.gitignore

@@ -1 +1 @@
-SOURCES/setuptools-53.0.0.tar.gz
+SOURCES/setuptools-39.2.0.zip

.python-setuptools.metadata

@@ -1 +1 @@
-878b8c351cac940e0b9fd1ba3ad49665dfc2889c SOURCES/setuptools-53.0.0.tar.gz
+83e75ec6b04423735e0a9a384b465c68f5206bcf SOURCES/setuptools-39.2.0.zip

SOURCES/CVE-2022-40897.patch

@@ -0,0 +1,30 @@
+diff --git a/setuptools/package_index.py b/setuptools/package_index.py
+index b6407be..bdcf4a6 100755
+--- a/setuptools/package_index.py
++++ b/setuptools/package_index.py
+@@ -212,7 +212,7 @@ def unique_values(func):
+     return wrapper
+ 
+ 
+-REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
++REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)
+ # this line is here to fix emacs' cruddy broken syntax highlighting
+ 
+ 
+diff --git a/setuptools/tests/test_packageindex.py b/setuptools/tests/test_packageindex.py
+index 63b9294..49bd819 100644
+--- a/setuptools/tests/test_packageindex.py
++++ b/setuptools/tests/test_packageindex.py
+@@ -223,6 +223,12 @@ class TestPackageIndex:
+             assert dists[0].version == ''
+             assert dists[1].version == vc
+ 
++    def test_REL_DoS(self):
++        """
++        REL should not hang on a contrived attack string.
++        """
++        setuptools.package_index.REL.search('< rel=' + ' ' * 2**12)
++
+ 
+ class TestContentCheckers:
+     def test_md5(self):

SOURCES/CVE-2024-6345.patch

@@ -0,0 +1,83 @@
+From 8af1b3e03edc8a38565558aff3bf1689c1ca3545 Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Fri, 26 Jul 2024 13:49:11 +0200
+Subject: [PATCH] CVE-2024-6345
+
+---
+ setuptools/package_index.py | 23 +++++++++--------------
+ 1 file changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/setuptools/package_index.py b/setuptools/package_index.py
+index bdcf4a6..1d3e5b4 100755
+--- a/setuptools/package_index.py
++++ b/setuptools/package_index.py
+@@ -1,4 +1,5 @@
+ """PyPI and direct package downloading"""
++import subprocess
+ import sys
+ import os
+ import re
+@@ -848,7 +849,7 @@ class PackageIndex(Environment):
+ 
+     def _download_svn(self, url, filename):
+         url = url.split('#', 1)[0]  # remove any fragment for svn's sake
+-        creds = ''
++        creds = []
+         if url.lower().startswith('svn:') and '@' in url:
+             scheme, netloc, path, p, q, f = urllib.parse.urlparse(url)
+             if not netloc and path.startswith('//') and '/' in path[2:]:
+@@ -857,14 +858,14 @@ class PackageIndex(Environment):
+                 if auth:
+                     if ':' in auth:
+                         user, pw = auth.split(':', 1)
+-                        creds = " --username=%s --password=%s" % (user, pw)
++                        creds = ["--username=" + user, "--password=" + pw]
+                     else:
+-                        creds = " --username=" + auth
++                        creds = ["--username=" + auth]
+                     netloc = host
+                     parts = scheme, netloc, url, p, q, f
+                     url = urllib.parse.urlunparse(parts)
+         self.info("Doing subversion checkout from %s to %s", url, filename)
+-        os.system("svn checkout%s -q %s %s" % (creds, url, filename))
++        subprocess.check_call(["svn", "checkout"] + creds + ["-q", url, filename])
+         return filename
+ 
+     @staticmethod
+@@ -890,14 +891,11 @@ class PackageIndex(Environment):
+         url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True)
+ 
+         self.info("Doing git clone from %s to %s", url, filename)
+-        os.system("git clone --quiet %s %s" % (url, filename))
++        subprocess.check_call(["git", "clone", "--quiet", url, filename])
+ 
+         if rev is not None:
+             self.info("Checking out %s", rev)
+-            os.system("(cd %s && git checkout --quiet %s)" % (
+-                filename,
+-                rev,
+-            ))
++            subprocess.check_call(["git", "-C", filename, "checkout", "--quiet", rev])
+ 
+         return filename
+ 
+@@ -906,14 +904,11 @@ class PackageIndex(Environment):
+         url, rev = self._vcs_split_rev_from_url(url, pop_prefix=True)
+ 
+         self.info("Doing hg clone from %s to %s", url, filename)
+-        os.system("hg clone --quiet %s %s" % (url, filename))
++        subprocess.check_call(["hg", "clone", "--quiet", url, filename])
+ 
+         if rev is not None:
+             self.info("Updating to %s", rev)
+-            os.system("(cd %s && hg up -C -r %s -q)" % (
+-                filename,
+-                rev,
+-            ))
++            subprocess.check_call(["hg", "--cwd", filename, "up", "-C", "-r", rev, "-q"])
+ 
+         return filename
+ 
+-- 
+2.45.2
+

SOURCES/CVE-2025-47273.patch

@@ -0,0 +1,30 @@
+From ff1c62ede76e29a9d00bbbad266afa59ee153e51 Mon Sep 17 00:00:00 2001
+From: "Jason R. Coombs" <jaraco@jaraco.com>
+Date: Sat, 19 Apr 2025 13:03:47 -0400
+Subject: [PATCH] Add a check to ensure the name resolves relative to     the
+ tmpdir.
+
+Closes #4946
+
+---
+ setuptools/package_index.py | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/setuptools/package_index.py b/setuptools/package_index.py
+index 1d3e5b4..79953f8 100755
+--- a/setuptools/package_index.py
++++ b/setuptools/package_index.py
+@@ -808,6 +808,10 @@ class PackageIndex(Environment):
+ 
+         filename = os.path.join(tmpdir, name)
+ 
++        # ensure path resolves within the tmpdir
++        if not filename.startswith(str(tmpdir)):
++            raise ValueError("Invalid filename {filename}".format(filename = filename))
++
+         # Download the file
+         #
+         if scheme == 'svn' or scheme.startswith('svn+'):
+-- 
+2.49.0
+

SOURCES/create-site-packages.patch

@@ -0,0 +1,17 @@
+diff --git a/setuptools/command/easy_install.py b/setuptools/command/easy_install.py
+index 91c48b3..0c9b0f4 100755
+--- a/setuptools/command/easy_install.py
++++ b/setuptools/command/easy_install.py
+@@ -446,6 +446,12 @@ class easy_install(Command):
+         instdir = normalize_path(self.install_dir)
+         pth_file = os.path.join(instdir, 'easy-install.pth')
+ 
++        if not os.path.exists(instdir):
++            try:
++                os.makedirs(instdir)
++            except (OSError, IOError):
++                self.cant_write_to_target()
++
+         # Is it a configured, PYTHONPATH, implicit, or explicit site dir?
+         is_site_dir = instdir in self.all_site_dirs
+ 

SPECS/python-setuptools.spec

@@ -1,406 +1,367 @@
 %global srcname setuptools
 
-# The original RHEL 9 content set is defined by (build)dependencies
-# of the packages in Fedora ELN. Hence we disable tests here
-# to prevent pulling many unwanted packages in.
-# Once the RHEL 9 content set is defined and/or RHEL 9 forks from ELN,
-# the conditional can be removed from the Fedora spec file.
-# We intentionally keep this enabled on EPEL.
-%if 0%{?rhel} >= 9 && !0%{?epel}
-%bcond_with tests
-%else
-%bcond_without tests
-%endif
-
 #  WARNING  When bootstrapping, disable tests as well,
 #           because tests need pip.
 %bcond_with bootstrap
-# Similar to what we have in pythonX.Y.spec files.
+%bcond_without tests
-# If enabled, provides unversioned executables and other stuff.
+
-# Disable it if you build this package in an alternative stack.
+%bcond_with py2_wheel
-%bcond_without main_python
+
+%if 0%{?rhel} && 0%{?rhel} <= 7
+%global _without_python3 1
+# define some macros for RHEL 6
+%global __python2 %__python
+%global python2_sitelib %python_sitelib
+%endif
+
+# Note(hguemar): overrides must be placed *before* those
+# Otherwise it doesn't work
+%bcond_without python2
+%bcond_without python3
 
 %if %{without bootstrap}
-%global python_wheelname %{srcname}-%{version}-py3-none-any.whl
+%global python_wheelname %{srcname}-%{version}-py2.py3-none-any.whl
+%if %{with python2}
+%global python2_wheelname %python_wheelname
+%global python2_record %{python2_sitelib}/%{srcname}-%{version}.dist-info/RECORD
+%global python2_wheeldir %{_datadir}/python2-wheels
+%endif # with python2
+%if %{with python3}
+%global python3_wheelname %python_wheelname
 %global python3_record %{python3_sitelib}/%{srcname}-%{version}.dist-info/RECORD
-%endif
+%global python3_wheeldir %{_datadir}/python3-wheels
-%global python_wheeldir %{_datadir}/python-wheels
+%endif # with python3
+%endif # without bootstrap
 
 Name:           python-setuptools
-# When updating, update the bundled libraries versions bellow!
+Version:        39.2.0
-Version:        53.0.0
+Release:        9%{?dist}
-Release:        6%{?dist}
 Summary:        Easily build and distribute Python packages
-# setuptools is MIT
+
-# appdirs is MIT
+Group:          Applications/System
-# ordered-set is MIT
+License:        MIT
-# packaging is BSD or ASL 2.0
-# pyparsing is MIT
-# the setuptools logo has unknown license and possible TM problems,
-# but the sdist **does not** contain it,
-# see https://github.com/pypa/setuptools/issues/2227
-License:        MIT and (BSD or ASL 2.0)
 URL:            https://pypi.python.org/pypi/%{srcname}
-Source0:        %{pypi_source %{srcname} %{version}}
+Source0:        https://files.pythonhosted.org/packages/source/s/%{srcname}/%{srcname}-%{version}.zip
+
+# In Fedora, sudo setup.py install installs to /usr/local/lib/pythonX.Y/site-packages
+# But pythonX doesn't own that dir, that would be against FHS
+# We need to create it if it doesn't exist
+# https://bugzilla.redhat.com/show_bug.cgi?id=1576924
+Patch0:         create-site-packages.patch
+
+# Security fix for CVE-2022-40897
+# Regular Expression Denial of Service (ReDoS) in package_index.py
+# Resolved upstream: https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be
+Patch1:         CVE-2022-40897.patch
+
+# Security fix for CVE-2024-6345
+# Remote code execution via download functions in the package_index module
+# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=2297771
+# Upstream solution: https://github.com/pypa/setuptools/pull/4332
+# Patch simplified because upstream doesn't support SVN anymore.
+Patch2:         CVE-2024-6345.patch
+
+# Security fix for CVE-2025-47273
+# Path traversal in PackageIndex.download leads to Arbitrary File Write
+# Upstream solution: https://github.com/pypa/setuptools/pull/4951/
+Patch3:         CVE-2025-47273.patch
+
 
 BuildArch:      noarch
 
-BuildRequires:  python%{python3_pkgversion}-devel
-%if %{with tests}
 BuildRequires:  gcc
-BuildRequires:  python%{python3_pkgversion}-pip
+%if %{with python2}
-BuildRequires:  python%{python3_pkgversion}-pytest
+BuildRequires:  python2-devel
-BuildRequires:  python%{python3_pkgversion}-mock
+%if %{with py2_wheel}
-BuildRequires:  python%{python3_pkgversion}-pytest-fixture-config
+BuildRequires:  python2-pip
-BuildRequires:  python%{python3_pkgversion}-pytest-virtualenv
+BuildRequires:  python2-wheel
-BuildRequires:  python%{python3_pkgversion}-jaraco-envs
+%endif # with py2_wheel
+%endif # with python2
+
+%if %{with python3}
+BuildRequires:  python3-devel
+%if %{with tests}
+BuildRequires:  python3-pip
+BuildRequires:  python3-pytest
+BuildRequires:  python3-mock
 %endif # with tests
 %if %{without bootstrap}
-BuildRequires:  python%{python3_pkgversion}-pip
+BuildRequires:  python3-pip
-BuildRequires:  python%{python3_pkgversion}-wheel
+BuildRequires:  python3-wheel
-BuildRequires:  python%{python3_pkgversion}-setuptools
-# python3 bootstrap: this is built before the final build of python3, which
-# adds the dependency on python3-rpm-generators, so we require it manually
-# The minimal version is for bundled provides verification script
-BuildRequires:  python3-rpm-generators >= 11-8
 %endif # without bootstrap
+%endif # with python3
 
-%description
+# We're now back to setuptools as the package.
-Setuptools is a collection of enhancements to the Python distutils that allow
+# Keep the python-distribute name active for a few releases.  Eventually we'll
-you to more easily build and distribute Python packages, especially ones that
+# want to get rid of the Provides and just keep the Obsoletes
-have dependencies on other packages.
+Provides: python-distribute = %{version}-%{release}
+Obsoletes: python-distribute < 0.6.36-2
 
-This package also contains the runtime components of setuptools, necessary to
+%global _description \
-execute the software that requires pkg_resources.
+Setuptools is a collection of enhancements to the Python distutils that allow \
+you to more easily build and distribute Python packages, especially ones that \
+have dependencies on other packages. \
+\
+This package also contains the runtime components of setuptools, necessary to \
+execute the software that requires pkg_resources.py.
 
-# Virtual provides for the packages bundled by setuptools.
+%description %_description
-# Bundled packages are defined in two files:
-# - pkg_resources/_vendor/vendored.txt, and
-# - setuptools/_vendor/vendored.txt
-# Merge them to one and then generate the list with:
-# %%{_rpmconfigdir}/pythonbundles.py --namespace 'python%%{python3_pkgversion}dist' allvendor.txt
-%global bundled %{expand:
-Provides: bundled(python%{python3_pkgversion}dist(appdirs)) = 1.4.3
-Provides: bundled(python%{python3_pkgversion}dist(ordered-set)) = 3.1.1
-Provides: bundled(python%{python3_pkgversion}dist(packaging)) = 20.4
-Provides: bundled(python%{python3_pkgversion}dist(pyparsing)) = 2.2.1
-}
 
-%package -n python%{python3_pkgversion}-setuptools
+%if %{with python3}
+%package -n platform-python-setuptools
 Summary:        Easily build and distribute Python 3 packages
-%{bundled}
+Group:          Applications/System
+Conflicts:      python3-setuptools < 39.2.0-4%{?dist}
 
-%if %{with bootstrap}
+%description -n platform-python-setuptools %_description
-Provides:       python%{python3_pkgversion}dist(setuptools) = %{version}
-Provides:       python%{python3_version}dist(setuptools) = %{version}
-%endif
 
-# For users who might see ModuleNotFoundError: No module named 'pkg_resoureces'
+%endif # with python3
-%py_provides    python%{python3_pkgversion}-pkg_resources
-%py_provides    python%{python3_pkgversion}-pkg-resources
 
-# Provide platform-python-setuptools for backwards compatibility with RHEL 8
-Provides:       platform-python-setuptools = %{version}-%{release}
 
-%description -n python%{python3_pkgversion}-setuptools
+%if %{with python2}
-Setuptools is a collection of enhancements to the Python 3 distutils that allow
+%package -n python2-setuptools
-you to more easily build and distribute Python 3 packages, especially ones that
+Summary:        Easily build and distribute Python packages
-have dependencies on other packages.
+%{?python_provide:%python_provide python2-setuptools}
 
-This package also contains the runtime components of setuptools, necessary to
+%description -n python2-setuptools %_description
-execute the software that requires pkg_resources.
+
+%endif # with python2
+
+
+%if %{with python3}
+%package -n python3-setuptools
+Summary:        Easily build and distribute Python 3 packages
+Group:          Applications/System
+Requires:       platform-python-setuptools = %{version}-%{release}
+%{?python_provide:%python_provide python3-setuptools}
+
+%description -n python3-setuptools %_description
+
+%endif # with python3
 
 %if %{without bootstrap}
-%package wheel
+%if %{with py2_wheel}
+%if %{with python2}
+%package -n python2-setuptools-wheel
 Summary:        The setuptools wheel
-%{bundled}
 
-%description wheel
+%description -n python2-setuptools-wheel
 A Python wheel of setuptools to use with venv.
-%endif
+%endif #with python2
+%endif #with py2_wheel
 
+%if %{with python3}
+%package -n python3-setuptools-wheel
+Summary:        The setuptools wheel
+
+%description -n python3-setuptools-wheel
+A Python wheel of setuptools to use with venv.
+%endif #with python3
+%endif #with bootstrap
 
 %prep
 %autosetup -p1 -n %{srcname}-%{version}
-%if %{without bootstrap}
+
-# If we don't have setuptools installed yet, we use the pre-generated .egg-info
+# We can't remove .egg-info (but it doesn't matter, since it'll be rebuilt):
-# See https://github.com/pypa/setuptools/pull/2543
+#  The problem is that to properly execute setuptools' setup.py,
-# And https://github.com/pypa/setuptools/issues/2550
+#   it is needed for setuptools to be loaded as a Distribution
-rm -r %{srcname}.egg-info
+#   (with egg-info or .dist-info dir), it's not sufficient
-%endif
+#   to just have them on PYTHONPATH
+#  Running "setup.py install" without having setuptools installed
+#   as a distribution gives warnings such as
+#    ... distutils/dist.py:267: UserWarning: Unknown distribution option: 'entry_points'
+#   and doesn't create "easy_install" and .egg-info directory
+# Note: this is only a problem if bootstrapping wheel or building on RHEL,
+#  otherwise setuptools are installed as dependency into buildroot
 
 # Strip shbang
-find setuptools pkg_resources -name \*.py | xargs sed -i -e '1 {/^#!\//d}'
+find setuptools -name \*.py | xargs sed -i -e '1 {/^#!\//d}'
 # Remove bundled exes
 rm -f setuptools/*.exe
 # These tests require internet connection
 rm setuptools/tests/test_integration.py 
-# We don't do linting or coverage here
-sed -i pytest.ini -e 's/ --flake8//' \
-                  -e 's/ --cov//'
 
 %build
+
+%if %{with python2}
+%if %{with py2_wheel} && %{without bootstrap}
+export RHEL_ALLOW_PYTHON2_FOR_BUILD=1
+%py2_build_wheel
+%else
+export RHEL_ALLOW_PYTHON2_FOR_BUILD=1
+%py2_build
+%endif # without bootstrap + py2_wheel
+%endif # with python2
+
+%if %{with python3}
 %if %{without bootstrap}
 %py3_build_wheel
 %else
 %py3_build
-%endif
+%endif # without bootstrap
+%endif # with python3
 
 
 %install
+# Must do the python3 install first because the scripts in /usr/bin are
+# overwritten with every setup.py install (and we want the python2 version to
+# be the default for now).
+%if %{with python3}
 %if %{without bootstrap}
-%py3_install_wheel %{python_wheelname}
+%py3_install_wheel %{python3_wheelname}
+
+# Remove /usr/bin/easy_install from the record as later on we delete the file
+sed -i '/\/usr\/bin\/easy_install,/d' %{buildroot}%{python3_record}
 %else
 %py3_install
 %endif
 
-# This is not installed (in 45.2.0 anyway), but better be safe than sorry
+# TODO: we have to remove this by hand now, but it'd be nice if we wouldn't have to
-rm -rf %{buildroot}%{python3_sitelib}/{setuptools,pkg_resources}/tests
+# (pip install wheel doesn't overwrite)
+rm %{buildroot}%{_bindir}/easy_install
 
+rm -rf %{buildroot}%{python3_sitelib}/setuptools/tests
 %if %{without bootstrap}
 sed -i '/^setuptools\/tests\//d' %{buildroot}%{python3_record}
 %endif
 
 find %{buildroot}%{python3_sitelib} -name '*.exe' | xargs rm -f
+%endif # with python3
+
+
+%if %{with python2}
+export RHEL_ALLOW_PYTHON2_FOR_BUILD=1
+%if %{with py2_wheel}
+%py2_install_wheel %{python2_wheelname}
+%else
+%py2_install
+%endif #with py2_wheel
+
+rm -rf %{buildroot}%{python2_sitelib}/setuptools/tests
+%if %{with py2_wheel}
+sed -i '/^setuptools\/tests\//d' %{buildroot}%{python2_record}
+%endif # with py2_wheel
+
+find %{buildroot}%{python2_sitelib} -name '*.exe' | xargs rm -f
+%endif # with python2
 
 # Don't ship these
-rm -r docs/{conf.py,_*}
+rm -r docs/{Makefile,conf.py,_*}
 
 %if %{without bootstrap}
-mkdir -p %{buildroot}%{python_wheeldir}
+%if %{with py2_wheel}
-install -p dist/%{python_wheelname} -t %{buildroot}%{python_wheeldir}
+%if %{with python2}
-%endif
+mkdir -p %{buildroot}%{python2_wheeldir}
+install -p dist/%{python2_wheelname} -t %{buildroot}%{python2_wheeldir}
+%endif #with python2
+%endif #with py2_wheel
+
+%if %{with python3}
+mkdir -p %{buildroot}%{python3_wheeldir}
+install -p dist/%{python3_wheelname} -t %{buildroot}%{python3_wheeldir}
+%endif #with python3
+%endif #with bootstrap
+
 
 %if %{with tests}
 %check
-# Verify bundled provides are up to date
+%if %{with python3}
-cat pkg_resources/_vendor/vendored.txt setuptools/_vendor/vendored.txt > allvendor.txt
+# --ignore=setuptools/tests/test_virtualenv.py: because virtualenv executable
-%{_rpmconfigdir}/pythonbundles.py allvendor.txt --namespace 'python%{python3_pkgversion}dist' --compare-with '%{bundled}'
+#   is configured only for Python 2 version of virtualenv—this needs to be fixed
-
+#   in the `python-pytest-virtualenv` package
-# Regression test, the wheel should not be larger than 600 KiB
+PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=$(pwd) py.test-%{python3_version} --ignore=setuptools/tests/test_virtualenv.py
-# https://bugzilla.redhat.com/show_bug.cgi?id=1914481#c3
+%endif # with python3
-test $(du dist/%{python_wheelname} | cut -f1) -lt 600
-
-# Upstream tests
-# --ignore=pavement.py:
-#   pavement.py is only used by upstream to do releases and vendoring, we don't ship it
-PYTHONPATH=$(pwd) %pytest --ignore=pavement.py
 %endif # with tests
 
 
-%files -n python%{python3_pkgversion}-setuptools
+%if %{with python2}
+%files -n python2-setuptools
 %license LICENSE
 %doc docs/* CHANGES.rst README.rst
+%{python2_sitelib}/*
+%{_bindir}/easy_install
+%{_bindir}/easy_install-2.*
+%endif # with python2
+
+%if %{with python3}
+%files -n python3-setuptools
+%license LICENSE
+%doc docs/* CHANGES.rst README.rst
+# The easy_install-3 binary is created using alternatives
+# defined in the python36 package
+%{_bindir}/easy_install-3.*
+
+%files -n platform-python-setuptools
+%license LICENSE
+%doc docs/* CHANGES.rst README.rst
+%{python3_sitelib}/easy_install.py
 %{python3_sitelib}/pkg_resources/
 %{python3_sitelib}/setuptools*/
-%{python3_sitelib}/_distutils_hack/
+%{python3_sitelib}/__pycache__/*
-%{python3_sitelib}/distutils-precedence.pth
+%endif # with python3
 
 %if %{without bootstrap}
-%files wheel
+%if %{with py2_wheel}
+%if %{with python2}
+%files -n python2-setuptools-wheel
 %license LICENSE
 # we own the dir for simplicity
-%dir %{python_wheeldir}/
+%dir %{python2_wheeldir}/
-%{python_wheeldir}/%{python_wheelname}
+%{python2_wheeldir}/%{python2_wheelname}
-%endif
+%endif #with python2
+%endif #with py2_wheel
+
+%if %{with python3}
+%files -n python3-setuptools-wheel
+%license LICENSE
+# we own the dir for simplicity
+%dir %{python3_wheeldir}/
+%{python3_wheeldir}/%{python3_wheelname}
+%endif #with python3
+%endif #with bootstrap
 
 
 %changelog
-* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com>
+* Wed Jun 18 2025 Tomáš Hrnčiar <thrnciar@redhat.com> - 39.2.0-9
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+- Security fix for CVE-2025-47273
-  Related: rhbz#1991688
+Resolves: RHEL-96802
 
-* Wed Jul 28 2021 Tomas Orsava <torsava@redhat.com> - 53.0.0-5
+* Wed Jul 24 2024 Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
-- Provide the platform-python-setuptools name for backwards compatibility
+- Security fix for CVE-2024-6345
-  with RHEL 8
+Resolves: RHEL-50470
-- Related: rhbz#1891487
 
-* Mon Jun 21 2021 Lumír Balhar <lbalhar@redhat.com> - 53.0.0-4
+* Wed Jan 11 2023 Charalampos Stratakis <cstratak@redhat.com> - 39.2.0-7
-- Add missing bundled provide - ordered-set
+- Security fix for CVE-2022-40897
-Related: rhbz#1950291
+Resolves: rhbz#2158559
 
-* Thu Apr 22 2021 Miro Hrončok <mhroncok@redhat.com> - 53.0.0-3
+* Wed Mar 25 2020 Charalampos Stratakis <cstratak@redhat.com> - 39.2.0-6
-- Provide python3-pkg_resources
+- Create /usr/local/lib/pythonX.Y when needed
-- Provide python3-pkg-resources
+Resolves: rhbz#1808301
-Resolves: rhbz#1947857
 
-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 53.0.0-2
+* Wed Apr 17 2019 Petr Viktorin <pviktori@redhat.com> - 39.2.0-5
-- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+- Add subpackages with wheels
+Resolves: rhbz#1718032
 
-* Tue Feb 02 2021 Miro Hrončok <mhroncok@redhat.com> - 53.0.0-1
+* Mon Oct 22 2018 Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
-- Update to 53.0.0
+- New subpackage platform-python-setuptools without files from /usr/bin/*
-- https://setuptools.readthedocs.io/en/latest/history.html#v53-0-0
+- python3-setuptools contains only files from /usr/bin/* and depends
-- Fixes: rhbz#1923249
+  on platform-python-setuptools
+- Resolves: rhbz#1641973
 
-* Tue Jan 26 2021 Lumír Balhar <lbalhar@redhat.com> - 52.0.0-1
+* Mon Jun 25 2018 Petr Viktorin <pviktori@redhat.com> - 39.2.0-3
-- Update to 52.0.0 (#1917060)
+- Allow Python 2 for build
-- Removes easy_install module and executable
+  see https://hurl.corp.redhat.com/rhel8-py2
 
-* Mon Jan 11 2021 Miro Hrončok <mhroncok@redhat.com> - 51.1.2-1
+* Fri Jun 22 2018 Petr Viktorin <pviktori@redhat.com> - 39.2.0-2
-- Update to 51.1.2
+- Do not use wheel on Python 2
-- Removes tests from the wheel
-- https://setuptools.readthedocs.io/en/latest/history.html#v51-1-2
-- Fixes: rhbz#1914481
 
-* Tue Dec 29 2020 Miro Hrončok <mhroncok@redhat.com> - 51.1.1-1
+* Tue Jun 19 2018 Charalampos Stratakis <cstratak@redhat.com> - 39.2.0-1
-- Update to 51.1.1
-- Fixes test failures with pip 20.3 as well as with pytest 6.2+
-- Fixes: rhbz#1909575
-
-* Fri Dec  4 2020 Miro Hrončok <mhroncok@redhat.com> - 50.3.2-2
-- Disable tests in Fedora ELN (and RHEL)
-
-* Tue Oct 20 2020 Tomas Hrnciar <thrnciar@redhat.com> - 50.3.2-1
-- Update to 50.3.2 (#1889093)
-
-* Fri Sep 04 2020 Tomas Hrnciar <thrnciar@redhat.com> - 50.1.0-1
-- Update to 50.1.0 (#1873889)
-
-* Fri Aug 21 2020 Petr Viktorin <pviktori@redhat.com> - 49.6.0-1
-- Update to 49.6.0 (#1862791)
-
-* Wed Jul 29 2020 Miro Hrončok <mhroncok@redhat.com> - 49.1.3-1
-- Update to 49.1.3 (#1853597)
-- https://setuptools.readthedocs.io/en/latest/history.html#v49-1-3
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 47.3.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Fri Jun 26 2020 Miro Hrončok <mhroncok@redhat.com> - 47.3.1-1
-- Update to 47.3.1 (#1847049)
-- https://setuptools.readthedocs.io/en/latest/history.html#v47-3-1
-
-* Mon Jun 01 2020 Charalampos Stratakis <cstratak@redhat.com> - 47.1.1-1
-- Update to 47.1.1 (#1841123)
-- https://setuptools.readthedocs.io/en/latest/history.html#v47-1-1
-
-* Sun May 24 2020 Miro Hrončok <mhroncok@redhat.com> - 46.4.0-4
-- Rebuilt for Python 3.9
-
-* Thu May 21 2020 Miro Hrončok <mhroncok@redhat.com> - 46.4.0-3
-- Bootstrap for Python 3.9
-
-* Thu May 21 2020 Miro Hrončok <mhroncok@redhat.com> - 46.4.0-2
-- Bootstrap for Python 3.9
-
-* Mon May 18 2020 Tomas Hrnciar <thrnciar@redhat.com> - 46.4.0-1
-- Update to 46.4.0 (#1835411)
-- https://setuptools.readthedocs.io/en/latest/history.html#v46-4-0
-
-* Tue May 12 2020 Tomas Hrnciar <thrnciar@redhat.com> - 46.2.0-1
-- Update to 46.2.0 (#1833826)
-- https://setuptools.readthedocs.io/en/latest/history.html#v46-2-0
-
-* Thu Mar 26 2020 Miro Hrončok <mhroncok@redhat.com> - 46.1.3-1
-- Upgrade to 46.1.3 (#1817189)
-- https://setuptools.readthedocs.io/en/latest/history.html#v46-1-3
-
-* Tue Mar 10 2020 Miro Hrončok <mhroncok@redhat.com> - 46.0.0-1
-- Upgrade to 46.0.0 (#1811340)
-- https://setuptools.readthedocs.io/en/latest/history.html#v46-0-0
-
-* Tue Feb 11 2020 Miro Hrončok <mhroncok@redhat.com> - 45.2.0-1
-- Upgrade to 45.2.0 (#1775943)
-- https://setuptools.readthedocs.io/en/latest/history.html#v45-2-0
-- No longer supports Python 2
-
-* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 41.6.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Mon Nov 04 2019 Tomas Orsava <torsava@redhat.com> - 41.6.0-1
-- Upgrade to 41.6.0 (#1758945).
-- https://setuptools.readthedocs.io/en/latest/history.html#v41-6-0
-- Disabled a failing upstream test: https://github.com/pypa/setuptools/issues/1896
-
-* Tue Sep 03 2019 Randy Barlow <bowlofeggs@fedoraproject.org> - 41.2.0-1
-- Upgrade to 41.2.0 (#1742718).
-- https://setuptools.readthedocs.io/en/latest/history.html#v41-2-0
-
-* Mon Aug 26 2019 Miro Hrončok <mhroncok@redhat.com> - 41.0.1-9
-- Move python2-setuptools to a separate package
-
-* Sun Aug 18 2019 Miro Hrončok <mhroncok@redhat.com> - 41.0.1-8
-- Rebuilt for Python 3.8
-
-* Wed Aug 14 2019 Miro Hrončok <mhroncok@redhat.com> - 41.0.1-7
-- Bootstrap for Python 3.8
-
-* Wed Aug 14 2019 Miro Hrončok <mhroncok@redhat.com> - 41.0.1-6
-- Provide pythonXdist(setuptools) when bootstrapping
-
-* Wed Aug 14 2019 Miro Hrončok <mhroncok@redhat.com> - 41.0.1-5
-- Bootstrap for Python 3.8
-
-* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 41.0.1-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Tue Jul 16 2019 Miro Hrončok <mhroncok@redhat.com> - 41.0.1-3
-- Make /usr/bin/easy_install Python 3
-- Drop obsoleted Obsoletes
-
-* Fri Jun 21 2019 Petr Viktorin <pviktori@redhat.com> - 41.0.1-2
-- Remove optional test dependencies for Python 2
-- Skip test_virtualenv on Python 2
-
-* Thu Apr 25 2019 Miro Hrončok <mhroncok@redhat.com> - 41.0.1-1
-- Update to 41.0.1 (#1695846)
-- https://github.com/pypa/setuptools/blob/v41.0.1/CHANGES.rst
-
-* Tue Feb 05 2019 Miro Hrončok <mhroncok@redhat.com> - 40.8.0-1
-- Update to 40.8.0 (#1672756)
-- https://github.com/pypa/setuptools/blob/v40.8.0/CHANGES.rst
-
-* Sun Feb 03 2019 Miro Hrončok <mhroncok@redhat.com> - 40.7.3-1
-- Hotfix update to 40.7.3 (#1672084)
-- https://github.com/pypa/setuptools/blob/v40.7.3/CHANGES.rst
-
-* Sat Feb 02 2019 Miro Hrončok <mhroncok@redhat.com> - 40.7.2-1
-- Hotfix update to 40.7.2 (#1671608)
-- https://github.com/pypa/setuptools/blob/v40.7.2/CHANGES.rst
-
-* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 40.7.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Tue Jan 29 2019 Miro Hrončok <mhroncok@redhat.com> - 40.7.1-1
-- Hotfix update to 40.7.1 (#1670243)
-- https://github.com/pypa/setuptools/blob/v40.7.1/CHANGES.rst
-
-* Mon Jan 28 2019 Miro Hrončok <mhroncok@redhat.com> - 40.7.0-1
-- Update to 40.7.0 (#1669876)
-- https://github.com/pypa/setuptools/blob/v40.7.0/CHANGES.rst
-
-* Mon Sep 24 2018 Miro Hrončok <mhroncok@redhat.com> - 40.4.3-1
-- Update to 40.4.3 to fix dire DeprecationWarnings (#1627071)
-- List vendored libraries
-- https://github.com/pypa/setuptools/blob/v40.4.3/CHANGES.rst
-
-* Wed Sep 19 2018 Randy Barlow <bowlofeggs@fedoraproject.org> - 40.4.1-1
-- Update to 40.4.1 (#1599307).
-- https://github.com/pypa/setuptools/blob/v40.4.1/CHANGES.rst
-
-* Wed Aug 15 2018 Petr Viktorin <pviktori@redhat.com> - 39.2.0-7
-- Add a subpackage with wheels
-- Remove the python3 bcond
-- Remove macros for RHEL 6
-
-* Thu Jul 19 2018 Miro Hrončok <mhroncok@redhat.com> - 39.2.0-6
-- Create /usr/local/lib/pythonX.Y when needed (#1576924)
-
-* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 39.2.0-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Mon Jun 18 2018 Miro Hrončok <mhroncok@redhat.com> - 39.2.0-4
-- Rebuilt for Python 3.7
-
-* Wed Jun 13 2018 Miro Hrončok <mhroncok@redhat.com> - 39.2.0-3
-- Bootstrap for Python 3.7
-
-* Wed Jun 13 2018 Miro Hrončok <mhroncok@redhat.com> - 39.2.0-2
-- Bootstrap for Python 3.7
-
-* Wed May 23 2018 Charalampos Stratakis <cstratak@redhat.com> - 39.2.0-1
 - update to 39.2.0 Fixes bug #1572889
 
+* Thu Jun 07 2018 Petr Viktorin <pviktori@redhat.com> - 39.0.1-2
+- Remove test requirements on python2 packages and some exotic packages
+- Skip tests on Python 2
+
 * Tue Mar 20 2018 Charalampos Stratakis <cstratak@redhat.com> - 39.0.1-1
 - update to 39.0.1 Fixes bug #1531527