开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 2

_service:tar_scm:libtraceevent.spec Deleted

@@ -1,72 +0,0 @@
-Name:	 	libtraceevent
-Version: 	1.8.3
-Release: 	1
-License: 	LGPLv2+ and GPLv2+
-Summary: 	Library to parse raw trace event formats
-
-URL: 	       	https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git/
-Source0:       	https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git/snapshot/libtraceevent-%{version}.tar.gz
-
-Patch0000:      0001-fix-missing-fstack-protector-strong.patch
-
-BuildRequires: 	gcc
-BuildRequires: 	xmlto
-BuildRequires: 	asciidoc
-
-%global __provides_exclude_from ^%{_libdir}/traceevent/plugins
-
-%description
-libtraceevent is a library to parse raw trace event formats.
-
-%package devel
-Summary: Development headers of %{name}
-Requires: %{name}%{_isa} = %{version}-%{release}
-
-%description devel
-Development headers of %{name}-libs
-
-%prep
-%autosetup  -n %{name}-%{version} -p1
-
-%build
-MANPAGE_DOCBOOK_XSL=`rpm -ql docbook-style-xsl | grep manpages/docbook.xsl`
-%set_build_flags
-%make_build prefix=%{_prefix} libdir=%{_libdir} MANPAGE_XSL=%{MANPAGE_DOCBOOK_XSL} all doc
-
-%install
-%make_install prefix=%{_prefix} libdir=%{_libdir} install doc-install
-rm -rf %{buildroot}/%{_libdir}/libtraceevent.a
-
-%files
-%license LICENSES/LGPL-2.1
-%license LICENSES/GPL-2.0
-%{_libdir}/traceevent/
-%{_libdir}/libtraceevent.so.%{version}
-%{_libdir}/libtraceevent.so.1
-%{_mandir}/man3/tep_*.3*
-%{_mandir}/man3/libtraceevent.3*
-%{_mandir}/man3/trace_seq*.3*
-%{_mandir}/man3/kbuffer_*.3*
-%{_docdir}/%{name}-doc
-
-%files devel
-%{_includedir}/traceevent/
-%{_libdir}/libtraceevent.so
-%{_libdir}/pkgconfig/libtraceevent.pc
-
-%changelog
-* Sun Jun 30 2024 shafeipaozi <sunbo.oerv@isrc.iscas.ac.cn> - 1.8.3-1
-- update to 1.8.3
-
-* Thu Jul 13 2023 liyanan <thistleslyn@163.com> - 1.2.1-4
-- Delete confilt with perf when the kernel is greater than 6.2
-
-* Thu Jan 19 2023 yaoxin <yaoxin30@h-partners.com> - 1.2.1-3
-- Add conflict with perf
-
-* Mon Dec 05 2022 xu_ping <xuping33@h-partners.com> - 1.2.1-2
-- Add -fstack-protector-strong compile options
-
-* Fri Jan 14 2022 houyingchao <houyingchao@huawei.com> - 1.2.1-1
-- Init package
-

_service:tar_scm:python3.spec Added

@@ -0,0 +1,1166 @@
+Name: python3
+Summary: Interpreter of the Python3 programming language
+URL: https://www.python.org/
+
+Version: 3.11.6
+Release: 4
+License: Python-2.0
+
+%global branchversion 3.11
+%global pyshortver 311
+
+%ifarch %{ix86} x86_64
+%bcond_with optimizations
+%else
+%bcond_with optimizations
+%endif
+
+%global pylibdir %{_libdir}/python%{branchversion}
+%global dynload_dir %{pylibdir}/lib-dynload
+
+%global LDVERSION_optimized %{branchversion}
+%global LDVERSION_debug     %{branchversion}d
+
+%ifarch ppc64le
+%define _arch powerpc64le
+%endif
+
+%global SOABI_optimized cpython-%{pyshortver}-%{_arch}-linux%{_gnu}
+%global SOABI_debug     cpython-%{pyshortver}d-%{_arch}-linux%{_gnu}
+
+# See  http://www.python.org/dev/peps/pep-3147/
+%global bytecode_suffixes .cpython-%{pyshortver}*.pyc
+
+%global py_INSTSONAME_optimized libpython%{LDVERSION_optimized}.so.1.0
+%global py_INSTSONAME_debug     libpython%{LDVERSION_debug}.so.1.0
+
+%undefine py_auto_byte_compile
+
+%global wordsize 64
+
+BuildRequires: autoconf
+BuildRequires: bluez-libs-devel
+BuildRequires: bzip2
+BuildRequires: bzip2-devel
+BuildRequires: desktop-file-utils
+BuildRequires: expat-devel
+
+BuildRequires: findutils
+BuildRequires: gcc-c++
+BuildRequires: gcc
+BuildRequires: gdbm-devel
+BuildRequires: glibc-all-langpacks
+BuildRequires: glibc-devel
+BuildRequires: gmp-devel
+BuildRequires: libappstream-glib
+BuildRequires: libffi-devel
+BuildRequires: libnsl2-devel
+BuildRequires: libtirpc-devel
+BuildRequires: libGL-devel
+BuildRequires: libuuid-devel
+BuildRequires: libX11-devel
+BuildRequires: ncurses-devel
+
+BuildRequires: openssl-devel
+BuildRequires: pkgconfig
+BuildRequires: readline-devel
+BuildRequires: system-rpm-config
+BuildRequires: sqlite-devel
+
+BuildRequires: tar
+BuildRequires: tcl-devel
+BuildRequires: tix-devel
+BuildRequires: tk-devel
+
+%ifarch %{valgrind_arches}
+BuildRequires: valgrind-devel
+%endif
+
+BuildRequires: xz-devel
+BuildRequires: zlib-devel
+
+BuildRequires: systemtap-sdt-devel
+
+BuildRequires: net-tools
+
+BuildRequires: python-setuptools-wheel
+BuildRequires: python-pip-wheel
+
+Source: https://www.python.org/ftp/python/%{version}/Python-%{version}.tar.xz
+Source1: pyconfig.h
+
+Patch1:   00001-rpath.patch
+Patch251: 00251-change-user-install-location.patch
+
+Patch9000:  add-the-sm3-method-for-obtaining-the-salt-value.patch
+Patch9001:  0001-add-loongarch64-support-for-python.patch
+Patch9002:  backport-3.11-gh-114572-Fix-locking-in-cert_store_stats-and-g.patch
+Patch9003:  backport-3.11-gh-113171-gh-65056-Fix-private-non-global-IP-ad.patch
+Patch9004:  backport-3.11-gh-115133-Fix-tests-for-XMLPullParser-with-Expa.patch
+Patch9005:  fix-check-error-with-CVEfixed-expat-2.5.0.patch
+
+Provides: python%{branchversion} = %{version}-%{release}
+Provides: python(abi) = %{branchversion}
+
+Provides: python%{pyshortver} = %{version}-%{release}
+Obsoletes: python%{pyshortver}
+
+Requires: python-setuptools-wheel
+Requires: python-pip-wheel
+Provides: python3-libs
+Obsoletes: python3-libs
+Provides: python3-enum34 = 1.0.4-5
+Obsoletes: python3-enum34 < 1.0.4-5
+Obsoletes: python36
+
+Recommends: python3-setuptools
+Recommends: python3-pip
+
+%global __requires_exclude ^/usr/bin/python3
+
+%description
+Python combines remarkable power with very clear syntax. It has modules,
+classes, exceptions, very high level dynamic data types, and dynamic
+typing. There are interfaces to many system calls and libraries, as well
+as to various windowing systems. New built-in modules are easily written
+in C or C++ (or other languages, depending on the chosen implementation).
+Python is also usable as an extension language for applications written
+in other languages that need easy-to-use scripting or automation interfaces.
+
+This package Provides python version 3.
+
+%package -n python3-unversioned-command
+Summary: The "python" command that runs Python 3
+Requires: %{name} = %{version}-%{release}
+Provides: python = %{version}-%{release}
+Conflicts: python2
+%description -n python3-unversioned-command
+This package contains /usr/bin/python - the "python" command that runs Python 3.
+
+%package devel
+Summary: Libraries and header files needed for Python development
+Requires: %{name} = %{version}-%{release}
+BuildRequires: python-rpm-macros
+Requires: python-rpm-macros
+Requires: python3-rpm-macros
+Requires: python3-rpm-generators
+Requires: python3-setuptools
+Provides: %{name}-2to3 = %{version}-%{release}
+Provides: 2to3 = %{version}-%{release}
+Conflicts: %{name} < %{version}-%{release}
+Provides: python3-idle
+Obsoletes: python3-idle
+Provides: python3-test
+Obsoletes: python3-test
+Provides: %{name}-tools = %{version}-%{release}
+Obsoletes: %{name}-tools < %{version}-%{release}
+
+%description devel
+This package contains the header files and configuration needed to develop
+python3 modules.
+
+%package tkinter
+Summary: A GUI toolkit for Python
+Requires: %{name} = %{version}-%{release}
+Provides: %{name}-turtle = %{version}-%{release}
+Provides: %{name}-tkinter = %{version}-%{release}
+
+%description tkinter
+The Tkinter (Tk interface) library is a graphical user interface toolkit for
+the Python programming language.
+
+%package debug
+Summary: Debug version of the Python runtime
+
+Requires: %{name} = %{version}-%{release}
+Requires: %{name}-devel = %{version}-%{release}
+Requires: %{name}-tkinter = %{version}-%{release}
+
+%description debug
+python3-debug provides a version of the Python runtime with numerous debugging
+features enabled, aimed at advanced Python users such as developers of Python
+extension modules.
+
+%package_help
+
+%prep
+%setup -q -n Python-%{version}
+find -name '*.exe' -print -delete
+rm -r Modules/expat
+rm Lib/ensurepip/_bundled/*.whl
+rm configure pyconfig.h.in
+
+%patch1 -p1
+%patch251 -p1
+
+%patch9000 -p1
+%patch9001 -p1
+%patch9002 -p1
+%patch9003 -p1

_service:tar_scm:00001-rpath.patch Added

@@ -0,0 +1,30 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: David Malcolm <dmalcolm@redhat.com>
+Date: Wed, 13 Jan 2010 21:25:18 +0000
+Subject: PATCH 00001: Fixup distutils/unixccompiler.py to remove standard
+ library path from rpath Was Patch0 in ivazquez' python3000 specfile
+
+---
+ Lib/distutils/unixccompiler.py | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/Lib/distutils/unixccompiler.py b/Lib/distutils/unixccompiler.py
+index d00c48981e..0283a28c19 100644
+--- a/Lib/distutils/unixccompiler.py
++++ b/Lib/distutils/unixccompiler.py
+@@ -82,6 +82,15 @@ class UnixCCompiler(CCompiler):
+     if sys.platform == "cygwin":
+         exe_extension = ".exe"
+ 
++    def _fix_lib_args(self, libraries, library_dirs, runtime_library_dirs):
++        """Remove standard library path from rpath"""
++        libraries, library_dirs, runtime_library_dirs = super()._fix_lib_args(
++            libraries, library_dirs, runtime_library_dirs)
++        libdir = sysconfig.get_config_var('LIBDIR')
++        if runtime_library_dirs and (libdir in runtime_library_dirs):
++            runtime_library_dirs.remove(libdir)
++        return libraries, library_dirs, runtime_library_dirs
++
+     def preprocess(self, source, output_file=None, macros=None,
+                    include_dirs=None, extra_preargs=None, extra_postargs=None):
+         fixed_args = self._fix_compile_args(None, macros, include_dirs)

_service:tar_scm:0001-add-loongarch64-support-for-python.patch Added

_service:tar_scm:0001-fix-missing-fstack-protector-strong.patch Deleted

@@ -1,39 +0,0 @@
-From abb3f67fc0bb0875cba471338be990262152d5bc Mon Sep 17 00:00:00 2001
-From: shafeipaozi <2829702579@qq.com>
-Date: Tue, 16 Jul 2024 01:26:55 +0800
-Subject: PATCH 2
-
----
- Makefile         | 2 +-
- plugins/Makefile | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 41ad866..20ae048 100644
---- a/Makefile
-+++ b/Makefile
-@@ -127,7 +127,7 @@ export LIBTRACEEVENT_STATIC LIBTRACEEVENT_SHARED EP_HEADERS_DIR
- ifdef EXTRA_CFLAGS
-   CFLAGS := $(EXTRA_CFLAGS)
- else
--  CFLAGS := -g -Wall
-+  CFLAGS := -g -Wall -fstack-protector-strong
- endif
- 
- LIBS ?= -ldl
-diff --git a/plugins/Makefile b/plugins/Makefile
-index 4c8cb17..56b5646 100644
---- a/plugins/Makefile
-+++ b/plugins/Makefile
-@@ -68,7 +68,7 @@ INCLUDES = -I. -I.. -I../src -I $(srctree)/include -I $(EP_HEADERS_DIR) $(CONFIG
- ifdef EXTRA_CFLAGS
-   CFLAGS := $(EXTRA_CFLAGS)
- else
--  CFLAGS := -g -Wall
-+  CFLAGS := -g -Wall -fstack-protector-strong
- endif
- 
- # Append required CFLAGS
--- 
-2.42.0
-

_service:tar_scm:00251-change-user-install-location.patch Added

@@ -0,0 +1,204 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Mon, 15 Feb 2021 12:19:27 +0100
+Subject: PATCH 00251: Change user install location
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Set values of base and platbase in sysconfig from /usr
+to /usr/local when RPM build is not detected
+to make pip and similar tools install into separate location.
+
+Set values of prefix and exec_prefix in distutils install command
+to /usr/local if executable is /usr/bin/python* and RPM build
+is not detected to make distutils and pypa/distutils install into separate location.
+
+Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+Downstream only.
+
+We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
+but we have identified serious problems with that approach,
+see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
+
+pypa/distutils integration: https://github.com/pypa/distutils/pull/70
+
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+Co-authored-by: Miro Hrončok <miro@hroncok.cz>
+Co-authored-by: Michal Cyprian <m.cyprian@gmail.com>
+Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
+---
+ Lib/distutils/command/install.py |  8 ++++--
+ Lib/site.py                      |  9 +++++-
+ Lib/sysconfig.py                 | 49 +++++++++++++++++++++++++++++++-
+ Lib/test/test_sysconfig.py       | 17 +++++++++--
+ 4 files changed, 77 insertions(+), 6 deletions(-)
+
+diff --git a/Lib/distutils/command/install.py b/Lib/distutils/command/install.py
+index 01d5331a63..79f70f0de4 100644
+--- a/Lib/distutils/command/install.py
++++ b/Lib/distutils/command/install.py
+@@ -159,6 +159,8 @@ class install(Command):
+ 
+     negative_opt = {'no-compile' : 'compile'}
+ 
++    # Allow Fedora to add components to the prefix
++    _prefix_addition = getattr(sysconfig, '_prefix_addition', '')
+ 
+     def initialize_options(self):
+         """Initializes options."""
+@@ -441,8 +443,10 @@ def finalize_unix(self):
+                     raise DistutilsOptionError(
+                           "must not supply exec-prefix without prefix")
+ 
+-                self.prefix = os.path.normpath(sys.prefix)
+-                self.exec_prefix = os.path.normpath(sys.exec_prefix)
++                self.prefix = (
++                    os.path.normpath(sys.prefix) + self._prefix_addition)
++                self.exec_prefix = (
++                    os.path.normpath(sys.exec_prefix) + self._prefix_addition)
+ 
+             else:
+                 if self.exec_prefix is None:
+diff --git a/Lib/site.py b/Lib/site.py
+index 69670d9d7f..104cb93899 100644
+--- a/Lib/site.py
++++ b/Lib/site.py
+@@ -377,8 +377,15 @@ def getsitepackages(prefixes=None):
+     return sitepackages
+ 
+ def addsitepackages(known_paths, prefixes=None):
+-    """Add site-packages to sys.path"""
++    """Add site-packages to sys.path
++
++    '/usr/local' is included in PREFIXES if RPM build is not detected
++    to make packages installed into this location visible.
++
++    """
+     _trace("Processing global site-packages")
++    if ENABLE_USER_SITE and 'RPM_BUILD_ROOT' not in os.environ:
++        PREFIXES.insert(0, "/usr/local")
+     for sitedir in getsitepackages(prefixes):
+         if os.path.isdir(sitedir):
+             addsitedir(sitedir, known_paths)
+diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
+index ebe3711827..55af57b335 100644
+--- a/Lib/sysconfig.py
++++ b/Lib/sysconfig.py
+@@ -103,6 +103,11 @@
+ else:
+     _INSTALL_SCHEMES'venv' = _INSTALL_SCHEMES'posix_venv'
+ 
++# For a brief period of time in the Fedora 36 life cycle,
++# this installation scheme existed and was documented in the release notes.
++# For backwards compatibility, we keep it here (at least on 3.10 and 3.11).
++_INSTALL_SCHEMES'rpm_prefix' = _INSTALL_SCHEMES'posix_prefix'
++
+ 
+ # NOTE: site.py has copy of this function.
+ # Sync it when modify this function.
+@@ -162,6 +167,19 @@ def joinuser(*args):
+             },
+     }
+ 
++# This is used by distutils.command.install in the stdlib
++# as well as pypa/distutils (e.g. bundled in setuptools).
++# The self.prefix value is set to sys.prefix + /local/
++# if neither RPM build nor virtual environment is
++# detected to make distutils install packages
++# into the separate location.
++# https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++if (not (hasattr(sys, 'real_prefix') or
++    sys.prefix != sys.base_prefix) and
++    'RPM_BUILD_ROOT' not in os.environ):
++    _prefix_addition = '/local'
++
++
+ _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
+                 'scripts', 'data')
+ 
+@@ -258,11 +276,40 @@ def _extend_dict(target_dict, other_dict):
+         target_dictkey = value
+ 
+ 
++_CONFIG_VARS_LOCAL = None
++
++
++def _config_vars_local():
++    # This function returns the config vars with prefixes amended to /usr/local
++    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++    global _CONFIG_VARS_LOCAL
++    if _CONFIG_VARS_LOCAL is None:
++        _CONFIG_VARS_LOCAL = dict(get_config_vars())
++        _CONFIG_VARS_LOCAL'base' = '/usr/local'
++        _CONFIG_VARS_LOCAL'platbase' = '/usr/local'
++    return _CONFIG_VARS_LOCAL
++
++
+ def _expand_vars(scheme, vars):
+     res = {}
+     if vars is None:
+         vars = {}
+-    _extend_dict(vars, get_config_vars())
++
++    # when we are not in a virtual environment or an RPM build
++    # we change '/usr' to '/usr/local'
++    # to avoid surprises, we explicitly check for the /usr/ prefix
++    # Python virtual environments have different prefixes
++    # we only do this for posix_prefix, not to mangle the venv scheme
++    # posix_prefix is used by sudo pip install
++    # we only change the defaults here, so explicit --prefix will take precedence
++    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++    if (scheme == 'posix_prefix' and
++        _PREFIX == '/usr' and
++        'RPM_BUILD_ROOT' not in os.environ):
++            _extend_dict(vars, _config_vars_local())
++    else:
++        _extend_dict(vars, get_config_vars())
++
+     if os.name == 'nt':
+         # On Windows we want to substitute 'lib' for schemes rather
+         # than the native value (without modifying vars, in case it
+diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
+index d96371d242..72b028435f 100644
+--- a/Lib/test/test_sysconfig.py
++++ b/Lib/test/test_sysconfig.py
+@@ -111,8 +111,19 @@ def test_get_path(self):
+         for scheme in _INSTALL_SCHEMES:
+             for name in _INSTALL_SCHEMESscheme:
+                 expected = _INSTALL_SCHEMESschemename.format(**config_vars)
++                tested = get_path(name, scheme)
++                # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++                if tested.startswith('/usr/local'):
++                    # /usr/local should only be used in posix_prefix
++                    self.assertEqual(scheme, 'posix_prefix')
++                    # Fedora CI runs tests for venv and virtualenv that check for other prefixes
++                    self.assertEqual(sys.prefix, '/usr')
++                    # When building the RPM of Python, %check runs this with RPM_BUILD_ROOT set
++                    # Fedora CI runs this with RPM_BUILD_ROOT unset
++                    self.assertNotIn('RPM_BUILD_ROOT', os.environ)
++                    tested = tested.replace('/usr/local', '/usr')
+                 self.assertEqual(
+-                    os.path.normpath(get_path(name, scheme)),
++                    os.path.normpath(tested),
+                     os.path.normpath(expected),
+                 )
+ 
+@@ -336,7 +347,7 @@ def test_get_config_h_filename(self):
+         self.assertTrue(os.path.isfile(config_h), config_h)
+ 
+     def test_get_scheme_names(self):
+-        wanted = 'nt', 'posix_home', 'posix_prefix', 'posix_venv', 'nt_venv', 'venv'
++        wanted = 'nt', 'posix_home', 'posix_prefix', 'posix_venv', 'nt_venv', 'venv', 'rpm_prefix'
+         if HAS_USER_BASE:
+             wanted.extend('nt_user', 'osx_framework_user', 'posix_user')
+         self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
+@@ -348,6 +359,8 @@ def test_symlink(self): # Issue 7880
+             cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
+             self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
+

_service:tar_scm:add-the-sm3-method-for-obtaining-the-salt-value.patch Added

@@ -0,0 +1,34 @@
+From 1e245b53ec5ae96ca6ad11edd72b812f9ae0d141 Mon Sep 17 00:00:00 2001
+From: hanxinke <hanxinke@huawei.com>
+Date: Tue, 3 Aug 2021 09:34:30 +0800
+Subject: PATCH add the sm3 method for obtaining the salt value
+
+Signed-off-by: hanxinke <hanxinke@huawei.com>
+---
+ Lib/crypt.py | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/crypt.py b/Lib/crypt.py
+index 33dbc46..3a7cea1 100644
+--- a/Lib/crypt.py
++++ b/Lib/crypt.py
+@@ -55,7 +55,7 @@ def mksalt(method=None, *, rounds=None):
+             if not 4 <= log_rounds <= 31:
+                 raise ValueError('rounds out of the range 2**4 to 2**31')
+         s += f'{log_rounds:02d}$'
+-    elif method.ident in ('5', '6'):  # SHA-2
++    elif method.ident in ('5', '6', 'sm3'):  # SHA-2 and sm3
+         if rounds is not None:
+             if not 1000 <= rounds <= 999_999_999:
+                 raise ValueError('rounds out of the range 1000 to 999_999_999')
+@@ -117,4 +117,7 @@ for _v in 'b', 'y', 'a', '':
+ _add_method('MD5', '1', 8, 34)
+ _add_method('CRYPT', None, 2, 13)
+ 
++# support the sm3 method
++_add_method('SM3', 'sm3', 16, 63)
++
+ del _v, _add_method
+-- 
+1.8.3.1
+

_service:tar_scm:backport-3.11-gh-113171-gh-65056-Fix-private-non-global-IP-ad.patch Added

@@ -0,0 +1,346 @@
+From ba431579efdcbaed7a96f2ac4ea0775879a332fb Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Thu, 25 Apr 2024 14:45:48 +0200
+Subject: PATCH 3.11 gh-113171: gh-65056: Fix "private" (non-global) IP
+ address ranges (GH-113179) (GH-113186) (GH-118177) (#118227)
+
+---
+ Doc/library/ipaddress.rst                     | 43 +++++++-
+ Doc/whatsnew/3.11.rst                         |  9 ++
+ Lib/ipaddress.py                              | 99 +++++++++++++++----
+ Lib/test/test_ipaddress.py                    | 21 +++-
+ ...-03-14-01-38-44.gh-issue-113171.VFnObz.rst |  9 ++
+ 5 files changed, 157 insertions(+), 24 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst
+
+diff --git a/Doc/library/ipaddress.rst b/Doc/library/ipaddress.rst
+index 03dc956cd1..f57fa15aa5 100644
+--- a/Doc/library/ipaddress.rst
++++ b/Doc/library/ipaddress.rst
+@@ -178,18 +178,53 @@ write code that handles both IP versions correctly.  Address objects are
+ 
+    .. attribute:: is_private
+ 
+-      ``True`` if the address is allocated for private networks.  See
++      ``True`` if the address is defined as not globally reachable by
+       iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
+-      (for IPv6).
++      (for IPv6) with the following exceptions:
++
++      * ``is_private`` is ``False`` for the shared address space (``100.64.0.0/10``)
++      * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++        semantics of the underlying IPv4 addresses and the following condition holds
++        (see :attr:`IPv6Address.ipv4_mapped`)::
++
++            address.is_private == address.ipv4_mapped.is_private
++
++      ``is_private`` has value opposite to :attr:`is_global`, except for the shared address space
++      (``100.64.0.0/10`` range) where they are both ``False``.
++
++      .. versionchanged:: 3.11.10
++
++         Fixed some false positives and false negatives.
++
++         * ``192.0.0.0/24`` is considered private with the exception of ``192.0.0.9/32`` and
++           ``192.0.0.10/32`` (previously: only the ``192.0.0.0/29`` sub-range was considered private).
++         * ``64:ff9b:1::/48`` is considered private.
++         * ``2002::/16`` is considered private.
++         * There are exceptions within ``2001::/23`` (otherwise considered private): ``2001:1::1/128``,
++           ``2001:1::2/128``, ``2001:3::/32``, ``2001:4:112::/48``, ``2001:20::/28``, ``2001:30::/28``.
++           The exceptions are not considered private.
+ 
+    .. attribute:: is_global
+ 
+-      ``True`` if the address is allocated for public networks.  See
++      ``True`` if the address is defined as globally reachable by
+       iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
+-      (for IPv6).
++      (for IPv6) with the following exception:
++
++      For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++      semantics of the underlying IPv4 addresses and the following condition holds
++      (see :attr:`IPv6Address.ipv4_mapped`)::
++
++         address.is_global == address.ipv4_mapped.is_global
++
++      ``is_global`` has value opposite to :attr:`is_private`, except for the shared address space
++      (``100.64.0.0/10`` range) where they are both ``False``.
+ 
+       .. versionadded:: 3.4
+ 
++      .. versionchanged:: 3.11.10
++
++         Fixed some false positives and false negatives, see :attr:`is_private` for details.
++
+    .. attribute:: is_unspecified
+ 
+       ``True`` if the address is unspecified.  See :RFC:`5735` (for IPv4)
+diff --git a/Doc/whatsnew/3.11.rst b/Doc/whatsnew/3.11.rst
+index f670fa1f09..42b61c75c7 100644
+--- a/Doc/whatsnew/3.11.rst
++++ b/Doc/whatsnew/3.11.rst
+@@ -2727,3 +2727,12 @@ OpenSSL
+ * Windows builds and macOS installers from python.org now use OpenSSL 3.0.
+ 
+ .. _libb2: https://www.blake2.net/
++
++Notable changes in 3.11.10
++==========================
++
++ipaddress
++---------
++
++* Fixed ``is_global`` and ``is_private`` behavior in ``IPv4Address``,
++  ``IPv6Address``, ``IPv4Network`` and ``IPv6Network``.
+diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
+index 16ba16cd7d..567beb37e0 100644
+--- a/Lib/ipaddress.py
++++ b/Lib/ipaddress.py
+@@ -1086,7 +1086,11 @@ def is_private(self):
+         """
+         return any(self.network_address in priv_network and
+                    self.broadcast_address in priv_network
+-                   for priv_network in self._constants._private_networks)
++                   for priv_network in self._constants._private_networks) and all(
++                    self.network_address not in network and
++                    self.broadcast_address not in network
++                    for network in self._constants._private_networks_exceptions
++                )
+ 
+     @property
+     def is_global(self):
+@@ -1333,18 +1337,41 @@ def is_reserved(self):
+     @property
+     @functools.lru_cache()
+     def is_private(self):
+-        """Test if this address is allocated for private networks.
++        """``True`` if the address is defined as not globally reachable by
++        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
++        (for IPv6) with the following exceptions:
+ 
+-        Returns:
+-            A boolean, True if the address is reserved per
+-            iana-ipv4-special-registry.
++        * ``is_private`` is ``False`` for ``100.64.0.0/10``
++        * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++            semantics of the underlying IPv4 addresses and the following condition holds
++            (see :attr:`IPv6Address.ipv4_mapped`)::
+ 
++                address.is_private == address.ipv4_mapped.is_private
++
++        ``is_private`` has value opposite to :attr:`is_global`, except for the ``100.64.0.0/10``
++        IPv4 range where they are both ``False``.
+         """
+-        return any(self in net for net in self._constants._private_networks)
++        return (
++            any(self in net for net in self._constants._private_networks)
++            and all(self not in net for net in self._constants._private_networks_exceptions)
++        )
+ 
+     @property
+     @functools.lru_cache()
+     def is_global(self):
++        """``True`` if the address is defined as globally reachable by
++        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
++        (for IPv6) with the following exception:
++
++        For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
++        semantics of the underlying IPv4 addresses and the following condition holds
++        (see :attr:`IPv6Address.ipv4_mapped`)::
++
++            address.is_global == address.ipv4_mapped.is_global
++
++        ``is_global`` has value opposite to :attr:`is_private`, except for the ``100.64.0.0/10``
++        IPv4 range where they are both ``False``.
++        """
+         return self not in self._constants._public_network and not self.is_private
+ 
+     @property
+@@ -1548,13 +1575,15 @@ class _IPv4Constants:
+ 
+     _public_network = IPv4Network('100.64.0.0/10')
+ 
++    # Not globally reachable address blocks listed on
++    # https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+     _private_networks = 
+         IPv4Network('0.0.0.0/8'),
+         IPv4Network('10.0.0.0/8'),
+         IPv4Network('127.0.0.0/8'),
+         IPv4Network('169.254.0.0/16'),
+         IPv4Network('172.16.0.0/12'),
+-        IPv4Network('192.0.0.0/29'),
++        IPv4Network('192.0.0.0/24'),
+         IPv4Network('192.0.0.170/31'),
+         IPv4Network('192.0.2.0/24'),
+         IPv4Network('192.168.0.0/16'),
+@@ -1565,6 +1594,11 @@ class _IPv4Constants:
+         IPv4Network('255.255.255.255/32'),
+         
+ 
++    _private_networks_exceptions = 
++        IPv4Network('192.0.0.9/32'),
++        IPv4Network('192.0.0.10/32'),
++    
++
+     _reserved_network = IPv4Network('240.0.0.0/4')
+ 
+     _unspecified_address = IPv4Address('0.0.0.0')
+@@ -2010,27 +2044,42 @@ def is_site_local(self):
+     @property
+     @functools.lru_cache()
+     def is_private(self):
+-        """Test if this address is allocated for private networks.
++        """``True`` if the address is defined as not globally reachable by
++        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
++        (for IPv6) with the following exceptions:
+ 
+-        Returns:
+-            A boolean, True if the address is reserved per
+-            iana-ipv6-special-registry, or is ipv4_mapped and is

_service:tar_scm:backport-3.11-gh-114572-Fix-locking-in-cert_store_stats-and-g.patch Added

@@ -0,0 +1,156 @@
+From 01c37f1d0714f5822d34063ca7180b595abf589d Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Tue, 20 Feb 2024 17:34:44 +0100
+Subject: PATCH 3.11 gh-114572: Fix locking in cert_store_stats and
+ get_ca_certs (GH-114573) (#115549)
+
+gh-114572: Fix locking in cert_store_stats and get_ca_certs (GH-114573)
+
+* gh-114572: Fix locking in cert_store_stats and get_ca_certs
+
+cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
+X509_STORE_get0_objects, but reading the result requires a lock. See
+https://github.com/openssl/openssl/pull/23224 for details.
+
+Instead, use X509_STORE_get1_objects, newly added in that PR.
+X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
+polyfill it with X509_STORE_lock and X509_STORE_unlock.
+
+* Work around const-correctness problem
+
+* Add missing X509_STORE_get1_objects failure check
+
+* Add blurb
+(cherry picked from commit bce693111bff906ccf9281c22371331aaff766ab)
+
+Co-authored-by: David Benjamin <davidben@google.com>
+---
+ ...-01-26-22-14-09.gh-issue-114572.t1QMQD.rst |  4 ++
+ Modules/_ssl.c                                | 65 +++++++++++++++++--
+ 2 files changed, 64 insertions(+), 5 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2024-01-26-22-14-09.gh-issue-114572.t1QMQD.rst
+
+diff --git a/Misc/NEWS.d/next/Security/2024-01-26-22-14-09.gh-issue-114572.t1QMQD.rst b/Misc/NEWS.d/next/Security/2024-01-26-22-14-09.gh-issue-114572.t1QMQD.rst
+new file mode 100644
+index 0000000000..b4f9fe64db
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2024-01-26-22-14-09.gh-issue-114572.t1QMQD.rst
+@@ -0,0 +1,4 @@
++:meth:`ssl.SSLContext.cert_store_stats` and
++:meth:`ssl.SSLContext.get_ca_certs` now correctly lock access to the
++certificate store, when the :class:`ssl.SSLContext` is shared across
++multiple threads.
+diff --git a/Modules/_ssl.c b/Modules/_ssl.c
+index 67ce6e97af..81d36a6f11 100644
+--- a/Modules/_ssl.c
++++ b/Modules/_ssl.c
+@@ -4529,6 +4529,50 @@ set_sni_callback(PySSLContext *self, PyObject *arg, void *c)
+     return 0;
+ }
+ 
++#if OPENSSL_VERSION_NUMBER < 0x30300000L
++static X509_OBJECT *x509_object_dup(const X509_OBJECT *obj)
++{
++    int ok;
++    X509_OBJECT *ret = X509_OBJECT_new();
++    if (ret == NULL) {
++        return NULL;
++    }
++    switch (X509_OBJECT_get_type(obj)) {
++        case X509_LU_X509:
++            ok = X509_OBJECT_set1_X509(ret, X509_OBJECT_get0_X509(obj));
++            break;
++        case X509_LU_CRL:
++            /* X509_OBJECT_get0_X509_CRL was not const-correct prior to 3.0.*/
++            ok = X509_OBJECT_set1_X509_CRL(
++                ret, X509_OBJECT_get0_X509_CRL((X509_OBJECT *)obj));
++            break;
++        default:
++            /* We cannot duplicate unrecognized types in a polyfill, but it is
++             * safe to leave an empty object. The caller will ignore it. */
++            ok = 1;
++            break;
++    }
++    if (!ok) {
++        X509_OBJECT_free(ret);
++        return NULL;
++    }
++    return ret;
++}
++
++static STACK_OF(X509_OBJECT) *
++X509_STORE_get1_objects(X509_STORE *store)
++{
++    STACK_OF(X509_OBJECT) *ret;
++    if (!X509_STORE_lock(store)) {
++        return NULL;
++    }
++    ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store),
++                                   x509_object_dup, X509_OBJECT_free);
++    X509_STORE_unlock(store);
++    return ret;
++}
++#endif
++
+ PyDoc_STRVAR(PySSLContext_sni_callback_doc,
+ "Set a callback that will be called when a server name is provided by the SSL/TLS client in the SNI extension.\n\
+ \n\
+@@ -4558,7 +4602,12 @@ _ssl__SSLContext_cert_store_stats_impl(PySSLContext *self)
+     int x509 = 0, crl = 0, ca = 0, i;
+ 
+     store = SSL_CTX_get_cert_store(self->ctx);
+-    objs = X509_STORE_get0_objects(store);
++    objs = X509_STORE_get1_objects(store);
++    if (objs == NULL) {
++        PyErr_SetString(PyExc_MemoryError, "failed to query cert store");
++        return NULL;
++    }
++
+     for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
+         obj = sk_X509_OBJECT_value(objs, i);
+         switch (X509_OBJECT_get_type(obj)) {
+@@ -4572,12 +4621,11 @@ _ssl__SSLContext_cert_store_stats_impl(PySSLContext *self)
+                 crl++;
+                 break;
+             default:
+-                /* Ignore X509_LU_FAIL, X509_LU_RETRY, X509_LU_PKEY.
+-                 * As far as I can tell they are internal states and never
+-                 * stored in a cert store */
++                /* Ignore unrecognized types. */
+                 break;
+         }
+     }
++    sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free);
+     return Py_BuildValue("{sisisi}", "x509", x509, "crl", crl,
+         "x509_ca", ca);
+ }
+@@ -4609,7 +4657,12 @@ _ssl__SSLContext_get_ca_certs_impl(PySSLContext *self, int binary_form)
+     }
+ 
+     store = SSL_CTX_get_cert_store(self->ctx);
+-    objs = X509_STORE_get0_objects(store);
++    objs = X509_STORE_get1_objects(store);
++    if (objs == NULL) {
++        PyErr_SetString(PyExc_MemoryError, "failed to query cert store");
++        goto error;
++    }
++
+     for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
+         X509_OBJECT *obj;
+         X509 *cert;
+@@ -4637,9 +4690,11 @@ _ssl__SSLContext_get_ca_certs_impl(PySSLContext *self, int binary_form)
+         }
+         Py_CLEAR(ci);
+     }
++    sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free);
+     return rlist;
+ 
+   error:
++    sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free);
+     Py_XDECREF(ci);
+     Py_XDECREF(rlist);
+     return NULL;
+-- 
+2.27.0
+

_service:tar_scm:backport-3.11-gh-115133-Fix-tests-for-XMLPullParser-with-Expa.patch Added

@@ -0,0 +1,112 @@
+From 3501eca89e27873f6037abcb39e5031dfbce7077 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Sun, 11 Feb 2024 11:38:04 +0100
+Subject: PATCH 3.11 gh-115133: Fix tests for XMLPullParser with Expat
+ 2.6.0 (GH-115164) (GH-115289)
+
+Feeding the parser by too small chunks defers parsing to prevent
+CVE-2023-52425. Future versions of Expat may be more reactive.
+(cherry picked from commit 4a08e7b3431cd32a0daf22a33421cd3035343dc4)
+
+Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
+---
+ Lib/test/test_xml_etree.py                    | 58 ++++++++++++-------
+ ...-02-08-14-21-28.gh-issue-115133.ycl4ko.rst |  2 +
+ 2 files changed, 38 insertions(+), 22 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+
+diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
+index 267982a823..fa03f381fa 100644
+--- a/Lib/test/test_xml_etree.py
++++ b/Lib/test/test_xml_etree.py
+@@ -13,6 +13,7 @@
+ import operator
+ import os
+ import pickle
++import pyexpat
+ import sys
+ import textwrap
+ import types
+@@ -120,6 +121,10 @@
+ </foo>
+ """
+ 
++fails_with_expat_2_6_0 = (unittest.expectedFailure
++                        if pyexpat.version_info >= (2, 6, 0) else
++                        lambda test: test)
++
+ def checkwarnings(*filters, quiet=False):
+     def decorator(test):
+         def newtest(*args, **kwargs):
+@@ -1400,28 +1405,37 @@ def assert_event_tags(self, parser, expected, max_events=None):
+         self.assertEqual((action, elem.tag) for action, elem in events,
+                          expected)
+ 
+-    def test_simple_xml(self):
+-        for chunk_size in (None, 1, 5):
+-            with self.subTest(chunk_size=chunk_size):
+-                parser = ET.XMLPullParser()
+-                self.assert_event_tags(parser, )
+-                self._feed(parser, "\n", chunk_size)
+-                self.assert_event_tags(parser, )
+-                self._feed(parser,
+-                           "<root>\n  <element key='value'>text</element",
+-                           chunk_size)
+-                self.assert_event_tags(parser, )
+-                self._feed(parser, ">\n", chunk_size)
+-                self.assert_event_tags(parser, ('end', 'element'))
+-                self._feed(parser, "<element>text</element>tail\n", chunk_size)
+-                self._feed(parser, "<empty-element/>\n", chunk_size)
+-                self.assert_event_tags(parser, 
+-                    ('end', 'element'),
+-                    ('end', 'empty-element'),
+-                    )
+-                self._feed(parser, "</root>\n", chunk_size)
+-                self.assert_event_tags(parser, ('end', 'root'))
+-                self.assertIsNone(parser.close())
++    def test_simple_xml(self, chunk_size=None):
++        parser = ET.XMLPullParser()
++        self.assert_event_tags(parser, )
++        self._feed(parser, "\n", chunk_size)
++        self.assert_event_tags(parser, )
++        self._feed(parser,
++                   "<root>\n  <element key='value'>text</element",
++                   chunk_size)
++        self.assert_event_tags(parser, )
++        self._feed(parser, ">\n", chunk_size)
++        self.assert_event_tags(parser, ('end', 'element'))
++        self._feed(parser, "<element>text</element>tail\n", chunk_size)
++        self._feed(parser, "<empty-element/>\n", chunk_size)
++        self.assert_event_tags(parser, 
++            ('end', 'element'),
++            ('end', 'empty-element'),
++            )
++        self._feed(parser, "</root>\n", chunk_size)
++        self.assert_event_tags(parser, ('end', 'root'))
++        self.assertIsNone(parser.close())
++
++    @fails_with_expat_2_6_0
++    def test_simple_xml_chunk_1(self):
++        self.test_simple_xml(chunk_size=1)
++
++    @fails_with_expat_2_6_0
++    def test_simple_xml_chunk_5(self):
++        self.test_simple_xml(chunk_size=5)
++
++    def test_simple_xml_chunk_22(self):
++        self.test_simple_xml(chunk_size=22)
+ 
+     def test_feed_while_iterating(self):
+         parser = ET.XMLPullParser()
+diff --git a/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+new file mode 100644
+index 0000000000..6f1015235c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+@@ -0,0 +1,2 @@
++Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat
++2.6.0.
+-- 
+2.27.0
+

_service:tar_scm:fix-check-error-with-CVEfixed-expat-2.5.0.patch Added

@@ -0,0 +1,28 @@
+diff -ur a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
+--- a/Lib/test/test_xml_etree.py	2024-06-25 03:33:22.925676272 +0000
++++ b/Lib/test/test_xml_etree.py	2024-06-25 03:34:30.900338499 +0000
+@@ -121,8 +121,8 @@
+ </foo>
+ """
+ 
+-fails_with_expat_2_6_0 = (unittest.expectedFailure
+-                        if pyexpat.version_info >= (2, 6, 0) else
++fails_with_expat_2_5_0 = (unittest.expectedFailure
++                        if pyexpat.version_info >= (2, 5, 0) else
+                         lambda test: test)
+ 
+ def checkwarnings(*filters, quiet=False):
+@@ -1424,11 +1424,11 @@
+         self.assert_event_tags(parser, ('end', 'root'))
+         self.assertIsNone(parser.close())
+ 
+-    @fails_with_expat_2_6_0
++    @fails_with_expat_2_5_0
+     def test_simple_xml_chunk_1(self):
+         self.test_simple_xml(chunk_size=1)
+ 
+-    @fails_with_expat_2_6_0
++    @fails_with_expat_2_5_0
+     def test_simple_xml_chunk_5(self):
+         self.test_simple_xml(chunk_size=5)
+

_service Changed

_service:tar_scm:Python-3.11.6.tar.xz Added

_service:tar_scm:README.en.md Deleted

_service:tar_scm:README.md Deleted

_service:tar_scm:libtraceevent-1.8.3.tar.gz Deleted

_service:tar_scm:pyconfig.h Added

_service:tar_scm:python3.yaml Added