# ==================

# Top-level metadata

# ==================

Name: python3

Summary: Interpreter of the Python programming language

URL: https://www.python.org/

%global pybasever 3.6

# pybasever without the dot:

%global pyshortver 36

#  WARNING  When rebasing to a new Python version,

#           remember to update the python3-docs package as well

Version: %{pybasever}.8

Release: 51%{?dist}

License: Python

# ==================================

# Conditionals controlling the build

# ==================================

# Note that the bcond macros are named for the CLI option they create.

# "%%bcond_without" means "ENABLE by default and create a --without option"

# Whether to use RPM build wheels from the python-{pip,setuptools}-wheel package

# Uses upstream bundled prebuilt wheels otherwise

%bcond_without rpmwheels

# Expensive optimizations (mainly, profile-guided optimizations)

%bcond_without optimizations

# Run the test suite in %%check

%bcond_without tests

# Extra build for debugging the interpreter or C-API extensions

# (the -debug subpackages)

%bcond_without debug_build

# Support for the GDB debugger

%bcond_without gdb_hooks

# The dbm.gnu module (key-value database)

%bcond_without gdbm

# Main interpreter loop optimization

%bcond_without computed_gotos

# Support for the Valgrind debugger/profiler

%ifarch %{valgrind_arches}

%bcond_without valgrind

%else

# Some arches don't have valgrind, disable support for it there.

%bcond_with valgrind

%endif

# https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names

# For a very long time we have converted "upstream architecture names" to "Fedora names".

# This made sense at the time, see https://github.com/pypa/manylinux/issues/687#issuecomment-666362947

# However, with manylinux wheels popularity growth, this is now a problem.

# Wheels built on a Linux that doesn't do this were not compatible with ours and vice versa.

# We now have a compatibility layer to workaround a problem,

# but we also no longer use the legacy arch names in Fedora 34+.

# This bcond controls the behavior. The defaults should be good for anybody.

%bcond_without legacy_archnames

# ==================================

# Notes from bootstraping Python 3.6

# ==================================

#

# New Python major version (3.X) break ABI and bytecode compatibility,

# so all packages depending on it need to be rebuilt.

#

# Due to a dependency cycle between Python, gdb, rpm, pip, setuptools, wheel,

# and other packages, this isn't straightforward.

# Build in the following order:

#

# 1. At the same time:

#     - gdb without python support (add %%global _without_python 1 on top of

#       gdb's SPEC file)

#     - python-rpm-generators with bootstrapping_python set to 1

#       (this can be done also during step 2., but should be done before 3.)

# 2. python3 without rewheel (use %%bcond_with rewheel instead of

#     %%bcond_without)

# 3. At the same time:

#     - gdb with python support (remove %%global _without_python 1 on top of

#       gdb's SPEC file)

#     - python-rpm-generators with bootstrapping_python set to 0

#       (this can be done at any later step without negative effects)

# 4. rpm

# 5. python-setuptools with bootstrap set to 1

# 6. python-pip with build_wheel set to 0

# 7. python-wheel with %%bcond_without bootstrap

# 8. python-setuptools with bootstrap set to 0 and also with_check set to 0

# 9. python-pip with build_wheel set to 1

# 10. pyparsing

# 11. python3 with rewheel

#

# Then the most important packages have to be built, in dependency order.

# These were:

#   python-sphinx, pytest, python-requests, cloud-init, dnf, anaconda, abrt

#

# After these have been built, a targeted rebuild should be done for the rest.

# =====================

# General global macros

# =====================

%global pylibdir %{_libdir}/python%{pybasever}

%global dynload_dir %{pylibdir}/lib-dynload

# ABIFLAGS, LDVERSION and SOABI are in the upstream configure.ac

# See PEP 3149 for some background: http://www.python.org/dev/peps/pep-3149/

%global ABIFLAGS_optimized m

%global ABIFLAGS_debug     dm

%global LDVERSION_optimized %{pybasever}%{ABIFLAGS_optimized}

%global LDVERSION_debug     %{pybasever}%{ABIFLAGS_debug}

# When we use the upstream arch triplets, we convert them from the legacy ones

# This is reversed in prep when %%with legacy_archnames, so we keep both macros

%global platform_triplet_legacy %{_arch}-linux%{_gnu}

%global platform_triplet_upstream %{expand:%(echo %{platform_triplet_legacy} | sed -E \\

    -e 's/^arm(eb)?-linux-gnueabi$/arm\\1-linux-gnueabihf/' \\

    -e 's/^mips64(el)?-linux-gnu$/mips64\\1-linux-gnuabi64/' \\

    -e 's/^ppc(64)?(le)?-linux-gnu$/powerpc\\1\\2-linux-gnu/')}

%if %{with legacy_archnames}

%global platform_triplet %{platform_triplet_legacy}

%else

%global platform_triplet %{platform_triplet_upstream}

%endif

%global SOABI_optimized cpython-%{pyshortver}%{ABIFLAGS_optimized}-%{platform_triplet}

%global SOABI_debug     cpython-%{pyshortver}%{ABIFLAGS_debug}-%{platform_triplet}

# All bytecode files are in a __pycache__ subdirectory, with a name

# reflecting the version of the bytecode.

# See PEP 3147: http://www.python.org/dev/peps/pep-3147/

# For example,

#   foo/bar.py

# has bytecode at:

#   foo/__pycache__/bar.cpython-%%{pyshortver}.pyc

#   foo/__pycache__/bar.cpython-%%{pyshortver}.opt-1.pyc

#   foo/__pycache__/bar.cpython-%%{pyshortver}.opt-2.pyc

%global bytecode_suffixes .cpython-%{pyshortver}*.pyc

# Python's configure script defines SOVERSION, and this is used in the Makefile

# to determine INSTSONAME, the name of the libpython DSO:

#   LDLIBRARY='libpython$(VERSION).so'

#   INSTSONAME="$LDLIBRARY".$SOVERSION

# We mirror this here in order to make it easier to add the -gdb.py hooks.

# (if these get out of sync, the payload of the libs subpackage will fail

# and halt the build)

%global py_SOVERSION 1.0

%global py_INSTSONAME_optimized libpython%{LDVERSION_optimized}.so.%{py_SOVERSION}

%global py_INSTSONAME_debug     libpython%{LDVERSION_debug}.so.%{py_SOVERSION}

# Disable automatic bytecompilation. The python3 binary is not yet be

# available in /usr/bin when Python is built. Also, the bytecompilation fails

# on files that test invalid syntax.

%undefine py_auto_byte_compile

# For multilib support, files that are different between 32- and 64-bit arches

# need different filenames. Use "64" or "32" according to the word size.

# Currently, the best way to determine an architecture's word size happens to

# be checking %%{_lib}.

%if "%{_lib}" == "lib64"

%global wordsize 64

%else

%global wordsize 32

%endif

# =======================

# Build-time requirements

# =======================

# (keep this list alphabetized)

BuildRequires: autoconf

BuildRequires: bluez-libs-devel

BuildRequires: bzip2

BuildRequires: bzip2-devel

BuildRequires: desktop-file-utils

BuildRequires: expat-devel

BuildRequires: findutils

BuildRequires: gcc-c++

%if %{with gdbm}

BuildRequires: gdbm-devel >= 1:1.13

%endif

BuildRequires: git-core

BuildRequires: glibc-devel

BuildRequires: gmp-devel

BuildRequires: libappstream-glib

BuildRequires: libffi-devel

BuildRequires: libnsl2-devel

BuildRequires: libtirpc-devel

BuildRequires: libGL-devel

BuildRequires: libX11-devel

BuildRequires: ncurses-devel

BuildRequires: openssl-devel

BuildRequires: pkgconfig

BuildRequires: readline-devel

BuildRequires: redhat-rpm-config >= 118

BuildRequires: sqlite-devel

BuildRequires: gdb

BuildRequires: tar

BuildRequires: tcl-devel

BuildRequires: tix-devel

BuildRequires: tk-devel

%if %{with valgrind}

BuildRequires: valgrind-devel

%endif

BuildRequires: xz-devel

BuildRequires: zlib-devel

BuildRequires: /usr/bin/dtrace

# workaround http://bugs.python.org/issue19804 (test_uuid requires ifconfig)

BuildRequires: /usr/sbin/ifconfig

%if %{with rpmwheels}

BuildRequires: python3-setuptools-wheel

BuildRequires: python3-pip-wheel

# Verify that the BuildRoot includes python36.

# Not actually needed for build.

BuildRequires: python36-devel

%endif

# =======================

# Source code and patches

# =======================

# The upstream tarball includes questionable executable files for Windows,

# which we should not ship even in the SRPM.

# Run the "get-source.sh" with the version as argument to download the upstream

# tarball and generate a version with the .exe files removed. For example:

# $ ./get-source.sh 3.7.0

Source: Python-%{version}-noexe.tar.xz

# A script to remove .exe files from the source distribution

Source1: get-source.sh

# A simple script to check timestamps of bytecode files

# Run in check section with Python that is currently being built

# Written by bkabrda

Source8: check-pyc-and-pyo-timestamps.py

# Desktop menu entry for idle3

Source10: idle3.desktop

# AppData file for idle3

Source11: idle3.appdata.xml

# unversioned-python script

Source12: no-python

# unversioned-python man page

Source13: unversioned-python.1

# 00001 #

# Fixup distutils/unixccompiler.py to remove standard library path from rpath:

# Was Patch0 in ivazquez' python3000 specfile:

Patch1:         00001-rpath.patch

# 00102 #

# Change the various install paths to use /usr/lib64/ instead or /usr/lib

# Only used when "%%{_lib}" == "lib64"

# Not yet sent upstream.

Patch102: 00102-lib64.patch

# 00111 #

# Patch the Makefile.pre.in so that the generated Makefile doesn't try to build

# a libpythonMAJOR.MINOR.a

# See https://bugzilla.redhat.com/show_bug.cgi?id=556092

# Downstream only: not appropriate for upstream

Patch111: 00111-no-static-lib.patch

# 00132 #

# Add non-standard hooks to unittest for use in the "check" phase below, when

# running selftests within the build:

#   @unittest._skipInRpmBuild(reason)

# for tests that hang or fail intermittently within the build environment, and:

#   @unittest._expectedFailureInRpmBuild

# for tests that always fail within the build environment

#

# The hooks only take effect if WITHIN_PYTHON_RPM_BUILD is set in the

# environment, which we set manually in the appropriate portion of the "check"

# phase below (and which potentially other python-* rpms could set, to reuse

# these unittest hooks in their own "check" phases)

Patch132: 00132-add-rpmbuild-hooks-to-unittest.patch

# 00155 #

# Avoid allocating thunks in ctypes unless absolutely necessary, to avoid

# generating SELinux denials on "import ctypes" and "import uuid" when

# embedding Python within httpd

# See https://bugzilla.redhat.com/show_bug.cgi?id=814391

Patch155: 00155-avoid-ctypes-thunks.patch

# 00160 #

# Python 3.3 added os.SEEK_DATA and os.SEEK_HOLE, which may be present in the

# header files in the build chroot, but may not be supported in the running

# kernel, hence we disable this test in an rpm build.

# Adding these was upstream issue http://bugs.python.org/issue10142

# Not yet sent upstream

Patch160: 00160-disable-test_fs_holes-in-rpm-build.patch

# 00163 #

# Some tests within test_socket fail intermittently when run inside Koji;

# disable them using unittest._skipInRpmBuild

# Not yet sent upstream

Patch163: 00163-disable-parts-of-test_socket-in-rpm-build.patch

# 00170 #

# In debug builds, try to print repr() when a C-level assert fails in the

# garbage collector (typically indicating a reference-counting error

# somewhere else e.g in an extension module)

# The new macros/functions within gcmodule.c are hidden to avoid exposing

# them within the extension API.

# Sent upstream: http://bugs.python.org/issue9263

# See https://bugzilla.redhat.com/show_bug.cgi?id=614680

Patch170: 00170-gc-assertions.patch

# 00189 #

# Instead of bundled wheels, use our RPM packaged wheels from

# /usr/share/python3-wheels

Patch189: 00189-use-rpm-wheels.patch

# 00251

# Set values of prefix and exec_prefix in distutils install command

# to /usr/local if executable is /usr/bin/python* and RPM build

# is not detected to make pip and distutils install into separate location

# Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe

Patch251: 00251-change-user-install-location.patch

# 00257 #

# Use the monotonic clock for threading.Condition.wait() as to not be affected by

# the system clock changes.

# This patch works around the issue.

# Implemented by backporting the respective python2 code:

# https://github.com/python/cpython/blob/v2.7.18/Lib/threading.py#L331

# along with our downstream patch for python2 fixing the same issue.

# Downstream only.

Patch257: 00257-threading-condition-wait.patch

# 00262 #

# Backport of PEP 538: Coercing the legacy C locale to a UTF-8 based locale

# https://www.python.org/dev/peps/pep-0538/

# Fedora Change: https://fedoraproject.org/wiki/Changes/python3_c.utf-8_locale

# Original proposal: https://bugzilla.redhat.com/show_bug.cgi?id=1404918

Patch262: 00262-pep538_coerce_legacy_c_locale.patch

# 00294 #

# Define TLS cipher suite on build time depending

# on the OpenSSL default cipher suite selection.

# Fixed upstream on CPython's 3.7 branch:

# https://bugs.python.org/issue31429

# See also: https://bugzilla.redhat.com/show_bug.cgi?id=1489816

Patch294: 00294-define-TLS-cipher-suite-on-build-time.patch

# 00316 #

# We remove the exe files from distutil's bdist_wininst

# So we mark the command as unsupported - and the tests are skipped

# Fixed upstream and backported from the 3.7 branch: https://bugs.python.org/issue10945

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1754040

Patch316: 00316-mark-bdist_wininst-unsupported.patch

# 00317 #

# Security fix for CVE-2019-5010: Fix segfault in ssl's cert parser

# https://bugzilla.redhat.com/show_bug.cgi?id=1666789

# Fixed upstream: https://bugs.python.org/issue35746

Patch317: 00317-CVE-2019-5010.patch

# 00318 #

# Various fixes for TLS 1.3 and OpenSSL 1.1.1

# https://bugzilla.redhat.com/show_bug.cgi?id=1639531

# test_ssl fixes for TLS 1.3 and OpenSSL 1.1.1

# https://bugs.python.org/issue32947#msg333990

# https://github.com/python/cpython/pull/11612

# Encrypt private key test files with AES256

# https://bugs.python.org/issue38271

# https://github.com/python/cpython/pull/16396

# Prefer PROTOCOL_TLS_CLIENT/SERVER (partial backport)

# https://bugs.python.org/issue31346

# https://github.com/python/cpython/pull/3058

# Enable TLS 1.3 in tests (partial backport)

# https://bugs.python.org/issue33618

# https://github.com/python/cpython/pull/7082

# OpenSSL 1.1.1-pre1 / TLS 1.3 fixes (partial backport)

# https://bugs.python.org/issue32947

# https://github.com/python/cpython/pull/5923

Patch318: 00318-fixes-for-tls-13.patch

# 00319 #

# Fix test_tarfile on ppc64

# https://bugzilla.redhat.com/show_bug.cgi?id=1639490

# https://bugs.python.org/issue35772

Patch319: 00319-test_tarfile_ppc64.patch

# 00320 #

# Security fix for CVE-2019-9636 and CVE-2019-10160: Information Disclosure due to urlsplit improper NFKC normalization

# Fixed upstream: https://bugs.python.org/issue36216 and https://bugs.python.org/issue36742

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1689318

Patch320: 00320-CVE-2019-9636-and-CVE-2019-10160.patch

# 00324 #

# Disallow control chars in http URLs

# Security fix for CVE-2019-9740 and CVE-2019-9947

# Fixed upstream: https://bugs.python.org/issue30458

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1704365

# and https://bugzilla.redhat.com/show_bug.cgi?id=1703531

Patch324: 00324-disallow-control-chars-in-http-urls.patch

# 00325 #

# Unnecessary URL scheme exists to allow local_file:// reading file  in urllib

# Security fix for CVE-2019-9948

# Fixed upstream: https://bugs.python.org/issue35907

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1714643

Patch325: 00325-CVE-2019-9948.patch

# 00326 #

# Don't set the post-handshake authentication verify flag on client side

# on TLS 1.3, as it also implicitly enables cert chain validation and an

# SSL/TLS connection will fail when verify mode is set to CERT_NONE.

# Fixed upstream: https://bugs.python.org/issue37428

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1725721

Patch326: 00326-do-not-set-PHA-verify-flag-on-client-side.patch

# 00327 #

# Enable TLS 1.3 post-handshake authentication in http.client for default

# context or if a cert_file is passed to HTTPSConnection

# Fixed upstream: https://bugs.python.org/issue37440

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1671353

Patch327: 00327-enable-tls-1.3-PHA-in-http.client.patch

# 00329 #

# Support OpenSSL FIPS mode

# - Fallback implementations md5, sha1, sha256, sha512 are removed in favor of OpenSSL wrappers

# - In FIPS mode, OpenSSL wrappers are always used in hashlib

# - add a new "usedforsecurity" keyword argument to the various digest

#   algorithms in hashlib so that you can whitelist a callsite with

#   "usedforsecurity=False"

#   The change has been implemented upstream since Python 3.9:

#   https://bugs.python.org/issue9216

# - OpenSSL wrappers for the hashes blake2{b512,s256},

#     sha3_{224,256,384,512}, shake_{128,256} are now exported from _hashlib

# - In FIPS mode, the blake2, sha3 and shake hashes use OpenSSL wrappers

#   and do not offer extended functionality (keys, tree hashing, custom digest size)

# - In FIPS mode, hmac.HMAC can only be instantiated with an OpenSSL wrapper

#   or an string with OpenSSL hash name as the "digestmod" argument.

#   The argument must be specified (instead of defaulting to ‘md5’).

#

# - Also while in FIPS mode, we utilize OpenSSL's DRBG and disable the

#   os.getrandom() function.

#

#   Upstream changes that have also been backported with this patch

#   to allow tests to pass on stricter environments:

#

#   Avoid MD5 or check for MD5 availablity

#   https://bugs.python.org/issue38270

#   https://github.com/python/cpython/pull/16393

#   https://github.com/python/cpython/pull/16437

#   https://github.com/python/cpython/pull/17446

#

#   add usedforsecurity to hashlib constructors (partial backport for fixing a uuid test)

#   https://github.com/python/cpython/pull/16044

# Resolves: rhbz#1731424

Patch329: 00329-fips.patch

# 00330 #

# Fix CVE-2018-20852: cookie domain check returning incorrect results

# Fixed upstream: https://bugs.python.org/issue35121

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1741553

Patch330: 00330-CVE-2018-20852.patch

# 00332 #

# Fix CVE-2019-16056: Don't parse email addresses containing

# multiple '@' characters.

# Fixed upstream: https://bugs.python.org/issue34155

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1750776

Patch332: 00332-CVE-2019-16056.patch

# 00333 #

# Reduce the number of tests run during the profile guided optimizations build,

# as running the whole test suite during profiling increases the build time

# substantially, with negligible performance gain.

# Fixed upstream and backported from the 3.8 branch:

# https://bugs.python.org/issue36044

# https://bugs.python.org/issue37667

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749576

Patch333: 00333-reduce-pgo-tests.patch

# 00338 #

# Fix test_gdb for when compiling python with Link Time Optimizations

# Fixed upstream: https://bugs.python.org/issue38239

Patch338: 00338-fix-test_gdb-for-LTO.patch

# 00344 #

# Fix CVE-2019-16935: XSS vulnerability in the ocumentation XML-RPC server in server_title field

# Fixed upstream: https://bugs.python.org/issue38243

# Resolves: https://bugzilla.redhat.com/how_bug.cgi?id=1798001

Patch344: 00344-CVE-2019-16935.patch

# 00345 #

# Skip from test_site the test_startup_imports case if a path of sys.path

# contains a .pth file

# Fixed upstream: https://bugs.python.org/issue27807

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1814392

Patch345: 00345-fix-test_site-with-extra-pth-files.patch

# 00346 #

# Fix CVE-2020-8492: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS

# Fixed upstream: https://bugs.python.org/issue39503

# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1810618

Patch346: 00346-CVE-2020-8492.patch

# 00351 #

# Avoid infinite loop when reading specially crafted TAR files using the tarfile module

# (CVE-2019-20907).

# See: https://bugs.python.org/issue39017

Patch351: 00351-avoid-infinite-loop-in-the-tarfile-module.patch

# 00352 # 5253c417a23b3658fa115d2c72fa54b20293a31c

# Resolve hash collisions for IPv4Interface and IPv6Interface

#

# CVE-2020-14422

# The hash() methods of classes IPv4Interface and IPv6Interface had issue

# of generating constant hash values of 32 and 128 respectively causing hash collisions.

# The fix uses the hash() function to generate hash values for the objects

# instead of XOR operation.

# Fixed upstream: https://bugs.python.org/issue41004

Patch352: 00352-resolve-hash-collisions-for-ipv4interface-and-ipv6interface.patch

# 00353 #

# Original names for architectures with different names downstream

#

# https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names

#

# Pythons in RHEL/Fedora used different names for some architectures

# than upstream and other distros (for example ppc64 vs. powerpc64).

# This was patched in patch 274, now it is sedded if %%with legacy_archnames.

#

# That meant that an extension built with the default upstream settings

# (on other distro or as an manylinux wheel) could not been found by Python

# on RHEL/Fedora because it had a different suffix.

# This patch adds the legacy names to importlib so Python is able

# to import extensions with a legacy architecture name in its

# file name.

# It work both ways, so it support both %%with and %%without legacy_archnames.

#

# WARNING: This patch has no effect on Python built with bootstrap

# enabled because Python/importlib_external.h is not regenerated

# and therefore Python during bootstrap contains importlib from

# upstream without this feature. It's possible to include

# Python/importlib_external.h to this patch but it'd make rebasing

# a nightmare because it's basically a binary file.

Patch353: 00353-architecture-names-upstream-downstream.patch

# 00354 #

# Reject control chars in HTTP method in http.client to prevent

# HTTP header injection

# Fixed ustream: https://bugs.python.org/issue39603

Patch354: 00354-cve-2020-26116-http-request-method-crlf-injection-in-httplib.patch

# 00355 #

# No longer call eval() on content received via HTTP in the CJK codec tests

# Fixed upstream: https://bugs.python.org/issue41944

Patch355: 00355-CVE-2020-27619.patch

# 00356 #

# options -a and -k for pathfix.py used in %%py3_shebang_fix

# Upstream: https://github.com/python/cpython/commit/c71c54c62600fd721baed3c96709e3d6e9c33817

Patch356: 00356-k_and_a_options_for_pathfix.patch

# 00357 #

# CVE-2021-3177 stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c

# Upstream: https://bugs.python.org/issue42938

# Main BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1918168

Patch357: 00357-CVE-2021-3177.patch

# 00359 #

# CVE-2021-23336 python: Web Cache Poisoning via urllib.parse.parse_qsl and

# urllib.parse.parse_qs by using a semicolon in query parameters

# Upstream: https://bugs.python.org/issue42967

# Main BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1928904

Patch359: 00359-CVE-2021-23336.patch

# 00360 #

# CVE-2021-3426: information disclosure via pydoc

# Upstream: https://bugs.python.org/issue42988

# Main BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1935913

Patch360: 00360-CVE-2021-3426.patch

# 00362 #

# The threading.enumerate() function now uses a reentrant lock to

# prevent a hang on reentrant call.

# Upstream: https://bugs.python.org/issue44422

# Main BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1959459

Patch362: 00362-threading-enumerate-rlock.patch

# 00364 #

# Don't call PyThread_exit_thread() explicitly.

# Upstream: https://bugs.python.org/issue44434

# Main BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1972293

Patch364: 00364-thread-exit.patch

# 00366 #

# CVE-2021-3733: Denial of service when identifying crafted invalid RFCs

# Upstream: https://bugs.python.org/issue43075

# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=1995234

Patch366: 00366-CVE-2021-3733.patch

# 00368 #

# CVE-2021-3737: client can enter an infinite loop on a 100 Continue response from the server

# Upstream: https://bugs.python.org/issue44022

# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=1995162

Patch368: 00368-CVE-2021-3737.patch

# 00369 #

# Change shouldRollover() methods of logging.handlers to only rollover regular files and not devices

# Upstream: https://bugs.python.org/issue45401

# Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2009200

Patch369: 00369-rollover-only-regular-files-in-logging-handlers.patch

# 00370 #

# Utilize the monotonic clock for the global interpreter lock instead of the real-time clock

# to avoid issues when the system time changes

# Upstream: https://bugs.python.org/issue12822

# Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2003758

Patch370: 00370-GIL-monotonic-clock.patch

# 00372 #

# CVE-2021-4189: ftplib should not use the host from the PASV response

# Upstream: https://bugs.python.org/issue43285

# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=2036020

Patch372: 00372-CVE-2021-4189.patch

# 00377 #

# CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs

#

# ASCII newline and tab characters are stripped from the URL.

#

# Upstream: https://bugs.python.org/issue43882

# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=2047376

Patch377: 00377-CVE-2022-0391.patch

# 00378 #

# Support expat 2.4.5

#

# Curly brackets were never allowed in namespace URIs

# according to RFC 3986, and so-called namespace-validating

# XML parsers have the right to reject them a invalid URIs.

#

# libexpat >=2.4.5 has become strcter in that regard due to

# related security issues; with ET.XML instantiating a

# namespace-aware parser under the hood, this test has no

# future in CPython.

#

# References:

# - https://datatracker.ietf.org/doc/html/rfc3968

# - https://www.w3.org/TR/xml-names/

#

# Also, test_minidom.py: Support Expat >=2.4.5

#

# The patch has diverged from upstream as the python test

# suite was relying on checking the expat version, whereas

# in RHEL fixes get backported instead of rebasing packages.

# 

# Upstream: https://bugs.python.org/issue46811

Patch378: 00378-support-expat-2-4-5.patch

# 00382 #

# CVE-2015-20107

#

# Make mailcap refuse to match unsafe filenames/types/params (GH-91993)

#

# Upstream: https://github.com/python/cpython/issues/68966

#

# Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390

Patch382: 00382-cve-2015-20107.patch

# 00386 #

# CVE-2021-28861

#

# Fix an open redirection vulnerability in the `http.server` module when

# an URI path starts with `//` that could produce a 301 Location header

# with a misleading target.  Vulnerability discovered, and logic fix

# proposed, by Hamza Avvan (@hamzaavvan).

#

# Test and comments authored by Gregory P. Smith [Google].

#

# Upstream: https://github.com/python/cpython/pull/93879

# Tracking bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2120642

Patch386: 00386-cve-2021-28861.patch

# 00387 #

# CVE-2020-10735: Prevent DoS by very large int()

#

# gh-95778: CVE-2020-10735: Prevent DoS by very large int() (GH-96504)

#

# Converting between `int` and `str` in bases other than 2

# (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now

# raises a `ValueError` if the number of digits in string form is above a

# limit to avoid potential denial of service attacks due to the algorithmic