GH-96504)

--- a/00392-cve-2022-37454-fix-buffer-overflows-in-_sha3-module.patch
+++ b/00392-cve-2022-37454-fix-buffer-overflows-in-_sha3-module.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Theo Buehler <botovq@users.noreply.github.com>
 Date: Fri, 21 Oct 2022 20:37:54 -0700
-Subject: 00392: CVE-2022-37454: Fix buffer overflows in _sha3 module
+Subject: [PATCH] 00392: CVE-2022-37454: Fix buffer overflows in _sha3 module

 This is a port of the applicable part of XKCP's fix [1] for
 CVE-2022-37454 and avoids the segmentation fault and the infinite
--- a/00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decoder.patch
+++ b/00394-cve-2022-45061-cpu-denial-of-service-via-inefficient-idna-decoder.patch
@ -2,8 +2,8 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
 Date: Mon, 7 Nov 2022 19:22:14 -0800
-Subject: 00394: CVE-2022-45061: CPU denial of service via inefficient IDNA
- decoder
+Subject: [PATCH] 00394: CVE-2022-45061: CPU denial of service via inefficient
+ IDNA decoder

 gh-98433: Fix quadratic time idna decoding.

--- a/00397-pep-706-cve-2007-4559-filter-api-for-tarfile-extractall.patch
+++ b/00397-pep-706-cve-2007-4559-filter-api-for-tarfile-extractall.patch
@ -1,7 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <encukou@gmail.com>
 Date: Wed, 7 Jun 2023 14:53:48 +0200
-Subject: 00397: PEP 706, CVE-2007-4559: Filter API for tarfile.extractall
+Subject: [PATCH] 00397: PEP 706, CVE-2007-4559: Filter API for
+ tarfile.extractall

 Add API for allowing checks on the content of tar files, allowing callers to mitigate
 directory traversal (CVE-2007-4559) and related issues.
--- a/00399-cve-2023-24329.patch
+++ b/00399-cve-2023-24329.patch
@ -2,7 +2,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
 Date: Mon, 22 May 2023 03:42:37 -0700
-Subject: 00399: CVE-2023-24329
+Subject: [PATCH] 00399: CVE-2023-24329

 gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-102508)

--- a/00407-gh-99086-fix-implicit-int-compiler-warning-in-configure-check-for-pthread_scope_system.patch
+++ b/00407-gh-99086-fix-implicit-int-compiler-warning-in-configure-check-for-pthread_scope_system.patch
@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Erlend E. Aasland" <erlend.aasland@protonmail.com>
 Date: Sun, 6 Nov 2022 22:39:34 +0100
-Subject: 00407: gh-99086: Fix implicit int compiler warning in configure check
- for PTHREAD_SCOPE_SYSTEM
+Subject: [PATCH] 00407: gh-99086: Fix implicit int compiler warning in
+ configure check for PTHREAD_SCOPE_SYSTEM

 Co-authored-by: Sam James <sam@cmpct.info>
 ---
--- a/00409-bpo-13497-fix-broken-nice-configure-test.patch
+++ b/00409-bpo-13497-fix-broken-nice-configure-test.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: ngie-eign <1574099+ngie-eign@users.noreply.github.com>
 Date: Mon, 25 Feb 2019 21:34:24 -0800
-Subject: 00409: bpo-13497: Fix `broken nice` configure test
+Subject: [PATCH] 00409: bpo-13497: Fix `broken nice` configure test

 Per POSIX, `nice(3)` requires `unistd.h` and `exit(3)` requires `stdlib.h`.

--- a/00410-bpo-42598-fix-implicit-function-declarations-in-configure.patch
+++ b/00410-bpo-42598-fix-implicit-function-declarations-in-configure.patch
@ -1,7 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Joshua Root <jmr@macports.org>
 Date: Mon, 14 Dec 2020 07:56:34 +1100
-Subject: 00410: bpo-42598: Fix implicit function declarations in configure
+Subject: [PATCH] 00410: bpo-42598: Fix implicit function declarations in
+ configure

 This is invalid in C99 and later and is an error with some compilers
 (e.g. clang in Xcode 12), and can thus cause configure checks to
--- a/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+++ b/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@python.org>
 Date: Fri, 15 Dec 2023 16:10:40 +0100
-Subject: 00415: [CVE-2023-27043] gh-102988: Reject malformed addresses in
- email.parseaddr() (#111116)
+Subject: [PATCH] 00415: [CVE-2023-27043] gh-102988: Reject malformed addresses
+ in email.parseaddr() (#111116)

 Detect email address parsing errors and return empty tuple to
 indicate the parsing error (old API). Add an optional 'strict'
--- a/00419-gh-112769-test_zlib-fix-comparison-of-zlib_runtime_version-with-non-int-suffix-gh-112771-gh-112774.patch
+++ b/00419-gh-112769-test_zlib-fix-comparison-of-zlib_runtime_version-with-non-int-suffix-gh-112771-gh-112774.patch
@ -1,66 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
-Date: Tue, 5 Dec 2023 21:02:06 +0100
-Subject: 00419: gh-112769: test_zlib: Fix comparison of ZLIB_RUNTIME_VERSION
- with non-int suffix (GH-112771) (GH-112774)
-
-zlib-ng defines the version as "1.3.0.zlib-ng".
-(cherry picked from commit d384813ff18b33280a90b6d2011654528a2b6ad1)
---
- Lib/test/test_zlib.py | 28 ++++++++++++++++------------
- 1 file changed, 16 insertions(+), 12 deletions(-)
-
-diff --git a/Lib/test/test_zlib.py b/Lib/test/test_zlib.py
-index b7170b4ff5..93615e1e1e 100644
--- a/Lib/test/test_zlib.py
-+++ b/Lib/test/test_zlib.py
-@@ -16,6 +16,20 @@ requires_Decompress_copy = unittest.skipUnless(
-         'requires Decompress.copy()')
- 
- 
-+def _zlib_runtime_version_tuple(zlib_version=zlib.ZLIB_RUNTIME_VERSION):
-+    # Register "1.2.3" as "1.2.3.0"
-+    # or "1.2.0-linux","1.2.0.f","1.2.0.f-linux"
-+    v = zlib_version.split('-', 1)[0].split('.')
-+    if len(v) < 4:
-+        v.append('0')
-+    elif not v[-1].isnumeric():
-+        v[-1] = '0'
-+    return tuple(map(int, v))
-+
-+
-+ZLIB_RUNTIME_VERSION_TUPLE = _zlib_runtime_version_tuple()
-+
-+
- class VersionTestCase(unittest.TestCase):
- 
-     def test_library_version(self):
-@@ -437,9 +451,8 @@ class CompressObjectTestCase(BaseCompressTestCase, unittest.TestCase):
-         sync_opt = ['Z_NO_FLUSH', 'Z_SYNC_FLUSH', 'Z_FULL_FLUSH',
-                     'Z_PARTIAL_FLUSH']
- 
-        ver = tuple(int(v) for v in zlib.ZLIB_RUNTIME_VERSION.split('.'))
-         # Z_BLOCK has a known failure prior to 1.2.5.3
-        if ver >= (1, 2, 5, 3):
-+        if ZLIB_RUNTIME_VERSION_TUPLE >= (1, 2, 5, 3):
-             sync_opt.append('Z_BLOCK')
- 
-         sync_opt = [getattr(zlib, opt) for opt in sync_opt
-@@ -762,16 +775,7 @@ class CompressObjectTestCase(BaseCompressTestCase, unittest.TestCase):
- 
-     def test_wbits(self):
-         # wbits=0 only supported since zlib v1.2.3.5
-        # Register "1.2.3" as "1.2.3.0"
-        # or "1.2.0-linux","1.2.0.f","1.2.0.f-linux"
-        v = zlib.ZLIB_RUNTIME_VERSION.split('-', 1)[0].split('.')
-        if len(v) < 4:
-            v.append('0')
-        elif not v[-1].isnumeric():
-            v[-1] = '0'
-
-        v = tuple(map(int, v))
-        supports_wbits_0 = v >= (1, 2, 3, 5)
-+        supports_wbits_0 = ZLIB_RUNTIME_VERSION_TUPLE >= (1, 2, 3, 5)
- 
-         co = zlib.compressobj(level=1, wbits=15)
-         zlib15 = co.compress(HAMLET_SCENE) + co.flush()
--- a/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
+++ b/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
@ -1,7 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Serhiy Storchaka <storchaka@gmail.com>
 Date: Sun, 11 Feb 2024 12:08:39 +0200
-Subject: 00422: gh-115133: Fix tests for XMLPullParser with Expat 2.6.0
+Subject: [PATCH] 00422: gh-115133: Fix tests for XMLPullParser with Expat
+ 2.6.0

 Feeding the parser by too small chunks defers parsing to prevent
 CVE-2023-52425. Future versions of Expat may be more reactive.
--- a/00423-bpo-33377-add-triplets-for-mips-r6-and-riscv.patch
+++ b/00423-bpo-33377-add-triplets-for-mips-r6-and-riscv.patch
@ -1,161 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Matthias Klose <doko42@users.noreply.github.com>
-Date: Mon, 30 Apr 2018 19:22:16 +0200
-Subject: 00423: bpo-33377: Add triplets for mips-r6 and riscv
-
---
- .../2018-04-30-16-53-00.bpo-33377.QBh6vP.rst  |  2 +
- configure                                     | 42 ++++++++++++++++++-
- configure.ac                                  | 28 +++++++++++++
- 3 files changed, 71 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Build/2018-04-30-16-53-00.bpo-33377.QBh6vP.rst
-
-diff --git a/Misc/NEWS.d/next/Build/2018-04-30-16-53-00.bpo-33377.QBh6vP.rst b/Misc/NEWS.d/next/Build/2018-04-30-16-53-00.bpo-33377.QBh6vP.rst
-new file mode 100644
-index 0000000000..f5dbd23c7c
--- /dev/null
-+++ b/Misc/NEWS.d/next/Build/2018-04-30-16-53-00.bpo-33377.QBh6vP.rst
-@@ -0,0 +1,2 @@
-+Add new triplets for mips r6 and riscv variants (used in extension
-+suffixes).
-diff --git a/configure b/configure
-index 68a46deef5..6ea6e7d742 100755
--- a/configure
-+++ b/configure
-@@ -785,6 +785,7 @@ infodir
- docdir
- oldincludedir
- includedir
-+runstatedir
- localstatedir
- sharedstatedir
- sysconfdir
-@@ -898,6 +899,7 @@ datadir='${datarootdir}'
- sysconfdir='${prefix}/etc'
- sharedstatedir='${prefix}/com'
- localstatedir='${prefix}/var'
-+runstatedir='${localstatedir}/run'
- includedir='${prefix}/include'
- oldincludedir='/usr/include'
- docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
-@@ -1150,6 +1152,15 @@ do
-   | -silent | --silent | --silen | --sile | --sil)
-     silent=yes ;;
- 
-+  -runstatedir | --runstatedir | --runstatedi | --runstated \
-+  | --runstate | --runstat | --runsta | --runst | --runs \
-+  | --run | --ru | --r)
-+    ac_prev=runstatedir ;;
-+  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-+  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-+  | --run=* | --ru=* | --r=*)
-+    runstatedir=$ac_optarg ;;
-+
-   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
-     ac_prev=sbindir ;;
-   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
-@@ -1287,7 +1298,7 @@ fi
- for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
- 		datadir sysconfdir sharedstatedir localstatedir includedir \
- 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir
-+		libdir localedir mandir runstatedir
- do
-   eval ac_val=\$$ac_var
-   # Remove trailing slashes.
-@@ -1440,6 +1451,7 @@ Fine tuning of the installation directories:
-   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
-   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
-   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-+  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
-   --libdir=DIR            object code libraries [EPREFIX/lib]
-   --includedir=DIR        C header files [PREFIX/include]
-   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
-@@ -5261,6 +5273,26 @@ cat >> conftest.c <<EOF
-         ia64-linux-gnu
- # elif defined(__m68k__) && !defined(__mcoldfire__)
-         m68k-linux-gnu
-+# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6) && defined(_MIPSEL)
-+#  if _MIPS_SIM == _ABIO32
-+        mipsisa32r6el-linux-gnu
-+#  elif _MIPS_SIM == _ABIN32
-+        mipsisa64r6el-linux-gnuabin32
-+#  elif _MIPS_SIM == _ABI64
-+        mipsisa64r6el-linux-gnuabi64
-+#  else
-+#   error unknown platform triplet
-+#  endif
-+# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6)
-+#  if _MIPS_SIM == _ABIO32
-+        mipsisa32r6-linux-gnu
-+#  elif _MIPS_SIM == _ABIN32
-+        mipsisa64r6-linux-gnuabin32
-+#  elif _MIPS_SIM == _ABI64
-+        mipsisa64r6-linux-gnuabi64
-+#  else
-+#   error unknown platform triplet
-+#  endif
- # elif defined(__mips_hard_float) && defined(_MIPSEL)
- #  if _MIPS_SIM == _ABIO32
-         mipsel-linux-gnu
-@@ -5303,6 +5335,14 @@ cat >> conftest.c <<EOF
-         sparc64-linux-gnu
- # elif defined(__sparc__)
-         sparc-linux-gnu
-+# elif defined(__riscv)
-+#  if __riscv_xlen == 32
-+        riscv32-linux-gnu
-+#  elif __riscv_xlen == 64
-+        riscv64-linux-gnu
-+#  else
-+#   error unknown platform triplet
-+#  endif
- # else
- #   error unknown platform triplet
- # endif
-diff --git a/configure.ac b/configure.ac
-index 9d2ad9afba..046aed9d7c 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -804,6 +804,26 @@ cat >> conftest.c <<EOF
-         ia64-linux-gnu
- # elif defined(__m68k__) && !defined(__mcoldfire__)
-         m68k-linux-gnu
-+# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6) && defined(_MIPSEL)
-+#  if _MIPS_SIM == _ABIO32
-+        mipsisa32r6el-linux-gnu
-+#  elif _MIPS_SIM == _ABIN32
-+        mipsisa64r6el-linux-gnuabin32
-+#  elif _MIPS_SIM == _ABI64
-+        mipsisa64r6el-linux-gnuabi64
-+#  else
-+#   error unknown platform triplet
-+#  endif
-+# elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6)
-+#  if _MIPS_SIM == _ABIO32
-+        mipsisa32r6-linux-gnu
-+#  elif _MIPS_SIM == _ABIN32
-+        mipsisa64r6-linux-gnuabin32
-+#  elif _MIPS_SIM == _ABI64
-+        mipsisa64r6-linux-gnuabi64
-+#  else
-+#   error unknown platform triplet
-+#  endif
- # elif defined(__mips_hard_float) && defined(_MIPSEL)
- #  if _MIPS_SIM == _ABIO32
-         mipsel-linux-gnu
-@@ -846,6 +866,14 @@ cat >> conftest.c <<EOF
-         sparc64-linux-gnu
- # elif defined(__sparc__)
-         sparc-linux-gnu
-+# elif defined(__riscv)
-+#  if __riscv_xlen == 32
-+        riscv32-linux-gnu
-+#  elif __riscv_xlen == 64
-+        riscv64-linux-gnu
-+#  else
-+#   error unknown platform triplet
-+#  endif
- # else
- #   error unknown platform triplet
- # endif
--- a/00426-cve-2023-6597.patch
+++ b/00426-cve-2023-6597.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Lumir Balhar <lbalhar@redhat.com>
 Date: Wed, 24 Apr 2024 00:19:23 +0200
-Subject: 00426: CVE-2023-6597
+Subject: [PATCH] 00426: CVE-2023-6597
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
--- a/00427-zipextfile-tell-and-seek-cve-2024-0450.patch
+++ b/00427-zipextfile-tell-and-seek-cve-2024-0450.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: John Jolly <john.jolly@gmail.com>
 Date: Tue, 30 Jan 2018 01:51:35 -0700
-Subject: 00427: ZipExtFile tell and seek, CVE-2024-0450
+Subject: [PATCH] 00427: ZipExtFile tell and seek, CVE-2024-0450

 Backport of seek and tell methods for ZipExtFile makes it
 possible to backport the fix for CVE-2024-0450.
--- a/00431-cve-2024-4032.patch
+++ b/00431-cve-2024-4032.patch
@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <encukou@gmail.com>
 Date: Tue, 7 May 2024 11:58:20 +0200
-Subject: 00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges
+Subject: [PATCH] 00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

 Upstream issue: https://github.com/python/cpython/issues/113171

--- a/00435-gh-121650-encode-newlines-in-headers-and-verify.patch
+++ b/00435-gh-121650-encode-newlines-in-headers-and-verify.patch
@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= <thrnciar@redhat.com>
 Date: Fri, 16 Aug 2024 14:12:58 +0200
-Subject: 00435: gh-121650: Encode newlines in headers, and verify headers are
- sound (GH-122233)
+Subject: [PATCH] 00435: gh-121650: Encode newlines in headers, and verify 
+ headers are sound (GH-122233)

 Per RFC 2047:

--- a/00437-cve-2024-6232-remove-backtracking-when-parsing-tarfile-headers.patch
+++ b/00437-cve-2024-6232-remove-backtracking-when-parsing-tarfile-headers.patch
@ -1,7 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Seth Michael Larson <seth@python.org>
 Date: Wed, 4 Sep 2024 10:41:42 -0500
-Subject: 00437: CVE-2024-6232 Remove backtracking when parsing tarfile headers
+Subject: [PATCH] 00437: CVE-2024-6232 Remove backtracking when parsing tarfile
+ headers
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
--- a/00443-gh-124651-quote-template-strings-in-venv-activation-scripts.patch
+++ b/00443-gh-124651-quote-template-strings-in-venv-activation-scripts.patch
@ -1,280 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Victor Stinner <vstinner@python.org>
-Date: Fri, 1 Nov 2024 14:11:47 +0100
-Subject: 00443: gh-124651: Quote template strings in `venv` activation scripts
-
-(cherry picked from 3.9)
---
- Lib/test/test_venv.py                         | 82 +++++++++++++++++++
- Lib/venv/__init__.py                          | 42 ++++++++--
- Lib/venv/scripts/common/activate              |  8 +-
- Lib/venv/scripts/posix/activate.csh           |  8 +-
- Lib/venv/scripts/posix/activate.fish          |  8 +-
- ...-09-28-02-03-04.gh-issue-124651.bLBGtH.rst |  1 +
- 6 files changed, 132 insertions(+), 17 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
-
-diff --git a/Lib/test/test_venv.py b/Lib/test/test_venv.py
-index 842470fef0..67fdcd86bb 100644
--- a/Lib/test/test_venv.py
-+++ b/Lib/test/test_venv.py
-@@ -13,6 +13,8 @@ import struct
- import subprocess
- import sys
- import tempfile
-+import shlex
-+import shutil
- from test.support import (captured_stdout, captured_stderr, requires_zlib,
-                           can_symlink, EnvironmentVarGuard, rmtree)
- import unittest
-@@ -80,6 +82,10 @@ class BaseTest(unittest.TestCase):
-             result = f.read()
-         return result
- 
-+    def assertEndsWith(self, string, tail):
-+        if not string.endswith(tail):
-+            self.fail(f"String {string!r} does not end with {tail!r}")
-+
- class BasicTest(BaseTest):
-     """Test venv module functionality."""
- 
-@@ -293,6 +299,82 @@ class BasicTest(BaseTest):
-             'import sys; print(sys.executable)'])
-         self.assertEqual(out.strip(), envpy.encode())
- 
-+    # gh-124651: test quoted strings
-+    @unittest.skipIf(os.name == 'nt', 'contains invalid characters on Windows')
-+    def test_special_chars_bash(self):
-+        """
-+        Test that the template strings are quoted properly (bash)
-+        """
-+        rmtree(self.env_dir)
-+        bash = shutil.which('bash')
-+        if bash is None:
-+            self.skipTest('bash required for this test')
-+        env_name = '"\';&&$e|\'"'
-+        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
-+        builder = venv.EnvBuilder(clear=True)
-+        builder.create(env_dir)
-+        activate = os.path.join(env_dir, self.bindir, 'activate')
-+        test_script = os.path.join(self.env_dir, 'test_special_chars.sh')
-+        with open(test_script, "w") as f:
-+            f.write(f'source {shlex.quote(activate)}\n'
-+                    'python -c \'import sys; print(sys.executable)\'\n'
-+                    'python -c \'import os; print(os.environ["VIRTUAL_ENV"])\'\n'
-+                    'deactivate\n')
-+        out, err = check_output([bash, test_script])
-+        lines = out.splitlines()
-+        self.assertTrue(env_name.encode() in lines[0])
-+        self.assertEndsWith(lines[1], env_name.encode())
-+
-+    # gh-124651: test quoted strings
-+    @unittest.skipIf(os.name == 'nt', 'contains invalid characters on Windows')
-+    def test_special_chars_csh(self):
-+        """
-+        Test that the template strings are quoted properly (csh)
-+        """
-+        rmtree(self.env_dir)
-+        csh = shutil.which('tcsh') or shutil.which('csh')
-+        if csh is None:
-+            self.skipTest('csh required for this test')
-+        env_name = '"\';&&$e|\'"'
-+        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
-+        builder = venv.EnvBuilder(clear=True)
-+        builder.create(env_dir)
-+        activate = os.path.join(env_dir, self.bindir, 'activate.csh')
-+        test_script = os.path.join(self.env_dir, 'test_special_chars.csh')
-+        with open(test_script, "w") as f:
-+            f.write(f'source {shlex.quote(activate)}\n'
-+                    'python -c \'import sys; print(sys.executable)\'\n'
-+                    'python -c \'import os; print(os.environ["VIRTUAL_ENV"])\'\n'
-+                    'deactivate\n')
-+        out, err = check_output([csh, test_script])
-+        lines = out.splitlines()
-+        self.assertTrue(env_name.encode() in lines[0])
-+        self.assertEndsWith(lines[1], env_name.encode())
-+
-+    # gh-124651: test quoted strings on Windows
-+    @unittest.skipUnless(os.name == 'nt', 'only relevant on Windows')
-+    def test_special_chars_windows(self):
-+        """
-+        Test that the template strings are quoted properly on Windows
-+        """
-+        rmtree(self.env_dir)
-+        env_name = "'&&^$e"
-+        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
-+        builder = venv.EnvBuilder(clear=True)
-+        builder.create(env_dir)
-+        activate = os.path.join(env_dir, self.bindir, 'activate.bat')
-+        test_batch = os.path.join(self.env_dir, 'test_special_chars.bat')
-+        with open(test_batch, "w") as f:
-+            f.write('@echo off\n'
-+                    f'"{activate}" & '
-+                    f'{self.exe} -c "import sys; print(sys.executable)" & '
-+                    f'{self.exe} -c "import os; print(os.environ[\'VIRTUAL_ENV\'])" & '
-+                    'deactivate')
-+        out, err = check_output([test_batch])
-+        lines = out.splitlines()
-+        self.assertTrue(env_name.encode() in lines[0])
-+        self.assertEndsWith(lines[1], env_name.encode())
-+
-     @unittest.skipUnless(os.name == 'nt', 'only relevant on Windows')
-     def test_unicode_in_batch_file(self):
-         """
-diff --git a/Lib/venv/__init__.py b/Lib/venv/__init__.py
-index 716129d139..0c44dfd07d 100644
--- a/Lib/venv/__init__.py
-+++ b/Lib/venv/__init__.py
-@@ -10,6 +10,7 @@ import shutil
- import subprocess
- import sys
- import types
-+import shlex
- 
- logger = logging.getLogger(__name__)
- 
-@@ -280,11 +281,41 @@ class EnvBuilder:
-         :param context: The information for the environment creation request
-                         being processed.
-         """
-        text = text.replace('__VENV_DIR__', context.env_dir)
-        text = text.replace('__VENV_NAME__', context.env_name)
-        text = text.replace('__VENV_PROMPT__', context.prompt)
-        text = text.replace('__VENV_BIN_NAME__', context.bin_name)
-        text = text.replace('__VENV_PYTHON__', context.env_exe)
-+        replacements = {
-+            '__VENV_DIR__': context.env_dir,
-+            '__VENV_NAME__': context.env_name,
-+            '__VENV_PROMPT__': context.prompt,
-+            '__VENV_BIN_NAME__': context.bin_name,
-+            '__VENV_PYTHON__': context.env_exe,
-+        }
-+
-+        def quote_ps1(s):
-+            """
-+            This should satisfy PowerShell quoting rules [1], unless the quoted
-+            string is passed directly to Windows native commands [2].
-+            [1]: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules
-+            [2]: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_parsing#passing-arguments-that-contain-quote-characters
-+            """
-+            s = s.replace("'", "''")
-+            return f"'{s}'"
-+
-+        def quote_bat(s):
-+            return s
-+
-+        # gh-124651: need to quote the template strings properly
-+        quote = shlex.quote
-+        script_path = context.script_path
-+        if script_path.endswith('.ps1'):
-+            quote = quote_ps1
-+        elif script_path.endswith('.bat'):
-+            quote = quote_bat
-+        else:
-+            # fallbacks to POSIX shell compliant quote
-+            quote = shlex.quote
-+
-+        replacements = {key: quote(s) for key, s in replacements.items()}
-+        for key, quoted in replacements.items():
-+            text = text.replace(key, quoted)
-         return text
- 
-     def install_scripts(self, context, path):
-@@ -321,6 +352,7 @@ class EnvBuilder:
-                 with open(srcfile, 'rb') as f:
-                     data = f.read()
-                 if not srcfile.endswith('.exe'):
-+                    context.script_path = srcfile
-                     try:
-                         data = data.decode('utf-8')
-                         data = self.replace_variables(data, context)
-diff --git a/Lib/venv/scripts/common/activate b/Lib/venv/scripts/common/activate
-index fff0765af5..c2e2f968fa 100644
--- a/Lib/venv/scripts/common/activate
-+++ b/Lib/venv/scripts/common/activate
-@@ -37,11 +37,11 @@ deactivate () {
- # unset irrelevant variables
- deactivate nondestructive
- 
-VIRTUAL_ENV="__VENV_DIR__"
-+VIRTUAL_ENV=__VENV_DIR__
- export VIRTUAL_ENV
- 
- _OLD_VIRTUAL_PATH="$PATH"
-PATH="$VIRTUAL_ENV/__VENV_BIN_NAME__:$PATH"
-+PATH="$VIRTUAL_ENV/"__VENV_BIN_NAME__":$PATH"
- export PATH
- 
- # unset PYTHONHOME if set
-@@ -54,8 +54,8 @@ fi
- 
- if [ -z "${VIRTUAL_ENV_DISABLE_PROMPT:-}" ] ; then
-     _OLD_VIRTUAL_PS1="${PS1:-}"
-    if [ "x__VENV_PROMPT__" != x ] ; then
-	PS1="__VENV_PROMPT__${PS1:-}"
-+    if [ "x"__VENV_PROMPT__ != x ] ; then
-+	PS1=__VENV_PROMPT__"${PS1:-}"
-     else
-     if [ "`basename \"$VIRTUAL_ENV\"`" = "__" ] ; then
-         # special case for Aspen magic directories
-diff --git a/Lib/venv/scripts/posix/activate.csh b/Lib/venv/scripts/posix/activate.csh
-index b0c7028a92..0e90d54008 100644
--- a/Lib/venv/scripts/posix/activate.csh
-+++ b/Lib/venv/scripts/posix/activate.csh
-@@ -8,17 +8,17 @@ alias deactivate 'test $?_OLD_VIRTUAL_PATH != 0 && setenv PATH "$_OLD_VIRTUAL_PA
- # Unset irrelevant variables.
- deactivate nondestructive
- 
-setenv VIRTUAL_ENV "__VENV_DIR__"
-+setenv VIRTUAL_ENV __VENV_DIR__
- 
- set _OLD_VIRTUAL_PATH="$PATH"
-setenv PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__:$PATH"
-+setenv PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__":$PATH"
- 
- 
- set _OLD_VIRTUAL_PROMPT="$prompt"
- 
- if (! "$?VIRTUAL_ENV_DISABLE_PROMPT") then
-    if ("__VENV_NAME__" != "") then
-        set env_name = "__VENV_NAME__"
-+    if (__VENV_NAME__ != "") then
-+        set env_name = __VENV_NAME__
-     else
-         if (`basename "VIRTUAL_ENV"` == "__") then
-             # special case for Aspen magic directories
-diff --git a/Lib/venv/scripts/posix/activate.fish b/Lib/venv/scripts/posix/activate.fish
-index 4d4f0bd7a4..0407f9c7be 100644
--- a/Lib/venv/scripts/posix/activate.fish
-+++ b/Lib/venv/scripts/posix/activate.fish
-@@ -29,10 +29,10 @@ end
- # unset irrelevant variables
- deactivate nondestructive
- 
-set -gx VIRTUAL_ENV "__VENV_DIR__"
-+set -gx VIRTUAL_ENV __VENV_DIR__
- 
- set -gx _OLD_VIRTUAL_PATH $PATH
-set -gx PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__" $PATH
-+set -gx PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__ $PATH
- 
- # unset PYTHONHOME if set
- if set -q PYTHONHOME
-@@ -52,8 +52,8 @@ if test -z "$VIRTUAL_ENV_DISABLE_PROMPT"
-         set -l old_status $status
- 
-         # Prompt override?
-        if test -n "__VENV_PROMPT__"            
-            printf "%s%s" "__VENV_PROMPT__" (set_color normal)
-+        if test -n __VENV_PROMPT__            
-+            printf "%s%s" __VENV_PROMPT__ (set_color normal)
-         else
-             # ...Otherwise, prepend env
-             set -l _checkbase (basename "$VIRTUAL_ENV")
-diff --git a/Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst b/Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
-new file mode 100644
-index 0000000000..17fc917139
--- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
-@@ -0,0 +1 @@
-+Properly quote template strings in :mod:`venv` activation scripts.
--- a/00444-security-fix-for-cve-2024-11168.patch
+++ b/00444-security-fix-for-cve-2024-11168.patch
@ -1,110 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Tue, 9 May 2023 23:35:24 -0700
-Subject: 00444: Security fix for CVE-2024-11168
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (GH-103849)
-
-Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.
-
-(cherry picked from commit 29f348e232e82938ba2165843c448c2b291504c5)
-
-Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
-Co-authored-by: Gregory P. Smith <greg@krypto.org>
-Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
---
- Lib/test/test_urlparse.py                     | 26 +++++++++++++++++++
- Lib/urllib/parse.py                           | 15 +++++++++++
- ...-04-26-09-54-25.gh-issue-103848.aDSnpR.rst |  2 ++
- 3 files changed, 43 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
-
-diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
-index 7fd61ffea9..090d2f17bf 100644
--- a/Lib/test/test_urlparse.py
-+++ b/Lib/test/test_urlparse.py
-@@ -1076,6 +1076,32 @@ class UrlParseTestCase(unittest.TestCase):
-         self.assertEqual(p2.scheme, 'tel')
-         self.assertEqual(p2.path, '+31641044153')
- 
-+    def test_invalid_bracketed_hosts(self):
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[192.0.2.146]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[important.com:8000]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123r.IP]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v12ae]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v.IP]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v123.]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[v]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
-+
-+    def test_splitting_bracketed_hosts(self):
-+        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
-+        self.assertEqual(p1.hostname, 'v6a.ip')
-+        self.assertEqual(p1.username, 'user')
-+        self.assertEqual(p1.path, '/path')
-+        p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7]/path?query')
-+        self.assertEqual(p2.hostname, '0439:23af:2309::fae7')
-+        self.assertEqual(p2.username, 'user')
-+        self.assertEqual(p2.path, '/path')
-+        p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146]/path?query')
-+        self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146')
-+        self.assertEqual(p3.username, 'user')
-+        self.assertEqual(p3.path, '/path')
-+
-     def test_telurl_params(self):
-         p1 = urllib.parse.urlparse('tel:123-4;phone-context=+1-650-516')
-         self.assertEqual(p1.scheme, 'tel')
-diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
-index 717e990997..bf186b7984 100644
--- a/Lib/urllib/parse.py
-+++ b/Lib/urllib/parse.py
-@@ -34,6 +34,7 @@ It serves as a useful guide when making changes.
- import re
- import sys
- import collections
-+import ipaddress
- 
- __all__ = ["urlparse", "urlunparse", "urljoin", "urldefrag",
-            "urlsplit", "urlunsplit", "urlencode", "parse_qs",
-@@ -425,6 +426,17 @@ def _remove_unsafe_bytes_from_url(url):
-         url = url.replace(b, "")
-     return url
- 
-+# Valid bracketed hosts are defined in
-+# https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
-+def _check_bracketed_host(hostname):
-+    if hostname.startswith('v'):
-+        if not re.match(r"\Av[a-fA-F0-9]+\..+\Z", hostname):
-+            raise ValueError(f"IPvFuture address is invalid")
-+    else:
-+        ip = ipaddress.ip_address(hostname) # Throws Value Error if not IPv6 or IPv4
-+        if isinstance(ip, ipaddress.IPv4Address):
-+            raise ValueError(f"An IPv4 address cannot be in brackets")
-+
- def urlsplit(url, scheme='', allow_fragments=True):
-     """Parse a URL into 5 components:
-     <scheme>://<netloc>/<path>?<query>#<fragment>
-@@ -480,6 +492,9 @@ def urlsplit(url, scheme='', allow_fragments=True):
-         if (('[' in netloc and ']' not in netloc) or
-                 (']' in netloc and '[' not in netloc)):
-             raise ValueError("Invalid IPv6 URL")
-+        if '[' in netloc and ']' in netloc:
-+            bracketed_host = netloc.partition('[')[2].partition(']')[0]
-+            _check_bracketed_host(bracketed_host)
-     if allow_fragments and '#' in url:
-         url, fragment = url.split('#', 1)
-     if '?' in url:
-diff --git a/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst b/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
-new file mode 100644
-index 0000000000..81e5904aa6
--- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2023-04-26-09-54-25.gh-issue-103848.aDSnpR.rst
-@@ -0,0 +1,2 @@
-+Add checks to ensure that ``[`` bracketed ``]`` hosts found by
-+:func:`urllib.parse.urlsplit` are of IPv6 or IPvFuture format.
--- a/00446-Resolve-sinpi-name-clash-with-libm.patch
+++ b/00446-Resolve-sinpi-name-clash-with-libm.patch
@ -1,61 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Dima Pasechnik <dimpase@gmail.com>
-Date: Wed, 18 Dec 2024 14:31:08 +0100
-Subject: 00446: Resolve sinpi name clash with libm
-
-bpo-36106: Resolve sinpi name clash with libm (IEEE-754 violation). (GH-12027)
-
-The standard math library (libm) may follow IEEE-754 recommendation to
-include an implementation of sinPi(), i.e. sinPi(x):=sin(pi*x).
-And this triggers a name clash, found by FreeBSD developer
-Steve Kargl, who worken on putting sinpi into libm used on FreeBSD
-(it has to be named "sinpi", not "sinPi", cf. e.g.
-https://en.cppreference.com/w/c/experimental/fpext4).
-
-(cherry picked from commit f57cd8288dbe6aba99c057f37ad6d58f8db75350)
-
-Co-authored-by: Victor Stinner <vstinner@python.org>
---
- Modules/mathmodule.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/Modules/mathmodule.c b/Modules/mathmodule.c
-index 95ea4f7fef..670f1a04ad 100644
--- a/Modules/mathmodule.c
-+++ b/Modules/mathmodule.c
-@@ -67,7 +67,7 @@ static const double sqrtpi = 1.772453850905516027298167483341145182798;
- static const double logpi = 1.144729885849400174143427351353058711647;
- 
- static double
-sinpi(double x)
-+m_sinpi(double x)
- {
-     double y, r;
-     int n;
-@@ -296,7 +296,7 @@ m_tgamma(double x)
-        integer. */
-     if (absx > 200.0) {
-         if (x < 0.0) {
-            return 0.0/sinpi(x);
-+            return 0.0/m_sinpi(x);
-         }
-         else {
-             errno = ERANGE;
-@@ -320,7 +320,7 @@ m_tgamma(double x)
-     }
-     z = z * lanczos_g / y;
-     if (x < 0.0) {
-        r = -pi / sinpi(absx) / absx * exp(y) / lanczos_sum(absx);
-+        r = -pi / m_sinpi(absx) / absx * exp(y) / lanczos_sum(absx);
-         r -= z * r;
-         if (absx < 140.0) {
-             r /= pow(y, absx - 0.5);
-@@ -390,7 +390,7 @@ m_lgamma(double x)
-     r += (absx - 0.5) * (log(absx + lanczos_g - 0.5) - 1);
-     if (x < 0.0)
-         /* Use reflection formula to get value for negative x. */
-        r = logpi - log(fabs(sinpi(absx))) - log(absx) - r;
-+        r = logpi - log(fabs(m_sinpi(absx))) - log(absx) - r;
-     if (Py_IS_INFINITY(r))
-         errno = ERANGE;
-     return r;
--- a/00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch
+++ b/00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch
@ -1,119 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Seth Michael Larson <seth@python.org>
-Date: Fri, 31 Jan 2025 11:41:34 -0600
-Subject: 00450: CVE-2025-0938: Disallow square brackets ([ and ]) in domain
- names for parsed URLs
-
-Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
---
- Lib/test/test_urlparse.py                     | 37 ++++++++++++++++++-
- Lib/urllib/parse.py                           | 20 +++++++++-
- ...-01-28-14-08-03.gh-issue-105704.EnhHxu.rst |  4 ++
- 3 files changed, 58 insertions(+), 3 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
-
-diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
-index 090d2f17bf..8b2f5ca50f 100644
--- a/Lib/test/test_urlparse.py
-+++ b/Lib/test/test_urlparse.py
-@@ -1087,16 +1087,51 @@ class UrlParseTestCase(unittest.TestCase):
-         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
-         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
-         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]/')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix/')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]?')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix?')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]/')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix/')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]?')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix?')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a1')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a1')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:1a')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:1a')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:/')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:?')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@prefix.[v6a.ip]')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@[v6a.ip].suffix')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip]')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip[')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip].suffix')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip')
-+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[suffix')
- 
-     def test_splitting_bracketed_hosts(self):
-        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
-+        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
-         self.assertEqual(p1.hostname, 'v6a.ip')
-         self.assertEqual(p1.username, 'user')
-         self.assertEqual(p1.path, '/path')
-+        self.assertEqual(p1.port, 1234)
-         p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7]/path?query')
-         self.assertEqual(p2.hostname, '0439:23af:2309::fae7')
-         self.assertEqual(p2.username, 'user')
-         self.assertEqual(p2.path, '/path')
-+        self.assertIs(p2.port, None)
-         p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146]/path?query')
-         self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146')
-         self.assertEqual(p3.username, 'user')
-diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
-index bf186b7984..af41edf2ca 100644
--- a/Lib/urllib/parse.py
-+++ b/Lib/urllib/parse.py
-@@ -426,6 +426,23 @@ def _remove_unsafe_bytes_from_url(url):
-         url = url.replace(b, "")
-     return url
- 
-+def _check_bracketed_netloc(netloc):
-+    # Note that this function must mirror the splitting
-+    # done in NetlocResultMixins._hostinfo().
-+    hostname_and_port = netloc.rpartition('@')[2]
-+    before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
-+    if have_open_br:
-+        # No data is allowed before a bracket.
-+        if before_bracket:
-+            raise ValueError("Invalid IPv6 URL")
-+        hostname, _, port = bracketed.partition(']')
-+        # No data is allowed after the bracket but before the port delimiter.
-+        if port and not port.startswith(":"):
-+            raise ValueError("Invalid IPv6 URL")
-+    else:
-+        hostname, _, port = hostname_and_port.partition(':')
-+    _check_bracketed_host(hostname)
-+
- # Valid bracketed hosts are defined in
- # https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
- def _check_bracketed_host(hostname):
-@@ -493,8 +510,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
-                 (']' in netloc and '[' not in netloc)):
-             raise ValueError("Invalid IPv6 URL")
-         if '[' in netloc and ']' in netloc:
-            bracketed_host = netloc.partition('[')[2].partition(']')[0]
-            _check_bracketed_host(bracketed_host)
-+            _check_bracketed_netloc(netloc)
-     if allow_fragments and '#' in url:
-         url, fragment = url.split('#', 1)
-     if '?' in url:
-diff --git a/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst b/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
-new file mode 100644
-index 0000000000..bff1bc6b0d
--- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
-@@ -0,0 +1,4 @@
-+When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse` host
-+parsing would not reject domain names containing square brackets (``[`` and
-+``]``). Square brackets are only valid for IPv6 and IPvFuture hosts according to
-+`RFC 3986 Section 3.2.2 <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.
--- a/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
+++ b/00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
@ -1,49 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Mon, 31 Mar 2025 20:29:04 +0200
-Subject: 00452: Properly apply exported CFLAGS for dtrace/systemtap builds
-
-When using --with-dtrace the resulting object file could be missing
-specific CFLAGS exported by the build system due to the systemtap
-script using specific defaults.
-
-Exporting the CC and CFLAGS variables before the dtrace invocation
-allows us to properly apply CFLAGS exported by the build system
-even when cross-compiling.
-
-Co-authored-by: stratakis <cstratak@redhat.com>
---
- Makefile.pre.in                                               | 4 ++--
- .../next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst | 2 ++
- 2 files changed, 4 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-
-diff --git a/Makefile.pre.in b/Makefile.pre.in
-index b074b26039..825cefafd9 100644
--- a/Makefile.pre.in
-+++ b/Makefile.pre.in
-@@ -892,13 +892,13 @@ Python/frozen.o: $(srcdir)/Python/importlib.h $(srcdir)/Python/importlib_externa
- # an include guard, so we can't use a pipeline to transform its output.
- Include/pydtrace_probes.h: $(srcdir)/Include/pydtrace.d
- 	$(MKDIR_P) Include
-	$(DTRACE) $(DFLAGS) -o $@ -h -s $<
-+	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -h -s $<
- 	: sed in-place edit with POSIX-only tools
- 	sed 's/PYTHON_/PyDTrace_/' $@ > $@.tmp
- 	mv $@.tmp $@
- 
- Python/pydtrace.o: $(srcdir)/Include/pydtrace.d $(DTRACE_DEPS)
-	$(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
-+	CC="$(CC)" CFLAGS="$(CFLAGS)" $(DTRACE) $(DFLAGS) -o $@ -G -s $< $(DTRACE_DEPS)
- 
- Objects/typeobject.o: Objects/typeslots.inc
- 
-diff --git a/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-new file mode 100644
-index 0000000000..a287e0b228
--- /dev/null
-+++ b/Misc/NEWS.d/next/Build/2025-03-31-19-22-41.gh-issue-131865.PIJy7X.rst
-@@ -0,0 +1,2 @@
-+The DTrace build now properly passes the ``CC`` and ``CFLAGS`` variables
-+to the ``dtrace`` command when utilizing SystemTap on Linux.
--- a/00457-ssl-raise-oserror-for-err_lib_sys.patch
+++ b/00457-ssl-raise-oserror-for-err_lib_sys.patch
@ -1,43 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Victor Stinner <vstinner@python.org>
-Date: Thu, 3 Apr 2025 18:26:17 +0200
-Subject: 00457: ssl: Raise OSError for ERR_LIB_SYS
-
-The patch resolves the flakiness of test_ftplib
-
-Backported from upstream 3.10+:
-https://github.com/python/cpython/pull/127361
-
-Co-authored-by: Petr Viktorin <encukou@gmail.com>
---
- Modules/_ssl.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/Modules/_ssl.c b/Modules/_ssl.c
-index 3375b2bf3f..ab8a327d10 100644
--- a/Modules/_ssl.c
-+++ b/Modules/_ssl.c
-@@ -638,6 +638,11 @@ PySSL_SetError(PySSLSocket *obj, int ret, const char *filename, int lineno)
-                     errstr = "Some I/O error occurred";
-                 }
-             } else {
-+                if (ERR_GET_LIB(e) == ERR_LIB_SYS) {
-+                    // A system error is being reported; reason is set to errno
-+                    errno = ERR_GET_REASON(e);
-+                    return PyErr_SetFromErrno(PyExc_OSError);
-+                }
-                 p = PY_SSL_ERROR_SYSCALL;
-             }
-             break;
-@@ -648,6 +653,11 @@ PySSL_SetError(PySSLSocket *obj, int ret, const char *filename, int lineno)
-             if (e == 0)
-                 /* possible? */
-                 errstr = "A failure in the SSL library occurred";
-+            if (ERR_GET_LIB(e) == ERR_LIB_SYS) {
-+                // A system error is being reported; reason is set to errno
-+                errno = ERR_GET_REASON(e);
-+                return PyErr_SetFromErrno(PyExc_OSError);
-+            }
-             break;
-         }
-         default:
--- a/00465-tarfile-cves.patch
+++ b/00465-tarfile-cves.patch
--- a/00467-tarfile-cve-2025-8194.patch
+++ b/00467-tarfile-cve-2025-8194.patch
@ -1,212 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Alexander Urieles <aeurielesn@users.noreply.github.com>
-Date: Mon, 28 Jul 2025 17:37:26 +0200
-Subject: 00467: tarfile CVE-2025-8194
-
-tarfile now validates archives to ensure member offsets are non-negative (GH-137027)
-
-Co-authored-by: Gregory P. Smith <greg@krypto.org>
---
- Lib/tarfile.py                                |   3 +
- Lib/test/test_tarfile.py                      | 156 ++++++++++++++++++
- ...-07-23-00-35-29.gh-issue-130577.c7EITy.rst |   3 +
- 3 files changed, 162 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
-
-diff --git a/Lib/tarfile.py b/Lib/tarfile.py
-index 1a7d5f772a..4f536cb002 100755
--- a/Lib/tarfile.py
-+++ b/Lib/tarfile.py
-@@ -1582,6 +1582,9 @@ class TarInfo(object):
-         """Round up a byte count by BLOCKSIZE and return it,
-            e.g. _block(834) => 1024.
-         """
-+        # Only non-negative offsets are allowed
-+        if count < 0:
-+            raise InvalidHeaderError("invalid offset")
-         blocks, remainder = divmod(count, BLOCKSIZE)
-         if remainder:
-             blocks += 1
-diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
-index c5d837e716..484f114180 100644
--- a/Lib/test/test_tarfile.py
-+++ b/Lib/test/test_tarfile.py
-@@ -43,6 +43,7 @@ bz2name = os.path.join(TEMPDIR, "testtar.tar.bz2")
- xzname = os.path.join(TEMPDIR, "testtar.tar.xz")
- tmpname = os.path.join(TEMPDIR, "tmp.tar")
- dotlessname = os.path.join(TEMPDIR, "testtar")
-+SPACE = b" "
- 
- md5_regtype = "65f477c818ad9e15f7feab0c6d37742f"
- md5_sparse = "a54fbc4ca4f4399a90e1b27164012fc6"
-@@ -4005,6 +4006,161 @@ class TestExtractionFilters(unittest.TestCase):
-             self.expect_exception(TypeError)  # errorlevel is not int
- 
- 
-+class OffsetValidationTests(unittest.TestCase):
-+    tarname = tmpname
-+    invalid_posix_header = (
-+        # name: 100 bytes
-+        tarfile.NUL * tarfile.LENGTH_NAME
-+        # mode, space, null terminator: 8 bytes
-+        + b"000755" + SPACE + tarfile.NUL
-+        # uid, space, null terminator: 8 bytes
-+        + b"000001" + SPACE + tarfile.NUL
-+        # gid, space, null terminator: 8 bytes
-+        + b"000001" + SPACE + tarfile.NUL
-+        # size, space: 12 bytes
-+        + b"\xff" * 11 + SPACE
-+        # mtime, space: 12 bytes
-+        + tarfile.NUL * 11 + SPACE
-+        # chksum: 8 bytes
-+        + b"0011407" + tarfile.NUL
-+        # type: 1 byte
-+        + tarfile.REGTYPE
-+        # linkname: 100 bytes
-+        + tarfile.NUL * tarfile.LENGTH_LINK
-+        # magic: 6 bytes, version: 2 bytes
-+        + tarfile.POSIX_MAGIC
-+        # uname: 32 bytes
-+        + tarfile.NUL * 32
-+        # gname: 32 bytes
-+        + tarfile.NUL * 32
-+        # devmajor, space, null terminator: 8 bytes
-+        + tarfile.NUL * 6 + SPACE + tarfile.NUL
-+        # devminor, space, null terminator: 8 bytes
-+        + tarfile.NUL * 6 + SPACE + tarfile.NUL
-+        # prefix: 155 bytes
-+        + tarfile.NUL * tarfile.LENGTH_PREFIX
-+        # padding: 12 bytes
-+        + tarfile.NUL * 12
-+    )
-+    invalid_gnu_header = (
-+        # name: 100 bytes
-+        tarfile.NUL * tarfile.LENGTH_NAME
-+        # mode, null terminator: 8 bytes
-+        + b"0000755" + tarfile.NUL
-+        # uid, null terminator: 8 bytes
-+        + b"0000001" + tarfile.NUL
-+        # gid, space, null terminator: 8 bytes
-+        + b"0000001" + tarfile.NUL
-+        # size, space: 12 bytes
-+        + b"\xff" * 11 + SPACE
-+        # mtime, space: 12 bytes
-+        + tarfile.NUL * 11 + SPACE
-+        # chksum: 8 bytes
-+        + b"0011327" + tarfile.NUL
-+        # type: 1 byte
-+        + tarfile.REGTYPE
-+        # linkname: 100 bytes
-+        + tarfile.NUL * tarfile.LENGTH_LINK
-+        # magic: 8 bytes
-+        + tarfile.GNU_MAGIC
-+        # uname: 32 bytes
-+        + tarfile.NUL * 32
-+        # gname: 32 bytes
-+        + tarfile.NUL * 32
-+        # devmajor, null terminator: 8 bytes
-+        + tarfile.NUL * 8
-+        # devminor, null terminator: 8 bytes
-+        + tarfile.NUL * 8
-+        # padding: 167 bytes
-+        + tarfile.NUL * 167
-+    )
-+    invalid_v7_header = (
-+        # name: 100 bytes
-+        tarfile.NUL * tarfile.LENGTH_NAME
-+        # mode, space, null terminator: 8 bytes
-+        + b"000755" + SPACE + tarfile.NUL
-+        # uid, space, null terminator: 8 bytes
-+        + b"000001" + SPACE + tarfile.NUL
-+        # gid, space, null terminator: 8 bytes
-+        + b"000001" + SPACE + tarfile.NUL
-+        # size, space: 12 bytes
-+        + b"\xff" * 11 + SPACE
-+        # mtime, space: 12 bytes
-+        + tarfile.NUL * 11 + SPACE
-+        # chksum: 8 bytes
-+        + b"0010070" + tarfile.NUL
-+        # type: 1 byte
-+        + tarfile.REGTYPE
-+        # linkname: 100 bytes
-+        + tarfile.NUL * tarfile.LENGTH_LINK
-+        # padding: 255 bytes
-+        + tarfile.NUL * 255
-+    )
-+    valid_gnu_header = tarfile.TarInfo("filename").tobuf(tarfile.GNU_FORMAT)
-+    data_block = b"\xff" * tarfile.BLOCKSIZE
-+
-+    def _write_buffer(self, buffer):
-+        with open(self.tarname, "wb") as f:
-+            f.write(buffer)
-+
-+    def _get_members(self, ignore_zeros=None):
-+        with open(self.tarname, "rb") as f:
-+            with tarfile.open(
-+                mode="r", fileobj=f, ignore_zeros=ignore_zeros
-+            ) as tar:
-+                return tar.getmembers()
-+
-+    def _assert_raises_read_error_exception(self):
-+        with self.assertRaisesRegex(
-+            tarfile.ReadError, "file could not be opened successfully"
-+        ):
-+            self._get_members()
-+
-+    def test_invalid_offset_header_validations(self):
-+        for tar_format, invalid_header in (
-+            ("posix", self.invalid_posix_header),
-+            ("gnu", self.invalid_gnu_header),
-+            ("v7", self.invalid_v7_header),
-+        ):
-+            with self.subTest(format=tar_format):
-+                self._write_buffer(invalid_header)
-+                self._assert_raises_read_error_exception()
-+
-+    def test_early_stop_at_invalid_offset_header(self):
-+        buffer = self.valid_gnu_header + self.invalid_gnu_header + self.valid_gnu_header
-+        self._write_buffer(buffer)
-+        members = self._get_members()
-+        self.assertEqual(len(members), 1)
-+        self.assertEqual(members[0].name, "filename")
-+        self.assertEqual(members[0].offset, 0)
-+
-+    def test_ignore_invalid_archive(self):
-+        # 3 invalid headers with their respective data
-+        buffer = (self.invalid_gnu_header + self.data_block) * 3
-+        self._write_buffer(buffer)
-+        members = self._get_members(ignore_zeros=True)
-+        self.assertEqual(len(members), 0)
-+
-+    def test_ignore_invalid_offset_headers(self):
-+        for first_block, second_block, expected_offset in (
-+            (
-+                (self.valid_gnu_header),
-+                (self.invalid_gnu_header + self.data_block),
-+                0,
-+            ),
-+            (
-+                (self.invalid_gnu_header + self.data_block),
-+                (self.valid_gnu_header),
-+                1024,
-+            ),
-+        ):
-+            self._write_buffer(first_block + second_block)
-+            members = self._get_members(ignore_zeros=True)
-+            self.assertEqual(len(members), 1)
-+            self.assertEqual(members[0].name, "filename")
-+            self.assertEqual(members[0].offset, expected_offset)
-+
-+
- def setUpModule():
-     support.unlink(TEMPDIR)
-     os.makedirs(TEMPDIR)
-diff --git a/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
-new file mode 100644
-index 0000000000..342cabbc86
--- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
-@@ -0,0 +1,3 @@
-+:mod:`tarfile` now validates archives to ensure member offsets are
-+non-negative.  (Contributed by Alexander Enrique Urieles Nieto in
-+:gh:`130577`.)
--- a/plan.fmf
+++ b/plan.fmf
@ -1,38 +0,0 @@
-execute:
-  how: tmt
-
-environment:
-  pybasever: '3.6'
-
-discover:
-  - name: tests_python
-    how: shell
-    url: https://src.fedoraproject.org/tests/python.git
-    tests:
-    - name: smoke
-      path: /smoke
-      test: "VERSION=${pybasever} TOX_REQUIRES='virtualenv<20.22.0' ./venv.sh"
-    - name: debugsmoke
-      path: /smoke
-      test: "PYTHON=python${pybasever}dm TOX=false VERSION=${pybasever} INSTALL_OR_SKIP=true ./venv.sh"
-    - name: marshalparser
-      path: /marshalparser
-      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
-
-prepare:
-  - name: Install dependencies
-    how: install
-    package:
-    - gcc
-    - python3-tox
-    - python${pybasever}
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
-    - dnf  # for upgrade
-  - name: Update packages
-    how: shell
-    script: dnf upgrade -y
-  - name: rpm_qa
-    order: 100
-    how: shell
-    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt
--- a/python3.6.spec
+++ b/python3.6.spec
@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 50%{?dist}
+Release: 36%{?dist}
 # Python is Python
 # pip MIT is and bundles:
 #   appdirs: MIT
@ -48,8 +48,7 @@ Release: 50%{?dist}
 #   pyparsing: MIT
 #   six: MIT
 #   appdirs: MIT
-# Automatically converted from old format: Python and MIT and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) - review is highly recommended.
-License: LicenseRef-Callaway-Python AND LicenseRef-Callaway-MIT AND Apache-2.0 AND LicenseRef-Callaway-BSD AND ISC AND LicenseRef-Callaway-LGPLv2 AND MPL-2.0 AND (Apache-2.0 OR LicenseRef-Callaway-BSD)
+License: Python and MIT and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)


 # ==================================
@ -59,22 +58,12 @@ License: LicenseRef-Callaway-Python AND LicenseRef-Callaway-MIT AND Apache-2.0 A
 # Note that the bcond macros are named for the CLI option they create.
 # "%%bcond_without" means "ENABLE by default and create a --without option"

-# Main Python, i.e. whether this is the main Python version in the distribution
-# that owns /usr/bin/python3 and other unique paths
-# This also means the built subpackages are called python3 rather than python3X
-# WARNING: This also influences the flatpackage bcond below.
-# By default, this is disabled.
-%bcond_with main_python
-
 # Flat package, i.e. python36, python37, python38 for tox etc.
-# Default (in Fedora >= 44): disabled
-# Default (in Fedora < 44): enabled when this is not the main Python
-# Not supported: Combination of flatpackage enabled and main_python enabled
-%if %{with main_python} || 0%{?fedora} >= 44
-%bcond_with flatpackage
-%else
+# warning: changes some other defaults
+# in Fedora, never turn this on for the python3 package
+# and always keep it on for python36 etc.
+# WARNING: This does not change the package name and summary above
 %bcond_without flatpackage
-%endif

 # Whether to use RPM build wheels from the python-{pip,setuptools}-wheel package
 # Uses upstream bundled prebuilt wheels otherwise
@ -171,8 +160,6 @@ License: LicenseRef-Callaway-Python AND LicenseRef-Callaway-MIT AND Apache-2.0 A
 # General global macros
 # =====================

-%global pkgname python%{pybasever}
-
 %global pylibdir %{_libdir}/python%{pybasever}
 %global dynload_dir %{pylibdir}/lib-dynload

@ -278,7 +265,6 @@ BuildRequires: libffi-devel
 BuildRequires: libnsl2-devel
 BuildRequires: libtirpc-devel
 BuildRequires: libGL-devel
-BuildRequires: libxcrypt-devel
 BuildRequires: libX11-devel
 BuildRequires: make
 BuildRequires: ncurses-devel
@ -289,12 +275,12 @@ BuildRequires: redhat-rpm-config >= 127
 BuildRequires: sqlite-devel
 BuildRequires: gdb

-BuildRequires: openssl-devel
+BuildRequires: openssl1.1-devel

 BuildRequires: tar
-BuildRequires: tcl-devel < 1:9
+BuildRequires: tcl-devel
 BuildRequires: tix-devel
-BuildRequires: tk-devel < 1:9
+BuildRequires: tk-devel

 %if %{with valgrind}
 BuildRequires: valgrind-devel
@ -303,7 +289,6 @@ BuildRequires: valgrind-devel
 BuildRequires: xz-devel
 BuildRequires: zlib-devel

-BuildRequires: systemtap-sdt-devel
 BuildRequires: /usr/bin/dtrace

 # workaround http://bugs.python.org/issue19804 (test_uuid requires ifconfig)
@ -312,9 +297,6 @@ BuildRequires: /usr/sbin/ifconfig
 %if %{with rpmwheels}
 BuildRequires: python-setuptools-wheel
 BuildRequires: python-pip-wheel
-%else
-# For %%python_wheel_inject_sbom
-BuildRequires: python-rpm-macros
 %endif


@ -353,7 +335,6 @@ Source102: setuptools-CVE-2024-6345.patch

 # 00001 # d06a8853cf4bae9e115f45e1d531d2dc152c5cc8
 # Fixup distutils/unixccompiler.py to remove standard library path from rpath
-#
 # Was Patch0 in ivazquez' python3000 specfile
 Patch1: 00001-rpath.patch

@ -526,14 +507,6 @@ Patch353: 00353-architecture-names-upstream-downstream.patch
 # - 8766cb74e186d3820db0a855ccd780d6d84461f7
 Patch358: 00358-align-allocations-and-pygc_head-to-16-bytes-on-64-bit-platforms.patch

-# 00361 # b3dd949b7947b1b44b358e0c30d080e5b16ca8bc
-# openssl-3-compatibility
-#
-# Backported from Python 3.8
-#
-# Based on https://github.com/stratakis/cpython/tree/fedora-3.6_openssl3_compat
-Patch361: 00361-openssl-3-compatibility.patch
-
 # 00375 # 5488ab84d2447aa8df8b3502e76f151ac2488947
 # Fix test_distance to enable build on i686
 #
@ -708,12 +681,6 @@ Patch410: 00410-bpo-42598-fix-implicit-function-declarations-in-configure.patch
 # Thomas Dwyer.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch

-# 00419 # f13682530cc7e4daec2e40acd56508846fdd3aad
-# gh-112769: test_zlib: Fix comparison of ZLIB_RUNTIME_VERSION with non-int suffix (GH-112771) (GH-112774)
-#
-# zlib-ng defines the version as "1.3.0.zlib-ng".
-Patch419: 00419-gh-112769-test_zlib-fix-comparison-of-zlib_runtime_version-with-non-int-suffix-gh-112771-gh-112774.patch
-
 # 00422 # fefea32e0c70109a5c88e3d22ec9ff554fcbc6ab
 # gh-115133: Fix tests for XMLPullParser with Expat 2.6.0
 #
@ -721,10 +688,6 @@ Patch419: 00419-gh-112769-test_zlib-fix-comparison-of-zlib_runtime_version-with-
 # CVE-2023-52425. Future versions of Expat may be more reactive.
 Patch422: 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch

-# 00423 # 81584d3af3b307c2aeede3ba8ae95c7efc81f5f7
-# bpo-33377: Add triplets for mips-r6 and riscv
-Patch423: 00423-bpo-33377-add-triplets-for-mips-r6-and-riscv.patch
-
 # 00426 # 05ddec93394a09199c3bbb2d71a4a2566fd50332
 # CVE-2023-6597
 #
@ -753,7 +716,8 @@ Patch427: 00427-zipextfile-tell-and-seek-cve-2024-0450.patch
 Patch431: 00431-cve-2024-4032.patch

 # 00435 # f80b87e6a67eebe0693b895261bad2e9a58a4825
-# gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)
+# gh-121650: Encode newlines in headers, and verify
+#  headers are sound (GH-122233)
 #
 # Per RFC 2047:
 #
@ -788,85 +752,6 @@ Patch435: 00435-gh-121650-encode-newlines-in-headers-and-verify.patch
 # * Optimize parsing of GNU extended sparse headers v0.0
 Patch437: 00437-cve-2024-6232-remove-backtracking-when-parsing-tarfile-headers.patch

-# 00443 # 49e939f29e3551ec4e7bdb2cc8b8745e3d1fca35
-# gh-124651: Quote template strings in `venv` activation scripts
-#
-# (cherry picked from 3.9)
-Patch443: 00443-gh-124651-quote-template-strings-in-venv-activation-scripts.patch
-
-# 00444 # fed0071c8c86599091f93967a5fa2cce42ceb840
-# Security fix for CVE-2024-11168
-#
-# gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (GH-103849)
-#
-# Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.
-Patch444: 00444-security-fix-for-cve-2024-11168.patch
-
-# 00446 # f5cc2c3be4273be70cdcdf9eb95abf425808f752
-# Resolve sinpi name clash with libm
-#
-# bpo-36106: Resolve sinpi name clash with libm (IEEE-754 violation). (GH-12027)
-#
-# The standard math library (libm) may follow IEEE-754 recommendation to
-# include an implementation of sinPi(), i.e. sinPi(x):=sin(pi*x).
-# And this triggers a name clash, found by FreeBSD developer
-# Steve Kargl, who worken on putting sinpi into libm used on FreeBSD
-# (it has to be named "sinpi", not "sinPi", cf. e.g.
-# https://en.cppreference.com/w/c/experimental/fpext4).
-Patch446: 00446-Resolve-sinpi-name-clash-with-libm.patch
-
-# 00450 # 31aa7c11975e890489e31d8b293c3f92d3ea1180
-# CVE-2025-0938: Disallow square brackets ([ and ]) in domain names for parsed URLs
-Patch450: 00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch
-
-# 00452 # dab1c136301f0beac6ec132a8e5b08206b698bc8
-# Properly apply exported CFLAGS for dtrace/systemtap builds
-#
-# When using --with-dtrace the resulting object file could be missing
-# specific CFLAGS exported by the build system due to the systemtap
-# script using specific defaults.
-#
-# Exporting the CC and CFLAGS variables before the dtrace invocation
-# allows us to properly apply CFLAGS exported by the build system
-# even when cross-compiling.
-Patch452: 00452-properly-apply-exported-cflags-for-dtrace-systemtap-builds.patch
-
-# 00457 # da99203f07d380d50ec780323bbebda00f227797
-# ssl: Raise OSError for ERR_LIB_SYS
-#
-# The patch resolves the flakiness of test_ftplib
-#
-# Backported from upstream 3.10+:
-# https://github.com/python/cpython/pull/127361
-Patch457: 00457-ssl-raise-oserror-for-err_lib_sys.patch
-
-# 00465 # 2224c823bcc1b62b85f516883151459ae51cdb7d
-# tarfile cves
-#
-# Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 on tarfile
-#
-# The backported fixes do not contain changes for ntpath.py and related tests,
-# because the support for symlinks and junctions were added later in Python 3.9,
-# and it does not make sense to backport them to 3.6 here.
-#
-# The patch is contains the following changes:
-# - https://github.com/python/cpython/commit/42deeab5b2efc2930d4eb73416e1dde9cf790dd2
-#   fixes symlink handling for tarfile.data_filter
-# - https://github.com/python/cpython/commit/9d2c2a8e3b8fe18ee1568bfa4a419847b3e78575
-#   fixes handling of existing files/symlinks in tarfile
-# - https://github.com/python/cpython/commit/00af9794dd118f7b835dd844b2b609a503ad951e
-#   adds a new "strict" argument to realpath()
-# - https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
-#   fixes mulriple CVE fixes in the tarfile module
-# - downstream only fixes that makes the changes work and compatible with Python 3.6
-Patch465: 00465-tarfile-cves.patch
-
-# 00467 # f0b2819ec35fe1f732f661aea68863a5e4dd829f
-# tarfile CVE-2025-8194
-#
-# tarfile now validates archives to ensure member offsets are non-negative (GH-137027)
-Patch467: 00467-tarfile-cve-2025-8194.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -885,16 +770,12 @@ Patch467: 00467-tarfile-cve-2025-8194.patch
 Provides:  python%{pyshortver} = %{version}-%{release}
 Obsoletes: python%{pyshortver} < %{version}-%{release}

-# Packages with Python modules in standard locations automatically
-# depend on python(abi). Provide that here only for the main Python.
-%if %{with main_python}
-Provides: python(abi) = %{pybasever}
-%else
-%global __requires_exclude ^python\\(abi\\) = 3\\..+
-%global __provides_exclude ^python\\(abi\\) = 3\\..+
-%endif
-
 %if %{without flatpackage}
+
+# Packages with Python modules in standard locations automatically
+# depend on python(abi). Provide that here.
+Provides: python(abi) = %{pybasever}
+
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}

 # In order to support multiple Python interpreters for development purposes,
@ -909,16 +790,18 @@ Provides: python%{pyshortver} = %{version}-%{release}
 # replace python36-3.6.2.
 Obsoletes: python%{pyshortver}

-# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
-Obsoletes: %{name} < 3.6.15-50
+# Shall be removed in Fedora 31
+# The release is bumped to 20, so we can do f27 platform-python updates
+# If the release in f27 ever goes >= 20, raise it here
+# If platform-python is ever reintroduced, make it higher version than this:
+%global platpyver 3.6.2-20
+Obsoletes: platform-python < %{platpyver}

-%if %{with main_python}
 # Previously, this was required for our rewheel patch to work.
 # This is technically no longer needed, but we keep it recommended
 # for the developer experience.
 Recommends: python3-setuptools
 Recommends: python3-pip
-%endif

 # This prevents ALL subpackages built from this spec to require
 # /usr/bin/python3*. Granularity per subpackage is impossible.
@ -1001,8 +884,9 @@ Provides: bundled(libmpdec) = %{libmpdec_version}
 # See https://bugzilla.redhat.com/show_bug.cgi?id=1547131
 Recommends: %{name}%{?_isa} = %{version}-%{release}

-# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
-Obsoletes: %{name} < 3.6.15-50
+# Shall be removed in Fedora 31
+Obsoletes: platform-python-libs < %{platpyver}
+Obsoletes: platform-python-libs-devel < %{platpyver}

 %description libs
 This package contains runtime libraries for use by Python:
@ -1016,21 +900,17 @@ Summary: Libraries and header files needed for Python development
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 BuildRequires: python-rpm-macros
-# The RPM related dependencies bring nothing to a non-RPM Python developer
-# But we want them when packages BuildRequire python3-devel
-Requires: (python-rpm-macros if rpm-build)
-Requires: (python3-rpm-macros if rpm-build)
-Requires: (python3-rpm-generators if rpm-build)
+Requires: python-rpm-macros
+Requires: python3-rpm-macros
+Requires: python3-rpm-generators

 Provides: %{name}-2to3 = %{version}-%{release}
-%if %{with main_python}
 Provides: 2to3 = %{version}-%{release}
-%endif

 Conflicts: %{name} < %{version}-%{release}

-# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
-Obsoletes: %{name} < 3.6.15-50
+# Shall be removed in Fedora 31
+Obsoletes: platform-python-devel < %{platpyver}

 %description devel
 This package contains the header files and configuration needed to compile
@ -1046,16 +926,14 @@ Summary: A basic graphical development environment for Python
 Requires: %{name} = %{version}-%{release}
 Requires: %{name}-tkinter = %{version}-%{release}

-%if %{with main_python}
 Provides: idle3 = %{version}-%{release}
-%endif

 Provides: %{name}-tools = %{version}-%{release}
 Provides: %{name}-tools%{?_isa} = %{version}-%{release}
 Obsoletes: %{name}-tools < %{version}-%{release}

-# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
-Obsoletes: %{name} < 3.6.15-50
+# Shall be removed in Fedora 31
+Obsoletes: platform-python-tools < %{platpyver}

 %description idle
 IDLE is Python’s Integrated Development and Learning Environment.
@ -1074,8 +952,8 @@ configuration, browsers, and other dialogs.
 Summary: A GUI toolkit for Python
 Requires: %{name} = %{version}-%{release}

-# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
-Obsoletes: %{name} < 3.6.15-50
+# Shall be removed in Fedora 31
+Obsoletes: platform-python-tkinter < %{platpyver}

 %description tkinter
 The Tkinter (Tk interface) library is a graphical user interface toolkit for
@ -1086,8 +964,8 @@ the Python programming language.
 Summary: The self-test suite for the main python3 package
 Requires: %{name} = %{version}-%{release}

-# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_one_to_many_replacement
-Obsoletes: %{name} < 3.6.15-50
+# Shall be removed in Fedora 31
+Obsoletes: platform-python-test < %{platpyver}

 %description test
 The self-test suite for the Python interpreter.
@ -1132,6 +1010,11 @@ so extensions for both versions can co-exist in the same directory.

 %else  # with flatpackage

+# We'll not provide this, on purpose
+# No package in Fedora shall ever depend on flatpackage via this
+%global __requires_exclude ^python\\(abi\\) = 3\\..$
+%global __provides_exclude ^python\\(abi\\) = 3\\..$
+
 %if %{with rpmwheels}
 Requires: python-setuptools-wheel
 Requires: python-pip-wheel
@ -1175,16 +1058,6 @@ Provides: bundled(python3dist(appdirs)) = 1.4.3
 Provides: bundled(mpdecimal) = %{libmpdec_version}
 Provides: bundled(libmpdec) = %{libmpdec_version}

-# Provides of the subpackages contained in flatpackage
-Provides: %{pkgname}-libs = %{version}-%{release}
-Provides: %{pkgname}-devel = %{version}-%{release}
-Provides: %{pkgname}-idle = %{version}-%{release}
-Provides: %{pkgname}-tkinter = %{version}-%{release}
-Provides: %{pkgname}-test = %{version}-%{release}
-%if %{with debug_build}
-Provides: %{pkgname}-debug = %{version}-%{release}
-%endif
-
 # The description for the flat package
 %description
 Python %{pybasever} package for developers.
@ -1482,7 +1355,7 @@ install -d -m 0755 %{buildroot}%{pylibdir}/site-packages/__pycache__
 install -d -m 0755 %{buildroot}%{_prefix}/lib/python%{pybasever}/site-packages/__pycache__
 %endif

-%if %{with main_python}
+%if %{without flatpackage}
 # add idle3 to menu
 install -D -m 0644 Lib/idlelib/Icons/idle_16.png %{buildroot}%{_datadir}/icons/hicolor/16x16/apps/idle3.png
 install -D -m 0644 Lib/idlelib/Icons/idle_32.png %{buildroot}%{_datadir}/icons/hicolor/32x32/apps/idle3.png
@ -1572,18 +1445,13 @@ find %{buildroot} -perm 555 -exec chmod 755 {} \;
 # Create "/usr/bin/python3-debug", a symlink to the python3 debug binary, to
 # avoid the user having to know the precise version and ABI flags.
 # See e.g. https://bugzilla.redhat.com/show_bug.cgi?id=676748
-%if %{with debug_build} && %{with main_python}
+%if %{with debug_build} && %{without flatpackage}
 ln -s \
  %{_bindir}/python%{LDVERSION_debug} \
  %{buildroot}%{_bindir}/python3-debug
 %endif

-%if %{without rpmwheels}
-# Inject SBOM into the installed wheels (if the macro is available)
-%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{pylibdir}/ensurepip/_bundled/*.whl}
-%endif
-
-%if %{without main_python}
+%if %{with flatpackage}
 # Remove stuff that would conflict with python3 package
 rm %{buildroot}%{_bindir}/python3
 rm %{buildroot}%{_bindir}/pydoc3
@ -1700,15 +1568,11 @@ CheckPython optimized
 %doc README.rst

 %if %{without flatpackage}
-%if %{with main_python}
 %{_bindir}/pydoc*
 %{_bindir}/python3
 %{_bindir}/pyvenv
 %{_mandir}/*/*
-%else
-%{_bindir}/pydoc%{pybasever}
-%{_mandir}/*/python%{pybasever}*
-%endif
+%{_bindir}/pyvenv
 %else
 %{_bindir}/pydoc%{pybasever}
 %{_mandir}/*/python%{pybasever}*
@ -1853,10 +1717,6 @@ CheckPython optimized
 %dir %{pylibdir}/site-packages/
 %dir %{pylibdir}/site-packages/__pycache__/
 %{pylibdir}/site-packages/README.txt
-
-%exclude %{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py
-%exclude %{pylibdir}/__pycache__/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}%{bytecode_suffixes}
-
 %{pylibdir}/*.py
 %dir %{pylibdir}/__pycache__/
 %{pylibdir}/__pycache__/*%{bytecode_suffixes}
@ -1940,29 +1800,27 @@ CheckPython optimized
 %{_includedir}/python%{LDVERSION_optimized}/%{_pyconfig_h}

 %{_libdir}/%{py_INSTSONAME_optimized}
-%if %{with main_python}
+%if %{without flatpackage}
 %{_libdir}/libpython3.so
 %endif

 %if %{without flatpackage}
 %files devel
-%if %{with main_python}
 %{_bindir}/2to3
 # TODO: Remove 2to3-3.7 once rebased to 3.7
 %{_bindir}/2to3-%{pybasever}
 %endif
-%endif

 %{pylibdir}/config-%{LDVERSION_optimized}-%{platform_triplet}/*
 %if %{without flatpackage}
 %exclude %{pylibdir}/config-%{LDVERSION_optimized}-%{platform_triplet}/Makefile
 %exclude %{_includedir}/python%{LDVERSION_optimized}/%{_pyconfig_h}
 %endif
-%exclude %{pylibdir}/distutils/command/wininst-*.exe
+%{pylibdir}/distutils/command/wininst-*.exe
 %{_includedir}/python%{LDVERSION_optimized}/*.h
 %doc Misc/README.valgrind Misc/valgrind-python.supp Misc/gdbinit

-%if %{with main_python}
+%if %{without flatpackage}
 %{_bindir}/python3-config
 %{_libdir}/pkgconfig/python3.pc
 %{_bindir}/pathfix.py
@ -1990,7 +1848,7 @@ CheckPython optimized

 %{pylibdir}/idlelib

-%if %{with main_python}
+%if %{without flatpackage}
 %{_metainfodir}/idle3.appdata.xml
 %{_datadir}/applications/idle3.desktop
 %{_datadir}/icons/hicolor/*/apps/idle3.*
@ -2038,10 +1896,8 @@ CheckPython optimized
 %if %{with debug_build}
 %if %{without flatpackage}
 %files debug
-%if %{with main_python}
 %{_bindir}/python3-debug
 %endif
-%endif

 # Analog of the core subpackage's files:
 %{_bindir}/python%{LDVERSION_debug}
@ -2114,9 +1970,6 @@ CheckPython optimized
 %{dynload_dir}/unicodedata.%{SOABI_debug}.so
 %{dynload_dir}/zlib.%{SOABI_debug}.so

-%{pylibdir}/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}.py
-%{pylibdir}/__pycache__/_sysconfigdata_%{ABIFLAGS_debug}_linux_%{platform_triplet}%{bytecode_suffixes}
-
 # No need to split things out the "Makefile" and the config-32/64.h file as we
 # do for the regular build above (bug 531901), since they're all in one package
 # now; they're listed below, under "-devel":
@ -2168,95 +2021,28 @@ CheckPython optimized
 # ======================================================

 %changelog
-* Thu Nov 06 2025 Miro Hrončok <mhroncok@redhat.com> - 3.6.15-50
- On Fedora 44+, split this package into multiple subpackages
- This mimics newer Python versions
-
-* Mon Aug 11 2025 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-49
- Security fix for CVE-2025-8194
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-48
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Thu Jun 26 2025 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-47
- Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
-
-* Wed Apr 23 2025 Miro Hrončok <mhroncok@redhat.com> - 3.6.15-46
- Add RPM Provides for python3.6-libs, python3.6-devel, python3.6-idle, python3.6-tkinter, python3.6-test
-
-* Wed Apr 16 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-45
- Fix the flakiness of test_ftplib
-
-* Tue Apr 01 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-44
- Properly apply exported CFLAGS for dtrace/systemtap builds
- Fixes: rhbz#2356306
-
-* Fri Feb 14 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-43
- Security fix CVE-2025-0938
- Fixes: rhbz#2343277
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.6.15-42
- Add explicit BR: libxcrypt-devel
-
-* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-41
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Wed Dec 18 2024 Victor Stinner <vstinner@python.org> - 3.6.15-40
- Fix compatibility with glibc 2.41 (resolve sinpi name clash).
-
-* Thu Nov 14 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-39
- Security fix for CVE-2024-11168
-
-* Mon Nov 04 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-38
- Security fix for CVE-2024-9287 (rhbz#2321659)
-
-* Thu Sep 05 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-37
+* Thu Sep 05 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-36
 - Security fix for CVE-2024-6232 (rhbz#2310092)

-* Wed Sep 04 2024 Miroslav Suchý <msuchy@redhat.com> - 3.6.15-36
- convert license to SPDX
-
 * Fri Aug 16 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.6.15-35
 - Security fix for CVE-2024-6923 (rhbz#2303161)

 * Thu Aug 01 2024 Miro Hrončok <mhroncok@redhat.com> - 3.6.15-34
 - Security fix for CVE-2024-6345 (in bundled setuptools wheel)

-* Tue Jul 23 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-33
- Require systemtap-sdt-devel for sys/sdt.h
-
-* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-32
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jul 02 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-31
+* Tue Jul 02 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-29
 - Security fix for CVE-2024-4032 (rhbz#2293394)

-* Wed Apr 24 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-30
+* Wed Apr 24 2024 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-28
 - Security fix for CVE-2024-0450 and CVE-2023-6597

-* Mon Mar 11 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-29
- Support OpenSSL 3
- Fixes: rhbz#2254550
-
-* Thu Mar 07 2024 Miro Hrončok <mhroncok@redhat.com> - 3.6.15-28
- Fix build on riscv64
-
 * Thu Feb 29 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-27
 - Security fix for CVE-2007-4559
 - Fixes: rhbz#2141080

-* Wed Feb 28 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-26
+* Wed Feb 28 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.6.15-23
 - Fix tests for XMLPullParser with Expat 2.6.0

-* Mon Jan 29 2024 Karolina Surma <ksurma@redhat.com> - 3.6.15-25
- Fix test_zlib when building with zlib-ng-compat
-
-* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-24
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-23
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
 * Mon Dec 18 2023 Lumír Balhar <lbalhar@redhat.com> - 3.6.15-22
 - Security fix for CVE-2023-27043 (rhbz#2196191)

--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,22 @@
+---
+- hosts: localhost
+  roles:
+  - role: standard-test-basic
+    tags:
+    - classic
+    repositories:
+    - repo: "https://src.fedoraproject.org/tests/python.git"
+      dest: "python"
+    tests:
+    - smoke:
+        dir: python/smoke
+        run: VERSION=3.6 ./venv.sh
+    - marshalparser:
+        dir: python/marshalparser
+        run: VERSION=3.6 SAMPLE=10 test_marshalparser_compatibility.sh
+    required_packages:
+    - gcc
+    - python3-tox
+    - python3.6
+    - glibc-all-langpacks # for locale tests
+    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
Author	SHA1	Message	Date
Lumir Balhar	0bbcef3a92	Security fix for CVE-2024-6232 (rhbz#2310092)	2024-09-05 22:27:43 +02:00
Tomáš Hrnčiar	2cfab79d11	Security fix for CVE-2024-6923 (rhbz#2303161)	2024-08-16 16:29:30 +02:00
Miro Hrončok	1bb7fee2bb	Security fix for CVE-2024-6345 (in bundled setuptools wheel)	2024-08-02 18:39:05 +02:00
Miro Hrončok	64480d7ccc	Separate patches for wheel from other sources, apply them only --without rpmwheels	2024-08-02 18:37:33 +02:00
Lumir Balhar	be26dc77a7	Security fix for CVE-2024-4032 (rhbz#2293394)	2024-07-03 23:08:45 +02:00
Lumir Balhar	4a51f6d585	Security fix for CVE-2024-0450 and CVE-2023-6597	2024-05-22 16:04:44 +02:00
Charalampos Stratakis	5d9b6ada5c	Security fix for CVE-2007-4559 Fixes: rhzb#2141080	2024-03-07 12:59:27 +01:00
Charalampos Stratakis	8f986fd5ef	Fix tests for XMLPullParser with Expat 2.6.0 See also: https://bugzilla.redhat.com/2264859	2024-02-28 15:45:19 +01:00