rpms/python3.11
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Rebase to 3.11.7

Browse Source 
Rebased patches: 329, 415

Resolves: RHEL-21915
This commit is contained in:
Charalampos Stratakis 2024-01-22 23:42:43 +01:00
parent fec299bb84
commit 42da53f74b
6 changed files with 93 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -6,3 +6,5 @@
/Python-3.11.4.tar.xz.asc /Python-3.11.4.tar.xz.asc
/Python-3.11.5.tar.xz /Python-3.11.5.tar.xz
/Python-3.11.5.tar.xz.asc /Python-3.11.5.tar.xz.asc
/Python-3.11.7.tar.xz
/Python-3.11.7.tar.xz.asc

90
00329-fips.patch
View File

@ -1,4 +1,4 @@
From c96f1bea2ffc5c0ca849d5406236c07ea229a64f Mon Sep 17 00:00:00 2001 From ecc5137120f471c22ff6dcb1bd128561c31e023c Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com> From: Charalampos Stratakis <cstratak@redhat.com>
Date: Thu, 12 Dec 2019 16:58:31 +0100 Date: Thu, 12 Dec 2019 16:58:31 +0100
Subject: [PATCH 1/7] Expose blake2b and blake2s hashes from OpenSSL Subject: [PATCH 1/7] Expose blake2b and blake2s hashes from OpenSSL
@ -29,10 +29,10 @@ index 67becdd..6607ef7 100644
computed = m.hexdigest() if not shake else m.hexdigest(length) computed = m.hexdigest() if not shake else m.hexdigest(length)
self.assertEqual( self.assertEqual(
diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c
index 3c40f09..e819d02 100644 index 57d64bd..d0c3b9e 100644
--- a/Modules/_hashopenssl.c --- a/Modules/_hashopenssl.c
+++ b/Modules/_hashopenssl.c +++ b/Modules/_hashopenssl.c
@@ -1077,6 +1077,41 @@ _hashlib_openssl_sha512_impl(PyObject *module, PyObject *data_obj, @@ -1078,6 +1078,41 @@ _hashlib_openssl_sha512_impl(PyObject *module, PyObject *data_obj,
} }
@ -74,7 +74,7 @@ index 3c40f09..e819d02 100644
#ifdef PY_OPENSSL_HAS_SHA3 #ifdef PY_OPENSSL_HAS_SHA3
/*[clinic input] /*[clinic input]
@@ -2065,6 +2100,8 @@ static struct PyMethodDef EVP_functions[] = { @@ -2066,6 +2101,8 @@ static struct PyMethodDef EVP_functions[] = {
_HASHLIB_OPENSSL_SHA256_METHODDEF _HASHLIB_OPENSSL_SHA256_METHODDEF
_HASHLIB_OPENSSL_SHA384_METHODDEF _HASHLIB_OPENSSL_SHA384_METHODDEF
_HASHLIB_OPENSSL_SHA512_METHODDEF _HASHLIB_OPENSSL_SHA512_METHODDEF
@ -205,10 +205,10 @@ index 5d84f4a..011026a 100644
-/*[clinic end generated code: output=69f2374071bff707 input=a9049054013a1b77]*/ -/*[clinic end generated code: output=69f2374071bff707 input=a9049054013a1b77]*/
+/*[clinic end generated code: output=c6a9af5563972eda input=a9049054013a1b77]*/ +/*[clinic end generated code: output=c6a9af5563972eda input=a9049054013a1b77]*/
-- --
2.39.1 2.43.0
From 9a7e164840aa35602e1c6dddadd461fafc666a63 Mon Sep 17 00:00:00 2001 From 0198d467525e79cb4be4418708719af3eaee7a40 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com> From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 1 Aug 2019 17:57:05 +0200 Date: Thu, 1 Aug 2019 17:57:05 +0200
Subject: [PATCH 2/7] Use a stronger hash in multiprocessing handshake Subject: [PATCH 2/7] Use a stronger hash in multiprocessing handshake
@ -220,10 +220,10 @@ https://bugs.python.org/issue17258
1 file changed, 6 insertions(+), 2 deletions(-) 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py
index b08144f..0497557 100644 index 8b81f99..69c0b7e 100644
--- a/Lib/multiprocessing/connection.py --- a/Lib/multiprocessing/connection.py
+++ b/Lib/multiprocessing/connection.py +++ b/Lib/multiprocessing/connection.py
@@ -42,6 +42,10 @@ BUFSIZE = 8192 @@ -43,6 +43,10 @@ BUFSIZE = 8192
# A very generous timeout when it comes to local connections... # A very generous timeout when it comes to local connections...
CONNECTION_TIMEOUT = 20. CONNECTION_TIMEOUT = 20.
@ -234,7 +234,7 @@ index b08144f..0497557 100644
_mmap_counter = itertools.count() _mmap_counter = itertools.count()
default_family = 'AF_INET' default_family = 'AF_INET'
@@ -735,7 +739,7 @@ def deliver_challenge(connection, authkey): @@ -752,7 +756,7 @@ def deliver_challenge(connection, authkey):
"Authkey must be bytes, not {0!s}".format(type(authkey))) "Authkey must be bytes, not {0!s}".format(type(authkey)))
message = os.urandom(MESSAGE_LENGTH) message = os.urandom(MESSAGE_LENGTH)
connection.send_bytes(CHALLENGE + message) connection.send_bytes(CHALLENGE + message)
@ -243,7 +243,7 @@ index b08144f..0497557 100644
response = connection.recv_bytes(256) # reject large message response = connection.recv_bytes(256) # reject large message
if response == digest: if response == digest:
connection.send_bytes(WELCOME) connection.send_bytes(WELCOME)
@@ -751,7 +755,7 @@ def answer_challenge(connection, authkey): @@ -768,7 +772,7 @@ def answer_challenge(connection, authkey):
message = connection.recv_bytes(256) # reject large message message = connection.recv_bytes(256) # reject large message
assert message[:len(CHALLENGE)] == CHALLENGE, 'message = %r' % message assert message[:len(CHALLENGE)] == CHALLENGE, 'message = %r' % message
message = message[len(CHALLENGE):] message = message[len(CHALLENGE):]
@ -253,10 +253,10 @@ index b08144f..0497557 100644
response = connection.recv_bytes(256) # reject large message response = connection.recv_bytes(256) # reject large message
if response != WELCOME: if response != WELCOME:
-- --
2.39.1 2.43.0
From 10b91783a2f22153738c5658a98daf7475ad9a8c Mon Sep 17 00:00:00 2001 From a7822e2e1f21529e9730885bd8c9c6ab7c704d5b Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com> From: Petr Viktorin <pviktori@redhat.com>
Date: Thu, 25 Jul 2019 17:19:06 +0200 Date: Thu, 25 Jul 2019 17:19:06 +0200
Subject: [PATCH 3/7] Disable Python's hash implementations in FIPS mode, Subject: [PATCH 3/7] Disable Python's hash implementations in FIPS mode,
@ -359,7 +359,7 @@ index c2cac98..55b1677 100644
if (self->lock == NULL && buf.len >= HASHLIB_GIL_MINSIZE) if (self->lock == NULL && buf.len >= HASHLIB_GIL_MINSIZE)
diff --git a/Modules/_blake2/blake2module.c b/Modules/_blake2/blake2module.c diff --git a/Modules/_blake2/blake2module.c b/Modules/_blake2/blake2module.c
index 44d783b..d247e44 100644 index 93478f5..e3a024d 100644
--- a/Modules/_blake2/blake2module.c --- a/Modules/_blake2/blake2module.c
+++ b/Modules/_blake2/blake2module.c +++ b/Modules/_blake2/blake2module.c
@@ -13,6 +13,7 @@ @@ -13,6 +13,7 @@
@ -370,7 +370,7 @@ index 44d783b..d247e44 100644
#include "blake2module.h" #include "blake2module.h"
extern PyType_Spec blake2b_type_spec; extern PyType_Spec blake2b_type_spec;
@@ -77,6 +78,7 @@ _blake2_free(void *module) @@ -83,6 +84,7 @@ _blake2_free(void *module)
static int static int
blake2_exec(PyObject *m) blake2_exec(PyObject *m)
{ {
@ -378,7 +378,7 @@ index 44d783b..d247e44 100644
Blake2State* st = blake2_get_state(m); Blake2State* st = blake2_get_state(m);
st->blake2b_type = (PyTypeObject *)PyType_FromModuleAndSpec( st->blake2b_type = (PyTypeObject *)PyType_FromModuleAndSpec(
@@ -145,5 +147,6 @@ static struct PyModuleDef blake2_module = { @@ -154,5 +156,6 @@ static struct PyModuleDef blake2_module = {
PyMODINIT_FUNC PyMODINIT_FUNC
PyInit__blake2(void) PyInit__blake2(void)
{ {
@ -446,10 +446,10 @@ index 56ae7a5..45fb403 100644
+ if (_Py_hashlib_fips_error(exc, name)) return NULL; \ + if (_Py_hashlib_fips_error(exc, name)) return NULL; \
+} while (0) +} while (0)
diff --git a/configure.ac b/configure.ac diff --git a/configure.ac b/configure.ac
index c62a565..861f7a0 100644 index 52d5c1f..56aff78 100644
--- a/configure.ac --- a/configure.ac
+++ b/configure.ac +++ b/configure.ac
@@ -7044,7 +7044,8 @@ PY_STDLIB_MOD([_sha512], [test "$with_builtin_sha512" = yes]) @@ -7069,7 +7069,8 @@ PY_STDLIB_MOD([_sha512], [test "$with_builtin_sha512" = yes])
PY_STDLIB_MOD([_sha3], [test "$with_builtin_sha3" = yes]) PY_STDLIB_MOD([_sha3], [test "$with_builtin_sha3" = yes])
PY_STDLIB_MOD([_blake2], PY_STDLIB_MOD([_blake2],
[test "$with_builtin_blake2" = yes], [], [test "$with_builtin_blake2" = yes], [],
@ -460,10 +460,10 @@ index c62a565..861f7a0 100644
PY_STDLIB_MOD([_crypt], PY_STDLIB_MOD([_crypt],
[], [test "$ac_cv_crypt_crypt" = yes], [], [test "$ac_cv_crypt_crypt" = yes],
-- --
2.39.1 2.43.0
From e26066b1c05c9768e38cb6f45d6a01058de55b3f Mon Sep 17 00:00:00 2001 From e9ce6d33544559172dbebbe0c0dfba2757c62331 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com> From: Charalampos Stratakis <cstratak@redhat.com>
Date: Fri, 29 Jan 2021 14:16:21 +0100 Date: Fri, 29 Jan 2021 14:16:21 +0100
Subject: [PATCH 4/7] Use python's fall back crypto implementations only if we Subject: [PATCH 4/7] Use python's fall back crypto implementations only if we
@ -623,10 +623,10 @@ index 01d12f5..a7cdb07 100644
def test_pbkdf2_hmac_py(self): def test_pbkdf2_hmac_py(self):
with warnings_helper.check_warnings(): with warnings_helper.check_warnings():
-- --
2.39.1 2.43.0
From 9ccbd22b8538fee379717c8b2916dc1ff8b96f07 Mon Sep 17 00:00:00 2001 From 641c617775b6973ed84711a2602ba190fe064474 Mon Sep 17 00:00:00 2001
From: Charalampos Stratakis <cstratak@redhat.com> From: Charalampos Stratakis <cstratak@redhat.com>
Date: Wed, 31 Jul 2019 15:43:43 +0200 Date: Wed, 31 Jul 2019 15:43:43 +0200
Subject: [PATCH 5/7] Test equivalence of hashes for the various digests with Subject: [PATCH 5/7] Test equivalence of hashes for the various digests with
@ -783,10 +783,10 @@ index a7cdb07..c071f28 100644
class KDFTests(unittest.TestCase): class KDFTests(unittest.TestCase):
-- --
2.39.1 2.43.0
From c3b8d6ecc76c87e8b05fd2cb212d5dece50ce0b1 Mon Sep 17 00:00:00 2001 From a706c8342f0f9307d44c43c203702e1476fe73b4 Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pviktori@redhat.com> From: Petr Viktorin <pviktori@redhat.com>
Date: Mon, 26 Aug 2019 19:39:48 +0200 Date: Mon, 26 Aug 2019 19:39:48 +0200
Subject: [PATCH 6/7] Guard against Python HMAC in FIPS mode Subject: [PATCH 6/7] Guard against Python HMAC in FIPS mode
@ -844,7 +844,7 @@ index 8b4f920..20ef96c 100644
digest_cons = digestmod digest_cons = digestmod
elif isinstance(digestmod, str): elif isinstance(digestmod, str):
diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
index 7cf9973..a9e4e39 100644 index a39a2c4..0742a1c 100644
--- a/Lib/test/test_hmac.py --- a/Lib/test/test_hmac.py
+++ b/Lib/test/test_hmac.py +++ b/Lib/test/test_hmac.py
@@ -5,6 +5,7 @@ import hashlib @@ -5,6 +5,7 @@ import hashlib
@ -875,7 +875,7 @@ index 7cf9973..a9e4e39 100644
with warnings.catch_warnings(): with warnings.catch_warnings():
warnings.simplefilter('error', RuntimeWarning) warnings.simplefilter('error', RuntimeWarning)
with self.assertRaises(RuntimeWarning): with self.assertRaises(RuntimeWarning):
@@ -443,6 +450,7 @@ class ConstructorTestCase(unittest.TestCase): @@ -453,6 +460,7 @@ class ConstructorTestCase(unittest.TestCase):
with self.assertRaisesRegex(TypeError, "immutable type"): with self.assertRaisesRegex(TypeError, "immutable type"):
C_HMAC.value = None C_HMAC.value = None
@ -883,7 +883,7 @@ index 7cf9973..a9e4e39 100644
@unittest.skipUnless(sha256_module is not None, 'need _sha256') @unittest.skipUnless(sha256_module is not None, 'need _sha256')
def test_with_sha256_module(self): def test_with_sha256_module(self):
h = hmac.HMAC(b"key", b"hash this!", digestmod=sha256_module.sha256) h = hmac.HMAC(b"key", b"hash this!", digestmod=sha256_module.sha256)
@@ -471,6 +479,7 @@ class SanityTestCase(unittest.TestCase): @@ -481,6 +489,7 @@ class SanityTestCase(unittest.TestCase):
class CopyTestCase(unittest.TestCase): class CopyTestCase(unittest.TestCase):
@ -891,7 +891,7 @@ index 7cf9973..a9e4e39 100644
@hashlib_helper.requires_hashdigest('sha256') @hashlib_helper.requires_hashdigest('sha256')
def test_attributes_old(self): def test_attributes_old(self):
# Testing if attributes are of same type. # Testing if attributes are of same type.
@@ -482,6 +491,7 @@ class CopyTestCase(unittest.TestCase): @@ -492,6 +501,7 @@ class CopyTestCase(unittest.TestCase):
self.assertEqual(type(h1._outer), type(h2._outer), self.assertEqual(type(h1._outer), type(h2._outer),
"Types of outer don't match.") "Types of outer don't match.")
@ -900,10 +900,10 @@ index 7cf9973..a9e4e39 100644
def test_realcopy_old(self): def test_realcopy_old(self):
# Testing if the copy method created a real copy. # Testing if the copy method created a real copy.
-- --
2.39.1 2.43.0
From 2b06ee89344e8735cdc8435aadbdf83fe289e934 Mon Sep 17 00:00:00 2001 From 03f1dedfe5d29af20fb3686d76b045384d41d8dd Mon Sep 17 00:00:00 2001
From: Petr Viktorin <encukou@gmail.com> From: Petr Viktorin <encukou@gmail.com>
Date: Wed, 25 Aug 2021 16:44:43 +0200 Date: Wed, 25 Aug 2021 16:44:43 +0200
Subject: [PATCH 7/7] Disable hash-based PYCs in FIPS mode Subject: [PATCH 7/7] Disable hash-based PYCs in FIPS mode
@ -946,11 +946,11 @@ index db52725..5fca65e 100644
return PycInvalidationMode.CHECKED_HASH return PycInvalidationMode.CHECKED_HASH
else: else:
diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
index c33f90d..7d40540 100644 index dc7a6e6..646b328 100644
--- a/Lib/test/support/__init__.py --- a/Lib/test/support/__init__.py
+++ b/Lib/test/support/__init__.py +++ b/Lib/test/support/__init__.py
@@ -2225,6 +2225,20 @@ def requires_venv_with_pip(): @@ -2203,6 +2203,20 @@ def sleeping_retry(timeout, err_msg=None, /,
return unittest.skipUnless(ctypes, 'venv: pip requires ctypes') delay = min(delay * 2, max_delay)
+def fails_in_fips_mode(expected_error): +def fails_in_fips_mode(expected_error):
@ -971,7 +971,7 @@ index c33f90d..7d40540 100644
def adjust_int_max_str_digits(max_digits): def adjust_int_max_str_digits(max_digits):
"""Temporarily change the integer string conversion length limit.""" """Temporarily change the integer string conversion length limit."""
diff --git a/Lib/test/test_cmd_line_script.py b/Lib/test/test_cmd_line_script.py diff --git a/Lib/test/test_cmd_line_script.py b/Lib/test/test_cmd_line_script.py
index 4dadbc0..7dc7e51 100644 index 7fcd563..476b557 100644
--- a/Lib/test/test_cmd_line_script.py --- a/Lib/test/test_cmd_line_script.py
+++ b/Lib/test/test_cmd_line_script.py +++ b/Lib/test/test_cmd_line_script.py
@@ -286,6 +286,7 @@ class CmdLineTest(unittest.TestCase): @@ -286,6 +286,7 @@ class CmdLineTest(unittest.TestCase):
@ -991,10 +991,10 @@ index 4dadbc0..7dc7e51 100644
with os_helper.temp_dir() as script_dir: with os_helper.temp_dir() as script_dir:
script_name = _make_test_script(script_dir, '__main__') script_name = _make_test_script(script_dir, '__main__')
diff --git a/Lib/test/test_compileall.py b/Lib/test/test_compileall.py diff --git a/Lib/test/test_compileall.py b/Lib/test/test_compileall.py
index 05154c8..c678d4a 100644 index 9cd92ad..4ec29a1 100644
--- a/Lib/test/test_compileall.py --- a/Lib/test/test_compileall.py
+++ b/Lib/test/test_compileall.py +++ b/Lib/test/test_compileall.py
@@ -800,14 +800,23 @@ class CommandLineTestsBase: @@ -806,14 +806,23 @@ class CommandLineTestsBase:
out = self.assertRunOK('badfilename') out = self.assertRunOK('badfilename')
self.assertRegex(out, b"Can't list 'badfilename'") self.assertRegex(out, b"Can't list 'badfilename'")
@ -1020,10 +1020,10 @@ index 05154c8..c678d4a 100644
with open(pyc, 'rb') as fp: with open(pyc, 'rb') as fp:
data = fp.read() data = fp.read()
diff --git a/Lib/test/test_imp.py b/Lib/test/test_imp.py diff --git a/Lib/test/test_imp.py b/Lib/test/test_imp.py
index 4bb0390..ff62483 100644 index 4062afd..6bc276d 100644
--- a/Lib/test/test_imp.py --- a/Lib/test/test_imp.py
+++ b/Lib/test/test_imp.py +++ b/Lib/test/test_imp.py
@@ -350,6 +350,7 @@ class ImportTests(unittest.TestCase): @@ -352,6 +352,7 @@ class ImportTests(unittest.TestCase):
import _frozen_importlib import _frozen_importlib
self.assertEqual(_frozen_importlib.__spec__.origin, "frozen") self.assertEqual(_frozen_importlib.__spec__.origin, "frozen")
@ -1031,7 +1031,7 @@ index 4bb0390..ff62483 100644
def test_source_hash(self): def test_source_hash(self):
self.assertEqual(_imp.source_hash(42, b'hi'), b'\xfb\xd9G\x05\xaf$\x9b~') self.assertEqual(_imp.source_hash(42, b'hi'), b'\xfb\xd9G\x05\xaf$\x9b~')
self.assertEqual(_imp.source_hash(43, b'hi'), b'\xd0/\x87C\xccC\xff\xe2') self.assertEqual(_imp.source_hash(43, b'hi'), b'\xd0/\x87C\xccC\xff\xe2')
@@ -369,6 +370,7 @@ class ImportTests(unittest.TestCase): @@ -371,6 +372,7 @@ class ImportTests(unittest.TestCase):
res = script_helper.assert_python_ok(*args) res = script_helper.assert_python_ok(*args)
self.assertEqual(res.out.strip().decode('utf-8'), expected) self.assertEqual(res.out.strip().decode('utf-8'), expected)
@ -1092,10 +1092,10 @@ index 378dcbe..7b223a1 100644
with util.create_modules('_temp') as mapping: with util.create_modules('_temp') as mapping:
bc_path = self.manipulate_bytecode( bc_path = self.manipulate_bytecode(
diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
index e53f5d9..7266212 100644 index 9b420d2..dd6460a 100644
--- a/Lib/test/test_py_compile.py --- a/Lib/test/test_py_compile.py
+++ b/Lib/test/test_py_compile.py +++ b/Lib/test/test_py_compile.py
@@ -141,13 +141,16 @@ class PyCompileTestsBase: @@ -143,13 +143,16 @@ class PyCompileTestsBase:
importlib.util.cache_from_source(bad_coding))) importlib.util.cache_from_source(bad_coding)))
def test_source_date_epoch(self): def test_source_date_epoch(self):
@ -1113,7 +1113,7 @@ index e53f5d9..7266212 100644
expected_flags = 0b11 expected_flags = 0b11
else: else:
expected_flags = 0b00 expected_flags = 0b00
@@ -178,7 +181,8 @@ class PyCompileTestsBase: @@ -180,7 +183,8 @@ class PyCompileTestsBase:
# Specifying optimized bytecode should lead to a path reflecting that. # Specifying optimized bytecode should lead to a path reflecting that.
self.assertIn('opt-2', py_compile.compile(self.source_path, optimize=2)) self.assertIn('opt-2', py_compile.compile(self.source_path, optimize=2))
@ -1123,7 +1123,7 @@ index e53f5d9..7266212 100644
py_compile.compile( py_compile.compile(
self.source_path, self.source_path,
invalidation_mode=py_compile.PycInvalidationMode.CHECKED_HASH, invalidation_mode=py_compile.PycInvalidationMode.CHECKED_HASH,
@@ -187,6 +191,9 @@ class PyCompileTestsBase: @@ -189,6 +193,9 @@ class PyCompileTestsBase:
flags = importlib._bootstrap_external._classify_pyc( flags = importlib._bootstrap_external._classify_pyc(
fp.read(), 'test', {}) fp.read(), 'test', {})
self.assertEqual(flags, 0b11) self.assertEqual(flags, 0b11)
@ -1154,10 +1154,10 @@ index 59a5200..81fadb3 100644
def test_checked_hash_based_change_pyc(self): def test_checked_hash_based_change_pyc(self):
source = b"state = 'old'" source = b"state = 'old'"
diff --git a/Python/import.c b/Python/import.c diff --git a/Python/import.c b/Python/import.c
index 07a8b90..e97b47b 100644 index 39144d3..b439059 100644
--- a/Python/import.c --- a/Python/import.c
+++ b/Python/import.c +++ b/Python/import.c
@@ -2437,6 +2437,26 @@ static PyObject * @@ -2449,6 +2449,26 @@ static PyObject *
_imp_source_hash_impl(PyObject *module, long key, Py_buffer *source) _imp_source_hash_impl(PyObject *module, long key, Py_buffer *source)
/*[clinic end generated code: output=edb292448cf399ea input=9aaad1e590089789]*/ /*[clinic end generated code: output=edb292448cf399ea input=9aaad1e590089789]*/
{ {
@ -1185,5 +1185,5 @@ index 07a8b90..e97b47b 100644
uint64_t x; uint64_t x;
char data[sizeof(uint64_t)]; char data[sizeof(uint64_t)];
-- --
2.39.1 2.43.0

58
00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
View File

@ -1,8 +1,8 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From d8b0fafb202bf884135a3f7f0ce0b086217a2da2 Mon Sep 17 00:00:00 2001
From: Victor Stinner <vstinner@python.org> From: Victor Stinner <vstinner@python.org>
Date: Fri, 15 Dec 2023 16:10:40 +0100 Date: Fri, 15 Dec 2023 16:10:40 +0100
Subject: [PATCH] 00415: [CVE-2023-27043] gh-102988: Reject malformed addresses Subject: [PATCH 1/2] 00415: [CVE-2023-27043] gh-102988: Reject malformed
in email.parseaddr() (#111116) addresses in email.parseaddr() (#111116)
Detect email address parsing errors and return empty tuple to Detect email address parsing errors and return empty tuple to
indicate the parsing error (old API). Add an optional 'strict' indicate the parsing error (old API). Add an optional 'strict'
@ -19,7 +19,7 @@ Co-Authored-By: Thomas Dwyer <github@tomd.tel>
create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
index 0e266b6a45..6723dc4f13 100644 index 0e266b6..6723dc4 100644
--- a/Doc/library/email.utils.rst --- a/Doc/library/email.utils.rst
+++ b/Doc/library/email.utils.rst +++ b/Doc/library/email.utils.rst
@@ -60,13 +60,18 @@ of the new API. @@ -60,13 +60,18 @@ of the new API.
@ -72,10 +72,10 @@ index 0e266b6a45..6723dc4f13 100644
.. function:: parsedate(date) .. function:: parsedate(date)
diff --git a/Lib/email/utils.py b/Lib/email/utils.py diff --git a/Lib/email/utils.py b/Lib/email/utils.py
index cfdfeb3f1a..9522341fab 100644 index cfdfeb3..9522341 100644
--- a/Lib/email/utils.py --- a/Lib/email/utils.py
+++ b/Lib/email/utils.py +++ b/Lib/email/utils.py
@@ -48,6 +48,7 @@ @@ -48,6 +48,7 @@ TICK = "'"
specialsre = re.compile(r'[][\\()<>@,:;".]') specialsre = re.compile(r'[][\\()<>@,:;".]')
escapesre = re.compile(r'[\\"]') escapesre = re.compile(r'[\\"]')
@ -100,12 +100,7 @@ index cfdfeb3f1a..9522341fab 100644
+ yield (pos, ch) + yield (pos, ch)
+ if escape: + if escape:
+ yield (pos, '\\') + yield (pos, '\\')
+
-def getaddresses(fieldvalues):
- """Return a list of (REALNAME, EMAIL) for each fieldvalue."""
- all = COMMASPACE.join(str(v) for v in fieldvalues)
- a = _AddressList(all)
- return a.addresslist
+ +
+def _strip_quoted_realnames(addr): +def _strip_quoted_realnames(addr):
+ """Strip real names between quotes.""" + """Strip real names between quotes."""
@ -130,7 +125,12 @@ index cfdfeb3f1a..9522341fab 100644
+ result.append(addr[start:]) + result.append(addr[start:])
+ +
+ return ''.join(result) + return ''.join(result)
+
-def getaddresses(fieldvalues):
- """Return a list of (REALNAME, EMAIL) for each fieldvalue."""
- all = COMMASPACE.join(str(v) for v in fieldvalues)
- a = _AddressList(all)
- return a.addresslist
+ +
+supports_strict_parsing = True +supports_strict_parsing = True
+ +
@ -255,10 +255,10 @@ index cfdfeb3f1a..9522341fab 100644
diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
index 677f2094b8..20b67792ea 100644 index 677f209..20b6779 100644
--- a/Lib/test/test_email/test_email.py --- a/Lib/test/test_email/test_email.py
+++ b/Lib/test/test_email/test_email.py +++ b/Lib/test/test_email/test_email.py
@@ -17,6 +17,7 @@ @@ -17,6 +17,7 @@ from unittest.mock import patch
import email import email
import email.policy import email.policy
@ -266,7 +266,7 @@ index 677f2094b8..20b67792ea 100644
from email.charset import Charset from email.charset import Charset
from email.generator import Generator, DecodedGenerator, BytesGenerator from email.generator import Generator, DecodedGenerator, BytesGenerator
@@ -3321,15 +3322,154 @@ def test_getaddresses(self): @@ -3321,15 +3322,154 @@ Foo
[('Al Person', 'aperson@dom.ain'), [('Al Person', 'aperson@dom.ain'),
('Bud Person', 'bperson@dom.ain')]) ('Bud Person', 'bperson@dom.ain')])
@ -429,7 +429,7 @@ index 677f2094b8..20b67792ea 100644
def test_getaddresses_embedded_comment(self): def test_getaddresses_embedded_comment(self):
"""Test proper handling of a nested comment""" """Test proper handling of a nested comment"""
@@ -3520,6 +3660,54 @@ def test_mime_classes_policy_argument(self): @@ -3520,6 +3660,54 @@ multipart/report
m = cls(*constructor, policy=email.policy.default) m = cls(*constructor, policy=email.policy.default)
self.assertIs(m.policy, email.policy.default) self.assertIs(m.policy, email.policy.default)
@ -486,7 +486,7 @@ index 677f2094b8..20b67792ea 100644
class TestIterators(TestEmailBase): class TestIterators(TestEmailBase):
diff --git a/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst diff --git a/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
new file mode 100644 new file mode 100644
index 0000000000..3d0e9e4078 index 0000000..3d0e9e4
--- /dev/null --- /dev/null
+++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst +++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
@@ -0,0 +1,8 @@ @@ -0,0 +1,8 @@
@ -498,18 +498,21 @@ index 0000000000..3d0e9e4078
+``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check +``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check
+if the *strict* paramater is available. Patch by Thomas Dwyer and Victor +if the *strict* paramater is available. Patch by Thomas Dwyer and Victor
+Stinner to improve the CVE-2023-27043 fix. +Stinner to improve the CVE-2023-27043 fix.
--
2.43.0
From 84627ff5841b6715edc47a643225195a0718de99 Mon Sep 17 00:00:00 2001 From 6c34f5b95da90bd494e29776c0e807af44689fae Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com> From: Lumir Balhar <lbalhar@redhat.com>
Date: Wed, 10 Jan 2024 08:53:53 +0100 Date: Wed, 10 Jan 2024 08:53:53 +0100
Subject: [PATCH] Make it possible to disable strict parsing in email module Subject: [PATCH 2/2] Make it possible to disable strict parsing in email
module
--- ---
Doc/library/email.utils.rst | 26 +++++++++++ Doc/library/email.utils.rst | 26 +++++++++++
Lib/email/utils.py | 54 ++++++++++++++++++++++- Lib/email/utils.py | 54 +++++++++++++++++++++-
Lib/test/test_email/test_email.py | 72 ++++++++++++++++++++++++++++++- Lib/test/test_email/test_email.py | 74 ++++++++++++++++++++++++++++++-
3 files changed, 149 insertions(+), 3 deletions(-) 3 files changed, 150 insertions(+), 4 deletions(-)
diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
index 6723dc4..c89602d 100644 index 6723dc4..c89602d 100644
@ -649,7 +652,7 @@ index 9522341..2e30e09 100644
addrs = _AddressList(addr).addresslist addrs = _AddressList(addr).addresslist
if not addrs: if not addrs:
diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
index a1a7859..f4e8c7f 100644 index 20b6779..d7d99f0 100644
--- a/Lib/test/test_email/test_email.py --- a/Lib/test/test_email/test_email.py
+++ b/Lib/test/test_email/test_email.py +++ b/Lib/test/test_email/test_email.py
@@ -8,6 +8,9 @@ import base64 @@ -8,6 +8,9 @@ import base64
@ -662,17 +665,18 @@ index a1a7859..f4e8c7f 100644
from io import StringIO, BytesIO from io import StringIO, BytesIO
from itertools import chain from itertools import chain
@@ -40,7 +43,7 @@ from email import iterators @@ -41,8 +44,8 @@ from email import quoprimime
from email import quoprimime
from email import utils from email import utils
from test import support
-from test.support import threading_helper -from test.support import threading_helper
-from test.support.os_helper import unlink -from test.support.os_helper import unlink
+from test.support import threading_helper, swap_attr +from test.support import threading_helper, swap_attr
+from test.support.os_helper import unlink, EnvironmentVarGuard +from test.support.os_helper import unlink, EnvironmentVarGuard
from test.test_email import openfile, TestEmailBase from test.test_email import openfile, TestEmailBase
@@ -3426,6 +3429,73 @@ Foo # These imports are documented to work, but we are testing them using a
@@ -3427,6 +3430,73 @@ Foo
# Test email.utils.supports_strict_parsing attribute # Test email.utils.supports_strict_parsing attribute
self.assertEqual(email.utils.supports_strict_parsing, True) self.assertEqual(email.utils.supports_strict_parsing, True)

6
check-pyc-timestamps.py
View File

@ -17,9 +17,9 @@ LEVELS = (None, 1, 2)
not_compiled = [ not_compiled = [
'/usr/bin/*', '/usr/bin/*',
'/usr/lib/rpm/redhat/*', '/usr/lib/rpm/redhat/*',
'*/test/bad_coding.py', '*/test/*/bad_coding.py',
'*/test/bad_coding2.py', '*/test/*/bad_coding2.py',
'*/test/badsyntax_*.py', '*/test/*/badsyntax_*.py',
'*/lib2to3/tests/data/bom.py', '*/lib2to3/tests/data/bom.py',
'*/lib2to3/tests/data/crlf.py', '*/lib2to3/tests/data/crlf.py',
'*/lib2to3/tests/data/different_encoding.py', '*/lib2to3/tests/data/different_encoding.py',

12
python3.11.spec
View File

@ -16,11 +16,11 @@ URL: https://www.python.org/
# WARNING When rebasing to a new Python version, # WARNING When rebasing to a new Python version,
# remember to update the python3-docs package as well # remember to update the python3-docs package as well
%global general_version %{pybasever}.5 %global general_version %{pybasever}.7
#global prerel ... #global prerel ...
%global upstream_version %{general_version}%{?prerel} %global upstream_version %{general_version}%{?prerel}
Version: %{general_version}%{?prerel:~%{prerel}} Version: %{general_version}%{?prerel:~%{prerel}}
Release: 2%{?dist} Release: 1%{?dist}
License: Python License: Python
@ -1023,6 +1023,10 @@ for tool in pygettext msgfmt; do
ln -s ${tool}%{pybasever}.py %{buildroot}%{_bindir}/${tool}3.py ln -s ${tool}%{pybasever}.py %{buildroot}%{_bindir}/${tool}3.py
done done
# Install missing test data
# Fixed upstream: https://github.com/python/cpython/pull/112784
cp -rp Lib/test/regrtestdata/ %{buildroot}%{pylibdir}/test/
# Switch all shebangs to refer to the specific Python version. # Switch all shebangs to refer to the specific Python version.
# This currently only covers files matching ^[a-zA-Z0-9_]+\.py$, # This currently only covers files matching ^[a-zA-Z0-9_]+\.py$,
# so handle files named using other naming scheme separately. # so handle files named using other naming scheme separately.
@ -1835,6 +1839,10 @@ fi
# ====================================================== # ======================================================
%changelog %changelog
* Mon Jan 22 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.7-1
- Rebase to 3.11.7
Resolves: RHEL-21915
* Tue Jan 09 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.5-2 * Tue Jan 09 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.5-2
- Security fix for CVE-2023-27043 - Security fix for CVE-2023-27043
Resolves: RHEL-7842 Resolves: RHEL-7842

4
sources
View File

@ -1,2 +1,2 @@
SHA512 (Python-3.11.5.tar.xz) = 93fa640bedcea449060caac8aa691aa315a19f172fd9f0422183d17749c3512d4ecac60e7599f9ef14e3cdb3c8b4b060e484c9061b1e7ee8d958200d6041e408 SHA512 (Python-3.11.7.tar.xz) = 11e06f2ffe1f66888cb5b4e9f607de815294d6863a77eda6ec6d7c724ef158df9f51881f4a956d4a6fa973c2fb6fd031d495e3496e9b0bb53793fb1cc8434c63
SHA512 (Python-3.11.5.tar.xz.asc) = 5a8e1b1cabe89de03c050d581bbd3ec917d93ec943b2e8241db05c245809cf80294022c4cfc1bea3b90aa0570176109aac90455057256c025e2596aa136375fc SHA512 (Python-3.11.7.tar.xz.asc) = 7b342990c6e32897047f8ba33c4d264f1be987b73843b61bd7db08bfa1a7280c616e9dcd96225f37602f876549d011ff82a4d79f1e32a5ab7d7cc22651bba44f