# ======================================================

# Conditionals and other variables controlling the build

# ======================================================

%{!?scl:%global pkg_name %{name}}

%{?scl:%scl_package python}

# Turn off default SCL bytecompiling.

%{?scl:%global _turn_off_bytecompile 1}

%global pybasever 3.3

# pybasever without the dot:

%global pyshortver 33

%global pylibdir %{_libdir}/python%{pybasever}

%global dynload_dir %{pylibdir}/lib-dynload

# SOABI is defined in the upstream configure.in from Python-3.2a2 onwards,

# for PEP 3149:

#   http://www.python.org/dev/peps/pep-3149/

# ("configure.in" became "configure.ac" in Python 3.3 onwards, and in

# backports)

# ABIFLAGS, LDVERSION and SOABI are in the upstream Makefile

# With Python 3.3, we lose the "u" suffix due to PEP 393

%global ABIFLAGS_optimized m

%global ABIFLAGS_debug     dm

%global LDVERSION_optimized %{pybasever}%{ABIFLAGS_optimized}

%global LDVERSION_debug     %{pybasever}%{ABIFLAGS_debug}

%global SOABI_optimized cpython-%{pyshortver}%{ABIFLAGS_optimized}

%global SOABI_debug     cpython-%{pyshortver}%{ABIFLAGS_debug}

# All bytecode files are now in a __pycache__ subdirectory, with a name

# reflecting the version of the bytecode (to permit sharing of python libraries

# between different runtimes)

# See http://www.python.org/dev/peps/pep-3147/

# For example,

#   foo/bar.py

# now has bytecode at:

#   foo/__pycache__/bar.cpython-33.pyc

#   foo/__pycache__/bar.cpython-33.pyo

%global bytecode_suffixes .cpython-33.py?

# Python's configure script defines SOVERSION, and this is used in the Makefile

# to determine INSTSONAME, the name of the libpython DSO:

#   LDLIBRARY='libpython$(VERSION).so'

#   INSTSONAME="$LDLIBRARY".$SOVERSION

# We mirror this here in order to make it easier to add the -gdb.py hooks.

# (if these get out of sync, the payload of the libs subpackage will fail

# and halt the build)

%global py_SOVERSION 1.0

%global py_INSTSONAME_optimized libpython%{LDVERSION_optimized}.so.%{py_SOVERSION}

%global py_INSTSONAME_debug     libpython%{LDVERSION_debug}.so.%{py_SOVERSION}

%global with_debug_build 1

%global with_gdb_hooks 1

%global with_systemtap 1

# some arches don't have valgrind so we need to disable its support on them

%ifarch %{ix86} x86_64 ppc ppc64 s390x

%global with_valgrind 1

%else

%global with_valgrind 0

%endif

%global with_gdbm 1

# Change from yes to no to turn this off

%global with_computed_gotos yes

# Turn this to 0 to turn off the "check" phase:

%global run_selftest_suite 1

# We want to byte-compile the .py files within the packages using the new

# python3 binary.

# 

# Unfortunately, rpmbuild's infrastructure requires us to jump through some

# hoops to avoid byte-compiling with the system python 2 version:

#   /usr/lib/rpm/redhat/macros sets up build policy that (amongst other things)

# defines __os_install_post.  In particular, "brp-python-bytecompile" is

# invoked without an argument thus using the wrong version of python

# (/usr/bin/python, rather than the freshly built python), thus leading to

# numerous syntax errors, and incorrect magic numbers in the .pyc files.  We

# thus override __os_install_post to avoid invoking this script:

%global __os_install_post /usr/lib/rpm/brp-%{?scl:scl-}compress %{?_scl_root} \

  %{!?__debug_package:/usr/lib/rpm/redhat/brp-strip %{__strip}} \

  /usr/lib/rpm/redhat/brp-strip-static-archive %{__strip} \

  /usr/lib/rpm/redhat/brp-strip-comment-note %{__strip} %{__objdump} \

  /usr/lib/rpm/redhat/brp-python-hardlink

# to remove the invocation of brp-python-bytecompile, whilst keeping the

# invocation of brp-python-hardlink (since this should still work for python3

# pyc/pyo files)

# We need to get a newer configure generated out of configure.in for the following

# patches:

#   patch 55 (systemtap)

#   patch 113 (more config flags)

#

# For patch 55 (systemtap), we need to get a new header for configure to use

#

# configure.in requires autoconf-2.65, but the version in Fedora is currently

# autoconf-2.66

#

# For now, we'll generate a patch to the generated configure script and

# pyconfig.h.in on a machine that has a local copy of autoconf 2.65

#

# Instructions on obtaining such a copy can be seen at

#   http://bugs.python.org/issue7997

#

# To make it easy to regenerate the patch, this specfile can be run in two

# ways:

# (i) regenerate_autotooling_patch  0 : the normal approach: prep the

# source tree using a pre-generated patch to the "configure" script, and do a

# full build

# (ii) regenerate_autotooling_patch 1 : intended to be run on a developer's

# workstation: prep the source tree without patching configure, then rerun a

# local copy of autoconf-2.65, regenerate the patch, then exit, without doing

# the rest of the build

%global regenerate_autotooling_patch 0

# ==================

# Top-level metadata

# ==================

Summary: Version 3 of the Python programming language aka Python 3000

Name: %{?scl_prefix}python

Version: %{pybasever}.2

Release: 16%{?dist}

License: Python

Group: Development/Languages

# =======================

# Build-time requirements

# =======================

# (keep this list alphabetized)

%{?scl:BuildRequires: %{scl}-runtime}

BuildRequires: autoconf

BuildRequires: bluez-libs-devel

BuildRequires: bzip2

BuildRequires: bzip2-devel

# expat 2.1.0 added the symbol XML_SetHashSalt without bumping SONAME.  We use

# it (in pyexpat) in order to enable the fix in Python-3.2.3 for CVE-2012-0876:

# SCL: rhel has older but fixed version, no need to depend on 2.1.0

BuildRequires: expat-devel

BuildRequires: findutils

BuildRequires: gcc-c++

%if %{with_gdbm}

BuildRequires: gdbm-devel

%endif

BuildRequires: glibc-devel

BuildRequires: gmp-devel

BuildRequires: libdb-devel

BuildRequires: libffi-devel

BuildRequires: libGL-devel

BuildRequires: libX11-devel

BuildRequires: ncurses-devel

BuildRequires: openssl-devel

BuildRequires: pkgconfig

BuildRequires: readline-devel

BuildRequires: sqlite-devel

%if 0%{?with_systemtap}

BuildRequires: systemtap-sdt-devel

# (this introduces a dependency on "python", in that systemtap-sdt-devel's

# /usr/bin/dtrace is a python 2 script)

%global tapsetdir      %{_datadir}/systemtap/tapset

%endif # with_systemtap

BuildRequires: tar

BuildRequires: tcl-devel

BuildRequires: tix-devel

BuildRequires: tk-devel

%if 0%{?with_valgrind}

BuildRequires: valgrind-devel

%endif

BuildRequires: xz-devel

BuildRequires: zlib-devel

# =======================

# Source code and patches

# =======================

Source: http://www.python.org/ftp/python/%{version}/Python-%{version}.tar.xz

# Supply various useful macros for building python 3 modules:

#  __python3, python3_sitelib, python3_sitearch

Source2: macros.python3

# Supply an RPM macro "py_byte_compile" for the python3-devel subpackage

# to enable specfiles to selectively byte-compile individual files and paths

# with different Python runtimes as necessary:

Source3: macros.pybytecompile

# Systemtap tapset to make it easier to use the systemtap static probes

# (actually a template; LIBRARY_PATH will get fixed up during install)

# Written by dmalcolm; not yet sent upstream

Source5: libpython.stp

# Example systemtap script using the tapset

# Written by wcohen, mjw, dmalcolm; not yet sent upstream

Source6: systemtap-example.stp

# Another example systemtap script that uses the tapset

# Written by dmalcolm; not yet sent upstream

Source7: pyfuntop.stp

# SCL-custom version of pythondeps.sh

# Append 33 to not collide with python27 SCL

Source8: pythondeps-scl-33.sh

# Append 33 for the same reason here

Source9: brp-python-bytecompile-with-scl-python-33

# Fixup distutils/unixccompiler.py to remove standard library path from rpath:

# Was Patch0 in ivazquez' python3000 specfile:

Patch1:         Python-3.1.1-rpath.patch

# Some tests were removed due to audiotest.au not being packaged. This was

# however added to the archive in 3.3.1, so we no longer delete the tests.

#  Patch3: 00003-remove-mimeaudio-tests.patch

# 00055 #

# Systemtap support: add statically-defined probe points

# Patch sent upstream as http://bugs.python.org/issue14776

# with some subsequent reworking to cope with LANG=C in an rpmbuild

# (where sys.getfilesystemencoding() == 'ascii')

Patch55: 00055-systemtap.patch

Patch102: python-3.3.0b1-lib64.patch

# 00104 #

# Only used when "%{_lib}" == "lib64"

# Another lib64 fix, for distutils/tests/test_install.py; not upstream:

Patch104: 00104-lib64-fix-for-test_install.patch

# 00111 #

# Patch the Makefile.pre.in so that the generated Makefile doesn't try to build

# a libpythonMAJOR.MINOR.a (bug 550692):

# Downstream only: not appropriate for upstream

Patch111: 00111-no-static-lib.patch

# 00112 #

# Patch112: python-2.7rc1-debug-build.patch: this is not relevant to Python 3,

# for 3.2 onwards

# 00113 #

# Add configure-time support for the COUNT_ALLOCS and CALL_PROFILE options

# described at http://svn.python.org/projects/python/trunk/Misc/SpecialBuilds.txt

# so that if they are enabled, they will be in that build's pyconfig.h, so that

# extension modules will reliably use them

# Not yet sent upstream

Patch113: 00113-more-configuration-flags.patch

# 00114 #

# Add flags for statvfs.f_flag to the constant list in posixmodule (i.e. "os")

# (rhbz:553020); partially upstream as http://bugs.python.org/issue7647

# Not yet sent upstream

Patch114: 00114-statvfs-f_flag-constants.patch

# 00125 #

# COUNT_ALLOCS is useful for debugging, but the upstream behaviour of always

# emitting debug info to stdout on exit is too verbose and makes it harder to

# use the debug build.  Add a "PYTHONDUMPCOUNTS" environment variable which

# must be set to enable the output on exit

# Not yet sent upstream

Patch125: 00125-less-verbose-COUNT_ALLOCS.patch

# In my koji builds, /root/bin is in the PATH for some reason

# This leads to test_subprocess.py failing, due to "test_leaking_fds_on_error"

# trying every dir in PATH for "nonexisting_i_hope", which leads to it raising

#  OSError: [Errno 13] Permission denied

# when it tries to read /root/bin, rather than raising "No such file"

#

# Work around this by specifying an absolute path for the non-existant

# executable

# Not yet sent upstream

Patch129: python-3.2.1-fix-test-subprocess-with-nonreadable-path-dir.patch

# 00130 #

# Python 2's:

#   Patch130: python-2.7.2-add-extension-suffix-to-python-config.patch

# is not relevant to Python 3 (for 3.2 onwards)

# 00131 #

# The four tests in test_io built on top of check_interrupted_write_retry

# fail when built in Koji, for ppc and ppc64; for some reason, the SIGALRM

# handlers are never called, and the call to write runs to completion

# (rhbz#732998)

Patch131: 00131-disable-tests-in-test_io.patch

# 00132 #

# Add non-standard hooks to unittest for use in the "check" phase below, when

# running selftests within the build:

#   @unittest._skipInRpmBuild(reason)

# for tests that hang or fail intermittently within the build environment, and:

#   @unittest._expectedFailureInRpmBuild

# for tests that always fail within the build environment

#

# The hooks only take effect if WITHIN_PYTHON_RPM_BUILD is set in the

# environment, which we set manually in the appropriate portion of the "check"

# phase below (and which potentially other python-* rpms could set, to reuse

# these unittest hooks in their own "check" phases)

Patch132: 00132-add-rpmbuild-hooks-to-unittest.patch

# 00133 #

# 00133-skip-test_dl.patch is not relevant for python3: the "dl" module no

# longer exists

# 00134 #

# Fix a failure in test_sys.py when configured with COUNT_ALLOCS enabled

# Not yet sent upstream

Patch134: 00134-fix-COUNT_ALLOCS-failure-in-test_sys.patch

# 00135 #

# test_weakref's test_callback_in_cycle_resurrection doesn't work with

# COUNT_ALLOCS, as the metrics keep "C" alive.  Work around this for our

# debug build:

# Not yet sent upstream

Patch135: 00135-fix-test-within-test_weakref-in-debug-build.patch

# 00136 #

# Patch136: 00136-skip-tests-of-seeking-stdin-in-rpmbuild.patch does not seem

# to be needed by python3

# 00137 #

# Some tests within distutils fail when run in an rpmbuild:

Patch137: 00137-skip-distutils-tests-that-fail-in-rpmbuild.patch

# 00138 #

# Patch138: 00138-fix-distutils-tests-in-debug-build.patch is not relevant for

# python3

# 00139 #

# ARM-specific: skip known failure in test_float:

#  http://bugs.python.org/issue8265 (rhbz#706253)

Patch139: 00139-skip-test_float-known-failure-on-arm.patch

# 00140 #

# Patch140: 00140-skip-test_ctypes-known-failure-on-sparc.patch does not appear

# to be relevant for python3

# 00141 #

# Fix test_gc's test_newinstance case when configured with COUNT_ALLOCS:

# Not yet sent upstream

Patch141: 00141-fix-test_gc_with_COUNT_ALLOCS.patch

# 00142 #

# Some pty tests fail when run in mock (rhbz#714627):

Patch142: 00142-skip-failing-pty-tests-in-rpmbuild.patch

# 00143 #

# Fix the --with-tsc option on ppc64, and rework it on 32-bit ppc to avoid

# aliasing violations (rhbz#698726)

# Sent upstream as http://bugs.python.org/issue12872

Patch143: 00143-tsc-on-ppc.patch

# 00144 #

# (Optionally) disable the gdbm module:

# python.spec's

#   Patch144: 00144-no-gdbm.patch

# is not needed in python3.spec

# 00145 #

# python.spec's

#   Patch145: 00145-force-sys-platform-to-be-linux2.patch

# is upstream for Python 3 as of 3.2.2

# 00146 #

# Support OpenSSL FIPS mode (e.g. when OPENSSL_FORCE_FIPS_MODE=1 is set)

# - handle failures from OpenSSL (e.g. on attempts to use MD5 in a

#   FIPS-enforcing environment)

# - add a new "usedforsecurity" keyword argument to the various digest

#   algorithms in hashlib so that you can whitelist a callsite with

#   "usedforsecurity=False"

# (sent upstream for python 3 as http://bugs.python.org/issue9216 ; see RHEL6

# python patch 119)

# - enforce usage of the _hashlib implementation: don't fall back to the _md5

#   and _sha* modules (leading to clearer error messages if fips selftests

#   fail)

# - don't build the _md5 and _sha* modules; rely on the _hashlib implementation

#   of hashlib

# (rhbz#563986)

Patch146: 00146-hashlib-fips.patch

# 00147 #

# Add a sys._debugmallocstats() function

# Sent upstream as http://bugs.python.org/issue14785

# Upstream as of Python 3.3.0

#  Patch147: 00147-add-debug-malloc-stats.patch

# 00148 #

# Upstream as of Python 3.2.3:

#  Patch148: 00148-gdbm-1.9-magic-values.patch

# 00149 #

# Upstream as of Python 3.2.3:

#  Patch149: 00149-backport-issue11254-pycache-bytecompilation-fix.patch

# 00150 #

# temporarily disable rAssertAlmostEqual in test_cmath on PPC (bz #750811)

# caused by a glibc bug. This patch can be removed when we have a glibc with

# the patch mentioned here:

#   http://sourceware.org/bugzilla/show_bug.cgi?id=13472

Patch150: 00150-disable-rAssertAlmostEqual-cmath-on-ppc.patch

# 00151 #

# python.spec had:

#  Patch151: 00151-fork-deadlock.patch

# 00152 #

# Fix a regex in test_gdb so that it doesn't choke when gdb provides a full

# path to Python/bltinmodule.c:

# Committed upstream as 77824:abcd29c9a791 as part of fix for

# http://bugs.python.org/issue12605

#  Patch152: 00152-fix-test-gdb-regex.patch

# 00153 #

# Strip out lines of the form "warning: Unable to open ..." from gdb's stderr

# when running test_gdb.py; also cope with change to gdb in F17 onwards in

# which values are printed as "v@entry" rather than just "v":

# Not yet sent upstream

Patch153: 00153-fix-test_gdb-noise.patch

# 00154 #

# python3.spec on f15 has:

#  Patch154: 00154-skip-urllib-test-requiring-working-DNS.patch

# 00155 #

# Avoid allocating thunks in ctypes unless absolutely necessary, to avoid

# generating SELinux denials on "import ctypes" and "import uuid" when

# embedding Python within httpd (rhbz#814391)

Patch155: 00155-avoid-ctypes-thunks.patch

# 00156 #

# Recent builds of gdb will only auto-load scripts from certain safe

# locations.  Turn off this protection when running test_gdb in the selftest

# suite to ensure that it can load our -gdb.py script (rhbz#817072):

# Not yet sent upstream

Patch156: 00156-gdb-autoload-safepath.patch

# 00157 #

# Update uid/gid handling throughout the standard library: uid_t and gid_t are

# unsigned 32-bit values, but existing code often passed them through C long

# values, which are signed 32-bit values on 32-bit architectures, leading to

# negative int objects for uid/gid values >= 2^31 on 32-bit architectures.

#

# Introduce _PyObject_FromUid/Gid to convert uid_t/gid_t values to python

# objects, using int objects where the value will fit (long objects otherwise),

# and _PyArg_ParseUid/Gid to convert int/long to uid_t/gid_t, with -1 allowed

# as a special case (since this is given special meaning by the chown syscall)

#

# Update standard library to use this throughout for uid/gid values, so that

# very large uid/gid values are round-trippable, and -1 remains usable.

# (rhbz#697470)

Patch157: 00157-uid-gid-overflows.patch

# 00158 #

# Upstream as of Python 3.3.1

# 00159 #

#  Patch159: 00159-correct-libdb-include-path.patch

# in python.spec

# TODO: python3 status?

# 00160 #

# Python 3.3 added os.SEEK_DATA and os.SEEK_HOLE, which may be present in the

# header files in the build chroot, but may not be supported in the running

# kernel, hence we disable this test in an rpm build.

# Adding these was upstream issue http://bugs.python.org/issue10142

# Not yet sent upstream

Patch160: 00160-disable-test_fs_holes-in-rpm-build.patch

# 00161 #

# (Was only needed for Python 3.3.0b1)

# 00162 #

# (Was only needed for Python 3.3.0b1)

# 00163 #

# Some tests within test_socket fail intermittently when run inside Koji;

# disable them using unittest._skipInRpmBuild

# Not yet sent upstream

Patch163: 00163-disable-parts-of-test_socket-in-rpm-build.patch

# 0164 #

# some tests in test._io interrupted_write-* fail on PPC (rhbz#846849)

# testChainingDescriptors  test in test_exceptions fails on PPc, too (rhbz#846849)

# disable those tests so that rebuilds on PPC can continue

Patch164: 00164-disable-interrupted_write-tests-on-ppc.patch

# 00165 #

# python.spec has:

#   Patch165: 00165-crypt-module-salt-backport.patch

# which is a backport from 3.3 and thus not relevant to "python3"

# 00166 #

#  Patch166: 00166-fix-fake-repr-in-gdb-hooks.patch

# in python.spec

# TODO: python3 status?

# 00167 #

#  Patch167: 00167-disable-stack-navigation-tests-when-optimized-in-test_gdb.patch

# in python.spec

# TODO: python3 status?

# 00168 #

#  Patch168: 00168-distutils-cflags.patch

# in python.spec

# TODO: python3 status?

# 00169 #

#  Patch169: 00169-avoid-implicit-usage-of-md5-in-multiprocessing.patch

# in python.spec

# TODO: python3 status?

# 00170 #

# In debug builds, try to print repr() when a C-level assert fails in the

# garbage collector (typically indicating a reference-counting error

# somewhere else e.g in an extension module)

# Backported to 2.7 from a patch I sent upstream for py3k

#   http://bugs.python.org/issue9263  (rhbz#614680)

# hiding the proposed new macros/functions within gcmodule.c to avoid exposing

# them within the extension API.

# (rhbz#850013)

Patch170: 00170-gc-assertions.patch

# 00171 #

# python.spec had:

#  Patch171: 00171-raise-correct-exception-when-dev-urandom-is-missing.patch

# TODO: python3 status?

# 00172 #

# python.spec had:

#  Patch172: 00172-use-poll-for-multiprocessing-socket-connection.patch

# TODO: python3 status?

# 00173 #

# Workaround for ENOPROTOOPT seen in Koji withi test.support.bind_port()

# (rhbz#913732)

Patch173: 00173-workaround-ENOPROTOOPT-in-bind_port.patch

# 00174 #

#  Patch174: 00174-fix-for-usr-move.patch

# TODO: python3 status?

# 00175 #

# Upstream as of Python 3.3.2

#  Patch175: 00175-fix-configure-Wformat.patch

# 00176 #

# Fixed upstream as of Python 3.3.1

#  Patch176: 00176-upstream-issue16754-so-extension.patch

# 00177 #

# Patch for potential unicode error when determining OS release names

# http://bugs.python.org/issue17429

# (rhbz#922149)

# Does not affect python2 (python2 uses a byte string so it doesn't need to decode)

Patch177: 00177-platform-unicode.patch

# 00178 #

# Don't duplicate various FLAGS in sysconfig values

# http://bugs.python.org/issue17679

# Does not affect python2 AFAICS (different sysconfig values initialization)

Patch178: 00178-dont-duplicate-flags-in-sysconfig.patch

# 00179 #

# Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=951802

# Reported upstream in http://bugs.python.org/issue17737

# This patch basically looks at every frame and if it is somehow corrupted,

# it just stops printing the traceback - it doesn't fix the actual bug.

# This bug seems to only affect ARM.

# Doesn't seem to affect Python 2 AFAICS.

Patch179: 00179-dont-raise-error-on-gdb-corrupted-frames-in-backtrace.patch

# 00180 #

# Enable building on ppc64p7

# Not appropriate for upstream, Fedora-specific naming

Patch180: 00180-python-add-support-for-ppc64p7.patch

# 00181 #

# python.spec has

#  Patch181: 00181-allow-arbitrary-timeout-in-condition-wait.patch

# Does not affect python3

# 00182 #

# Fixed upstream as of Python 3.3.2

#  Patch182: 00182-fix-test_gdb-test_threads.patch

# 00183 #

# Upstream fix for CVE-2013-2099 (ssl.match_hostname DOS)

# http://bugs.python.org/issue17980

# http://hg.python.org/cpython/rev/c627638753e2

Patch183: 00183-cve-2013-2099-fix-ssl-match_hostname-dos.patch

# 00184 #

# Fix for gettext plural form headers (lines that begin with "#")

Patch184: 00184-gettext-plural-fix.patch

# 00185 #

# Fix for CVE-2013-4238 (rhbz#996733)

# http://bugs.python.org/issue18709

Patch185: 00185-CVE-2013-4238-hostname-check-bypass-in-SSL-module.patch

# 00186 #

# Fixes memory leak in gdbm module (rhbz#977308)

# This was upstreamed as a part of bigger patch, but for our purposes

# this is ok: http://bugs.python.org/issue18404

Patch186: 00186-fix-memory-leak-in-gdbm.patch

# 00187 #

# Fix for https://bugzilla.redhat.com/show_bug.cgi?id=979696

# Fixes build of ctypes against libffi with multilib wrapper

# Python recognizes ffi.h only if it contains "#define LIBFFI_H",

# but the wrapper doesn't contain that, which makes the build fail

# We patch this by also accepting "#define ffi_wrapper_h"

Patch187: 00187-ctypes-should-build-with-libffi-multilib-wrapper.patch

# 00188 #

# Fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023607

# Fixes the problem of some *.py files not being bytecompiled properly

# during build. This was result of py_compile.compile raising exception

# when trying to convert test file with bad encoding, and thus not

# continuing bytecompilation for other files.

Patch188: 00188-dont-raise-from-py_compile.patch

# 00189 #

# Fix for https://bugzilla.redhat.com/show_bug.cgi?id=1071868

# Fixes os.listxattr() leaking its internal buffer when the first

# call to C listxattr() fails with ERANGE.

Patch189: 00189-fix-leak-in-listxattr.patch

# 00237 #

# CVE-2016-0772 python: smtplib StartTLS stripping attack

#   https://bugzilla.redhat.com/show_bug.cgi?id=1303647

#   FIXED UPSTREAM: https://hg.python.org/cpython/rev/d590114c2394

# Raise an error when STARTTLS fails

# Resolves: rhbz#1346359

Patch237: 00237-CVE-2016-0772-smtplib.patch

# 00238 #

# CVE-2016-5699 python: http protocol steam injection attack

#   https://bugzilla.redhat.com/show_bug.cgi?id=1303699

#   FIXED UPSTREAM: https://hg.python.org/cpython/rev/bf3e1c9b80e9

# Disabled HTTP header injections in http.client

# Resolves: rhbz#1346359

Patch238: 00238-CVE-2016-5699-http-client.patch

# 00242 #

# HTTPoxy attack (CVE-2016-1000110)

# https://httpoxy.org/

# FIXED UPSTREAM: http://bugs.python.org/issue27568

# Based on a patch by Rémi Rampin

# Resolves: rhbz#1359169

Patch242: 00242-CVE-2016-1000110-httpoxy.patch

# (New patches go here ^^^)

#

# When adding new patches to "python" and "python3" in Fedora 17 onwards,

# please try to keep the patch numbers in-sync between the two specfiles:

#

#   - use the same patch number across both specfiles for conceptually-equivalent

#     fixes, ideally with the same name

#

#   - when a patch is relevant to both specfiles, use the same introductory

#     comment in both specfiles where possible (to improve "diff" output when

#     comparing them)

#

#   - when a patch is only relevant for one of the two specfiles, leave a gap

#     in the patch numbering in the other specfile, adding a comment when

#     omitting a patch, both in the manifest section here, and in the "prep"

#     phase below

#

# Hopefully this will make it easier to ensure that all relevant fixes are

# applied to both versions.

# This is the generated patch to "configure"; see the description of

#   %{regenerate_autotooling_patch}

# above:

Patch5000: 05000-autotool-intermediates.patch

BuildRoot: %{_tmppath}/%{name}-%{version}-root

# ======================================================

# Additional metadata, and subpackages

# ======================================================

URL: http://www.python.org/

# filter pkgconfig and python(abi) Requires/Provides

%{?scl:%filter_from_requires s|python(abi)|%{?scl_prefix}python(abi)|g}

%{?scl:%filter_from_provides s|pkgconfig(|%{?scl_prefix}pkgconfig(|g}

%{?scl:%filter_from_provides s|/usr/lib.*/python||g}

%{?scl:%filter_setup}

# See notes in bug 532118:

Provides: %{?scl_prefix}python(abi) = %{pybasever}

Requires: %{?scl_prefix}%{pkg_name}-libs%{?_isa} = %{version}-%{release}

%{?scl:Requires: %{scl}-runtime}

%description

Python 3 is a new version of the language that is incompatible with the 2.x

line of releases. The language is mostly the same, but many details, especially

how built-in objects like dictionaries and strings work, have changed

considerably, and a lot of deprecated features have finally been removed.