14 changed files with 372 additions and 1388 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/Python-3.11.7.tar.xz
+SOURCES/Python-3.11.11.tar.xz
--- a/.python3.11.metadata
+++ b/.python3.11.metadata
@ -1 +1 @@
-f2534d591121f3845388fbdd6a121b96dfe305a6 SOURCES/Python-3.11.7.tar.xz
+acf539109b024d3c5f1fc63d6e7f08cd294ba56d SOURCES/Python-3.11.11.tar.xz
--- a/SOURCES/00329-fips.patch
+++ b/SOURCES/00329-fips.patch
@ -1,4 +1,4 @@
-From ecc5137120f471c22ff6dcb1bd128561c31e023c Mon Sep 17 00:00:00 2001
+From 4345f8ea8a56a58ef8a48439c0e201702d1012a2 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Thu, 12 Dec 2019 16:58:31 +0100
 Subject: [PATCH 1/7] Expose blake2b and blake2s hashes from OpenSSL
@ -205,10 +205,10 @@ index 5d84f4a..011026a 100644
 -/*[clinic end generated code: output=69f2374071bff707 input=a9049054013a1b77]*/
 +/*[clinic end generated code: output=c6a9af5563972eda input=a9049054013a1b77]*/
 -- 
-2.43.0
+2.45.0
-From 0198d467525e79cb4be4418708719af3eaee7a40 Mon Sep 17 00:00:00 2001
+From 1f79be1a11ad6811913c239da980c5bab0f1c538 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 1 Aug 2019 17:57:05 +0200
 Subject: [PATCH 2/7] Use a stronger hash in multiprocessing handshake
@ -220,7 +220,7 @@ https://bugs.python.org/issue17258
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py
-index 8b81f99..69c0b7e 100644
+index 59c61d2..7fc594e 100644
 --- a/Lib/multiprocessing/connection.py
 +++ b/Lib/multiprocessing/connection.py
@@ -43,6 +43,10 @@ BUFSIZE = 8192
@ -234,7 +234,7 @@ index 8b81f99..69c0b7e 100644
 _mmap_counter = itertools.count()
 default_family = 'AF_INET'
-@@ -752,7 +756,7 @@ def deliver_challenge(connection, authkey):
+@@ -753,7 +757,7 @@ def deliver_challenge(connection, authkey):
             "Authkey must be bytes, not {0!s}".format(type(authkey)))
     message = os.urandom(MESSAGE_LENGTH)
     connection.send_bytes(CHALLENGE + message)
@ -243,7 +243,7 @@ index 8b81f99..69c0b7e 100644
     response = connection.recv_bytes(256)        # reject large message
     if response == digest:
         connection.send_bytes(WELCOME)
-@@ -768,7 +772,7 @@ def answer_challenge(connection, authkey):
+@@ -769,7 +773,7 @@ def answer_challenge(connection, authkey):
     message = connection.recv_bytes(256)         # reject large message
     assert message[:len(CHALLENGE)] == CHALLENGE, 'message = %r' % message
     message = message[len(CHALLENGE):]
@ -253,10 +253,10 @@ index 8b81f99..69c0b7e 100644
     response = connection.recv_bytes(256)        # reject large message
     if response != WELCOME:
 -- 
-2.43.0
+2.45.0
-From a7822e2e1f21529e9730885bd8c9c6ab7c704d5b Mon Sep 17 00:00:00 2001
+From e069ed2dcd0edf0de489eb387267fb35a92ed506 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 25 Jul 2019 17:19:06 +0200
 Subject: [PATCH 3/7] Disable Python's hash implementations in FIPS mode,
@ -446,10 +446,10 @@ index 56ae7a5..45fb403 100644
 +    if (_Py_hashlib_fips_error(exc, name)) return NULL; \
 +} while (0)
 diff --git a/configure.ac b/configure.ac
-index 52d5c1f..56aff78 100644
+index 7b4000f..8e2f0ad 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -7069,7 +7069,8 @@ PY_STDLIB_MOD([_sha512], [test "$with_builtin_sha512" = yes])
+@@ -7070,7 +7070,8 @@ PY_STDLIB_MOD([_sha512], [test "$with_builtin_sha512" = yes])
 PY_STDLIB_MOD([_sha3], [test "$with_builtin_sha3" = yes])
 PY_STDLIB_MOD([_blake2],
   [test "$with_builtin_blake2" = yes], [],
@ -460,10 +460,10 @@ index 52d5c1f..56aff78 100644
 PY_STDLIB_MOD([_crypt],
   [], [test "$ac_cv_crypt_crypt" = yes],
 -- 
-2.43.0
+2.45.0
-From e9ce6d33544559172dbebbe0c0dfba2757c62331 Mon Sep 17 00:00:00 2001
+From 2e0c5086f4a52803595e19795111278c3c80ee2f Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Fri, 29 Jan 2021 14:16:21 +0100
 Subject: [PATCH 4/7] Use python's fall back crypto implementations only if we
@ -623,10 +623,10 @@ index 01d12f5..a7cdb07 100644
     def test_pbkdf2_hmac_py(self):
         with warnings_helper.check_warnings():
 -- 
-2.43.0
+2.45.0
-From 641c617775b6973ed84711a2602ba190fe064474 Mon Sep 17 00:00:00 2001
+From 0e1d2a67ef66cccc9afa4a515dc34ce587946f22 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Wed, 31 Jul 2019 15:43:43 +0200
 Subject: [PATCH 5/7] Test equivalence of hashes for the various digests with
@ -783,21 +783,21 @@ index a7cdb07..c071f28 100644
 class KDFTests(unittest.TestCase):
 -- 
-2.43.0
+2.45.0
-From a706c8342f0f9307d44c43c203702e1476fe73b4 Mon Sep 17 00:00:00 2001
+From f1c9ecbb2e2f08d792fb0557058824eed23abb7b Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 26 Aug 2019 19:39:48 +0200
 Subject: [PATCH 6/7] Guard against Python HMAC in FIPS mode
 ---
- Lib/hmac.py           | 13 +++++++++----
+ Lib/hmac.py           | 12 +++++++++---
 Lib/test/test_hmac.py | 10 ++++++++++
- 2 files changed, 19 insertions(+), 4 deletions(-)
+ 2 files changed, 19 insertions(+), 3 deletions(-)
 diff --git a/Lib/hmac.py b/Lib/hmac.py
-index 8b4f920..20ef96c 100644
+index 8b4eb2f..8930bda 100644
 --- a/Lib/hmac.py
 +++ b/Lib/hmac.py
@@ -16,8 +16,9 @@ else:
@ -812,16 +812,9 @@ index 8b4f920..20ef96c 100644
 # The size of the digests returned by HMAC depends on the underlying
 # hashing module used.  Use digest_size from the instance of HMAC instead.
-@@ -48,17 +49,18 @@ class HMAC:
+@@ -55,10 +56,12 @@ class HMAC:
                    msg argument.  Passing it as a keyword argument is
                    recommended, though not required for legacy API reasons.
         """
 -
         if not isinstance(key, (bytes, bytearray)):
             raise TypeError("key: expected bytes or bytearray, but got %r" % type(key).__name__)
         if not digestmod:
-             raise TypeError("Missing required parameter 'digestmod'.")
+             raise TypeError("Missing required argument 'digestmod'.")
 -        if _hashopenssl and isinstance(digestmod, (str, _functype)):
 +        if _hashopenssl.get_fips_mode() or (_hashopenssl and isinstance(digestmod, (str, _functype))):
@ -833,7 +826,7 @@ index 8b4f920..20ef96c 100644
                 self._init_old(key, msg, digestmod)
         else:
             self._init_old(key, msg, digestmod)
-@@ -69,6 +71,9 @@ class HMAC:
+@@ -69,6 +72,9 @@ class HMAC:
         self.block_size = self._hmac.block_size
     def _init_old(self, key, msg, digestmod):
@ -844,7 +837,7 @@ index 8b4f920..20ef96c 100644
             digest_cons = digestmod
         elif isinstance(digestmod, str):
 diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
-index a39a2c4..0742a1c 100644
+index 1502fba..e40ca4b 100644
 --- a/Lib/test/test_hmac.py
 +++ b/Lib/test/test_hmac.py
@@ -5,6 +5,7 @@ import hashlib
@ -883,7 +876,7 @@ index a39a2c4..0742a1c 100644
     @unittest.skipUnless(sha256_module is not None, 'need _sha256')
     def test_with_sha256_module(self):
         h = hmac.HMAC(b"key", b"hash this!", digestmod=sha256_module.sha256)
-@@ -481,6 +489,7 @@ class SanityTestCase(unittest.TestCase):
+@@ -489,6 +497,7 @@ class UpdateTestCase(unittest.TestCase):
 class CopyTestCase(unittest.TestCase):
@ -891,7 +884,7 @@ index a39a2c4..0742a1c 100644
     @hashlib_helper.requires_hashdigest('sha256')
     def test_attributes_old(self):
         # Testing if attributes are of same type.
-@@ -492,6 +501,7 @@ class CopyTestCase(unittest.TestCase):
+@@ -500,6 +509,7 @@ class CopyTestCase(unittest.TestCase):
         self.assertEqual(type(h1._outer), type(h2._outer),
             "Types of outer don't match.")
@ -900,290 +893,43 @@ index a39a2c4..0742a1c 100644
     def test_realcopy_old(self):
         # Testing if the copy method created a real copy.
 -- 
-2.43.0
+2.45.0
-From 03f1dedfe5d29af20fb3686d76b045384d41d8dd Mon Sep 17 00:00:00 2001
+From a0c3f9ac5a4e60ab22418a3196ae46ba34e9477b Mon Sep 17 00:00:00 2001
-From: Petr Viktorin <encukou@gmail.com>
+From: Nikita Sobolev <mail@sobolevn.me>
-Date: Wed, 25 Aug 2021 16:44:43 +0200
+Date: Thu, 24 Nov 2022 01:47:31 +0300
-Subject: [PATCH 7/7] Disable hash-based PYCs in FIPS mode
+Subject: [PATCH 7/7] closes gh-99508: fix `TypeError` in
 `Lib/importlib/_bootstrap_external.py` (GH-99635)
 If FIPS mode is on, we can't use siphash-based HMAC
 (_Py_KeyedHash), so:
 - Unchecked hash PYCs can be imported, but not created
 - Checked hash PYCs can not be imported nor created
 - The default mode is timestamp-based PYCs, even if
  SOURCE_DATE_EPOCH is set.
 If FIPS mode is off, there are no changes in behavior.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1835169
 ---
- Lib/py_compile.py                             |  2 ++
+ Lib/importlib/_bootstrap_external.py                           | 3 ++-
- Lib/test/support/__init__.py                  | 14 +++++++++++++
+ .../next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst | 2 ++
- Lib/test/test_cmd_line_script.py              |  2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
- Lib/test/test_compileall.py                   | 11 +++++++++-
+ create mode 100644 Misc/NEWS.d/next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst
 Lib/test/test_imp.py                          |  2 ++
 .../test_importlib/source/test_file_loader.py |  6 ++++++
 Lib/test/test_py_compile.py                   | 11 ++++++++--
 Lib/test/test_zipimport.py                    |  2 ++
 Python/import.c                               | 20 +++++++++++++++++++
 9 files changed, 67 insertions(+), 3 deletions(-)
-diff --git a/Lib/py_compile.py b/Lib/py_compile.py
+diff --git a/Lib/importlib/_bootstrap_external.py b/Lib/importlib/_bootstrap_external.py
-index db52725..5fca65e 100644
+index e53f6ac..bdc491e 100644
--- a/Lib/py_compile.py
+--- a/Lib/importlib/_bootstrap_external.py
-+++ b/Lib/py_compile.py
+++ b/Lib/importlib/_bootstrap_external.py
-@@ -70,7 +70,9 @@ class PycInvalidationMode(enum.Enum):
+@@ -1077,7 +1077,8 @@ class SourceLoader(_LoaderBasics):
- 
+                 source_mtime is not None):
- 
+             if hash_based:
- def _get_default_invalidation_mode():
+                 if source_hash is None:
-+    import _hashlib
+-                    source_hash = _imp.source_hash(source_bytes)
-     if (os.environ.get('SOURCE_DATE_EPOCH') and not
+                    source_hash = _imp.source_hash(_RAW_MAGIC_NUMBER,
-+            _hashlib.get_fips_mode() and not
+                                                   source_bytes)
-             os.environ.get('RPM_BUILD_ROOT')):
+                 data = _code_to_hash_pyc(code_object, source_hash, check_source)
         return PycInvalidationMode.CHECKED_HASH
             else:
-diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
+                 data = _code_to_timestamp_pyc(code_object, source_mtime,
-index dc7a6e6..646b328 100644
+diff --git a/Misc/NEWS.d/next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst b/Misc/NEWS.d/next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst
--- a/Lib/test/support/__init__.py
+new file mode 100644
-+++ b/Lib/test/support/__init__.py
+index 0000000..82720d1
-@@ -2203,6 +2203,20 @@ def sleeping_retry(timeout, err_msg=None, /,
+--- /dev/null
-         delay = min(delay * 2, max_delay)
+++ b/Misc/NEWS.d/next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst
- 
+@@ -0,0 +1,2 @@
- 
+Fix ``TypeError`` in ``Lib/importlib/_bootstrap_external.py`` while calling
-+def fails_in_fips_mode(expected_error):
+``_imp.source_hash()``.
 +    import _hashlib
 +    if _hashlib.get_fips_mode():
 +        def _decorator(func):
 +            def _wrapper(self, *args, **kwargs):
 +                with self.assertRaises(expected_error):
 +                    func(self, *args, **kwargs)
 +            return _wrapper
 +    else:
 +        def _decorator(func):
 +            return func
 +    return _decorator
 +
 +
 @contextlib.contextmanager
 def adjust_int_max_str_digits(max_digits):
     """Temporarily change the integer string conversion length limit."""
 diff --git a/Lib/test/test_cmd_line_script.py b/Lib/test/test_cmd_line_script.py
 index 7fcd563..476b557 100644
 --- a/Lib/test/test_cmd_line_script.py
 +++ b/Lib/test/test_cmd_line_script.py
@@ -286,6 +286,7 @@ class CmdLineTest(unittest.TestCase):
             self._check_script(zip_name, run_name, zip_name, zip_name, '',
                                zipimport.zipimporter)
 +    @support.fails_in_fips_mode(ImportError)
     def test_zipfile_compiled_checked_hash(self):
         with os_helper.temp_dir() as script_dir:
             script_name = _make_test_script(script_dir, '__main__')
@@ -296,6 +297,7 @@ class CmdLineTest(unittest.TestCase):
             self._check_script(zip_name, run_name, zip_name, zip_name, '',
                                zipimport.zipimporter)
 +    @support.fails_in_fips_mode(ImportError)
     def test_zipfile_compiled_unchecked_hash(self):
         with os_helper.temp_dir() as script_dir:
             script_name = _make_test_script(script_dir, '__main__')
 diff --git a/Lib/test/test_compileall.py b/Lib/test/test_compileall.py
 index 9cd92ad..4ec29a1 100644
 --- a/Lib/test/test_compileall.py
 +++ b/Lib/test/test_compileall.py
@@ -806,14 +806,23 @@ class CommandLineTestsBase:
         out = self.assertRunOK('badfilename')
         self.assertRegex(out, b"Can't list 'badfilename'")
 -    def test_pyc_invalidation_mode(self):
 +    @support.fails_in_fips_mode(AssertionError)
 +    def test_pyc_invalidation_mode_checked(self):
         script_helper.make_script(self.pkgdir, 'f1', '')
         pyc = importlib.util.cache_from_source(
             os.path.join(self.pkgdir, 'f1.py'))
 +
         self.assertRunOK('--invalidation-mode=checked-hash', self.pkgdir)
         with open(pyc, 'rb') as fp:
             data = fp.read()
         self.assertEqual(int.from_bytes(data[4:8], 'little'), 0b11)
 +
 +    @support.fails_in_fips_mode(AssertionError)
 +    def test_pyc_invalidation_mode_unchecked(self):
 +        script_helper.make_script(self.pkgdir, 'f1', '')
 +        pyc = importlib.util.cache_from_source(
 +            os.path.join(self.pkgdir, 'f1.py'))
 +
         self.assertRunOK('--invalidation-mode=unchecked-hash', self.pkgdir)
         with open(pyc, 'rb') as fp:
             data = fp.read()
 diff --git a/Lib/test/test_imp.py b/Lib/test/test_imp.py
 index 4062afd..6bc276d 100644
 --- a/Lib/test/test_imp.py
 +++ b/Lib/test/test_imp.py
@@ -352,6 +352,7 @@ class ImportTests(unittest.TestCase):
         import _frozen_importlib
         self.assertEqual(_frozen_importlib.__spec__.origin, "frozen")
 +    @support.fails_in_fips_mode(ImportError)
     def test_source_hash(self):
         self.assertEqual(_imp.source_hash(42, b'hi'), b'\xfb\xd9G\x05\xaf$\x9b~')
         self.assertEqual(_imp.source_hash(43, b'hi'), b'\xd0/\x87C\xccC\xff\xe2')
@@ -371,6 +372,7 @@ class ImportTests(unittest.TestCase):
             res = script_helper.assert_python_ok(*args)
             self.assertEqual(res.out.strip().decode('utf-8'), expected)
 +    @support.fails_in_fips_mode(ImportError)
     def test_find_and_load_checked_pyc(self):
         # issue 34056
         with os_helper.temp_cwd():
 diff --git a/Lib/test/test_importlib/source/test_file_loader.py b/Lib/test/test_importlib/source/test_file_loader.py
 index 378dcbe..7b223a1 100644
 --- a/Lib/test/test_importlib/source/test_file_loader.py
 +++ b/Lib/test/test_importlib/source/test_file_loader.py
@@ -16,6 +16,7 @@ import types
 import unittest
 import warnings
 +from test import support
 from test.support.import_helper import make_legacy_pyc, unload
 from test.test_py_compile import without_source_date_epoch
@@ -238,6 +239,7 @@ class SimpleTest(abc.LoaderTests):
                 loader.load_module('bad name')
     @util.writes_bytecode_files
 +    @support.fails_in_fips_mode(ImportError)
     def test_checked_hash_based_pyc(self):
         with util.create_modules('_temp') as mapping:
             source = mapping['_temp']
@@ -269,6 +271,7 @@ class SimpleTest(abc.LoaderTests):
             )
     @util.writes_bytecode_files
 +    @support.fails_in_fips_mode(ImportError)
     def test_overridden_checked_hash_based_pyc(self):
         with util.create_modules('_temp') as mapping, \
              unittest.mock.patch('_imp.check_hash_based_pycs', 'never'):
@@ -294,6 +297,7 @@ class SimpleTest(abc.LoaderTests):
             self.assertEqual(mod.state, 'old')
     @util.writes_bytecode_files
 +    @support.fails_in_fips_mode(ImportError)
     def test_unchecked_hash_based_pyc(self):
         with util.create_modules('_temp') as mapping:
             source = mapping['_temp']
@@ -324,6 +328,7 @@ class SimpleTest(abc.LoaderTests):
             )
     @util.writes_bytecode_files
 +    @support.fails_in_fips_mode(ImportError)
     def test_overridden_unchecked_hash_based_pyc(self):
         with util.create_modules('_temp') as mapping, \
              unittest.mock.patch('_imp.check_hash_based_pycs', 'always'):
@@ -433,6 +438,7 @@ class BadBytecodeTest:
                                                del_source=del_source)
             test('_temp', mapping, bc_path)
 +    @support.fails_in_fips_mode(ImportError)
     def _test_partial_hash(self, test, *, del_source=False):
         with util.create_modules('_temp') as mapping:
             bc_path = self.manipulate_bytecode(
 diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
 index 9b420d2..dd6460a 100644
 --- a/Lib/test/test_py_compile.py
 +++ b/Lib/test/test_py_compile.py
@@ -143,13 +143,16 @@ class PyCompileTestsBase:
             importlib.util.cache_from_source(bad_coding)))
     def test_source_date_epoch(self):
 +        import _hashlib
         py_compile.compile(self.source_path, self.pyc_path)
         self.assertTrue(os.path.exists(self.pyc_path))
         self.assertFalse(os.path.exists(self.cache_path))
         with open(self.pyc_path, 'rb') as fp:
             flags = importlib._bootstrap_external._classify_pyc(
                 fp.read(), 'test', {})
 -        if os.environ.get('SOURCE_DATE_EPOCH'):
 +        if _hashlib.get_fips_mode():
 +            expected_flags = 0b00
 +        elif os.environ.get('SOURCE_DATE_EPOCH'):
             expected_flags = 0b11
         else:
             expected_flags = 0b00
@@ -180,7 +183,8 @@ class PyCompileTestsBase:
         # Specifying optimized bytecode should lead to a path reflecting that.
         self.assertIn('opt-2', py_compile.compile(self.source_path, optimize=2))
 -    def test_invalidation_mode(self):
 +    @support.fails_in_fips_mode(ImportError)
 +    def test_invalidation_mode_checked(self):
         py_compile.compile(
             self.source_path,
             invalidation_mode=py_compile.PycInvalidationMode.CHECKED_HASH,
@@ -189,6 +193,9 @@ class PyCompileTestsBase:
             flags = importlib._bootstrap_external._classify_pyc(
                 fp.read(), 'test', {})
         self.assertEqual(flags, 0b11)
 +
 +    @support.fails_in_fips_mode(ImportError)
 +    def test_invalidation_mode_unchecked(self):
         py_compile.compile(
             self.source_path,
             invalidation_mode=py_compile.PycInvalidationMode.UNCHECKED_HASH,
 diff --git a/Lib/test/test_zipimport.py b/Lib/test/test_zipimport.py
 index 59a5200..81fadb3 100644
 --- a/Lib/test/test_zipimport.py
 +++ b/Lib/test/test_zipimport.py
@@ -190,6 +190,7 @@ class UncompressedZipImportTestCase(ImportHooksBaseTestCase):
                  TESTMOD + pyc_ext: (NOW, test_pyc)}
         self.doTest(pyc_ext, files, TESTMOD)
 +    @support.fails_in_fips_mode(ImportError)
     def testUncheckedHashBasedPyc(self):
         source = b"state = 'old'"
         source_hash = importlib.util.source_hash(source)
@@ -204,6 +205,7 @@ class UncompressedZipImportTestCase(ImportHooksBaseTestCase):
             self.assertEqual(mod.state, 'old')
         self.doTest(None, files, TESTMOD, call=check)
 +    @support.fails_in_fips_mode(ImportError)
     @unittest.mock.patch('_imp.check_hash_based_pycs', 'always')
     def test_checked_hash_based_change_pyc(self):
         source = b"state = 'old'"
 diff --git a/Python/import.c b/Python/import.c
 index 39144d3..b439059 100644
 --- a/Python/import.c
 +++ b/Python/import.c
@@ -2449,6 +2449,26 @@ static PyObject *
 _imp_source_hash_impl(PyObject *module, long key, Py_buffer *source)
 /*[clinic end generated code: output=edb292448cf399ea input=9aaad1e590089789]*/
 {
 +    PyObject *_hashlib = PyImport_ImportModule("_hashlib");
 +    if (_hashlib == NULL) {
 +        return NULL;
 +    }
 +    PyObject *fips_mode_obj = PyObject_CallMethod(_hashlib, "get_fips_mode", NULL);
 +    Py_DECREF(_hashlib);
 +    if (fips_mode_obj == NULL) {
 +        return NULL;
 +    }
 +    int fips_mode = PyObject_IsTrue(fips_mode_obj);
 +    Py_DECREF(fips_mode_obj);
 +    if (fips_mode < 0) {
 +        return NULL;
 +    }
 +    if (fips_mode) {
 +        PyErr_SetString(
 +            PyExc_ImportError,
 +            "hash-based PYC validation (siphash24) not available in FIPS mode");
 +        return NULL;
 +    };
     union {
         uint64_t x;
         char data[sizeof(uint64_t)];
 -- 
-2.43.0
+2.45.0
--- a/SOURCES/00378-support-expat-2-4-5.patch
+++ b/SOURCES/00378-support-expat-2-4-5.patch
@ -1,47 +0,0 @@
 From db083095e3bdb93e4f8170d814664c482b1e94da Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Tue, 14 Jun 2022 06:38:43 +0200
 Subject: [PATCH] Fix test suite for Expat >= 2.4.5
 ---
 Lib/test/test_minidom.py | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)
 diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py
 index 9762025..5f52ed1 100644
 --- a/Lib/test/test_minidom.py
 +++ b/Lib/test/test_minidom.py
@@ -1149,14 +1149,10 @@ class MinidomTest(unittest.TestCase):
         # Verify that character decoding errors raise exceptions instead
         # of crashing
 -        if pyexpat.version_info >= (2, 4, 5):
 -            self.assertRaises(ExpatError, parseString,
 -                    b'<fran\xe7ais></fran\xe7ais>')
 -            self.assertRaises(ExpatError, parseString,
 -                    b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
 -        else:
 -            self.assertRaises(UnicodeDecodeError, parseString,
 -                b'<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
 +        self.assertRaises(ExpatError, parseString,
 +                b'<fran\xe7ais></fran\xe7ais>')
 +        self.assertRaises(ExpatError, parseString,
 +                b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
         doc.unlink()
@@ -1617,10 +1613,7 @@ class MinidomTest(unittest.TestCase):
         self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE)
     def testExceptionOnSpacesInXMLNSValue(self):
 -        if pyexpat.version_info >= (2, 4, 5):
 -            context = self.assertRaisesRegex(ExpatError, 'syntax error')
 -        else:
 -            context = self.assertRaisesRegex(ValueError, 'Unsupported syntax')
 +        context = self.assertRaisesRegex(ExpatError, 'syntax error')
         with context:
             parseString('<element xmlns:abc="http:abc.com/de f g/hi/j k"><abc:foo /></element>')
 -- 
 2.35.3
--- a/SOURCES/00397-tarfile-filter.patch
+++ b/SOURCES/00397-tarfile-filter.patch
@ -1,4 +1,4 @@
-From 8b70605b594b3831331a9340ba764ff751871612 Mon Sep 17 00:00:00 2001
+From 0181d677dd7fd11bc19a211b3eb735ac3ad3d7fb Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <encukou@gmail.com>
 Date: Mon, 6 Mar 2023 17:24:24 +0100
 Subject: [PATCH] CVE-2007-4559, PEP-706: Add filters for tarfile extraction
@ -9,11 +9,11 @@ variable and config file.
 ---
 Lib/tarfile.py           |  42 +++++++++++++
 Lib/test/test_shutil.py  |   3 +-
- Lib/test/test_tarfile.py | 128 ++++++++++++++++++++++++++++++++++++++-
+ Lib/test/test_tarfile.py | 127 ++++++++++++++++++++++++++++++++++++++-
- 3 files changed, 169 insertions(+), 4 deletions(-)
+ 3 files changed, 168 insertions(+), 4 deletions(-)
 diff --git a/Lib/tarfile.py b/Lib/tarfile.py
-index 130b5e0..3b7d8d5 100755
+index 612217b..dc59fc6 100755
 --- a/Lib/tarfile.py
 +++ b/Lib/tarfile.py
@@ -72,6 +72,13 @@ __all__ = ["TarFile", "TarInfo", "is_tarfile", "TarError", "ReadError",
@ -30,7 +30,7 @@ index 130b5e0..3b7d8d5 100755
 #---------------------------------------------------------
 # tar constants
-@@ -2211,6 +2218,41 @@ class TarFile(object):
+@@ -2219,6 +2226,41 @@ class TarFile(object):
         if filter is None:
             filter = self.extraction_filter
             if filter is None:
@ -73,10 +73,10 @@ index 130b5e0..3b7d8d5 100755
             if isinstance(filter, str):
                 raise TypeError(
 diff --git a/Lib/test/test_shutil.py b/Lib/test/test_shutil.py
-index 9bf4145..f247b82 100644
+index 6728d30..2338b63 100644
 --- a/Lib/test/test_shutil.py
 +++ b/Lib/test/test_shutil.py
-@@ -1665,7 +1665,8 @@ class TestArchives(BaseTest, unittest.TestCase):
+@@ -1774,7 +1774,8 @@ class TestArchives(BaseTest, unittest.TestCase):
     def check_unpack_tarball(self, format):
         self.check_unpack_archive(format, filter='fully_trusted')
         self.check_unpack_archive(format, filter='data')
@ -87,10 +87,10 @@ index 9bf4145..f247b82 100644
     def test_unpack_archive_tar(self):
 diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
-index cdea033..4724285 100644
+index 389da7b..5a43f9d 100644
 --- a/Lib/test/test_tarfile.py
 +++ b/Lib/test/test_tarfile.py
-@@ -2,7 +2,7 @@ import sys
+@@ -3,7 +3,7 @@ import sys
 import os
 import io
 from hashlib import sha256
@ -99,7 +99,7 @@ index cdea033..4724285 100644
 from random import Random
 import pathlib
 import shutil
-@@ -2999,7 +2999,11 @@ class NoneInfoExtractTests(ReadTest):
+@@ -3049,7 +3049,11 @@ class NoneInfoExtractTests(ReadTest):
         tar = tarfile.open(tarname, mode='r', encoding="iso8859-1")
         cls.control_dir = pathlib.Path(TEMPDIR) / "extractall_ctrl"
         tar.errorlevel = 0
@ -112,7 +112,7 @@ index cdea033..4724285 100644
         tar.close()
         cls.control_paths = set(
             p.relative_to(cls.control_dir)
-@@ -3674,7 +3678,8 @@ class TestExtractionFilters(unittest.TestCase):
+@@ -3868,7 +3872,8 @@ class TestExtractionFilters(unittest.TestCase):
         """Ensure the default filter does not warn (like in 3.12)"""
         with ArchiveMaker() as arc:
             arc.add('foo')
@ -122,10 +122,10 @@ index cdea033..4724285 100644
             with self.check_context(arc.open(), None):
                 self.expect_file('foo')
-@@ -3844,6 +3849,123 @@ class TestExtractionFilters(unittest.TestCase):
+@@ -4037,6 +4042,122 @@ class TestExtractionFilters(unittest.TestCase):
         with self.check_context(arc.open(errorlevel='boo!'), filtererror_filter):
             self.expect_exception(TypeError)  # errorlevel is not int
 +    @contextmanager
 +    def rh_config_context(self, config_lines=None):
 +        """Set up for testing various ways of overriding the default filter
@ -242,10 +242,9 @@ index cdea033..4724285 100644
 +            ):
 +                self.check_trusted_default(tar, tempdir)
 +
-+
+ 
- def setUpModule():
+ class OverwriteTests(archiver_tests.OverwriteTests, unittest.TestCase):
-     os_helper.unlink(TEMPDIR)
+     testdir = os.path.join(TEMPDIR, "testoverwrite")
-     os.makedirs(TEMPDIR)
+-- 
-- 
+2.44.0
 2.41.0
--- a/SOURCES/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+++ b/SOURCES/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
@ -1,512 +1,7 @@
-From d8b0fafb202bf884135a3f7f0ce0b086217a2da2 Mon Sep 17 00:00:00 2001
+From 3f01ced0b5051798516fc65f5fac10ffd15dbce6 Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@python.org>
 Date: Fri, 15 Dec 2023 16:10:40 +0100
 Subject: [PATCH 1/2] 00415: [CVE-2023-27043] gh-102988: Reject malformed
 addresses in email.parseaddr() (#111116)
 Detect email address parsing errors and return empty tuple to
 indicate the parsing error (old API). Add an optional 'strict'
 parameter to getaddresses() and parseaddr() functions. Patch by
 Thomas Dwyer.
 Co-Authored-By: Thomas Dwyer <github@tomd.tel>
 ---
 Doc/library/email.utils.rst                   |  19 +-
 Lib/email/utils.py                            | 151 ++++++++++++-
 Lib/test/test_email/test_email.py             | 204 +++++++++++++++++-
 ...-10-20-15-28-08.gh-issue-102988.dStNO7.rst |   8 +
 4 files changed, 361 insertions(+), 21 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
 diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
 index 0e266b6..6723dc4 100644
 --- a/Doc/library/email.utils.rst
 +++ b/Doc/library/email.utils.rst
@@ -60,13 +60,18 @@ of the new API.
    begins with angle brackets, they are stripped off.
 -.. function:: parseaddr(address)
 +.. function:: parseaddr(address, *, strict=True)
    Parse address -- which should be the value of some address-containing field such
    as :mailheader:`To` or :mailheader:`Cc` -- into its constituent *realname* and
    *email address* parts.  Returns a tuple of that information, unless the parse
    fails, in which case a 2-tuple of ``('', '')`` is returned.
 +   If *strict* is true, use a strict parser which rejects malformed inputs.
 +
 +   .. versionchanged:: 3.13
 +      Add *strict* optional parameter and reject malformed inputs by default.
 +
 .. function:: formataddr(pair, charset='utf-8')
@@ -84,12 +89,15 @@ of the new API.
       Added the *charset* option.
 -.. function:: getaddresses(fieldvalues)
 +.. function:: getaddresses(fieldvalues, *, strict=True)
    This method returns a list of 2-tuples of the form returned by ``parseaddr()``.
    *fieldvalues* is a sequence of header field values as might be returned by
 -   :meth:`Message.get_all <email.message.Message.get_all>`.  Here's a simple
 -   example that gets all the recipients of a message::
 +   :meth:`Message.get_all <email.message.Message.get_all>`.
 +
 +   If *strict* is true, use a strict parser which rejects malformed inputs.
 +
 +   Here's a simple example that gets all the recipients of a message::
       from email.utils import getaddresses
@@ -99,6 +107,9 @@ of the new API.
       resent_ccs = msg.get_all('resent-cc', [])
       all_recipients = getaddresses(tos + ccs + resent_tos + resent_ccs)
 +   .. versionchanged:: 3.13
 +      Add *strict* optional parameter and reject malformed inputs by default.
 +
 .. function:: parsedate(date)
 diff --git a/Lib/email/utils.py b/Lib/email/utils.py
 index cfdfeb3..9522341 100644
 --- a/Lib/email/utils.py
 +++ b/Lib/email/utils.py
@@ -48,6 +48,7 @@ TICK = "'"
 specialsre = re.compile(r'[][\\()<>@,:;".]')
 escapesre = re.compile(r'[\\"]')
 +
 def _has_surrogates(s):
     """Return True if s contains surrogate-escaped binary data."""
     # This check is based on the fact that unless there are surrogates, utf8
@@ -106,12 +107,127 @@ def formataddr(pair, charset='utf-8'):
     return address
 +def _iter_escaped_chars(addr):
 +    pos = 0
 +    escape = False
 +    for pos, ch in enumerate(addr):
 +        if escape:
 +            yield (pos, '\\' + ch)
 +            escape = False
 +        elif ch == '\\':
 +            escape = True
 +        else:
 +            yield (pos, ch)
 +    if escape:
 +        yield (pos, '\\')
 +
 +
 +def _strip_quoted_realnames(addr):
 +    """Strip real names between quotes."""
 +    if '"' not in addr:
 +        # Fast path
 +        return addr
 +
 +    start = 0
 +    open_pos = None
 +    result = []
 +    for pos, ch in _iter_escaped_chars(addr):
 +        if ch == '"':
 +            if open_pos is None:
 +                open_pos = pos
 +            else:
 +                if start != open_pos:
 +                    result.append(addr[start:open_pos])
 +                start = pos + 1
 +                open_pos = None
 +
 +    if start < len(addr):
 +        result.append(addr[start:])
 +
 +    return ''.join(result)
 -def getaddresses(fieldvalues):
 -    """Return a list of (REALNAME, EMAIL) for each fieldvalue."""
 -    all = COMMASPACE.join(str(v) for v in fieldvalues)
 -    a = _AddressList(all)
 -    return a.addresslist
 +
 +supports_strict_parsing = True
 +
 +def getaddresses(fieldvalues, *, strict=True):
 +    """Return a list of (REALNAME, EMAIL) or ('','') for each fieldvalue.
 +
 +    When parsing fails for a fieldvalue, a 2-tuple of ('', '') is returned in
 +    its place.
 +
 +    If strict is true, use a strict parser which rejects malformed inputs.
 +    """
 +
 +    # If strict is true, if the resulting list of parsed addresses is greater
 +    # than the number of fieldvalues in the input list, a parsing error has
 +    # occurred and consequently a list containing a single empty 2-tuple [('',
 +    # '')] is returned in its place. This is done to avoid invalid output.
 +    #
 +    # Malformed input: getaddresses(['alice@example.com <bob@example.com>'])
 +    # Invalid output: [('', 'alice@example.com'), ('', 'bob@example.com')]
 +    # Safe output: [('', '')]
 +
 +    if not strict:
 +        all = COMMASPACE.join(str(v) for v in fieldvalues)
 +        a = _AddressList(all)
 +        return a.addresslist
 +
 +    fieldvalues = [str(v) for v in fieldvalues]
 +    fieldvalues = _pre_parse_validation(fieldvalues)
 +    addr = COMMASPACE.join(fieldvalues)
 +    a = _AddressList(addr)
 +    result = _post_parse_validation(a.addresslist)
 +
 +    # Treat output as invalid if the number of addresses is not equal to the
 +    # expected number of addresses.
 +    n = 0
 +    for v in fieldvalues:
 +        # When a comma is used in the Real Name part it is not a deliminator.
 +        # So strip those out before counting the commas.
 +        v = _strip_quoted_realnames(v)
 +        # Expected number of addresses: 1 + number of commas
 +        n += 1 + v.count(',')
 +    if len(result) != n:
 +        return [('', '')]
 +
 +    return result
 +
 +
 +def _check_parenthesis(addr):
 +    # Ignore parenthesis in quoted real names.
 +    addr = _strip_quoted_realnames(addr)
 +
 +    opens = 0
 +    for pos, ch in _iter_escaped_chars(addr):
 +        if ch == '(':
 +            opens += 1
 +        elif ch == ')':
 +            opens -= 1
 +            if opens < 0:
 +                return False
 +    return (opens == 0)
 +
 +
 +def _pre_parse_validation(email_header_fields):
 +    accepted_values = []
 +    for v in email_header_fields:
 +        if not _check_parenthesis(v):
 +            v = "('', '')"
 +        accepted_values.append(v)
 +
 +    return accepted_values
 +
 +
 +def _post_parse_validation(parsed_email_header_tuples):
 +    accepted_values = []
 +    # The parser would have parsed a correctly formatted domain-literal
 +    # The existence of an [ after parsing indicates a parsing failure
 +    for v in parsed_email_header_tuples:
 +        if '[' in v[1]:
 +            v = ('', '')
 +        accepted_values.append(v)
 +
 +    return accepted_values
 def _format_timetuple_and_zone(timetuple, zone):
@@ -205,16 +321,33 @@ def parsedate_to_datetime(data):
             tzinfo=datetime.timezone(datetime.timedelta(seconds=tz)))
 -def parseaddr(addr):
 +def parseaddr(addr, *, strict=True):
     """
     Parse addr into its constituent realname and email address parts.
     Return a tuple of realname and email address, unless the parse fails, in
     which case return a 2-tuple of ('', '').
 +
 +    If strict is True, use a strict parser which rejects malformed inputs.
     """
 -    addrs = _AddressList(addr).addresslist
 -    if not addrs:
 -        return '', ''
 +    if not strict:
 +        addrs = _AddressList(addr).addresslist
 +        if not addrs:
 +            return ('', '')
 +        return addrs[0]
 +
 +    if isinstance(addr, list):
 +        addr = addr[0]
 +
 +    if not isinstance(addr, str):
 +        return ('', '')
 +
 +    addr = _pre_parse_validation([addr])[0]
 +    addrs = _post_parse_validation(_AddressList(addr).addresslist)
 +
 +    if not addrs or len(addrs) > 1:
 +        return ('', '')
 +
     return addrs[0]
 diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
 index 677f209..20b6779 100644
 --- a/Lib/test/test_email/test_email.py
 +++ b/Lib/test/test_email/test_email.py
@@ -17,6 +17,7 @@ from unittest.mock import patch
 import email
 import email.policy
 +import email.utils
 from email.charset import Charset
 from email.generator import Generator, DecodedGenerator, BytesGenerator
@@ -3321,15 +3322,154 @@ Foo
            [('Al Person', 'aperson@dom.ain'),
             ('Bud Person', 'bperson@dom.ain')])
 +    def test_getaddresses_comma_in_name(self):
 +        """GH-106669 regression test."""
 +        self.assertEqual(
 +            utils.getaddresses(
 +                [
 +                    '"Bud, Person" <bperson@dom.ain>',
 +                    'aperson@dom.ain (Al Person)',
 +                    '"Mariusz Felisiak" <to@example.com>',
 +                ]
 +            ),
 +            [
 +                ('Bud, Person', 'bperson@dom.ain'),
 +                ('Al Person', 'aperson@dom.ain'),
 +                ('Mariusz Felisiak', 'to@example.com'),
 +            ],
 +        )
 +
 +    def test_parsing_errors(self):
 +        """Test for parsing errors from CVE-2023-27043 and CVE-2019-16056"""
 +        alice = 'alice@example.org'
 +        bob = 'bob@example.com'
 +        empty = ('', '')
 +
 +        # Test utils.getaddresses() and utils.parseaddr() on malformed email
 +        # addresses: default behavior (strict=True) rejects malformed address,
 +        # and strict=False which tolerates malformed address.
 +        for invalid_separator, expected_non_strict in (
 +            ('(', [(f'<{bob}>', alice)]),
 +            (')', [('', alice), empty, ('', bob)]),
 +            ('<', [('', alice), empty, ('', bob), empty]),
 +            ('>', [('', alice), empty, ('', bob)]),
 +            ('[', [('', f'{alice}[<{bob}>]')]),
 +            (']', [('', alice), empty, ('', bob)]),
 +            ('@', [empty, empty, ('', bob)]),
 +            (';', [('', alice), empty, ('', bob)]),
 +            (':', [('', alice), ('', bob)]),
 +            ('.', [('', alice + '.'), ('', bob)]),
 +            ('"', [('', alice), ('', f'<{bob}>')]),
 +        ):
 +            address = f'{alice}{invalid_separator}<{bob}>'
 +            with self.subTest(address=address):
 +                self.assertEqual(utils.getaddresses([address]),
 +                                 [empty])
 +                self.assertEqual(utils.getaddresses([address], strict=False),
 +                                 expected_non_strict)
 +
 +                self.assertEqual(utils.parseaddr([address]),
 +                                 empty)
 +                self.assertEqual(utils.parseaddr([address], strict=False),
 +                                 ('', address))
 +
 +        # Comma (',') is treated differently depending on strict parameter.
 +        # Comma without quotes.
 +        address = f'{alice},<{bob}>'
 +        self.assertEqual(utils.getaddresses([address]),
 +                         [('', alice), ('', bob)])
 +        self.assertEqual(utils.getaddresses([address], strict=False),
 +                         [('', alice), ('', bob)])
 +        self.assertEqual(utils.parseaddr([address]),
 +                         empty)
 +        self.assertEqual(utils.parseaddr([address], strict=False),
 +                         ('', address))
 +
 +        # Real name between quotes containing comma.
 +        address = '"Alice, alice@example.org" <bob@example.com>'
 +        expected_strict = ('Alice, alice@example.org', 'bob@example.com')
 +        self.assertEqual(utils.getaddresses([address]), [expected_strict])
 +        self.assertEqual(utils.getaddresses([address], strict=False), [expected_strict])
 +        self.assertEqual(utils.parseaddr([address]), expected_strict)
 +        self.assertEqual(utils.parseaddr([address], strict=False),
 +                         ('', address))
 +
 +        # Valid parenthesis in comments.
 +        address = 'alice@example.org (Alice)'
 +        expected_strict = ('Alice', 'alice@example.org')
 +        self.assertEqual(utils.getaddresses([address]), [expected_strict])
 +        self.assertEqual(utils.getaddresses([address], strict=False), [expected_strict])
 +        self.assertEqual(utils.parseaddr([address]), expected_strict)
 +        self.assertEqual(utils.parseaddr([address], strict=False),
 +                         ('', address))
 +
 +        # Invalid parenthesis in comments.
 +        address = 'alice@example.org )Alice('
 +        self.assertEqual(utils.getaddresses([address]), [empty])
 +        self.assertEqual(utils.getaddresses([address], strict=False),
 +                         [('', 'alice@example.org'), ('', ''), ('', 'Alice')])
 +        self.assertEqual(utils.parseaddr([address]), empty)
 +        self.assertEqual(utils.parseaddr([address], strict=False),
 +                         ('', address))
 +
 +        # Two addresses with quotes separated by comma.
 +        address = '"Jane Doe" <jane@example.net>, "John Doe" <john@example.net>'
 +        self.assertEqual(utils.getaddresses([address]),
 +                         [('Jane Doe', 'jane@example.net'),
 +                          ('John Doe', 'john@example.net')])
 +        self.assertEqual(utils.getaddresses([address], strict=False),
 +                         [('Jane Doe', 'jane@example.net'),
 +                          ('John Doe', 'john@example.net')])
 +        self.assertEqual(utils.parseaddr([address]), empty)
 +        self.assertEqual(utils.parseaddr([address], strict=False),
 +                         ('', address))
 +
 +        # Test email.utils.supports_strict_parsing attribute
 +        self.assertEqual(email.utils.supports_strict_parsing, True)
 +
     def test_getaddresses_nasty(self):
 -        eq = self.assertEqual
 -        eq(utils.getaddresses(['foo: ;']), [('', '')])
 -        eq(utils.getaddresses(
 -           ['[]*-- =~$']),
 -           [('', ''), ('', ''), ('', '*--')])
 -        eq(utils.getaddresses(
 -           ['foo: ;', '"Jason R. Mastaler" <jason@dom.ain>']),
 -           [('', ''), ('Jason R. Mastaler', 'jason@dom.ain')])
 +        for addresses, expected in (
 +            (['"Sürname, Firstname" <to@example.com>'],
 +             [('Sürname, Firstname', 'to@example.com')]),
 +
 +            (['foo: ;'],
 +             [('', '')]),
 +
 +            (['foo: ;', '"Jason R. Mastaler" <jason@dom.ain>'],
 +             [('', ''), ('Jason R. Mastaler', 'jason@dom.ain')]),
 +
 +            ([r'Pete(A nice \) chap) <pete(his account)@silly.test(his host)>'],
 +             [('Pete (A nice ) chap his account his host)', 'pete@silly.test')]),
 +
 +            (['(Empty list)(start)Undisclosed recipients  :(nobody(I know))'],
 +             [('', '')]),
 +
 +            (['Mary <@machine.tld:mary@example.net>, , jdoe@test   . example'],
 +             [('Mary', 'mary@example.net'), ('', ''), ('', 'jdoe@test.example')]),
 +
 +            (['John Doe <jdoe@machine(comment).  example>'],
 +             [('John Doe (comment)', 'jdoe@machine.example')]),
 +
 +            (['"Mary Smith: Personal Account" <smith@home.example>'],
 +             [('Mary Smith: Personal Account', 'smith@home.example')]),
 +
 +            (['Undisclosed recipients:;'],
 +             [('', '')]),
 +
 +            ([r'<boss@nil.test>, "Giant; \"Big\" Box" <bob@example.net>'],
 +             [('', 'boss@nil.test'), ('Giant; "Big" Box', 'bob@example.net')]),
 +        ):
 +            with self.subTest(addresses=addresses):
 +                self.assertEqual(utils.getaddresses(addresses),
 +                                 expected)
 +                self.assertEqual(utils.getaddresses(addresses, strict=False),
 +                                 expected)
 +
 +        addresses = ['[]*-- =~$']
 +        self.assertEqual(utils.getaddresses(addresses),
 +                         [('', '')])
 +        self.assertEqual(utils.getaddresses(addresses, strict=False),
 +                         [('', ''), ('', ''), ('', '*--')])
     def test_getaddresses_embedded_comment(self):
         """Test proper handling of a nested comment"""
@@ -3520,6 +3660,54 @@ multipart/report
                 m = cls(*constructor, policy=email.policy.default)
                 self.assertIs(m.policy, email.policy.default)
 +    def test_iter_escaped_chars(self):
 +        self.assertEqual(list(utils._iter_escaped_chars(r'a\\b\"c\\"d')),
 +                         [(0, 'a'),
 +                          (2, '\\\\'),
 +                          (3, 'b'),
 +                          (5, '\\"'),
 +                          (6, 'c'),
 +                          (8, '\\\\'),
 +                          (9, '"'),
 +                          (10, 'd')])
 +        self.assertEqual(list(utils._iter_escaped_chars('a\\')),
 +                         [(0, 'a'), (1, '\\')])
 +
 +    def test_strip_quoted_realnames(self):
 +        def check(addr, expected):
 +            self.assertEqual(utils._strip_quoted_realnames(addr), expected)
 +
 +        check('"Jane Doe" <jane@example.net>, "John Doe" <john@example.net>',
 +              ' <jane@example.net>,  <john@example.net>')
 +        check(r'"Jane \"Doe\"." <jane@example.net>',
 +              ' <jane@example.net>')
 +
 +        # special cases
 +        check(r'before"name"after', 'beforeafter')
 +        check(r'before"name"', 'before')
 +        check(r'b"name"', 'b')  # single char
 +        check(r'"name"after', 'after')
 +        check(r'"name"a', 'a')  # single char
 +        check(r'"name"', '')
 +
 +        # no change
 +        for addr in (
 +            'Jane Doe <jane@example.net>, John Doe <john@example.net>',
 +            'lone " quote',
 +        ):
 +            self.assertEqual(utils._strip_quoted_realnames(addr), addr)
 +
 +
 +    def test_check_parenthesis(self):
 +        addr = 'alice@example.net'
 +        self.assertTrue(utils._check_parenthesis(f'{addr} (Alice)'))
 +        self.assertFalse(utils._check_parenthesis(f'{addr} )Alice('))
 +        self.assertFalse(utils._check_parenthesis(f'{addr} (Alice))'))
 +        self.assertFalse(utils._check_parenthesis(f'{addr} ((Alice)'))
 +
 +        # Ignore real name between quotes
 +        self.assertTrue(utils._check_parenthesis(f'")Alice((" {addr}'))
 +
 # Test the iterator/generators
 class TestIterators(TestEmailBase):
 diff --git a/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
 new file mode 100644
 index 0000000..3d0e9e4
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
@@ -0,0 +1,8 @@
 +:func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now
 +return ``('', '')`` 2-tuples in more situations where invalid email
 +addresses are encountered instead of potentially inaccurate values. Add
 +optional *strict* parameter to these two functions: use ``strict=False`` to
 +get the old behavior, accept malformed inputs.
 +``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check
 +if the *strict* paramater is available. Patch by Thomas Dwyer and Victor
 +Stinner to improve the CVE-2023-27043 fix.
 -- 
 2.43.0
 From 6c34f5b95da90bd494e29776c0e807af44689fae Mon Sep 17 00:00:00 2001
 From: Lumir Balhar <lbalhar@redhat.com>
 Date: Wed, 10 Jan 2024 08:53:53 +0100
-Subject: [PATCH 2/2] Make it possible to disable strict parsing in email
+Subject: [PATCH] Make it possible to disable strict parsing in email module
 module
 ---
 Doc/library/email.utils.rst       | 26 +++++++++++
@ -515,7 +10,7 @@ Subject: [PATCH 2/2] Make it possible to disable strict parsing in email
 3 files changed, 150 insertions(+), 4 deletions(-)
 diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
-index 6723dc4..c89602d 100644
+index 97ddf49..0c9bf53 100644
 --- a/Doc/library/email.utils.rst
 +++ b/Doc/library/email.utils.rst
@@ -69,6 +69,19 @@ of the new API.
@ -535,7 +30,7 @@ index 6723dc4..c89602d 100644
 +      [email_addr_parsing]
 +      PYTHON_EMAIL_DISABLE_STRICT_ADDR_PARSING = true
 +
-    .. versionchanged:: 3.13
+    .. versionchanged:: 3.11.10
       Add *strict* optional parameter and reject malformed inputs by default.
@@ -97,6 +110,19 @@ of the new API.
@ -559,7 +54,7 @@ index 6723dc4..c89602d 100644
       from email.utils import getaddresses
 diff --git a/Lib/email/utils.py b/Lib/email/utils.py
-index 9522341..2e30e09 100644
+index 94ead0e..09a414c 100644
 --- a/Lib/email/utils.py
 +++ b/Lib/email/utils.py
@@ -48,6 +48,46 @@ TICK = "'"
@ -608,7 +103,7 @@ index 9522341..2e30e09 100644
 +
 def _has_surrogates(s):
-     """Return True if s contains surrogate-escaped binary data."""
+     """Return True if s may contain surrogate-escaped binary data."""
@@ -149,7 +189,7 @@ def _strip_quoted_realnames(addr):
 supports_strict_parsing = True
@ -652,7 +147,7 @@ index 9522341..2e30e09 100644
         addrs = _AddressList(addr).addresslist
         if not addrs:
 diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
-index 20b6779..d7d99f0 100644
+index ad60ed3..f85da56 100644
 --- a/Lib/test/test_email/test_email.py
 +++ b/Lib/test/test_email/test_email.py
@@ -8,6 +8,9 @@ import base64
@ -676,7 +171,7 @@ index 20b6779..d7d99f0 100644
 from test.test_email import openfile, TestEmailBase
 # These imports are documented to work, but we are testing them using a
-@@ -3427,6 +3430,73 @@ Foo
+@@ -3442,6 +3445,73 @@ Foo
         # Test email.utils.supports_strict_parsing attribute
         self.assertEqual(email.utils.supports_strict_parsing, True)
@ -751,5 +246,5 @@ index 20b6779..d7d99f0 100644
         for addresses, expected in (
             (['"Sürname, Firstname" <to@example.com>'],
 -- 
-2.43.0
+2.46.0
--- a/SOURCES/00422-fix-expat-tests.patch
+++ b/SOURCES/00422-fix-expat-tests.patch
@ -0,0 +1,75 @@
 From 670984c96eea60488c5355b4cf535c1ee3cf081a Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 24 Apr 2024 04:24:16 +0200
 Subject: [PATCH] Fix xml tests
 ---
 Lib/test/test_pyexpat.py   | 3 +++
 Lib/test/test_sax.py       | 2 ++
 Lib/test/test_xml_etree.py | 6 ++++++
 3 files changed, 11 insertions(+)
 diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
 index 44bd1de..5976fa0 100644
 --- a/Lib/test/test_pyexpat.py
 +++ b/Lib/test/test_pyexpat.py
@@ -3,6 +3,7 @@
 import os
 import platform
 +import pyexpat
 import sys
 import sysconfig
 import unittest
@@ -793,6 +794,8 @@ class ReparseDeferralTest(unittest.TestCase):
         self.assertEqual(started, ['doc'])
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +                     "Reparse deferral not defined for libexpat < 2.6.0")
     def test_reparse_deferral_disabled(self):
         started = []
 diff --git a/Lib/test/test_sax.py b/Lib/test/test_sax.py
 index 9b3014a..5960de1 100644
 --- a/Lib/test/test_sax.py
 +++ b/Lib/test/test_sax.py
@@ -1240,6 +1240,8 @@ class ExpatReaderTest(XmlTestBase):
         self.assertEqual(result.getvalue(), start + b"<doc></doc>")
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +                     "Reparse deferral not defined for libexpat < 2.6.0")
     def test_flush_reparse_deferral_disabled(self):
         result = BytesIO()
         xmlgen = XMLGenerator(result)
 diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
 index 8becafb..5e9b6b5 100644
 --- a/Lib/test/test_xml_etree.py
 +++ b/Lib/test/test_xml_etree.py
@@ -1424,9 +1424,13 @@ class XMLPullParserTest(unittest.TestCase):
         self.assert_event_tags(parser, [('end', 'root')])
         self.assertIsNone(parser.close())
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +        "test not compatible with the latest expat security release")
     def test_simple_xml_chunk_1(self):
         self.test_simple_xml(chunk_size=1, flush=True)
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +        "test not compatible with the latest expat security release")
     def test_simple_xml_chunk_5(self):
         self.test_simple_xml(chunk_size=5, flush=True)
@@ -1651,6 +1655,8 @@ class XMLPullParserTest(unittest.TestCase):
         self.assert_event_tags(parser, [('end', 'doc')])
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +                     "Reparse deferral not defined for libexpat < 2.6.0")
     def test_flush_reparse_deferral_disabled(self):
         parser = ET.XMLPullParser(events=('start', 'end'))
 -- 
 2.44.0
--- a/SOURCES/00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch
+++ b/SOURCES/00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch
@ -0,0 +1,119 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Seth Michael Larson <seth@python.org>
 Date: Fri, 31 Jan 2025 11:41:34 -0600
 Subject: [PATCH] 00450: CVE-2025-0938: Disallow square brackets ([ and ]) in
 domain names for parsed URLs
 Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
 ---
 Lib/test/test_urlparse.py                     | 37 ++++++++++++++++++-
 Lib/urllib/parse.py                           | 20 +++++++++-
 ...-01-28-14-08-03.gh-issue-105704.EnhHxu.rst |  4 ++
 3 files changed, 58 insertions(+), 3 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
 diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
 index 2376dad81b..a283063f24 100644
 --- a/Lib/test/test_urlparse.py
 +++ b/Lib/test/test_urlparse.py
@@ -1224,16 +1224,51 @@ def test_invalid_bracketed_hosts(self):
         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]/')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix/')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]?')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix?')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]/')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix/')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]?')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix?')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a1')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a1')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:1a')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:1a')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:/')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:?')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@prefix.[v6a.ip]')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@[v6a.ip].suffix')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip]')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip[')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip].suffix')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip')
 +        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[suffix')
     def test_splitting_bracketed_hosts(self):
 -        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
 +        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
         self.assertEqual(p1.hostname, 'v6a.ip')
         self.assertEqual(p1.username, 'user')
         self.assertEqual(p1.path, '/path')
 +        self.assertEqual(p1.port, 1234)
         p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
         self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test')
         self.assertEqual(p2.username, 'user')
         self.assertEqual(p2.path, '/path')
 +        self.assertIs(p2.port, None)
         p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
         self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test')
         self.assertEqual(p3.username, 'user')
 diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
 index abf1d1b546..724cce8d39 100644
 --- a/Lib/urllib/parse.py
 +++ b/Lib/urllib/parse.py
@@ -436,6 +436,23 @@ def _checknetloc(netloc):
             raise ValueError("netloc '" + netloc + "' contains invalid " +
                              "characters under NFKC normalization")
 +def _check_bracketed_netloc(netloc):
 +    # Note that this function must mirror the splitting
 +    # done in NetlocResultMixins._hostinfo().
 +    hostname_and_port = netloc.rpartition('@')[2]
 +    before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
 +    if have_open_br:
 +        # No data is allowed before a bracket.
 +        if before_bracket:
 +            raise ValueError("Invalid IPv6 URL")
 +        hostname, _, port = bracketed.partition(']')
 +        # No data is allowed after the bracket but before the port delimiter.
 +        if port and not port.startswith(":"):
 +            raise ValueError("Invalid IPv6 URL")
 +    else:
 +        hostname, _, port = hostname_and_port.partition(':')
 +    _check_bracketed_host(hostname)
 +
 # Valid bracketed hosts are defined in
 # https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
 def _check_bracketed_host(hostname):
@@ -496,8 +513,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
                 (']' in netloc and '[' not in netloc)):
             raise ValueError("Invalid IPv6 URL")
         if '[' in netloc and ']' in netloc:
 -            bracketed_host = netloc.partition('[')[2].partition(']')[0]
 -            _check_bracketed_host(bracketed_host)
 +            _check_bracketed_netloc(netloc)
     if allow_fragments and '#' in url:
         url, fragment = url.split('#', 1)
     if '?' in url:
 diff --git a/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst b/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
 new file mode 100644
 index 0000000000..bff1bc6b0d
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
@@ -0,0 +1,4 @@
 +When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse` host
 +parsing would not reject domain names containing square brackets (``[`` and
 +``]``). Square brackets are only valid for IPv6 and IPvFuture hosts according to
 +`RFC 3986 Section 3.2.2 <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.
--- a/SOURCES/Python-3.11.11.tar.xz.asc
+++ b/SOURCES/Python-3.11.11.tar.xz.asc
@ -0,0 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCAAdFiEEz9yiRbEEPPKl+Xhl/+h0BBaL2EcFAmdPRgIACgkQ/+h0BBaL
 2EeZ0g//W0Dw34k4l9Itf++MtfvRzfHIaELmo3w44y1bOl4WumgzTocVAoFf/vF2
 BYupcHzPKV/3n2qrAEkEryutV21MykSZzcryDNXqXCAra/5WIFhpKfdGE+q6Ld/a
 6bJEQwbXuuE703GWGwIVT8Dxeo7gPdpyZegnKpGS9ij/01m5s30DXSu9+HFkQmUL
 dmqjPyE80hUbcrb5qoTedh0Kn+TsfhQ3QfSLTHailsCFpb6Y17KI2GSRAhKTvaEw
 +to46LMximYc+Nz+frjTIzoUNsCh5wcBAnN5yLh3wIJTWdo7CGg8ffaZmBDJhRPR
 drUl/8GFjC0WPfPSnwJFEfn+Dy9jmrhcoIzb/RdSZhe1NybxJ9o6cEybSM7/A/X3
 RPMsywEiMElK4TAyjgMobxtDaZAC1V/qzfKP8bLdyhNWKC8pLwaL1S0xPZvToIT2
 kZ4AyqEScZb23vI3P8orymawsdJBMhtZ7yJlUtsx1IdzgPEN3YLgjiqBTzRpOjZV
 VcyUZZKn7aLZYFQlcY1ghtCj5Z5RIFwnOg4Ay+M3UNzXrd81rWc7IcIVLuQPGVgu
 INlDLpQs2EuikXWT2ADvQ/Gm3Z42M3AZtSDIUyRb1gFWDWjqThjO0ypFA1rdZb6+
 2MjmRsQ9nK6Nm5uJ+Ww+s0o8O/D52pMg/J9zshQGON/8LRBBoXk=
 =UKo7
 -----END PGP SIGNATURE-----
--- a/SOURCES/Python-3.11.7.tar.xz.asc
+++ b/SOURCES/Python-3.11.7.tar.xz.asc
@ -1,16 +0,0 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCAAdFiEEz9yiRbEEPPKl+Xhl/+h0BBaL2EcFAmVuFigACgkQ/+h0BBaL
 2EeHPg/+LU5xs2ZDrQogDcH+A1v8RyursiggypdM5hXTrsFsTCIk4iekcI9xkhG1
 ltNX4UuCe5PUEbTgtaWP0ncXARrUnPCoQaQ1sHVDTYoHegancsk+sXZc1JM7qr0p
 Y4Ig6mKjuHFMXCInQSI2GaH4t5r4Z1jGk/PGrecIHOPJgqfA/6Z3TBF5N+y3jEvS
 2QazMB298q4RDhh9m3REe8LwFPHDlfw9eRohv0MB8xygg9KtxhLZrN7gLBQZvKGD
 ihNw6EgJj5OZ0dvwKCCXnlZuwknuJW7vAOPHhYeenPdVdYCGoRSyN7JdD07L+5AG
 O14l2rqZrz5Eu28by+kAUrcPYAfAXekw1PmtT3HSd9U/nqnUiTkkJcjyGG/e3cjJ
 sUDKMNCSBq0G7j5DB3bB6VHkZjVuz+T+iR5QdfJ4kI2pYSuE/rUj1rhkUXApYsHl
 7Wff0QbOW6QT1wCtQcMpJSzkTDVJVYxiqrko/ihlOhphDHYLdOIGOrxWAUwc06x/
 BhJD6tM1kEVZvifoJp1OsNwDzZ/Ku6CUs05E1vWxdeNVeANyKAgCZ5hOVmhnv866
 11zfgo/znRsMzMIyJuy0bhO0C6omVLzzfhipAbZM2jDorn37xxV0v/I0pceNtLrp
 YR7Tjs7+Ihe6/oItjW53j9T7ANdgQ1RVDg98lKlPFNL+hxfctwY=
 =0Pkd
 -----END PGP SIGNATURE-----
--- a/SOURCES/check-pyc-timestamps.py
+++ b/SOURCES/check-pyc-timestamps.py
@ -16,7 +16,6 @@ LEVELS = (None, 1, 2)
 # list of globs of test and other files that we expect not to have bytecode
 not_compiled = [
    '/usr/bin/*',
    '/usr/lib/rpm/redhat/*',
    '*/test/*/bad_coding.py',
    '*/test/*/bad_coding2.py',
    '*/test/*/badsyntax_*.py',
--- a/SOURCES/import_all_modules_py3_11.py
+++ b/SOURCES/import_all_modules_py3_11.py
@ -1,171 +0,0 @@
 '''Script to perform import of each module given to %%py_check_import
 '''
 import argparse
 import importlib
 import fnmatch
 import os
 import re
 import site
 import sys
 from contextlib import contextmanager
 from pathlib import Path
 def read_modules_files(file_paths):
    '''Read module names from the files (modules must be newline separated).
    Return the module names list or, if no files were provided, an empty list.
    '''
    if not file_paths:
        return []
    modules = []
    for file in file_paths:
        file_contents = file.read_text()
        modules.extend(file_contents.split())
    return modules
 def read_modules_from_cli(argv):
    '''Read module names from command-line arguments (space or comma separated).
    Return the module names list.
    '''
    if not argv:
        return []
    # %%py3_check_import allows to separate module list with comma or whitespace,
    # we need to unify the output to a list of particular elements
    modules_as_str = ' '.join(argv)
    modules = re.split(r'[\s,]+', modules_as_str)
    # Because of shell expansion in some less typical cases it may happen
    # that a trailing space will occur at the end of the list.
    # Remove the empty items from the list before passing it further
    modules = [m for m in modules if m]
    return modules
 def filter_top_level_modules_only(modules):
    '''Filter out entries with nested modules (containing dot) ie. 'foo.bar'.
    Return the list of top-level modules.
    '''
    return [module for module in modules if '.' not in module]
 def any_match(text, globs):
    '''Return True if any of given globs fnmatchcase's the given text.'''
    return any(fnmatch.fnmatchcase(text, g) for g in globs)
 def exclude_unwanted_module_globs(globs, modules):
    '''Filter out entries which match the either of the globs given as argv.
    Return the list of filtered modules.
    '''
    return [m for m in modules if not any_match(m, globs)]
 def read_modules_from_all_args(args):
    '''Return a joined list of modules from all given command-line arguments.
    '''
    modules = read_modules_files(args.filename)
    modules.extend(read_modules_from_cli(args.modules))
    if args.exclude:
        modules = exclude_unwanted_module_globs(args.exclude, modules)
    if args.top_level:
        modules = filter_top_level_modules_only(modules)
    # Error when someone accidentally managed to filter out everything
    if len(modules) == 0:
        raise ValueError('No modules to check were left')
    return modules
 def import_modules(modules):
    '''Procedure to perform import check for each module name from the given list of modules.
    '''
    for module in modules:
        print('Check import:', module, file=sys.stderr)
        importlib.import_module(module)
 def argparser():
    parser = argparse.ArgumentParser(
        description='Generate list of all importable modules for import check.'
    )
    parser.add_argument(
        'modules', nargs='*',
        help=('Add modules to check the import (space or comma separated).'),
    )
    parser.add_argument(
        '-f', '--filename', action='append', type=Path,
        help='Add importable module names list from file.',
    )
    parser.add_argument(
        '-t', '--top-level', action='store_true',
        help='Check only top-level modules.',
    )
    parser.add_argument(
        '-e', '--exclude', action='append',
        help='Provide modules globs to be excluded from the check.',
    )
    return parser
@contextmanager
 def remove_unwanteds_from_sys_path():
    '''Remove cwd and this script's parent from sys.path for the import test.
    Bring the original contents back after import is done (or failed)
    '''
    cwd_absolute = Path.cwd().absolute()
    this_file_parent = Path(__file__).parent.absolute()
    old_sys_path = list(sys.path)
    for path in old_sys_path:
        if Path(path).absolute() in (cwd_absolute, this_file_parent):
            sys.path.remove(path)
    try:
        yield
    finally:
        sys.path = old_sys_path
 def addsitedirs_from_environ():
    '''Load directories from the _PYTHONSITE environment variable (separated by :)
    and load the ones already present in sys.path via site.addsitedir()
    to handle .pth files in them.
    This is needed to properly import old-style namespace packages with nspkg.pth files.
    See https://bugzilla.redhat.com/2018551 for a more detailed rationale.'''
    for path in os.getenv('_PYTHONSITE', '').split(':'):
        if path in sys.path:
            site.addsitedir(path)
 def main(argv=None):
    cli_args = argparser().parse_args(argv)
    if not cli_args.modules and not cli_args.filename:
        raise ValueError('No modules to check were provided')
    modules = read_modules_from_all_args(cli_args)
    with remove_unwanteds_from_sys_path():
        addsitedirs_from_environ()
        import_modules(modules)
 if __name__ == '__main__':
    main()
--- a/SOURCES/macros.python3.11
+++ b/SOURCES/macros.python3.11
@ -1,77 +0,0 @@
 %__python3 /usr/bin/python3.11
 %python3_pkgversion 3.11
 # The following are macros from macros.python3 in Fedora that are newer/different than those in the python3-rpm-macros package in RHEL.
 # These macros overwrite/supercede some of the macros in the python3-rpm-macros package in RHEL.
 # nb: $RPM_BUILD_ROOT is not set when the macros are expanded (at spec parse time)
 #     so we set it manually (to empty string), making our Python prefer the correct install scheme location
 # platbase/base is explicitly set to %%{_prefix} to support custom values, such as /app for flatpaks
 %python3_sitelib %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '%{_prefix}', 'base': '%{_prefix}'}))")
 %python3_sitearch %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_path('platlib', vars={'platbase': '%{_prefix}', 'base': '%{_prefix}'}))")
 %python3_version %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; sys.stdout.write('{0.major}.{0.minor}'.format(sys.version_info))")
 %python3_version_nodots %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; sys.stdout.write('{0.major}{0.minor}'.format(sys.version_info))")
 %python3_platform %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_platform())")
 %python3_platform_triplet %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_config_var('MULTIARCH'))")
 %python3_ext_suffix %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_config_var('EXT_SUFFIX'))")
 %python3_cache_tag %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print(sys.implementation.cache_tag)")
 %_py3_shebang_s s
 %_py3_shebang_P %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print('P' if hasattr(sys.flags, 'safe_path') else '')")
 %py3_shbang_opts -%{?_py3_shebang_s}%{?_py3_shebang_P}
 %py3_install() %{expand:\\\
  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
  %{__python3} %{py_setup} %{?py_setup_args} install -O1 --skip-build --root %{buildroot} --prefix %{_prefix} %{?*}
  rm -rfv %{buildroot}%{_bindir}/__pycache__
 }
 %py3_install_egg() %{expand:\\\
  mkdir -p %{buildroot}%{python3_sitelib}
  %{__python3} -m easy_install -m --prefix %{buildroot}%{_prefix} -Z dist/*-py%{python3_version}.egg %{?*}
  rm -rfv %{buildroot}%{_bindir}/__pycache__
 }
 %py3_install_wheel() %{expand:\\\
  %{__python3} -m pip install -I dist/%{1} --root %{buildroot} --prefix %{_prefix} --no-deps --no-index --no-warn-script-location
  rm -rfv %{buildroot}%{_bindir}/__pycache__
  for distinfo in %{buildroot}%{python3_sitelib}/*.dist-info %{buildroot}%{python3_sitearch}/*.dist-info; do
    if [ -f ${distinfo}/direct_url.json ]; then
      rm -fv ${distinfo}/direct_url.json
      sed -i '/direct_url.json/d' ${distinfo}/RECORD
    fi
  done
 }
 # With $PATH and $PYTHONPATH set to the %%buildroot,
 # try to import the Python 3 module(s) given as command-line args or read from file (-f).
 # Respect the custom values of %%py3_shebang_flags or set nothing if it's undefined.
 # Filter and check import on only top-level modules using -t flag.
 # Exclude unwanted modules by passing their globs to -e option.
 # Useful as a smoke test in %%check when running tests is not feasible.
 # Use spaces or commas as separators if providing list directly.
 # Use newlines as separators if providing list in a file.
 %py3_check_import(e:tf:) %{expand:\\\
  PATH="%{buildroot}%{_bindir}:$PATH"\\\
  PYTHONPATH="${PYTHONPATH:-%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}}"\\\
  _PYTHONSITE="%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}"\\\
  PYTHONDONTWRITEBYTECODE=1\\\
  %{lua:
  local command = "%{__python3} "
  if rpm.expand("%{?py3_shebang_flags}") ~= "" then
    command = command .. "-%{py3_shebang_flags}"
  end
  command = command .. " %{_rpmconfigdir}/redhat/import_all_modules_py3_11.py "
  -- handle multiline arguments correctly, see https://bugzilla.redhat.com/2018809
  local args=rpm.expand('%{?**}'):gsub("[%s\\\\]*%s+", " ")
  print(command .. args)
  }
 }
 %pytest %{expand:\\\
  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
  PATH="%{buildroot}%{_bindir}:$PATH"\\\
  PYTHONPATH="${PYTHONPATH:-%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}}"\\\
  PYTHONDONTWRITEBYTECODE=1\\\
  %{?__pytest_addopts:PYTEST_ADDOPTS="${PYTEST_ADDOPTS:-} %{__pytest_addopts}"}\\\
  %__pytest}
--- a/SPECS/python3.11.spec
+++ b/SPECS/python3.11.spec
@ -16,11 +16,11 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.7
+%global general_version %{pybasever}.11
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: Python
@ -63,7 +63,7 @@ License: Python
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 23.2.1
+%global pip_version 24.0
 %global setuptools_version 65.5.0
 # Expensive optimizations (mainly, profile-guided optimizations)
@ -145,6 +145,13 @@ License: Python
 %global py_INSTSONAME_optimized libpython%{LDVERSION_optimized}.so.%{py_SOVERSION}
 %global py_INSTSONAME_debug     libpython%{LDVERSION_debug}.so.%{py_SOVERSION}
 # The -O flag for the compiler, optimized builds
 # https://fedoraproject.org/wiki/Changes/Python_built_with_gcc_O3
 %global optflags_optimized -O3
 # The -O flag for the compiler, debug builds
 # -Wno-cpp avoids some warnings with -O0
 %global optflags_debug -O0 -Wno-cpp
 # Disable automatic bytecompilation. The python3 binary is not yet be
 # available in /usr/bin when Python is built. Also, the bytecompilation fails
 # on files that test invalid syntax.
@ -253,10 +260,6 @@ Source1: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz.a
 # The release manager for Python 3.11 is pablogsal
 Source2: https://keybase.io/pablogsal/pgp_keys.asc
 # Sources for the python3.11-rpm-macros
 Source3: macros.python3.11
 Source4: import_all_modules_py3_11.py
 # A simple script to check timestamps of bytecode files
 # Run in check section with Python that is currently being built
 # Originally written by bkabrda
@ -336,31 +339,6 @@ Patch329: 00329-fips.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 # 00378 #
 # Support expat 2.4.5
 #
 # Curly brackets were never allowed in namespace URIs
 # according to RFC 3986, and so-called namespace-validating
 # XML parsers have the right to reject them a invalid URIs.
 #
 # libexpat >=2.4.5 has become strcter in that regard due to
 # related security issues; with ET.XML instantiating a
 # namespace-aware parser under the hood, this test has no
 # future in CPython.
 #
 # References:
 # - https://datatracker.ietf.org/doc/html/rfc3968
 # - https://www.w3.org/TR/xml-names/
 #
 # Also, test_minidom.py: Support Expat >=2.4.5
 #
 # The patch has diverged from upstream as the python test
 # suite was relying on checking the expat version, whereas
 # in RHEL fixes get backported instead of rebasing packages.
 #
 # Upstream: https://bugs.python.org/issue46811
 Patch378: 00378-support-expat-2-4-5.patch
 # 00397 #
 # Filters for tarfile extraction (CVE-2007-4559, PEP-706)
 # First patch fixes determination of symlink targets, which were treated
@ -381,10 +359,20 @@ Patch397: 00397-tarfile-filter.patch
 #
 # Upstream PR: https://github.com/python/cpython/pull/111116
 #
-# Second patch implmenets the possibility to restore the old behavior via
+# The patch implements the possibility to restore the old behavior via
 # config file or environment variable.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 # 00422 #
 # Fix the test suite for releases of expat < 2.6.0
 # which backport the CVE-2023-52425 fix.
 # Downstream only.
 Patch422: 00422-fix-expat-tests.patch
 # 00450 # 4ab8663661748eb994c09e4ae89f59eb84c5d3ea
 # CVE-2025-0938: Disallow square brackets ([ and ]) in domain names for parsed URLs
 Patch450: 00450-cve-2025-0938-disallow-square-brackets-and-in-domain-names-for-parsed-urls.patch
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -403,14 +391,6 @@ Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-par
 # Descriptions, and metadata for subpackages
 # ==========================================
 # Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
 Requires:         alternatives >= 1.19.2-1
 Requires(post):   alternatives >= 1.19.2-1
 Requires(postun): alternatives >= 1.19.2-1
 # When the user tries to `yum install python`, yum will list this package among
 # the possible alternatives
 Provides: alternative-for(python)
 %if %{with main_python}
 # Description for the python3X SRPM only:
@ -485,7 +465,6 @@ Documentation for Python is provided in the %{pkgname}-docs package.
 Packages containing additional libraries for Python are generally named with
 the "%{pkgname}-" prefix.
 For the unversioned "python" executable, see manual page "unversioned-python".
 %if %{with main_python}
 # https://fedoraproject.org/wiki/Changes/Move_usr_bin_python_into_separate_package
@ -554,12 +533,9 @@ Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 Requires: (python-rpm-macros if rpm-build)
 Requires: (python3-rpm-macros if rpm-build)
-# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
+# We provide the python3.11-rpm-macros here to make it possible to
-Requires(postun): alternatives >= 1.19.2-1
+# BuildRequire them in the same manner as RHEL8.
-
+Provides: %{pkgname}-rpm-macros = %{version}-%{release}
 # python3.11 installs the alternatives master symlink to which we attach a slave
 Requires(post): %{pkgname}
 Requires(postun): %{pkgname}
 %unversioned_obsoletes_of_python3_X_if_main devel
@ -608,13 +584,6 @@ Provides: idle = %{version}-%{release}
 Provides: %{pkgname}-tools = %{version}-%{release}
 Provides: %{pkgname}-tools%{?_isa} = %{version}-%{release}
 # Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
 Requires(postun): alternatives >= 1.19.2-1
 # python3.11 installs the alternatives master symlink to which we attach a slave
 Requires(post): %{pkgname}
 Requires(postun): %{pkgname}
 %description -n %{pkgname}-idle
 IDLE is Python’s Integrated Development and Learning Environment.
@ -674,13 +643,6 @@ Requires: %{pkgname}-idle%{?_isa} = %{version}-%{release}
 %unversioned_obsoletes_of_python3_X_if_main debug
 # Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
 Requires(postun): alternatives >= 1.19.2-1
 # python3.11 installs the alternatives master symlink to which we attach a slave
 Requires(post): %{pkgname}
 Requires(postun): %{pkgname}
 %description -n %{pkgname}-debug
 python3-debug provides a version of the Python runtime with numerous debugging
 features enabled, aimed at advanced Python users such as developers of Python
@ -698,23 +660,6 @@ The debug runtime additionally supports debug builds of C-API extensions
 (with the "d" ABI flag) for debugging issues in those extensions.
 %endif # with debug_build
 # We package the python3.11-rpm-macros in RHEL8 as to properly set the
 # %%__python3 and %%python3_pkgversion macros as well as provide modern
 # versions the current base macros.
 %package -n %{pkgname}-rpm-macros
 Summary:    RPM macros for building RPMs with Python %{pybasever}
 License:    MIT
 Provides:   python-modular-rpm-macros == %{pybasever}
 Conflicts:  python-modular-rpm-macros > %{pybasever}
 Requires:   python3-rpm-macros
 BuildArch:  noarch
 %description -n %{pkgname}-rpm-macros
 RPM macros for building RPMs with Python %{pybasever} from the python%{pyshortver} module.
 If you want to build an RPM against the python%{pyshortver} module, you need to add:
    BuildRequire: %{pkgname}-rpm-macros.
 # ======================================================
 # The prep phase of the build:
 # ======================================================
@ -798,6 +743,7 @@ BuildPython() {
  ConfName=$1
  ExtraConfigArgs=$2
  MoreCFlags=$3
  MoreCFlagsNodist=$4
  # Each build is done in its own directory
  ConfDir=build/$ConfName
@ -837,7 +783,7 @@ BuildPython() {
  $ExtraConfigArgs \
  %{nil}
-%global flags_override EXTRA_CFLAGS="$MoreCFlags" CFLAGS_NODIST="$CFLAGS_NODIST $MoreCFlags"
+%global flags_override EXTRA_CFLAGS="$MoreCFlags" CFLAGS_NODIST="$CFLAGS_NODIST $MoreCFlags $MoreCFlagsNodist"
 %if %{without bootstrap}
  # Regenerate generated files (needs python3)
@ -860,12 +806,14 @@ BuildPython() {
 # See also: https://bugzilla.redhat.com/show_bug.cgi?id=1818857
 BuildPython debug \
  "--without-ensurepip --with-pydebug" \
-  "-O0 -Wno-cpp"
+  "%{optflags_debug}" \
  ""
 %endif # with debug_build
 BuildPython optimized \
  "--without-ensurepip %{optimizations_flag}" \
-  ""
+  "" \
  "%{optflags_optimized}"
 # ======================================================
 # Installing the built code:
@ -964,7 +912,7 @@ EOF
 %if %{with debug_build}
 InstallPython debug \
  %{py_INSTSONAME_debug} \
-  -O0 \
+  "%{optflags_debug}" \
  %{LDVERSION_debug}
 %endif # with debug_build
@ -1124,28 +1072,6 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
    rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done
 # Python RPM macros
 mkdir -p %{buildroot}%{rpmmacrodir}/
 install -m 644 %{SOURCE3} \
    %{buildroot}/%{rpmmacrodir}/
 # Add a script that is being used by python3.11-rpm-macros
 mkdir -p %{buildroot}%{_rpmconfigdir}/redhat
 install -m 644 %{SOURCE4} %{buildroot}%{_rpmconfigdir}/redhat/
 # All ghost files controlled by alternatives need to exist for the files
 # section check to succeed
 # - Don't list /usr/bin/python as a ghost file so `yum install /usr/bin/python`
 #   doesn't install this package
 touch %{buildroot}%{_bindir}/unversioned-python
 touch %{buildroot}%{_mandir}/man1/python.1.gz
 touch %{buildroot}%{_bindir}/python3
 touch %{buildroot}%{_mandir}/man1/python3.1.gz
 touch %{buildroot}%{_bindir}/pydoc3
 touch %{buildroot}%{_bindir}/pydoc-3
 touch %{buildroot}%{_bindir}/idle3
 touch %{buildroot}%{_bindir}/python3-config
 # ======================================================
 # Checks for packaging issues
 # ======================================================
@ -1236,118 +1162,9 @@ CheckPython optimized
 %endif # with tests
 # ======================================================
 # Scriptlets for alternatives on rhel8
 # ======================================================
 %post
 # Alternative for /usr/bin/python -> /usr/bin/python3 + man page
 alternatives --install %{_bindir}/unversioned-python \
                        python \
                        %{_bindir}/python3 \
                        300 \
              --slave   %{_bindir}/python \
                        unversioned-python \
                        %{_bindir}/python3 \
              --slave   %{_mandir}/man1/python.1.gz \
                        unversioned-python-man \
                        %{_mandir}/man1/python3.1.gz
 # Alternative for /usr/bin/python -> /usr/bin/python3.11 + man page
 alternatives --install %{_bindir}/unversioned-python \
                        python \
                        %{_bindir}/python3.11 \
                        211 \
              --slave   %{_bindir}/python \
                        unversioned-python \
                        %{_bindir}/python3.11 \
              --slave   %{_mandir}/man1/python.1.gz \
                        unversioned-python-man \
                        %{_mandir}/man1/python3.11.1.gz
 # Alternative for /usr/bin/python3 -> /usr/bin/python3.11 + related files
 # Create only if it doesn't exist already
 EXISTS=`alternatives --display python3 | \
         grep -c "^/usr/bin/python3.11 - priority [0-9]*"`
 if [ $EXISTS -eq 0 ]; then
     alternatives --install %{_bindir}/python3 \
                            python3 \
                            %{_bindir}/python3.11 \
                            31100 \
                  --slave   %{_mandir}/man1/python3.1.gz \
                            python3-man \
                            %{_mandir}/man1/python3.11.1.gz \
                  --slave   %{_bindir}/pydoc3 \
                            pydoc3 \
                            %{_bindir}/pydoc3.11 \
                  --slave   %{_bindir}/pydoc-3 \
                            pydoc-3 \
                            %{_bindir}/pydoc3.11
 fi
 %postun
 # Do this only during uninstall process (not during update)
 if [ $1 -eq 0 ]; then
     alternatives --keep-foreign --remove python \
                         %{_bindir}/python3.11
     alternatives --keep-foreign --remove python3 \
                         %{_bindir}/python3.11
     # Remove link python → python3 if no other python3.* exists
     if ! alternatives --display python3 > /dev/null; then
         alternatives --keep-foreign --remove python \
                             %{_bindir}/python3
     fi
 fi
 %post devel
 alternatives --add-slave python3 %{_bindir}/python3.11 \
     %{_bindir}/python3-config \
     python3-config \
     %{_bindir}/python3.11-config
 %postun devel
 # Do this only during uninstall process (not during update)
 if [ $1 -eq 0 ]; then
     alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.11 \
         python3-config
 fi
 %post idle
 alternatives --add-slave python3 %{_bindir}/python3.11 \
     %{_bindir}/idle3 \
     idle3 \
     %{_bindir}/idle3.11
 %postun idle
 # Do this only during uninstall process (not during update)
 if [ $1 -eq 0 ]; then
     alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.11 \
        idle3
 fi
 # ======================================================
 # Files for each RPM (sub)package
 # ======================================================
 %files -n %{pkgname}-rpm-macros
 %{rpmmacrodir}/macros.python%{pybasever}
 %{_rpmconfigdir}/redhat/import_all_modules_py3_11.py
 %files -n %{pkgname}
 %doc README.rst
 # Alternatives
 %ghost %{_bindir}/unversioned-python
 %ghost %{_mandir}/man1/python.1.gz
 %ghost %{_bindir}/python3
 %ghost %{_mandir}/man1/python3.1.gz
 %ghost %{_bindir}/pydoc3
 %ghost %{_bindir}/pydoc-3
 %if %{with main_python}
 %{_bindir}/pydoc*
 %{_bindir}/python3
@ -1637,9 +1454,6 @@ fi
 %{_bindir}/python%{pybasever}-config
 %{_bindir}/python%{LDVERSION_optimized}-config
 %{_bindir}/python%{LDVERSION_optimized}-*-config
 # Alternatives
 %ghost %{_bindir}/python3-config
 %{_libdir}/libpython%{LDVERSION_optimized}.so
 %{_libdir}/pkgconfig/python-%{LDVERSION_optimized}.pc
 %{_libdir}/pkgconfig/python-%{LDVERSION_optimized}-embed.pc
@ -1652,8 +1466,6 @@ fi
 %{_bindir}/idle*
 %else
 %{_bindir}/idle%{pybasever}
 # Alternatives
 %ghost %{_bindir}/idle3
 %endif
 %{pylibdir}/idlelib
@ -1839,22 +1651,59 @@ fi
 # ======================================================
 %changelog
 * Mon Feb 10 2025 Charalampos Stratakis <cstratak@redhat.com> - 3.11.11-2
 - Security fix for CVE-2025-0938
 Resolves: RHEL-77262
 * Tue Dec 03 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.11-1
 - Update to 3.11.11
 Resolves: RHEL-64883
 * Mon Sep 09 2024 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.10-1
 - Update to 3.11.10
 Resolves: RHEL-57412
 * Fri Aug 23 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-7
 - Security fix for CVE-2024-8088
 Resolves: RHEL-55959
 * Thu Aug 15 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-6
 - Security fix for CVE-2024-6923
 Resolves: RHEL-53038
 * Thu Jul 25 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-5
 - Properly propagate the optimization flags to C extensions
 * Thu Jul 18 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-4
 - Build Python with -O3
 - https://fedoraproject.org/wiki/Changes/Python_built_with_gcc_O3
 * Thu Jul 18 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-3
 - Security fix for CVE-2024-4032
 Resolves: RHEL-44099
 * Tue Jun 11 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-2
 - Enable importing of hash-based .pyc files under FIPS mode
 Resolves: RHEL-40779
 * Mon Apr 22 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-1
 - Rebase to 3.11.9
 - Security fixes for CVE-2023-6597 and CVE-2024-0450
 - Fix expat tests for the latest expat security release
 Resolves: RHEL-33677, RHEL-33689
 * Mon Jan 22 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.7-1
 - Rebase to 3.11.7
-Resolves: RHEL-21915
+Resolves: RHEL-20233
 * Tue Jan 09 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.5-2
 - Security fix for CVE-2023-27043
-Resolves: RHEL-7842
+Resolves: RHEL-21325
 * Thu Sep 07 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.5-1
 - Rebase to 3.11.5
 - Security fixes for CVE-2023-40217 and CVE-2023-41105
-Resolves: RHEL-3047, RHEL-3267
+Resolves: RHEL-3045, RHEL-3269
 * Thu Aug 10 2023 Tomas Orsava <torsava@redhat.com> - 3.11.4-4
 - Add the import_all_modules_py3_11.py file for the python3.11-rpm-macros subpackage
 Resolves: rhbz#2207631
 * Wed Aug 09 2023 Petr Viktorin <pviktori@redhat.com> - 3.11.4-3
 - Fix symlink handling in the fix for CVE-2023-24329
@ -1880,10 +1729,7 @@ Resolves: rhbz#2173917
 * Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-3
 - Disable bootstrap
- Revert python3.11-rpm-macros requirement
+- Bump release to sync with RHEL8
 * Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-2
 - Fix macros requirements
 * Tue Dec 13 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-1
 - Initial package
`@ -1 +1 @@`
	`SOURCES/Python-3.11.7.tar.xz`	`SOURCES/Python-3.11.11.tar.xz`
`@ -1 +1 @@`
	`f2534d591121f3845388fbdd6a121b96dfe305a6 SOURCES/Python-3.11.7.tar.xz`	`acf539109b024d3c5f1fc63d6e7f08cd294ba56d SOURCES/Python-3.11.11.tar.xz`