Backport TLS 1.3 related fixes to fix FTBFS

Resolves https://bugzilla.redhat.com/show_bug.cgi?id=1609291

python3.spec

@@ -14,7 +14,7 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 Version: %{pybasever}.0
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: Python
 
 
@@ -311,6 +311,15 @@ Patch291: 00291-setup-Link-ctypes-against-dl-explicitly.patch
 # and: https://bugs.python.org/issue34008
 Patch307: 00307-allow-to-call-Py_Main-after-Py_Initialize.patch
 
+# 00308 #
+# TLS 1.3 related fixes from upstream:
+# https://github.com/python/cpython/pull/8762
+# https://github.com/python/cpython/pull/8787
+# And a workaround before openssl is 1.1.1-pre9:
+# https://bugzilla.redhat.com/show_bug.cgi?id=1609291#c12
+# See: https://bugzilla.redhat.com/show_bug.cgi?id=1609291
+Patch308: 00308-tls-1.3.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -633,6 +642,7 @@ rm Lib/ensurepip/_bundled/*.whl
 %patch274 -p1
 %patch291 -p1
 %patch307 -p1
+%patch308 -p1
 
 
 # Remove files that should be generated by the build
@@ -1009,6 +1019,12 @@ CheckPython() {
   ConfName=$1
   ConfDir=$(pwd)/build/$ConfName
 
+  # Fedora sets TLSv1 as explicit minimum version.
+  # Python's test suite assumes that the minimum protocol version is set to
+  # a magic marker. We workaround the test problem by setting:
+  export OPENSSL_CONF=/non-existing-file
+  # https://bugzilla.redhat.com/show_bug.cgi?id=1618753
+
   echo STARTING: CHECKING OF PYTHON FOR CONFIGURATION: $ConfName
 
   # Note that we're running the tests using the version of the code in the
@@ -1512,6 +1528,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Aug 17 2018 Miro Hrončok <mhroncok@redhat.com> - 3.7.0-7
+- Backport TLS 1.3 related fixes to fix FTBFS
+Resolves: rhbz#1609291
+
 * Wed Aug 15 2018 Miro Hrončok <mhroncok@redhat.com> - 3.7.0-6
 - Use RPM built wheels of pip and setuptools in ensurepip instead of our rewheel patch