16 changed files with 1127 additions and 912 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/Python-3.11.7.tar.xz
+SOURCES/Python-3.11.9.tar.xz
--- a/.python3.11.metadata
+++ b/.python3.11.metadata
@ -1 +1 @@
-f2534d591121f3845388fbdd6a121b96dfe305a6 SOURCES/Python-3.11.7.tar.xz
+926cd6a577b2e8dcbb17671b30eda04019328ada SOURCES/Python-3.11.9.tar.xz
--- a/SOURCES/00329-fips.patch
+++ b/SOURCES/00329-fips.patch
@ -1,4 +1,4 @@
-From ecc5137120f471c22ff6dcb1bd128561c31e023c Mon Sep 17 00:00:00 2001
+From 4345f8ea8a56a58ef8a48439c0e201702d1012a2 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Thu, 12 Dec 2019 16:58:31 +0100
 Subject: [PATCH 1/7] Expose blake2b and blake2s hashes from OpenSSL
@ -205,10 +205,10 @@ index 5d84f4a..011026a 100644
 -/*[clinic end generated code: output=69f2374071bff707 input=a9049054013a1b77]*/
 +/*[clinic end generated code: output=c6a9af5563972eda input=a9049054013a1b77]*/
 -- 
-2.43.0
+2.45.0
-From 0198d467525e79cb4be4418708719af3eaee7a40 Mon Sep 17 00:00:00 2001
+From 1f79be1a11ad6811913c239da980c5bab0f1c538 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 1 Aug 2019 17:57:05 +0200
 Subject: [PATCH 2/7] Use a stronger hash in multiprocessing handshake
@ -220,7 +220,7 @@ https://bugs.python.org/issue17258
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py
-index 8b81f99..69c0b7e 100644
+index 59c61d2..7fc594e 100644
 --- a/Lib/multiprocessing/connection.py
 +++ b/Lib/multiprocessing/connection.py
@@ -43,6 +43,10 @@ BUFSIZE = 8192
@ -234,7 +234,7 @@ index 8b81f99..69c0b7e 100644
 _mmap_counter = itertools.count()
 default_family = 'AF_INET'
-@@ -752,7 +756,7 @@ def deliver_challenge(connection, authkey):
+@@ -753,7 +757,7 @@ def deliver_challenge(connection, authkey):
             "Authkey must be bytes, not {0!s}".format(type(authkey)))
     message = os.urandom(MESSAGE_LENGTH)
     connection.send_bytes(CHALLENGE + message)
@ -243,7 +243,7 @@ index 8b81f99..69c0b7e 100644
     response = connection.recv_bytes(256)        # reject large message
     if response == digest:
         connection.send_bytes(WELCOME)
-@@ -768,7 +772,7 @@ def answer_challenge(connection, authkey):
+@@ -769,7 +773,7 @@ def answer_challenge(connection, authkey):
     message = connection.recv_bytes(256)         # reject large message
     assert message[:len(CHALLENGE)] == CHALLENGE, 'message = %r' % message
     message = message[len(CHALLENGE):]
@ -253,10 +253,10 @@ index 8b81f99..69c0b7e 100644
     response = connection.recv_bytes(256)        # reject large message
     if response != WELCOME:
 -- 
-2.43.0
+2.45.0
-From a7822e2e1f21529e9730885bd8c9c6ab7c704d5b Mon Sep 17 00:00:00 2001
+From e069ed2dcd0edf0de489eb387267fb35a92ed506 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 25 Jul 2019 17:19:06 +0200
 Subject: [PATCH 3/7] Disable Python's hash implementations in FIPS mode,
@ -446,10 +446,10 @@ index 56ae7a5..45fb403 100644
 +    if (_Py_hashlib_fips_error(exc, name)) return NULL; \
 +} while (0)
 diff --git a/configure.ac b/configure.ac
-index 52d5c1f..56aff78 100644
+index 7b4000f..8e2f0ad 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -7069,7 +7069,8 @@ PY_STDLIB_MOD([_sha512], [test "$with_builtin_sha512" = yes])
+@@ -7070,7 +7070,8 @@ PY_STDLIB_MOD([_sha512], [test "$with_builtin_sha512" = yes])
 PY_STDLIB_MOD([_sha3], [test "$with_builtin_sha3" = yes])
 PY_STDLIB_MOD([_blake2],
   [test "$with_builtin_blake2" = yes], [],
@ -460,10 +460,10 @@ index 52d5c1f..56aff78 100644
 PY_STDLIB_MOD([_crypt],
   [], [test "$ac_cv_crypt_crypt" = yes],
 -- 
-2.43.0
+2.45.0
-From e9ce6d33544559172dbebbe0c0dfba2757c62331 Mon Sep 17 00:00:00 2001
+From 2e0c5086f4a52803595e19795111278c3c80ee2f Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Fri, 29 Jan 2021 14:16:21 +0100
 Subject: [PATCH 4/7] Use python's fall back crypto implementations only if we
@ -623,10 +623,10 @@ index 01d12f5..a7cdb07 100644
     def test_pbkdf2_hmac_py(self):
         with warnings_helper.check_warnings():
 -- 
-2.43.0
+2.45.0
-From 641c617775b6973ed84711a2602ba190fe064474 Mon Sep 17 00:00:00 2001
+From 0e1d2a67ef66cccc9afa4a515dc34ce587946f22 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Wed, 31 Jul 2019 15:43:43 +0200
 Subject: [PATCH 5/7] Test equivalence of hashes for the various digests with
@ -783,21 +783,21 @@ index a7cdb07..c071f28 100644
 class KDFTests(unittest.TestCase):
 -- 
-2.43.0
+2.45.0
-From a706c8342f0f9307d44c43c203702e1476fe73b4 Mon Sep 17 00:00:00 2001
+From f1c9ecbb2e2f08d792fb0557058824eed23abb7b Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 26 Aug 2019 19:39:48 +0200
 Subject: [PATCH 6/7] Guard against Python HMAC in FIPS mode
 ---
- Lib/hmac.py           | 13 +++++++++----
+ Lib/hmac.py           | 12 +++++++++---
 Lib/test/test_hmac.py | 10 ++++++++++
- 2 files changed, 19 insertions(+), 4 deletions(-)
+ 2 files changed, 19 insertions(+), 3 deletions(-)
 diff --git a/Lib/hmac.py b/Lib/hmac.py
-index 8b4f920..20ef96c 100644
+index 8b4eb2f..8930bda 100644
 --- a/Lib/hmac.py
 +++ b/Lib/hmac.py
@@ -16,8 +16,9 @@ else:
@ -812,16 +812,9 @@ index 8b4f920..20ef96c 100644
 # The size of the digests returned by HMAC depends on the underlying
 # hashing module used.  Use digest_size from the instance of HMAC instead.
-@@ -48,17 +49,18 @@ class HMAC:
+@@ -55,10 +56,12 @@ class HMAC:
                    msg argument.  Passing it as a keyword argument is
                    recommended, though not required for legacy API reasons.
         """
 -
         if not isinstance(key, (bytes, bytearray)):
             raise TypeError("key: expected bytes or bytearray, but got %r" % type(key).__name__)
         if not digestmod:
-             raise TypeError("Missing required parameter 'digestmod'.")
+             raise TypeError("Missing required argument 'digestmod'.")
 -        if _hashopenssl and isinstance(digestmod, (str, _functype)):
 +        if _hashopenssl.get_fips_mode() or (_hashopenssl and isinstance(digestmod, (str, _functype))):
@ -833,7 +826,7 @@ index 8b4f920..20ef96c 100644
                 self._init_old(key, msg, digestmod)
         else:
             self._init_old(key, msg, digestmod)
-@@ -69,6 +71,9 @@ class HMAC:
+@@ -69,6 +72,9 @@ class HMAC:
         self.block_size = self._hmac.block_size
     def _init_old(self, key, msg, digestmod):
@ -844,7 +837,7 @@ index 8b4f920..20ef96c 100644
             digest_cons = digestmod
         elif isinstance(digestmod, str):
 diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
-index a39a2c4..0742a1c 100644
+index 1502fba..e40ca4b 100644
 --- a/Lib/test/test_hmac.py
 +++ b/Lib/test/test_hmac.py
@@ -5,6 +5,7 @@ import hashlib
@ -883,7 +876,7 @@ index a39a2c4..0742a1c 100644
     @unittest.skipUnless(sha256_module is not None, 'need _sha256')
     def test_with_sha256_module(self):
         h = hmac.HMAC(b"key", b"hash this!", digestmod=sha256_module.sha256)
-@@ -481,6 +489,7 @@ class SanityTestCase(unittest.TestCase):
+@@ -489,6 +497,7 @@ class UpdateTestCase(unittest.TestCase):
 class CopyTestCase(unittest.TestCase):
@ -891,7 +884,7 @@ index a39a2c4..0742a1c 100644
     @hashlib_helper.requires_hashdigest('sha256')
     def test_attributes_old(self):
         # Testing if attributes are of same type.
-@@ -492,6 +501,7 @@ class CopyTestCase(unittest.TestCase):
+@@ -500,6 +509,7 @@ class CopyTestCase(unittest.TestCase):
         self.assertEqual(type(h1._outer), type(h2._outer),
             "Types of outer don't match.")
@ -900,290 +893,43 @@ index a39a2c4..0742a1c 100644
     def test_realcopy_old(self):
         # Testing if the copy method created a real copy.
 -- 
-2.43.0
+2.45.0
-From 03f1dedfe5d29af20fb3686d76b045384d41d8dd Mon Sep 17 00:00:00 2001
+From a0c3f9ac5a4e60ab22418a3196ae46ba34e9477b Mon Sep 17 00:00:00 2001
-From: Petr Viktorin <encukou@gmail.com>
+From: Nikita Sobolev <mail@sobolevn.me>
-Date: Wed, 25 Aug 2021 16:44:43 +0200
+Date: Thu, 24 Nov 2022 01:47:31 +0300
-Subject: [PATCH 7/7] Disable hash-based PYCs in FIPS mode
+Subject: [PATCH 7/7] closes gh-99508: fix `TypeError` in
 `Lib/importlib/_bootstrap_external.py` (GH-99635)
 If FIPS mode is on, we can't use siphash-based HMAC
 (_Py_KeyedHash), so:
 - Unchecked hash PYCs can be imported, but not created
 - Checked hash PYCs can not be imported nor created
 - The default mode is timestamp-based PYCs, even if
  SOURCE_DATE_EPOCH is set.
 If FIPS mode is off, there are no changes in behavior.
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1835169
 ---
- Lib/py_compile.py                             |  2 ++
+ Lib/importlib/_bootstrap_external.py                           | 3 ++-
- Lib/test/support/__init__.py                  | 14 +++++++++++++
+ .../next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst | 2 ++
- Lib/test/test_cmd_line_script.py              |  2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
- Lib/test/test_compileall.py                   | 11 +++++++++-
+ create mode 100644 Misc/NEWS.d/next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst
 Lib/test/test_imp.py                          |  2 ++
 .../test_importlib/source/test_file_loader.py |  6 ++++++
 Lib/test/test_py_compile.py                   | 11 ++++++++--
 Lib/test/test_zipimport.py                    |  2 ++
 Python/import.c                               | 20 +++++++++++++++++++
 9 files changed, 67 insertions(+), 3 deletions(-)
-diff --git a/Lib/py_compile.py b/Lib/py_compile.py
+diff --git a/Lib/importlib/_bootstrap_external.py b/Lib/importlib/_bootstrap_external.py
-index db52725..5fca65e 100644
+index e53f6ac..bdc491e 100644
--- a/Lib/py_compile.py
+--- a/Lib/importlib/_bootstrap_external.py
-+++ b/Lib/py_compile.py
+++ b/Lib/importlib/_bootstrap_external.py
-@@ -70,7 +70,9 @@ class PycInvalidationMode(enum.Enum):
+@@ -1077,7 +1077,8 @@ class SourceLoader(_LoaderBasics):
- 
+                 source_mtime is not None):
- 
+             if hash_based:
- def _get_default_invalidation_mode():
+                 if source_hash is None:
-+    import _hashlib
+-                    source_hash = _imp.source_hash(source_bytes)
-     if (os.environ.get('SOURCE_DATE_EPOCH') and not
+                    source_hash = _imp.source_hash(_RAW_MAGIC_NUMBER,
-+            _hashlib.get_fips_mode() and not
+                                                   source_bytes)
-             os.environ.get('RPM_BUILD_ROOT')):
+                 data = _code_to_hash_pyc(code_object, source_hash, check_source)
-         return PycInvalidationMode.CHECKED_HASH
+             else:
-     else:
+                 data = _code_to_timestamp_pyc(code_object, source_mtime,
-diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
+diff --git a/Misc/NEWS.d/next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst b/Misc/NEWS.d/next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst
-index dc7a6e6..646b328 100644
+new file mode 100644
--- a/Lib/test/support/__init__.py
+index 0000000..82720d1
-+++ b/Lib/test/support/__init__.py
+--- /dev/null
-@@ -2203,6 +2203,20 @@ def sleeping_retry(timeout, err_msg=None, /,
+++ b/Misc/NEWS.d/next/Library/2022-11-21-10-45-54.gh-issue-99508.QqVbby.rst
-         delay = min(delay * 2, max_delay)
+@@ -0,0 +1,2 @@
- 
+Fix ``TypeError`` in ``Lib/importlib/_bootstrap_external.py`` while calling
- 
+``_imp.source_hash()``.
 +def fails_in_fips_mode(expected_error):
 +    import _hashlib
 +    if _hashlib.get_fips_mode():
 +        def _decorator(func):
 +            def _wrapper(self, *args, **kwargs):
 +                with self.assertRaises(expected_error):
 +                    func(self, *args, **kwargs)
 +            return _wrapper
 +    else:
 +        def _decorator(func):
 +            return func
 +    return _decorator
 +
 +
 @contextlib.contextmanager
 def adjust_int_max_str_digits(max_digits):
     """Temporarily change the integer string conversion length limit."""
 diff --git a/Lib/test/test_cmd_line_script.py b/Lib/test/test_cmd_line_script.py
 index 7fcd563..476b557 100644
 --- a/Lib/test/test_cmd_line_script.py
 +++ b/Lib/test/test_cmd_line_script.py
@@ -286,6 +286,7 @@ class CmdLineTest(unittest.TestCase):
             self._check_script(zip_name, run_name, zip_name, zip_name, '',
                                zipimport.zipimporter)
 +    @support.fails_in_fips_mode(ImportError)
     def test_zipfile_compiled_checked_hash(self):
         with os_helper.temp_dir() as script_dir:
             script_name = _make_test_script(script_dir, '__main__')
@@ -296,6 +297,7 @@ class CmdLineTest(unittest.TestCase):
             self._check_script(zip_name, run_name, zip_name, zip_name, '',
                                zipimport.zipimporter)
 +    @support.fails_in_fips_mode(ImportError)
     def test_zipfile_compiled_unchecked_hash(self):
         with os_helper.temp_dir() as script_dir:
             script_name = _make_test_script(script_dir, '__main__')
 diff --git a/Lib/test/test_compileall.py b/Lib/test/test_compileall.py
 index 9cd92ad..4ec29a1 100644
 --- a/Lib/test/test_compileall.py
 +++ b/Lib/test/test_compileall.py
@@ -806,14 +806,23 @@ class CommandLineTestsBase:
         out = self.assertRunOK('badfilename')
         self.assertRegex(out, b"Can't list 'badfilename'")
 -    def test_pyc_invalidation_mode(self):
 +    @support.fails_in_fips_mode(AssertionError)
 +    def test_pyc_invalidation_mode_checked(self):
         script_helper.make_script(self.pkgdir, 'f1', '')
         pyc = importlib.util.cache_from_source(
             os.path.join(self.pkgdir, 'f1.py'))
 +
         self.assertRunOK('--invalidation-mode=checked-hash', self.pkgdir)
         with open(pyc, 'rb') as fp:
             data = fp.read()
         self.assertEqual(int.from_bytes(data[4:8], 'little'), 0b11)
 +
 +    @support.fails_in_fips_mode(AssertionError)
 +    def test_pyc_invalidation_mode_unchecked(self):
 +        script_helper.make_script(self.pkgdir, 'f1', '')
 +        pyc = importlib.util.cache_from_source(
 +            os.path.join(self.pkgdir, 'f1.py'))
 +
         self.assertRunOK('--invalidation-mode=unchecked-hash', self.pkgdir)
         with open(pyc, 'rb') as fp:
             data = fp.read()
 diff --git a/Lib/test/test_imp.py b/Lib/test/test_imp.py
 index 4062afd..6bc276d 100644
 --- a/Lib/test/test_imp.py
 +++ b/Lib/test/test_imp.py
@@ -352,6 +352,7 @@ class ImportTests(unittest.TestCase):
         import _frozen_importlib
         self.assertEqual(_frozen_importlib.__spec__.origin, "frozen")
 +    @support.fails_in_fips_mode(ImportError)
     def test_source_hash(self):
         self.assertEqual(_imp.source_hash(42, b'hi'), b'\xfb\xd9G\x05\xaf$\x9b~')
         self.assertEqual(_imp.source_hash(43, b'hi'), b'\xd0/\x87C\xccC\xff\xe2')
@@ -371,6 +372,7 @@ class ImportTests(unittest.TestCase):
             res = script_helper.assert_python_ok(*args)
             self.assertEqual(res.out.strip().decode('utf-8'), expected)
 +    @support.fails_in_fips_mode(ImportError)
     def test_find_and_load_checked_pyc(self):
         # issue 34056
         with os_helper.temp_cwd():
 diff --git a/Lib/test/test_importlib/source/test_file_loader.py b/Lib/test/test_importlib/source/test_file_loader.py
 index 378dcbe..7b223a1 100644
 --- a/Lib/test/test_importlib/source/test_file_loader.py
 +++ b/Lib/test/test_importlib/source/test_file_loader.py
@@ -16,6 +16,7 @@ import types
 import unittest
 import warnings
 +from test import support
 from test.support.import_helper import make_legacy_pyc, unload
 from test.test_py_compile import without_source_date_epoch
@@ -238,6 +239,7 @@ class SimpleTest(abc.LoaderTests):
                 loader.load_module('bad name')
     @util.writes_bytecode_files
 +    @support.fails_in_fips_mode(ImportError)
     def test_checked_hash_based_pyc(self):
         with util.create_modules('_temp') as mapping:
             source = mapping['_temp']
@@ -269,6 +271,7 @@ class SimpleTest(abc.LoaderTests):
             )
     @util.writes_bytecode_files
 +    @support.fails_in_fips_mode(ImportError)
     def test_overridden_checked_hash_based_pyc(self):
         with util.create_modules('_temp') as mapping, \
              unittest.mock.patch('_imp.check_hash_based_pycs', 'never'):
@@ -294,6 +297,7 @@ class SimpleTest(abc.LoaderTests):
             self.assertEqual(mod.state, 'old')
     @util.writes_bytecode_files
 +    @support.fails_in_fips_mode(ImportError)
     def test_unchecked_hash_based_pyc(self):
         with util.create_modules('_temp') as mapping:
             source = mapping['_temp']
@@ -324,6 +328,7 @@ class SimpleTest(abc.LoaderTests):
             )
     @util.writes_bytecode_files
 +    @support.fails_in_fips_mode(ImportError)
     def test_overridden_unchecked_hash_based_pyc(self):
         with util.create_modules('_temp') as mapping, \
              unittest.mock.patch('_imp.check_hash_based_pycs', 'always'):
@@ -433,6 +438,7 @@ class BadBytecodeTest:
                                                del_source=del_source)
             test('_temp', mapping, bc_path)
 +    @support.fails_in_fips_mode(ImportError)
     def _test_partial_hash(self, test, *, del_source=False):
         with util.create_modules('_temp') as mapping:
             bc_path = self.manipulate_bytecode(
 diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
 index 9b420d2..dd6460a 100644
 --- a/Lib/test/test_py_compile.py
 +++ b/Lib/test/test_py_compile.py
@@ -143,13 +143,16 @@ class PyCompileTestsBase:
             importlib.util.cache_from_source(bad_coding)))
     def test_source_date_epoch(self):
 +        import _hashlib
         py_compile.compile(self.source_path, self.pyc_path)
         self.assertTrue(os.path.exists(self.pyc_path))
         self.assertFalse(os.path.exists(self.cache_path))
         with open(self.pyc_path, 'rb') as fp:
             flags = importlib._bootstrap_external._classify_pyc(
                 fp.read(), 'test', {})
 -        if os.environ.get('SOURCE_DATE_EPOCH'):
 +        if _hashlib.get_fips_mode():
 +            expected_flags = 0b00
 +        elif os.environ.get('SOURCE_DATE_EPOCH'):
             expected_flags = 0b11
         else:
             expected_flags = 0b00
@@ -180,7 +183,8 @@ class PyCompileTestsBase:
         # Specifying optimized bytecode should lead to a path reflecting that.
         self.assertIn('opt-2', py_compile.compile(self.source_path, optimize=2))
 -    def test_invalidation_mode(self):
 +    @support.fails_in_fips_mode(ImportError)
 +    def test_invalidation_mode_checked(self):
         py_compile.compile(
             self.source_path,
             invalidation_mode=py_compile.PycInvalidationMode.CHECKED_HASH,
@@ -189,6 +193,9 @@ class PyCompileTestsBase:
             flags = importlib._bootstrap_external._classify_pyc(
                 fp.read(), 'test', {})
         self.assertEqual(flags, 0b11)
 +
 +    @support.fails_in_fips_mode(ImportError)
 +    def test_invalidation_mode_unchecked(self):
         py_compile.compile(
             self.source_path,
             invalidation_mode=py_compile.PycInvalidationMode.UNCHECKED_HASH,
 diff --git a/Lib/test/test_zipimport.py b/Lib/test/test_zipimport.py
 index 59a5200..81fadb3 100644
 --- a/Lib/test/test_zipimport.py
 +++ b/Lib/test/test_zipimport.py
@@ -190,6 +190,7 @@ class UncompressedZipImportTestCase(ImportHooksBaseTestCase):
                  TESTMOD + pyc_ext: (NOW, test_pyc)}
         self.doTest(pyc_ext, files, TESTMOD)
 +    @support.fails_in_fips_mode(ImportError)
     def testUncheckedHashBasedPyc(self):
         source = b"state = 'old'"
         source_hash = importlib.util.source_hash(source)
@@ -204,6 +205,7 @@ class UncompressedZipImportTestCase(ImportHooksBaseTestCase):
             self.assertEqual(mod.state, 'old')
         self.doTest(None, files, TESTMOD, call=check)
 +    @support.fails_in_fips_mode(ImportError)
     @unittest.mock.patch('_imp.check_hash_based_pycs', 'always')
     def test_checked_hash_based_change_pyc(self):
         source = b"state = 'old'"
 diff --git a/Python/import.c b/Python/import.c
 index 39144d3..b439059 100644
 --- a/Python/import.c
 +++ b/Python/import.c
@@ -2449,6 +2449,26 @@ static PyObject *
 _imp_source_hash_impl(PyObject *module, long key, Py_buffer *source)
 /*[clinic end generated code: output=edb292448cf399ea input=9aaad1e590089789]*/
 {
 +    PyObject *_hashlib = PyImport_ImportModule("_hashlib");
 +    if (_hashlib == NULL) {
 +        return NULL;
 +    }
 +    PyObject *fips_mode_obj = PyObject_CallMethod(_hashlib, "get_fips_mode", NULL);
 +    Py_DECREF(_hashlib);
 +    if (fips_mode_obj == NULL) {
 +        return NULL;
 +    }
 +    int fips_mode = PyObject_IsTrue(fips_mode_obj);
 +    Py_DECREF(fips_mode_obj);
 +    if (fips_mode < 0) {
 +        return NULL;
 +    }
 +    if (fips_mode) {
 +        PyErr_SetString(
 +            PyExc_ImportError,
 +            "hash-based PYC validation (siphash24) not available in FIPS mode");
 +        return NULL;
 +    };
     union {
         uint64_t x;
         char data[sizeof(uint64_t)];
 -- 
-2.43.0
+2.45.0
--- a/SOURCES/00378-support-expat-2-4-5.patch
+++ b/SOURCES/00378-support-expat-2-4-5.patch
@ -1,47 +0,0 @@
 From db083095e3bdb93e4f8170d814664c482b1e94da Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Tue, 14 Jun 2022 06:38:43 +0200
 Subject: [PATCH] Fix test suite for Expat >= 2.4.5
 ---
 Lib/test/test_minidom.py | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)
 diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py
 index 9762025..5f52ed1 100644
 --- a/Lib/test/test_minidom.py
 +++ b/Lib/test/test_minidom.py
@@ -1149,14 +1149,10 @@ class MinidomTest(unittest.TestCase):
         # Verify that character decoding errors raise exceptions instead
         # of crashing
 -        if pyexpat.version_info >= (2, 4, 5):
 -            self.assertRaises(ExpatError, parseString,
 -                    b'<fran\xe7ais></fran\xe7ais>')
 -            self.assertRaises(ExpatError, parseString,
 -                    b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
 -        else:
 -            self.assertRaises(UnicodeDecodeError, parseString,
 -                b'<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
 +        self.assertRaises(ExpatError, parseString,
 +                b'<fran\xe7ais></fran\xe7ais>')
 +        self.assertRaises(ExpatError, parseString,
 +                b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
         doc.unlink()
@@ -1617,10 +1613,7 @@ class MinidomTest(unittest.TestCase):
         self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE)
     def testExceptionOnSpacesInXMLNSValue(self):
 -        if pyexpat.version_info >= (2, 4, 5):
 -            context = self.assertRaisesRegex(ExpatError, 'syntax error')
 -        else:
 -            context = self.assertRaisesRegex(ValueError, 'Unsupported syntax')
 +        context = self.assertRaisesRegex(ExpatError, 'syntax error')
         with context:
             parseString('<element xmlns:abc="http:abc.com/de f g/hi/j k"><abc:foo /></element>')
 -- 
 2.35.3
--- a/SOURCES/00397-tarfile-filter.patch
+++ b/SOURCES/00397-tarfile-filter.patch
@ -1,4 +1,4 @@
-From 8b70605b594b3831331a9340ba764ff751871612 Mon Sep 17 00:00:00 2001
+From 0181d677dd7fd11bc19a211b3eb735ac3ad3d7fb Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <encukou@gmail.com>
 Date: Mon, 6 Mar 2023 17:24:24 +0100
 Subject: [PATCH] CVE-2007-4559, PEP-706: Add filters for tarfile extraction
@ -9,11 +9,11 @@ variable and config file.
 ---
 Lib/tarfile.py           |  42 +++++++++++++
 Lib/test/test_shutil.py  |   3 +-
- Lib/test/test_tarfile.py | 128 ++++++++++++++++++++++++++++++++++++++-
+ Lib/test/test_tarfile.py | 127 ++++++++++++++++++++++++++++++++++++++-
- 3 files changed, 169 insertions(+), 4 deletions(-)
+ 3 files changed, 168 insertions(+), 4 deletions(-)
 diff --git a/Lib/tarfile.py b/Lib/tarfile.py
-index 130b5e0..3b7d8d5 100755
+index 612217b..dc59fc6 100755
 --- a/Lib/tarfile.py
 +++ b/Lib/tarfile.py
@@ -72,6 +72,13 @@ __all__ = ["TarFile", "TarInfo", "is_tarfile", "TarError", "ReadError",
@ -30,7 +30,7 @@ index 130b5e0..3b7d8d5 100755
 #---------------------------------------------------------
 # tar constants
-@@ -2211,6 +2218,41 @@ class TarFile(object):
+@@ -2219,6 +2226,41 @@ class TarFile(object):
         if filter is None:
             filter = self.extraction_filter
             if filter is None:
@ -73,10 +73,10 @@ index 130b5e0..3b7d8d5 100755
             if isinstance(filter, str):
                 raise TypeError(
 diff --git a/Lib/test/test_shutil.py b/Lib/test/test_shutil.py
-index 9bf4145..f247b82 100644
+index 6728d30..2338b63 100644
 --- a/Lib/test/test_shutil.py
 +++ b/Lib/test/test_shutil.py
-@@ -1665,7 +1665,8 @@ class TestArchives(BaseTest, unittest.TestCase):
+@@ -1774,7 +1774,8 @@ class TestArchives(BaseTest, unittest.TestCase):
     def check_unpack_tarball(self, format):
         self.check_unpack_archive(format, filter='fully_trusted')
         self.check_unpack_archive(format, filter='data')
@ -87,10 +87,10 @@ index 9bf4145..f247b82 100644
     def test_unpack_archive_tar(self):
 diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
-index cdea033..4724285 100644
+index 389da7b..5a43f9d 100644
 --- a/Lib/test/test_tarfile.py
 +++ b/Lib/test/test_tarfile.py
-@@ -2,7 +2,7 @@ import sys
+@@ -3,7 +3,7 @@ import sys
 import os
 import io
 from hashlib import sha256
@ -99,7 +99,7 @@ index cdea033..4724285 100644
 from random import Random
 import pathlib
 import shutil
-@@ -2999,7 +2999,11 @@ class NoneInfoExtractTests(ReadTest):
+@@ -3049,7 +3049,11 @@ class NoneInfoExtractTests(ReadTest):
         tar = tarfile.open(tarname, mode='r', encoding="iso8859-1")
         cls.control_dir = pathlib.Path(TEMPDIR) / "extractall_ctrl"
         tar.errorlevel = 0
@ -112,7 +112,7 @@ index cdea033..4724285 100644
         tar.close()
         cls.control_paths = set(
             p.relative_to(cls.control_dir)
-@@ -3674,7 +3678,8 @@ class TestExtractionFilters(unittest.TestCase):
+@@ -3868,7 +3872,8 @@ class TestExtractionFilters(unittest.TestCase):
         """Ensure the default filter does not warn (like in 3.12)"""
         with ArchiveMaker() as arc:
             arc.add('foo')
@ -122,10 +122,10 @@ index cdea033..4724285 100644
             with self.check_context(arc.open(), None):
                 self.expect_file('foo')
-@@ -3844,6 +3849,123 @@ class TestExtractionFilters(unittest.TestCase):
+@@ -4037,6 +4042,122 @@ class TestExtractionFilters(unittest.TestCase):
         with self.check_context(arc.open(errorlevel='boo!'), filtererror_filter):
             self.expect_exception(TypeError)  # errorlevel is not int
 +    @contextmanager
 +    def rh_config_context(self, config_lines=None):
 +        """Set up for testing various ways of overriding the default filter
@ -242,10 +242,9 @@ index cdea033..4724285 100644
 +            ):
 +                self.check_trusted_default(tar, tempdir)
 +
-+
+ 
- def setUpModule():
+ class OverwriteTests(archiver_tests.OverwriteTests, unittest.TestCase):
-     os_helper.unlink(TEMPDIR)
+     testdir = os.path.join(TEMPDIR, "testoverwrite")
     os.makedirs(TEMPDIR)
 -- 
-2.41.0
+2.44.0
--- a/SOURCES/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
+++ b/SOURCES/00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
@ -1,4 +1,4 @@
-From d8b0fafb202bf884135a3f7f0ce0b086217a2da2 Mon Sep 17 00:00:00 2001
+From 642f28679e04c7b4ec7731f0c8872103f21a76f8 Mon Sep 17 00:00:00 2001
 From: Victor Stinner <vstinner@python.org>
 Date: Fri, 15 Dec 2023 16:10:40 +0100
 Subject: [PATCH 1/2] 00415: [CVE-2023-27043] gh-102988: Reject malformed
@ -12,10 +12,10 @@ Thomas Dwyer.
 Co-Authored-By: Thomas Dwyer <github@tomd.tel>
 ---
 Doc/library/email.utils.rst                   |  19 +-
- Lib/email/utils.py                            | 151 ++++++++++++-
+ Lib/email/utils.py                            | 150 ++++++++++++-
 Lib/test/test_email/test_email.py             | 204 +++++++++++++++++-
 ...-10-20-15-28-08.gh-issue-102988.dStNO7.rst |   8 +
- 4 files changed, 361 insertions(+), 21 deletions(-)
+ 4 files changed, 360 insertions(+), 21 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2023-10-20-15-28-08.gh-issue-102988.dStNO7.rst
 diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
@ -72,18 +72,10 @@ index 0e266b6..6723dc4 100644
 .. function:: parsedate(date)
 diff --git a/Lib/email/utils.py b/Lib/email/utils.py
-index cfdfeb3..9522341 100644
+index 8993858..41bb3c9 100644
 --- a/Lib/email/utils.py
 +++ b/Lib/email/utils.py
-@@ -48,6 +48,7 @@ TICK = "'"
+@@ -106,12 +106,127 @@ def formataddr(pair, charset='utf-8'):
 specialsre = re.compile(r'[][\\()<>@,:;".]')
 escapesre = re.compile(r'[\\"]')
 +
 def _has_surrogates(s):
     """Return True if s contains surrogate-escaped binary data."""
     # This check is based on the fact that unless there are surrogates, utf8
@@ -106,12 +107,127 @@ def formataddr(pair, charset='utf-8'):
     return address
@ -125,12 +117,7 @@ index cfdfeb3..9522341 100644
 +        result.append(addr[start:])
 +
 +    return ''.join(result)
- 
+
 -def getaddresses(fieldvalues):
 -    """Return a list of (REALNAME, EMAIL) for each fieldvalue."""
 -    all = COMMASPACE.join(str(v) for v in fieldvalues)
 -    a = _AddressList(all)
 -    return a.addresslist
 +
 +supports_strict_parsing = True
 +
@ -139,7 +126,12 @@ index cfdfeb3..9522341 100644
 +
 +    When parsing fails for a fieldvalue, a 2-tuple of ('', '') is returned in
 +    its place.
-+
+ 
 -def getaddresses(fieldvalues):
 -    """Return a list of (REALNAME, EMAIL) for each fieldvalue."""
 -    all = COMMASPACE.join(str(v) for v in fieldvalues)
 -    a = _AddressList(all)
 -    return a.addresslist
 +    If strict is true, use a strict parser which rejects malformed inputs.
 +    """
 +
@ -216,7 +208,7 @@ index cfdfeb3..9522341 100644
 def _format_timetuple_and_zone(timetuple, zone):
-@@ -205,16 +321,33 @@ def parsedate_to_datetime(data):
+@@ -205,16 +320,33 @@ def parsedate_to_datetime(data):
             tzinfo=datetime.timezone(datetime.timedelta(seconds=tz)))
@ -255,7 +247,7 @@ index cfdfeb3..9522341 100644
 diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
-index 677f209..20b6779 100644
+index 785696e..ad60ed3 100644
 --- a/Lib/test/test_email/test_email.py
 +++ b/Lib/test/test_email/test_email.py
@@ -17,6 +17,7 @@ from unittest.mock import patch
@ -266,7 +258,7 @@ index 677f209..20b6779 100644
 from email.charset import Charset
 from email.generator import Generator, DecodedGenerator, BytesGenerator
-@@ -3321,15 +3322,154 @@ Foo
+@@ -3336,15 +3337,154 @@ Foo
            [('Al Person', 'aperson@dom.ain'),
             ('Bud Person', 'bperson@dom.ain')])
@ -429,7 +421,7 @@ index 677f209..20b6779 100644
     def test_getaddresses_embedded_comment(self):
         """Test proper handling of a nested comment"""
-@@ -3520,6 +3660,54 @@ multipart/report
+@@ -3535,6 +3675,54 @@ multipart/report
                 m = cls(*constructor, policy=email.policy.default)
                 self.assertIs(m.policy, email.policy.default)
@ -499,10 +491,10 @@ index 0000000..3d0e9e4
 +if the *strict* paramater is available. Patch by Thomas Dwyer and Victor
 +Stinner to improve the CVE-2023-27043 fix.
 -- 
-2.43.0
+2.44.0
-From 6c34f5b95da90bd494e29776c0e807af44689fae Mon Sep 17 00:00:00 2001
+From d371679e7c485551c10380ac11e5039a9fb4515b Mon Sep 17 00:00:00 2001
 From: Lumir Balhar <lbalhar@redhat.com>
 Date: Wed, 10 Jan 2024 08:53:53 +0100
 Subject: [PATCH 2/2] Make it possible to disable strict parsing in email
@ -510,9 +502,9 @@ Subject: [PATCH 2/2] Make it possible to disable strict parsing in email
 ---
 Doc/library/email.utils.rst       | 26 +++++++++++
- Lib/email/utils.py                | 54 +++++++++++++++++++++-
+ Lib/email/utils.py                | 55 ++++++++++++++++++++++-
 Lib/test/test_email/test_email.py | 74 ++++++++++++++++++++++++++++++-
- 3 files changed, 150 insertions(+), 4 deletions(-)
+ 3 files changed, 151 insertions(+), 4 deletions(-)
 diff --git a/Doc/library/email.utils.rst b/Doc/library/email.utils.rst
 index 6723dc4..c89602d 100644
@ -559,10 +551,10 @@ index 6723dc4..c89602d 100644
       from email.utils import getaddresses
 diff --git a/Lib/email/utils.py b/Lib/email/utils.py
-index 9522341..2e30e09 100644
+index 41bb3c9..09a414c 100644
 --- a/Lib/email/utils.py
 +++ b/Lib/email/utils.py
-@@ -48,6 +48,46 @@ TICK = "'"
+@@ -48,6 +48,47 @@ TICK = "'"
 specialsre = re.compile(r'[][\\()<>@,:;".]')
 escapesre = re.compile(r'[\\"]')
@ -606,10 +598,11 @@ index 9522341..2e30e09 100644
 +
 +    return True
 +
- 
+
 def _has_surrogates(s):
-     """Return True if s contains surrogate-escaped binary data."""
+     """Return True if s may contain surrogate-escaped binary data."""
-@@ -149,7 +189,7 @@ def _strip_quoted_realnames(addr):
+     # This check is based on the fact that unless there are surrogates, utf8
@@ -148,7 +189,7 @@ def _strip_quoted_realnames(addr):
 supports_strict_parsing = True
@ -618,7 +611,7 @@ index 9522341..2e30e09 100644
     """Return a list of (REALNAME, EMAIL) or ('','') for each fieldvalue.
     When parsing fails for a fieldvalue, a 2-tuple of ('', '') is returned in
-@@ -158,6 +198,11 @@ def getaddresses(fieldvalues, *, strict=True):
+@@ -157,6 +198,11 @@ def getaddresses(fieldvalues, *, strict=True):
     If strict is true, use a strict parser which rejects malformed inputs.
     """
@ -630,7 +623,7 @@ index 9522341..2e30e09 100644
     # If strict is true, if the resulting list of parsed addresses is greater
     # than the number of fieldvalues in the input list, a parsing error has
     # occurred and consequently a list containing a single empty 2-tuple [('',
-@@ -321,7 +366,7 @@ def parsedate_to_datetime(data):
+@@ -320,7 +366,7 @@ def parsedate_to_datetime(data):
             tzinfo=datetime.timezone(datetime.timedelta(seconds=tz)))
@ -639,7 +632,7 @@ index 9522341..2e30e09 100644
     """
     Parse addr into its constituent realname and email address parts.
-@@ -330,6 +375,11 @@ def parseaddr(addr, *, strict=True):
+@@ -329,6 +375,11 @@ def parseaddr(addr, *, strict=True):
     If strict is True, use a strict parser which rejects malformed inputs.
     """
@ -652,7 +645,7 @@ index 9522341..2e30e09 100644
         addrs = _AddressList(addr).addresslist
         if not addrs:
 diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py
-index 20b6779..d7d99f0 100644
+index ad60ed3..f85da56 100644
 --- a/Lib/test/test_email/test_email.py
 +++ b/Lib/test/test_email/test_email.py
@@ -8,6 +8,9 @@ import base64
@ -676,7 +669,7 @@ index 20b6779..d7d99f0 100644
 from test.test_email import openfile, TestEmailBase
 # These imports are documented to work, but we are testing them using a
-@@ -3427,6 +3430,73 @@ Foo
+@@ -3442,6 +3445,73 @@ Foo
         # Test email.utils.supports_strict_parsing attribute
         self.assertEqual(email.utils.supports_strict_parsing, True)
@ -751,5 +744,5 @@ index 20b6779..d7d99f0 100644
         for addresses, expected in (
             (['"Sürname, Firstname" <to@example.com>'],
 -- 
-2.43.0
+2.44.0
--- a/SOURCES/00422-fix-expat-tests.patch
+++ b/SOURCES/00422-fix-expat-tests.patch
@ -0,0 +1,75 @@
 From 670984c96eea60488c5355b4cf535c1ee3cf081a Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Wed, 24 Apr 2024 04:24:16 +0200
 Subject: [PATCH] Fix xml tests
 ---
 Lib/test/test_pyexpat.py   | 3 +++
 Lib/test/test_sax.py       | 2 ++
 Lib/test/test_xml_etree.py | 6 ++++++
 3 files changed, 11 insertions(+)
 diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
 index 44bd1de..5976fa0 100644
 --- a/Lib/test/test_pyexpat.py
 +++ b/Lib/test/test_pyexpat.py
@@ -3,6 +3,7 @@
 import os
 import platform
 +import pyexpat
 import sys
 import sysconfig
 import unittest
@@ -793,6 +794,8 @@ class ReparseDeferralTest(unittest.TestCase):
         self.assertEqual(started, ['doc'])
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +                     "Reparse deferral not defined for libexpat < 2.6.0")
     def test_reparse_deferral_disabled(self):
         started = []
 diff --git a/Lib/test/test_sax.py b/Lib/test/test_sax.py
 index 9b3014a..5960de1 100644
 --- a/Lib/test/test_sax.py
 +++ b/Lib/test/test_sax.py
@@ -1240,6 +1240,8 @@ class ExpatReaderTest(XmlTestBase):
         self.assertEqual(result.getvalue(), start + b"<doc></doc>")
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +                     "Reparse deferral not defined for libexpat < 2.6.0")
     def test_flush_reparse_deferral_disabled(self):
         result = BytesIO()
         xmlgen = XMLGenerator(result)
 diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
 index 8becafb..5e9b6b5 100644
 --- a/Lib/test/test_xml_etree.py
 +++ b/Lib/test/test_xml_etree.py
@@ -1424,9 +1424,13 @@ class XMLPullParserTest(unittest.TestCase):
         self.assert_event_tags(parser, [('end', 'root')])
         self.assertIsNone(parser.close())
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +        "test not compatible with the latest expat security release")
     def test_simple_xml_chunk_1(self):
         self.test_simple_xml(chunk_size=1, flush=True)
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +        "test not compatible with the latest expat security release")
     def test_simple_xml_chunk_5(self):
         self.test_simple_xml(chunk_size=5, flush=True)
@@ -1651,6 +1655,8 @@ class XMLPullParserTest(unittest.TestCase):
         self.assert_event_tags(parser, [('end', 'doc')])
 +    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
 +                     "Reparse deferral not defined for libexpat < 2.6.0")
     def test_flush_reparse_deferral_disabled(self):
         parser = ET.XMLPullParser(events=('start', 'end'))
 -- 
 2.44.0
--- a/SOURCES/00431-CVE-2024-4032.patch
+++ b/SOURCES/00431-CVE-2024-4032.patch
@ -0,0 +1,346 @@
 From 2963bbab04546f5aef6a37a3b027ae7a484deec1 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <encukou@gmail.com>
 Date: Thu, 25 Apr 2024 14:45:48 +0200
 Subject: [PATCH] gh-113171: gh-65056: Fix "private" (non-global) IP address
 ranges (GH-113179) (GH-113186) (GH-118177) (#118227)
 ---
 Doc/library/ipaddress.rst                     | 43 +++++++-
 Doc/whatsnew/3.11.rst                         |  9 ++
 Lib/ipaddress.py                              | 99 +++++++++++++++----
 Lib/test/test_ipaddress.py                    | 21 +++-
 ...-03-14-01-38-44.gh-issue-113171.VFnObz.rst |  9 ++
 5 files changed, 157 insertions(+), 24 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst
 diff --git a/Doc/library/ipaddress.rst b/Doc/library/ipaddress.rst
 index 03dc956..f57fa15 100644
 --- a/Doc/library/ipaddress.rst
 +++ b/Doc/library/ipaddress.rst
@@ -178,18 +178,53 @@ write code that handles both IP versions correctly.  Address objects are
    .. attribute:: is_private
 -      ``True`` if the address is allocated for private networks.  See
 +      ``True`` if the address is defined as not globally reachable by
       iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
 -      (for IPv6).
 +      (for IPv6) with the following exceptions:
 +
 +      * ``is_private`` is ``False`` for the shared address space (``100.64.0.0/10``)
 +      * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
 +        semantics of the underlying IPv4 addresses and the following condition holds
 +        (see :attr:`IPv6Address.ipv4_mapped`)::
 +
 +            address.is_private == address.ipv4_mapped.is_private
 +
 +      ``is_private`` has value opposite to :attr:`is_global`, except for the shared address space
 +      (``100.64.0.0/10`` range) where they are both ``False``.
 +
 +      .. versionchanged:: 3.11.10
 +
 +         Fixed some false positives and false negatives.
 +
 +         * ``192.0.0.0/24`` is considered private with the exception of ``192.0.0.9/32`` and
 +           ``192.0.0.10/32`` (previously: only the ``192.0.0.0/29`` sub-range was considered private).
 +         * ``64:ff9b:1::/48`` is considered private.
 +         * ``2002::/16`` is considered private.
 +         * There are exceptions within ``2001::/23`` (otherwise considered private): ``2001:1::1/128``,
 +           ``2001:1::2/128``, ``2001:3::/32``, ``2001:4:112::/48``, ``2001:20::/28``, ``2001:30::/28``.
 +           The exceptions are not considered private.
    .. attribute:: is_global
 -      ``True`` if the address is allocated for public networks.  See
 +      ``True`` if the address is defined as globally reachable by
       iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
 -      (for IPv6).
 +      (for IPv6) with the following exception:
 +
 +      For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
 +      semantics of the underlying IPv4 addresses and the following condition holds
 +      (see :attr:`IPv6Address.ipv4_mapped`)::
 +
 +         address.is_global == address.ipv4_mapped.is_global
 +
 +      ``is_global`` has value opposite to :attr:`is_private`, except for the shared address space
 +      (``100.64.0.0/10`` range) where they are both ``False``.
       .. versionadded:: 3.4
 +      .. versionchanged:: 3.11.10
 +
 +         Fixed some false positives and false negatives, see :attr:`is_private` for details.
 +
    .. attribute:: is_unspecified
       ``True`` if the address is unspecified.  See :RFC:`5735` (for IPv4)
 diff --git a/Doc/whatsnew/3.11.rst b/Doc/whatsnew/3.11.rst
 index f670fa1..42b61c7 100644
 --- a/Doc/whatsnew/3.11.rst
 +++ b/Doc/whatsnew/3.11.rst
@@ -2727,3 +2727,12 @@ OpenSSL
 * Windows builds and macOS installers from python.org now use OpenSSL 3.0.
 .. _libb2: https://www.blake2.net/
 +
 +Notable changes in 3.11.10
 +==========================
 +
 +ipaddress
 +---------
 +
 +* Fixed ``is_global`` and ``is_private`` behavior in ``IPv4Address``,
 +  ``IPv6Address``, ``IPv4Network`` and ``IPv6Network``.
 diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
 index 16ba16c..567beb3 100644
 --- a/Lib/ipaddress.py
 +++ b/Lib/ipaddress.py
@@ -1086,7 +1086,11 @@ class _BaseNetwork(_IPAddressBase):
         """
         return any(self.network_address in priv_network and
                    self.broadcast_address in priv_network
 -                   for priv_network in self._constants._private_networks)
 +                   for priv_network in self._constants._private_networks) and all(
 +                    self.network_address not in network and
 +                    self.broadcast_address not in network
 +                    for network in self._constants._private_networks_exceptions
 +                )
     @property
     def is_global(self):
@@ -1333,18 +1337,41 @@ class IPv4Address(_BaseV4, _BaseAddress):
     @property
     @functools.lru_cache()
     def is_private(self):
 -        """Test if this address is allocated for private networks.
 +        """``True`` if the address is defined as not globally reachable by
 +        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
 +        (for IPv6) with the following exceptions:
 -        Returns:
 -            A boolean, True if the address is reserved per
 -            iana-ipv4-special-registry.
 +        * ``is_private`` is ``False`` for ``100.64.0.0/10``
 +        * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
 +            semantics of the underlying IPv4 addresses and the following condition holds
 +            (see :attr:`IPv6Address.ipv4_mapped`)::
 +                address.is_private == address.ipv4_mapped.is_private
 +
 +        ``is_private`` has value opposite to :attr:`is_global`, except for the ``100.64.0.0/10``
 +        IPv4 range where they are both ``False``.
         """
 -        return any(self in net for net in self._constants._private_networks)
 +        return (
 +            any(self in net for net in self._constants._private_networks)
 +            and all(self not in net for net in self._constants._private_networks_exceptions)
 +        )
     @property
     @functools.lru_cache()
     def is_global(self):
 +        """``True`` if the address is defined as globally reachable by
 +        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
 +        (for IPv6) with the following exception:
 +
 +        For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
 +        semantics of the underlying IPv4 addresses and the following condition holds
 +        (see :attr:`IPv6Address.ipv4_mapped`)::
 +
 +            address.is_global == address.ipv4_mapped.is_global
 +
 +        ``is_global`` has value opposite to :attr:`is_private`, except for the ``100.64.0.0/10``
 +        IPv4 range where they are both ``False``.
 +        """
         return self not in self._constants._public_network and not self.is_private
     @property
@@ -1548,13 +1575,15 @@ class _IPv4Constants:
     _public_network = IPv4Network('100.64.0.0/10')
 +    # Not globally reachable address blocks listed on
 +    # https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
     _private_networks = [
         IPv4Network('0.0.0.0/8'),
         IPv4Network('10.0.0.0/8'),
         IPv4Network('127.0.0.0/8'),
         IPv4Network('169.254.0.0/16'),
         IPv4Network('172.16.0.0/12'),
 -        IPv4Network('192.0.0.0/29'),
 +        IPv4Network('192.0.0.0/24'),
         IPv4Network('192.0.0.170/31'),
         IPv4Network('192.0.2.0/24'),
         IPv4Network('192.168.0.0/16'),
@@ -1565,6 +1594,11 @@ class _IPv4Constants:
         IPv4Network('255.255.255.255/32'),
         ]
 +    _private_networks_exceptions = [
 +        IPv4Network('192.0.0.9/32'),
 +        IPv4Network('192.0.0.10/32'),
 +    ]
 +
     _reserved_network = IPv4Network('240.0.0.0/4')
     _unspecified_address = IPv4Address('0.0.0.0')
@@ -2010,27 +2044,42 @@ class IPv6Address(_BaseV6, _BaseAddress):
     @property
     @functools.lru_cache()
     def is_private(self):
 -        """Test if this address is allocated for private networks.
 +        """``True`` if the address is defined as not globally reachable by
 +        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
 +        (for IPv6) with the following exceptions:
 -        Returns:
 -            A boolean, True if the address is reserved per
 -            iana-ipv6-special-registry, or is ipv4_mapped and is
 -            reserved in the iana-ipv4-special-registry.
 +        * ``is_private`` is ``False`` for ``100.64.0.0/10``
 +        * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
 +            semantics of the underlying IPv4 addresses and the following condition holds
 +            (see :attr:`IPv6Address.ipv4_mapped`)::
 +                address.is_private == address.ipv4_mapped.is_private
 +
 +        ``is_private`` has value opposite to :attr:`is_global`, except for the ``100.64.0.0/10``
 +        IPv4 range where they are both ``False``.
         """
         ipv4_mapped = self.ipv4_mapped
         if ipv4_mapped is not None:
             return ipv4_mapped.is_private
 -        return any(self in net for net in self._constants._private_networks)
 +        return (
 +            any(self in net for net in self._constants._private_networks)
 +            and all(self not in net for net in self._constants._private_networks_exceptions)
 +        )
     @property
     def is_global(self):
 -        """Test if this address is allocated for public networks.
 +        """``True`` if the address is defined as globally reachable by
 +        iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_
 +        (for IPv6) with the following exception:
 -        Returns:
 -            A boolean, true if the address is not reserved per
 -            iana-ipv6-special-registry.
 +        For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the
 +        semantics of the underlying IPv4 addresses and the following condition holds
 +        (see :attr:`IPv6Address.ipv4_mapped`)::
 +
 +            address.is_global == address.ipv4_mapped.is_global
 +        ``is_global`` has value opposite to :attr:`is_private`, except for the ``100.64.0.0/10``
 +        IPv4 range where they are both ``False``.
         """
         return not self.is_private
@@ -2271,19 +2320,31 @@ class _IPv6Constants:
     _multicast_network = IPv6Network('ff00::/8')
 +    # Not globally reachable address blocks listed on
 +    # https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
     _private_networks = [
         IPv6Network('::1/128'),
         IPv6Network('::/128'),
         IPv6Network('::ffff:0:0/96'),
 +        IPv6Network('64:ff9b:1::/48'),
         IPv6Network('100::/64'),
         IPv6Network('2001::/23'),
 -        IPv6Network('2001:2::/48'),
         IPv6Network('2001:db8::/32'),
 -        IPv6Network('2001:10::/28'),
 +        # IANA says N/A, let's consider it not globally reachable to be safe
 +        IPv6Network('2002::/16'),
         IPv6Network('fc00::/7'),
         IPv6Network('fe80::/10'),
         ]
 +    _private_networks_exceptions = [
 +        IPv6Network('2001:1::1/128'),
 +        IPv6Network('2001:1::2/128'),
 +        IPv6Network('2001:3::/32'),
 +        IPv6Network('2001:4:112::/48'),
 +        IPv6Network('2001:20::/28'),
 +        IPv6Network('2001:30::/28'),
 +    ]
 +
     _reserved_networks = [
         IPv6Network('::/8'), IPv6Network('100::/8'),
         IPv6Network('200::/7'), IPv6Network('400::/6'),
 diff --git a/Lib/test/test_ipaddress.py b/Lib/test/test_ipaddress.py
 index fc27628..16c3416 100644
 --- a/Lib/test/test_ipaddress.py
 +++ b/Lib/test/test_ipaddress.py
@@ -2269,6 +2269,10 @@ class IpaddrUnitTest(unittest.TestCase):
         self.assertEqual(True, ipaddress.ip_address(
                 '172.31.255.255').is_private)
         self.assertEqual(False, ipaddress.ip_address('172.32.0.0').is_private)
 +        self.assertFalse(ipaddress.ip_address('192.0.0.0').is_global)
 +        self.assertTrue(ipaddress.ip_address('192.0.0.9').is_global)
 +        self.assertTrue(ipaddress.ip_address('192.0.0.10').is_global)
 +        self.assertFalse(ipaddress.ip_address('192.0.0.255').is_global)
         self.assertEqual(True,
                          ipaddress.ip_address('169.254.100.200').is_link_local)
@@ -2294,6 +2298,7 @@ class IpaddrUnitTest(unittest.TestCase):
         self.assertEqual(True, ipaddress.ip_network("169.254.0.0/16").is_private)
         self.assertEqual(True, ipaddress.ip_network("172.16.0.0/12").is_private)
         self.assertEqual(True, ipaddress.ip_network("192.0.0.0/29").is_private)
 +        self.assertEqual(False, ipaddress.ip_network("192.0.0.9/32").is_private)
         self.assertEqual(True, ipaddress.ip_network("192.0.0.170/31").is_private)
         self.assertEqual(True, ipaddress.ip_network("192.0.2.0/24").is_private)
         self.assertEqual(True, ipaddress.ip_network("192.168.0.0/16").is_private)
@@ -2310,8 +2315,8 @@ class IpaddrUnitTest(unittest.TestCase):
         self.assertEqual(True, ipaddress.ip_network("::/128").is_private)
         self.assertEqual(True, ipaddress.ip_network("::ffff:0:0/96").is_private)
         self.assertEqual(True, ipaddress.ip_network("100::/64").is_private)
 -        self.assertEqual(True, ipaddress.ip_network("2001::/23").is_private)
         self.assertEqual(True, ipaddress.ip_network("2001:2::/48").is_private)
 +        self.assertEqual(False, ipaddress.ip_network("2001:3::/48").is_private)
         self.assertEqual(True, ipaddress.ip_network("2001:db8::/32").is_private)
         self.assertEqual(True, ipaddress.ip_network("2001:10::/28").is_private)
         self.assertEqual(True, ipaddress.ip_network("fc00::/7").is_private)
@@ -2390,6 +2395,20 @@ class IpaddrUnitTest(unittest.TestCase):
         self.assertEqual(True, ipaddress.ip_address('0::0').is_unspecified)
         self.assertEqual(False, ipaddress.ip_address('::1').is_unspecified)
 +        self.assertFalse(ipaddress.ip_address('64:ff9b:1::').is_global)
 +        self.assertFalse(ipaddress.ip_address('2001::').is_global)
 +        self.assertTrue(ipaddress.ip_address('2001:1::1').is_global)
 +        self.assertTrue(ipaddress.ip_address('2001:1::2').is_global)
 +        self.assertFalse(ipaddress.ip_address('2001:2::').is_global)
 +        self.assertTrue(ipaddress.ip_address('2001:3::').is_global)
 +        self.assertFalse(ipaddress.ip_address('2001:4::').is_global)
 +        self.assertTrue(ipaddress.ip_address('2001:4:112::').is_global)
 +        self.assertFalse(ipaddress.ip_address('2001:10::').is_global)
 +        self.assertTrue(ipaddress.ip_address('2001:20::').is_global)
 +        self.assertTrue(ipaddress.ip_address('2001:30::').is_global)
 +        self.assertFalse(ipaddress.ip_address('2001:40::').is_global)
 +        self.assertFalse(ipaddress.ip_address('2002::').is_global)
 +
         # some generic IETF reserved addresses
         self.assertEqual(True, ipaddress.ip_address('100::').is_reserved)
         self.assertEqual(True, ipaddress.ip_network('4000::1/128').is_reserved)
 diff --git a/Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst b/Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst
 new file mode 100644
 index 0000000..f9a7247
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Library/2024-03-14-01-38-44.gh-issue-113171.VFnObz.rst
@@ -0,0 +1,9 @@
 +Fixed various false positives and false negatives in
 +
 +* :attr:`ipaddress.IPv4Address.is_private` (see these docs for details)
 +* :attr:`ipaddress.IPv4Address.is_global`
 +* :attr:`ipaddress.IPv6Address.is_private`
 +* :attr:`ipaddress.IPv6Address.is_global`
 +
 +Also in the corresponding :class:`ipaddress.IPv4Network` and :class:`ipaddress.IPv6Network`
 +attributes.
 -- 
 2.45.2
--- a/SOURCES/00435-gh-121650-encode-newlines-in-headers-and-verify-headers-are-sound-gh-122233.patch
+++ b/SOURCES/00435-gh-121650-encode-newlines-in-headers-and-verify-headers-are-sound-gh-122233.patch
@ -0,0 +1,365 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <encukou@gmail.com>
 Date: Wed, 31 Jul 2024 00:19:48 +0200
 Subject: [PATCH] 00435: gh-121650: Encode newlines in headers, and verify
 headers are sound (GH-122233)
 Per RFC 2047:
 > [...] these encoding schemes allow the
 > encoding of arbitrary octet values, mail readers that implement this
 > decoding should also ensure that display of the decoded data on the
 > recipient's terminal will not cause unwanted side-effects
 It seems that the "quoted-word" scheme is a valid way to include
 a newline character in a header value, just like we already allow
 undecodable bytes or control characters.
 They do need to be properly quoted when serialized to text, though.
 This should fail for custom fold() implementations that aren't careful
 about newlines.
 (cherry picked from commit 097633981879b3c9de9a1dd120d3aa585ecc2384)
 Co-authored-by: Petr Viktorin <encukou@gmail.com>
 Co-authored-by: Bas Bloemsaat <bas@bloemsaat.org>
 Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
 ---
 Doc/library/email.errors.rst                  |  7 +++
 Doc/library/email.policy.rst                  | 18 ++++++
 Doc/whatsnew/3.11.rst                         | 13 ++++
 Lib/email/_header_value_parser.py             | 12 +++-
 Lib/email/_policybase.py                      |  8 +++
 Lib/email/errors.py                           |  4 ++
 Lib/email/generator.py                        | 13 +++-
 Lib/test/test_email/test_generator.py         | 62 +++++++++++++++++++
 Lib/test/test_email/test_policy.py            | 26 ++++++++
 ...-07-27-16-10-41.gh-issue-121650.nf6oc9.rst |  5 ++
 10 files changed, 164 insertions(+), 4 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst
 diff --git a/Doc/library/email.errors.rst b/Doc/library/email.errors.rst
 index 56aea6598b..27b0481a85 100644
 --- a/Doc/library/email.errors.rst
 +++ b/Doc/library/email.errors.rst
@@ -58,6 +58,13 @@ The following exception classes are defined in the :mod:`email.errors` module:
    :class:`~email.mime.nonmultipart.MIMENonMultipart` (e.g.
    :class:`~email.mime.image.MIMEImage`).
 +
 +.. exception:: HeaderWriteError()
 +
 +   Raised when an error occurs when the :mod:`~email.generator` outputs
 +   headers.
 +
 +
 .. exception:: MessageDefect()
    This is the base class for all defects found when parsing email messages.
 diff --git a/Doc/library/email.policy.rst b/Doc/library/email.policy.rst
 index bb406c5a56..3edba4028b 100644
 --- a/Doc/library/email.policy.rst
 +++ b/Doc/library/email.policy.rst
@@ -228,6 +228,24 @@ added matters.  To illustrate::
       .. versionadded:: 3.6
 +
 +   .. attribute:: verify_generated_headers
 +
 +      If ``True`` (the default), the generator will raise
 +      :exc:`~email.errors.HeaderWriteError` instead of writing a header
 +      that is improperly folded or delimited, such that it would
 +      be parsed as multiple headers or joined with adjacent data.
 +      Such headers can be generated by custom header classes or bugs
 +      in the ``email`` module.
 +
 +      As it's a security feature, this defaults to ``True`` even in the
 +      :class:`~email.policy.Compat32` policy.
 +      For backwards compatible, but unsafe, behavior, it must be set to
 +      ``False`` explicitly.
 +
 +      .. versionadded:: 3.11.10
 +
 +
    The following :class:`Policy` method is intended to be called by code using
    the email library to create policy instances with custom settings:
 diff --git a/Doc/whatsnew/3.11.rst b/Doc/whatsnew/3.11.rst
 index 42b61c75c7..f12c871998 100644
 --- a/Doc/whatsnew/3.11.rst
 +++ b/Doc/whatsnew/3.11.rst
@@ -2728,6 +2728,7 @@ OpenSSL
 .. _libb2: https://www.blake2.net/
 +
 Notable changes in 3.11.10
 ==========================
@@ -2736,3 +2737,15 @@ ipaddress
 * Fixed ``is_global`` and ``is_private`` behavior in ``IPv4Address``,
   ``IPv6Address``, ``IPv4Network`` and ``IPv6Network``.
 +
 +email
 +-----
 +
 +* Headers with embedded newlines are now quoted on output.
 +
 +  The :mod:`~email.generator` will now refuse to serialize (write) headers
 +  that are improperly folded or delimited, such that they would be parsed as
 +  multiple headers or joined with adjacent data.
 +  If you need to turn this safety feature off,
 +  set :attr:`~email.policy.Policy.verify_generated_headers`.
 +  (Contributed by Bas Bloemsaat and Petr Viktorin in :gh:`121650`.)
 diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py
 index 8cb8852cf0..255a953092 100644
 --- a/Lib/email/_header_value_parser.py
 +++ b/Lib/email/_header_value_parser.py
@@ -92,6 +92,8 @@
 ASPECIALS = TSPECIALS | set("*'%")
 ATTRIBUTE_ENDS = ASPECIALS | WSP
 EXTENDED_ATTRIBUTE_ENDS = ATTRIBUTE_ENDS - set('%')
 +NLSET = {'\n', '\r'}
 +SPECIALSNL = SPECIALS | NLSET
 def quote_string(value):
     return '"'+str(value).replace('\\', '\\\\').replace('"', r'\"')+'"'
@@ -2780,9 +2782,13 @@ def _refold_parse_tree(parse_tree, *, policy):
             wrap_as_ew_blocked -= 1
             continue
         tstr = str(part)
 -        if part.token_type == 'ptext' and set(tstr) & SPECIALS:
 -            # Encode if tstr contains special characters.
 -            want_encoding = True
 +        if not want_encoding:
 +            if part.token_type == 'ptext':
 +                # Encode if tstr contains special characters.
 +                want_encoding = not SPECIALSNL.isdisjoint(tstr)
 +            else:
 +                # Encode if tstr contains newlines.
 +                want_encoding = not NLSET.isdisjoint(tstr)
         try:
             tstr.encode(encoding)
             charset = encoding
 diff --git a/Lib/email/_policybase.py b/Lib/email/_policybase.py
 index c9cbadd2a8..d1f48211f9 100644
 --- a/Lib/email/_policybase.py
 +++ b/Lib/email/_policybase.py
@@ -157,6 +157,13 @@ class Policy(_PolicyBase, metaclass=abc.ABCMeta):
     message_factory     -- the class to use to create new message objects.
                            If the value is None, the default is Message.
 +    verify_generated_headers
 +                        -- if true, the generator verifies that each header
 +                           they are properly folded, so that a parser won't
 +                           treat it as multiple headers, start-of-body, or
 +                           part of another header.
 +                           This is a check against custom Header & fold()
 +                           implementations.
     """
     raise_on_defect = False
@@ -165,6 +172,7 @@ class Policy(_PolicyBase, metaclass=abc.ABCMeta):
     max_line_length = 78
     mangle_from_ = False
     message_factory = None
 +    verify_generated_headers = True
     def handle_defect(self, obj, defect):
         """Based on policy, either raise defect or call register_defect.
 diff --git a/Lib/email/errors.py b/Lib/email/errors.py
 index 3ad0056554..02aa5eced6 100644
 --- a/Lib/email/errors.py
 +++ b/Lib/email/errors.py
@@ -29,6 +29,10 @@ class CharsetError(MessageError):
     """An illegal charset was given."""
 +class HeaderWriteError(MessageError):
 +    """Error while writing headers."""
 +
 +
 # These are parsing defects which the parser was able to work around.
 class MessageDefect(ValueError):
     """Base class for a message defect."""
 diff --git a/Lib/email/generator.py b/Lib/email/generator.py
 index eb597de76d..563ca17072 100644
 --- a/Lib/email/generator.py
 +++ b/Lib/email/generator.py
@@ -14,12 +14,14 @@
 from copy import deepcopy
 from io import StringIO, BytesIO
 from email.utils import _has_surrogates
 +from email.errors import HeaderWriteError
 UNDERSCORE = '_'
 NL = '\n'  # XXX: no longer used by the code below.
 NLCRE = re.compile(r'\r\n|\r|\n')
 fcre = re.compile(r'^From ', re.MULTILINE)
 +NEWLINE_WITHOUT_FWSP = re.compile(r'\r\n[^ \t]|\r[^ \n\t]|\n[^ \t]')
 class Generator:
@@ -222,7 +224,16 @@ def _dispatch(self, msg):
     def _write_headers(self, msg):
         for h, v in msg.raw_items():
 -            self.write(self.policy.fold(h, v))
 +            folded = self.policy.fold(h, v)
 +            if self.policy.verify_generated_headers:
 +                linesep = self.policy.linesep
 +                if not folded.endswith(self.policy.linesep):
 +                    raise HeaderWriteError(
 +                        f'folded header does not end with {linesep!r}: {folded!r}')
 +                if NEWLINE_WITHOUT_FWSP.search(folded.removesuffix(linesep)):
 +                    raise HeaderWriteError(
 +                        f'folded header contains newline: {folded!r}')
 +            self.write(folded)
         # A blank line always separates headers from body
         self.write(self._NL)
 diff --git a/Lib/test/test_email/test_generator.py b/Lib/test/test_email/test_generator.py
 index 89e7edeb63..d29400f0ed 100644
 --- a/Lib/test/test_email/test_generator.py
 +++ b/Lib/test/test_email/test_generator.py
@@ -6,6 +6,7 @@
 from email.generator import Generator, BytesGenerator
 from email.headerregistry import Address
 from email import policy
 +import email.errors
 from test.test_email import TestEmailBase, parameterize
@@ -216,6 +217,44 @@ def test_rfc2231_wrapping_switches_to_default_len_if_too_narrow(self):
         g.flatten(msg)
         self.assertEqual(s.getvalue(), self.typ(expected))
 +    def test_keep_encoded_newlines(self):
 +        msg = self.msgmaker(self.typ(textwrap.dedent("""\
 +            To: nobody
 +            Subject: Bad subject=?UTF-8?Q?=0A?=Bcc: injection@example.com
 +
 +            None
 +            """)))
 +        expected = textwrap.dedent("""\
 +            To: nobody
 +            Subject: Bad subject=?UTF-8?Q?=0A?=Bcc: injection@example.com
 +
 +            None
 +            """)
 +        s = self.ioclass()
 +        g = self.genclass(s, policy=self.policy.clone(max_line_length=80))
 +        g.flatten(msg)
 +        self.assertEqual(s.getvalue(), self.typ(expected))
 +
 +    def test_keep_long_encoded_newlines(self):
 +        msg = self.msgmaker(self.typ(textwrap.dedent("""\
 +            To: nobody
 +            Subject: Bad subject=?UTF-8?Q?=0A?=Bcc: injection@example.com
 +
 +            None
 +            """)))
 +        expected = textwrap.dedent("""\
 +            To: nobody
 +            Subject: Bad subject
 +             =?utf-8?q?=0A?=Bcc:
 +             injection@example.com
 +
 +            None
 +            """)
 +        s = self.ioclass()
 +        g = self.genclass(s, policy=self.policy.clone(max_line_length=30))
 +        g.flatten(msg)
 +        self.assertEqual(s.getvalue(), self.typ(expected))
 +
 class TestGenerator(TestGeneratorBase, TestEmailBase):
@@ -224,6 +263,29 @@ class TestGenerator(TestGeneratorBase, TestEmailBase):
     ioclass = io.StringIO
     typ = str
 +    def test_verify_generated_headers(self):
 +        """gh-121650: by default the generator prevents header injection"""
 +        class LiteralHeader(str):
 +            name = 'Header'
 +            def fold(self, **kwargs):
 +                return self
 +
 +        for text in (
 +            'Value\r\nBad Injection\r\n',
 +            'NoNewLine'
 +        ):
 +            with self.subTest(text=text):
 +                message = message_from_string(
 +                    "Header: Value\r\n\r\nBody",
 +                    policy=self.policy,
 +                )
 +
 +                del message['Header']
 +                message['Header'] = LiteralHeader(text)
 +
 +                with self.assertRaises(email.errors.HeaderWriteError):
 +                    message.as_string()
 +
 class TestBytesGenerator(TestGeneratorBase, TestEmailBase):
 diff --git a/Lib/test/test_email/test_policy.py b/Lib/test/test_email/test_policy.py
 index c6b9c80efe..baa35fd68e 100644
 --- a/Lib/test/test_email/test_policy.py
 +++ b/Lib/test/test_email/test_policy.py
@@ -26,6 +26,7 @@ class PolicyAPITests(unittest.TestCase):
         'raise_on_defect':          False,
         'mangle_from_':             True,
         'message_factory':          None,
 +        'verify_generated_headers': True,
         }
     # These default values are the ones set on email.policy.default.
     # If any of these defaults change, the docs must be updated.
@@ -294,6 +295,31 @@ def test_short_maxlen_error(self):
                 with self.assertRaises(email.errors.HeaderParseError):
                     policy.fold("Subject", subject)
 +    def test_verify_generated_headers(self):
 +        """Turning protection off allows header injection"""
 +        policy = email.policy.default.clone(verify_generated_headers=False)
 +        for text in (
 +            'Header: Value\r\nBad: Injection\r\n',
 +            'Header: NoNewLine'
 +        ):
 +            with self.subTest(text=text):
 +                message = email.message_from_string(
 +                    "Header: Value\r\n\r\nBody",
 +                    policy=policy,
 +                )
 +                class LiteralHeader(str):
 +                    name = 'Header'
 +                    def fold(self, **kwargs):
 +                        return self
 +
 +                del message['Header']
 +                message['Header'] = LiteralHeader(text)
 +
 +                self.assertEqual(
 +                    message.as_string(),
 +                    f"{text}\nBody",
 +                )
 +
     # XXX: Need subclassing tests.
     # For adding subclassed objects, make sure the usual rules apply (subclass
     # wins), but that the order still works (right overrides left).
 diff --git a/Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst b/Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst
 new file mode 100644
 index 0000000000..83dd28d4ac
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Library/2024-07-27-16-10-41.gh-issue-121650.nf6oc9.rst
@@ -0,0 +1,5 @@
 +:mod:`email` headers with embedded newlines are now quoted on output. The
 +:mod:`~email.generator` will now refuse to serialize (write) headers that
 +are unsafely folded or delimited; see
 +:attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas
 +Bloemsaat and Petr Viktorin in :gh:`121650`.)
--- a/SOURCES/00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
+++ b/SOURCES/00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
@ -0,0 +1,128 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Jason R. Coombs" <jaraco@jaraco.com>
 Date: Mon, 19 Aug 2024 19:28:20 -0400
 Subject: [PATCH] 00436: [CVE-2024-8088] gh-122905: Sanitize names in
 zipfile.Path.
 Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>
 ---
 Lib/test/test_zipfile.py                      | 17 ++++++
 Lib/zipfile.py                                | 61 ++++++++++++++++++-
 ...-08-11-14-08-04.gh-issue-122905.7tDsxA.rst |  1 +
 3 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
 diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py
 index 4de6f379a4..8bdc7a1b7d 100644
 --- a/Lib/test/test_zipfile.py
 +++ b/Lib/test/test_zipfile.py
@@ -3651,6 +3651,23 @@ def test_extract_orig_with_implied_dirs(self, alpharep):
         zipfile.Path(zf)
         zf.extractall(source_path.parent)
 +    def test_malformed_paths(self):
 +        """
 +        Path should handle malformed paths.
 +        """
 +        data = io.BytesIO()
 +        zf = zipfile.ZipFile(data, "w")
 +        zf.writestr("/one-slash.txt", b"content")
 +        zf.writestr("//two-slash.txt", b"content")
 +        zf.writestr("../parent.txt", b"content")
 +        zf.filename = ''
 +        root = zipfile.Path(zf)
 +        assert list(map(str, root.iterdir())) == [
 +            'one-slash.txt',
 +            'two-slash.txt',
 +            'parent.txt',
 +        ]
 +
 class EncodedMetadataTests(unittest.TestCase):
     file_names = ['\u4e00', '\u4e8c', '\u4e09']  # Han 'one', 'two', 'three'
 diff --git a/Lib/zipfile.py b/Lib/zipfile.py
 index 86829abce4..b7bf9ef7e3 100644
 --- a/Lib/zipfile.py
 +++ b/Lib/zipfile.py
@@ -9,6 +9,7 @@
 import itertools
 import os
 import posixpath
 +import re
 import shutil
 import stat
 import struct
@@ -2243,7 +2244,65 @@ def _difference(minuend, subtrahend):
     return itertools.filterfalse(set(subtrahend).__contains__, minuend)
 -class CompleteDirs(ZipFile):
 +class SanitizedNames:
 +    """
 +    ZipFile mix-in to ensure names are sanitized.
 +    """
 +
 +    def namelist(self):
 +        return list(map(self._sanitize, super().namelist()))
 +
 +    @staticmethod
 +    def _sanitize(name):
 +        r"""
 +        Ensure a relative path with posix separators and no dot names.
 +        Modeled after
 +        https://github.com/python/cpython/blob/bcc1be39cb1d04ad9fc0bd1b9193d3972835a57c/Lib/zipfile/__init__.py#L1799-L1813
 +        but provides consistent cross-platform behavior.
 +        >>> san = SanitizedNames._sanitize
 +        >>> san('/foo/bar')
 +        'foo/bar'
 +        >>> san('//foo.txt')
 +        'foo.txt'
 +        >>> san('foo/.././bar.txt')
 +        'foo/bar.txt'
 +        >>> san('foo../.bar.txt')
 +        'foo../.bar.txt'
 +        >>> san('\\foo\\bar.txt')
 +        'foo/bar.txt'
 +        >>> san('D:\\foo.txt')
 +        'D/foo.txt'
 +        >>> san('\\\\server\\share\\file.txt')
 +        'server/share/file.txt'
 +        >>> san('\\\\?\\GLOBALROOT\\Volume3')
 +        '?/GLOBALROOT/Volume3'
 +        >>> san('\\\\.\\PhysicalDrive1\\root')
 +        'PhysicalDrive1/root'
 +        Retain any trailing slash.
 +        >>> san('abc/')
 +        'abc/'
 +        Raises a ValueError if the result is empty.
 +        >>> san('../..')
 +        Traceback (most recent call last):
 +        ...
 +        ValueError: Empty filename
 +        """
 +
 +        def allowed(part):
 +            return part and part not in {'..', '.'}
 +
 +        # Remove the drive letter.
 +        # Don't use ntpath.splitdrive, because that also strips UNC paths
 +        bare = re.sub('^([A-Z]):', r'\1', name, flags=re.IGNORECASE)
 +        clean = bare.replace('\\', '/')
 +        parts = clean.split('/')
 +        joined = '/'.join(filter(allowed, parts))
 +        if not joined:
 +            raise ValueError("Empty filename")
 +        return joined + '/' * name.endswith('/')
 +
 +
 +class CompleteDirs(SanitizedNames, ZipFile):
     """
     A ZipFile subclass that ensures that implied directories
     are always included in the namelist.
 diff --git a/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
 new file mode 100644
 index 0000000000..1be44c906c
 --- /dev/null
 +++ b/Misc/NEWS.d/next/Library/2024-08-11-14-08-04.gh-issue-122905.7tDsxA.rst
@@ -0,0 +1 @@
 +:class:`zipfile.Path` objects now sanitize names from the zipfile.
--- a/SOURCES/Python-3.11.7.tar.xz.asc
+++ b/SOURCES/Python-3.11.7.tar.xz.asc
@ -1,16 +0,0 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCAAdFiEEz9yiRbEEPPKl+Xhl/+h0BBaL2EcFAmVuFigACgkQ/+h0BBaL
 2EeHPg/+LU5xs2ZDrQogDcH+A1v8RyursiggypdM5hXTrsFsTCIk4iekcI9xkhG1
 ltNX4UuCe5PUEbTgtaWP0ncXARrUnPCoQaQ1sHVDTYoHegancsk+sXZc1JM7qr0p
 Y4Ig6mKjuHFMXCInQSI2GaH4t5r4Z1jGk/PGrecIHOPJgqfA/6Z3TBF5N+y3jEvS
 2QazMB298q4RDhh9m3REe8LwFPHDlfw9eRohv0MB8xygg9KtxhLZrN7gLBQZvKGD
 ihNw6EgJj5OZ0dvwKCCXnlZuwknuJW7vAOPHhYeenPdVdYCGoRSyN7JdD07L+5AG
 O14l2rqZrz5Eu28by+kAUrcPYAfAXekw1PmtT3HSd9U/nqnUiTkkJcjyGG/e3cjJ
 sUDKMNCSBq0G7j5DB3bB6VHkZjVuz+T+iR5QdfJ4kI2pYSuE/rUj1rhkUXApYsHl
 7Wff0QbOW6QT1wCtQcMpJSzkTDVJVYxiqrko/ihlOhphDHYLdOIGOrxWAUwc06x/
 BhJD6tM1kEVZvifoJp1OsNwDzZ/Ku6CUs05E1vWxdeNVeANyKAgCZ5hOVmhnv866
 11zfgo/znRsMzMIyJuy0bhO0C6omVLzzfhipAbZM2jDorn37xxV0v/I0pceNtLrp
 YR7Tjs7+Ihe6/oItjW53j9T7ANdgQ1RVDg98lKlPFNL+hxfctwY=
 =0Pkd
 -----END PGP SIGNATURE-----
--- a/SOURCES/Python-3.11.9.tar.xz.asc
+++ b/SOURCES/Python-3.11.9.tar.xz.asc
@ -0,0 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCAAdFiEEz9yiRbEEPPKl+Xhl/+h0BBaL2EcFAmYNMEcACgkQ/+h0BBaL
 2EeHhxAAuuIM9bl0dgAWOjbgRjCeXR8aFdfcI4dkO7bZrUy8eKbM+XCvPUUvloRJ
 vzGkxYyTmI4kcNPOHfscUwH7AVVij8nGv7WeaXBUZGIXNwfHwvqOxvYvSsNNNFnr
 70yJB7Df8/2s0XqFx3X1aWcnyMDerWKpfJ/VI/NPmCVxkYXGshuTTSFcCMTSFBQB
 sNrIb5NWAsBF4R85uRQDlCg1AoyaKOdJNQkPo1Nrjol1ExJ+MHE7+E+QL9pQkUWG
 SBISPUhJySBAegxolw6YR5dz1L4nukueQDJz3NizUeQGDvH7h1ImY8cypRi44U61
 SUUHhBfmUBiC2dS/tTQawySULWcgbkV4GJ6cJZfDd95uffd4S/GDJCa2wCE2UTlA
 XzQHwbcnIeoL064gX7ruBuFHJ6n/Oz7nZkFqbH2aqLTAWgLiUq31xH3HY734sL6X
 zIJQRbcK1EM7cnNjKMVPlnHpAeKbsbHbU6yzWwZ7reIoyWlZ7vEGrfXO7Kmul93K
 wVaWu0AiOY566ugekdDx4cKV+FQN6oppAN63yTfPJ2Ddcmxs4KNrtozw9OAgDTPE
 GTPFD6V1CMuyQj/jOpAmbj+4bRD4Mx3u2PSittvrIeopxrXPsGGSZ5kdl62Xa2+A
 DzKyYNXzcmxqS9lGdFb+OWCTyAIXxwZrdz1Q61g5xDvR9z/wZiI=
 =Br9/
 -----END PGP SIGNATURE-----
--- a/SOURCES/check-pyc-timestamps.py
+++ b/SOURCES/check-pyc-timestamps.py
@ -16,7 +16,6 @@ LEVELS = (None, 1, 2)
 # list of globs of test and other files that we expect not to have bytecode
 not_compiled = [
    '/usr/bin/*',
    '/usr/lib/rpm/redhat/*',
    '*/test/*/bad_coding.py',
    '*/test/*/bad_coding2.py',
    '*/test/*/badsyntax_*.py',
--- a/SOURCES/import_all_modules_py3_11.py
+++ b/SOURCES/import_all_modules_py3_11.py
@ -1,171 +0,0 @@
 '''Script to perform import of each module given to %%py_check_import
 '''
 import argparse
 import importlib
 import fnmatch
 import os
 import re
 import site
 import sys
 from contextlib import contextmanager
 from pathlib import Path
 def read_modules_files(file_paths):
    '''Read module names from the files (modules must be newline separated).
    Return the module names list or, if no files were provided, an empty list.
    '''
    if not file_paths:
        return []
    modules = []
    for file in file_paths:
        file_contents = file.read_text()
        modules.extend(file_contents.split())
    return modules
 def read_modules_from_cli(argv):
    '''Read module names from command-line arguments (space or comma separated).
    Return the module names list.
    '''
    if not argv:
        return []
    # %%py3_check_import allows to separate module list with comma or whitespace,
    # we need to unify the output to a list of particular elements
    modules_as_str = ' '.join(argv)
    modules = re.split(r'[\s,]+', modules_as_str)
    # Because of shell expansion in some less typical cases it may happen
    # that a trailing space will occur at the end of the list.
    # Remove the empty items from the list before passing it further
    modules = [m for m in modules if m]
    return modules
 def filter_top_level_modules_only(modules):
    '''Filter out entries with nested modules (containing dot) ie. 'foo.bar'.
    Return the list of top-level modules.
    '''
    return [module for module in modules if '.' not in module]
 def any_match(text, globs):
    '''Return True if any of given globs fnmatchcase's the given text.'''
    return any(fnmatch.fnmatchcase(text, g) for g in globs)
 def exclude_unwanted_module_globs(globs, modules):
    '''Filter out entries which match the either of the globs given as argv.
    Return the list of filtered modules.
    '''
    return [m for m in modules if not any_match(m, globs)]
 def read_modules_from_all_args(args):
    '''Return a joined list of modules from all given command-line arguments.
    '''
    modules = read_modules_files(args.filename)
    modules.extend(read_modules_from_cli(args.modules))
    if args.exclude:
        modules = exclude_unwanted_module_globs(args.exclude, modules)
    if args.top_level:
        modules = filter_top_level_modules_only(modules)
    # Error when someone accidentally managed to filter out everything
    if len(modules) == 0:
        raise ValueError('No modules to check were left')
    return modules
 def import_modules(modules):
    '''Procedure to perform import check for each module name from the given list of modules.
    '''
    for module in modules:
        print('Check import:', module, file=sys.stderr)
        importlib.import_module(module)
 def argparser():
    parser = argparse.ArgumentParser(
        description='Generate list of all importable modules for import check.'
    )
    parser.add_argument(
        'modules', nargs='*',
        help=('Add modules to check the import (space or comma separated).'),
    )
    parser.add_argument(
        '-f', '--filename', action='append', type=Path,
        help='Add importable module names list from file.',
    )
    parser.add_argument(
        '-t', '--top-level', action='store_true',
        help='Check only top-level modules.',
    )
    parser.add_argument(
        '-e', '--exclude', action='append',
        help='Provide modules globs to be excluded from the check.',
    )
    return parser
@contextmanager
 def remove_unwanteds_from_sys_path():
    '''Remove cwd and this script's parent from sys.path for the import test.
    Bring the original contents back after import is done (or failed)
    '''
    cwd_absolute = Path.cwd().absolute()
    this_file_parent = Path(__file__).parent.absolute()
    old_sys_path = list(sys.path)
    for path in old_sys_path:
        if Path(path).absolute() in (cwd_absolute, this_file_parent):
            sys.path.remove(path)
    try:
        yield
    finally:
        sys.path = old_sys_path
 def addsitedirs_from_environ():
    '''Load directories from the _PYTHONSITE environment variable (separated by :)
    and load the ones already present in sys.path via site.addsitedir()
    to handle .pth files in them.
    This is needed to properly import old-style namespace packages with nspkg.pth files.
    See https://bugzilla.redhat.com/2018551 for a more detailed rationale.'''
    for path in os.getenv('_PYTHONSITE', '').split(':'):
        if path in sys.path:
            site.addsitedir(path)
 def main(argv=None):
    cli_args = argparser().parse_args(argv)
    if not cli_args.modules and not cli_args.filename:
        raise ValueError('No modules to check were provided')
    modules = read_modules_from_all_args(cli_args)
    with remove_unwanteds_from_sys_path():
        addsitedirs_from_environ()
        import_modules(modules)
 if __name__ == '__main__':
    main()
--- a/SOURCES/macros.python3.11
+++ b/SOURCES/macros.python3.11
@ -1,77 +0,0 @@
 %__python3 /usr/bin/python3.11
 %python3_pkgversion 3.11
 # The following are macros from macros.python3 in Fedora that are newer/different than those in the python3-rpm-macros package in RHEL.
 # These macros overwrite/supercede some of the macros in the python3-rpm-macros package in RHEL.
 # nb: $RPM_BUILD_ROOT is not set when the macros are expanded (at spec parse time)
 #     so we set it manually (to empty string), making our Python prefer the correct install scheme location
 # platbase/base is explicitly set to %%{_prefix} to support custom values, such as /app for flatpaks
 %python3_sitelib %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '%{_prefix}', 'base': '%{_prefix}'}))")
 %python3_sitearch %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_path('platlib', vars={'platbase': '%{_prefix}', 'base': '%{_prefix}'}))")
 %python3_version %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; sys.stdout.write('{0.major}.{0.minor}'.format(sys.version_info))")
 %python3_version_nodots %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; sys.stdout.write('{0.major}{0.minor}'.format(sys.version_info))")
 %python3_platform %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_platform())")
 %python3_platform_triplet %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_config_var('MULTIARCH'))")
 %python3_ext_suffix %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_config_var('EXT_SUFFIX'))")
 %python3_cache_tag %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print(sys.implementation.cache_tag)")
 %_py3_shebang_s s
 %_py3_shebang_P %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print('P' if hasattr(sys.flags, 'safe_path') else '')")
 %py3_shbang_opts -%{?_py3_shebang_s}%{?_py3_shebang_P}
 %py3_install() %{expand:\\\
  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
  %{__python3} %{py_setup} %{?py_setup_args} install -O1 --skip-build --root %{buildroot} --prefix %{_prefix} %{?*}
  rm -rfv %{buildroot}%{_bindir}/__pycache__
 }
 %py3_install_egg() %{expand:\\\
  mkdir -p %{buildroot}%{python3_sitelib}
  %{__python3} -m easy_install -m --prefix %{buildroot}%{_prefix} -Z dist/*-py%{python3_version}.egg %{?*}
  rm -rfv %{buildroot}%{_bindir}/__pycache__
 }
 %py3_install_wheel() %{expand:\\\
  %{__python3} -m pip install -I dist/%{1} --root %{buildroot} --prefix %{_prefix} --no-deps --no-index --no-warn-script-location
  rm -rfv %{buildroot}%{_bindir}/__pycache__
  for distinfo in %{buildroot}%{python3_sitelib}/*.dist-info %{buildroot}%{python3_sitearch}/*.dist-info; do
    if [ -f ${distinfo}/direct_url.json ]; then
      rm -fv ${distinfo}/direct_url.json
      sed -i '/direct_url.json/d' ${distinfo}/RECORD
    fi
  done
 }
 # With $PATH and $PYTHONPATH set to the %%buildroot,
 # try to import the Python 3 module(s) given as command-line args or read from file (-f).
 # Respect the custom values of %%py3_shebang_flags or set nothing if it's undefined.
 # Filter and check import on only top-level modules using -t flag.
 # Exclude unwanted modules by passing their globs to -e option.
 # Useful as a smoke test in %%check when running tests is not feasible.
 # Use spaces or commas as separators if providing list directly.
 # Use newlines as separators if providing list in a file.
 %py3_check_import(e:tf:) %{expand:\\\
  PATH="%{buildroot}%{_bindir}:$PATH"\\\
  PYTHONPATH="${PYTHONPATH:-%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}}"\\\
  _PYTHONSITE="%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}"\\\
  PYTHONDONTWRITEBYTECODE=1\\\
  %{lua:
  local command = "%{__python3} "
  if rpm.expand("%{?py3_shebang_flags}") ~= "" then
    command = command .. "-%{py3_shebang_flags}"
  end
  command = command .. " %{_rpmconfigdir}/redhat/import_all_modules_py3_11.py "
  -- handle multiline arguments correctly, see https://bugzilla.redhat.com/2018809
  local args=rpm.expand('%{?**}'):gsub("[%s\\\\]*%s+", " ")
  print(command .. args)
  }
 }
 %pytest %{expand:\\\
  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
  PATH="%{buildroot}%{_bindir}:$PATH"\\\
  PYTHONPATH="${PYTHONPATH:-%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}}"\\\
  PYTHONDONTWRITEBYTECODE=1\\\
  %{?__pytest_addopts:PYTEST_ADDOPTS="${PYTEST_ADDOPTS:-} %{__pytest_addopts}"}\\\
  %__pytest}
--- a/SPECS/python3.11.spec
+++ b/SPECS/python3.11.spec
@ -16,11 +16,11 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.7
+%global general_version %{pybasever}.9
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}
+Release: 7%{?dist}
 License: Python
@ -63,7 +63,7 @@ License: Python
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
-%global pip_version 23.2.1
+%global pip_version 24.0
 %global setuptools_version 65.5.0
 # Expensive optimizations (mainly, profile-guided optimizations)
@ -145,6 +145,13 @@ License: Python
 %global py_INSTSONAME_optimized libpython%{LDVERSION_optimized}.so.%{py_SOVERSION}
 %global py_INSTSONAME_debug     libpython%{LDVERSION_debug}.so.%{py_SOVERSION}
 # The -O flag for the compiler, optimized builds
 # https://fedoraproject.org/wiki/Changes/Python_built_with_gcc_O3
 %global optflags_optimized -O3
 # The -O flag for the compiler, debug builds
 # -Wno-cpp avoids some warnings with -O0
 %global optflags_debug -O0 -Wno-cpp
 # Disable automatic bytecompilation. The python3 binary is not yet be
 # available in /usr/bin when Python is built. Also, the bytecompilation fails
 # on files that test invalid syntax.
@ -253,10 +260,6 @@ Source1: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz.a
 # The release manager for Python 3.11 is pablogsal
 Source2: https://keybase.io/pablogsal/pgp_keys.asc
 # Sources for the python3.11-rpm-macros
 Source3: macros.python3.11
 Source4: import_all_modules_py3_11.py
 # A simple script to check timestamps of bytecode files
 # Run in check section with Python that is currently being built
 # Originally written by bkabrda
@ -336,31 +339,6 @@ Patch329: 00329-fips.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch
 # 00378 #
 # Support expat 2.4.5
 #
 # Curly brackets were never allowed in namespace URIs
 # according to RFC 3986, and so-called namespace-validating
 # XML parsers have the right to reject them a invalid URIs.
 #
 # libexpat >=2.4.5 has become strcter in that regard due to
 # related security issues; with ET.XML instantiating a
 # namespace-aware parser under the hood, this test has no
 # future in CPython.
 #
 # References:
 # - https://datatracker.ietf.org/doc/html/rfc3968
 # - https://www.w3.org/TR/xml-names/
 #
 # Also, test_minidom.py: Support Expat >=2.4.5
 #
 # The patch has diverged from upstream as the python test
 # suite was relying on checking the expat version, whereas
 # in RHEL fixes get backported instead of rebasing packages.
 #
 # Upstream: https://bugs.python.org/issue46811
 Patch378: 00378-support-expat-2-4-5.patch
 # 00397 #
 # Filters for tarfile extraction (CVE-2007-4559, PEP-706)
 # First patch fixes determination of symlink targets, which were treated
@ -385,6 +363,41 @@ Patch397: 00397-tarfile-filter.patch
 # config file or environment variable.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 # 00422 #
 # Fix the test suite for releases of expat < 2.6.0
 # which backport the CVE-2023-52425 fix.
 # Downstream only.
 Patch422: 00422-fix-expat-tests.patch
 # 00431 #
 # Security fix for CVE-2024-4032: incorrect IPv4 and IPv6 private ranges
 # Resolved upstream: https://github.com/python/cpython/issues/113171
 # Tracking bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2292921
 Patch431: 00431-CVE-2024-4032.patch
 # 00435 # d33a3c90daa3d5d2d7e67f6e9264e5438d9608a0
 # gh-121650: Encode newlines in headers, and verify headers are sound (GH-122233)
 #
 # Per RFC 2047:
 #
 # > [...] these encoding schemes allow the
 # > encoding of arbitrary octet values, mail readers that implement this
 # > decoding should also ensure that display of the decoded data on the
 # > recipient's terminal will not cause unwanted side-effects
 #
 # It seems that the "quoted-word" scheme is a valid way to include
 # a newline character in a header value, just like we already allow
 # undecodable bytes or control characters.
 # They do need to be properly quoted when serialized to text, though.
 #
 # This should fail for custom fold() implementations that aren't careful
 # about newlines.
 Patch435: 00435-gh-121650-encode-newlines-in-headers-and-verify-headers-are-sound-gh-122233.patch
 # 00436 # 1acd6db660ad1124ab7ae449a841608dd9d9062d
 # [CVE-2024-8088] gh-122905: Sanitize names in zipfile.Path.
 Patch436: 00436-cve-2024-8088-gh-122905-sanitize-names-in-zipfile-path.patch
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -403,14 +416,6 @@ Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-par
 # Descriptions, and metadata for subpackages
 # ==========================================
 # Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
 Requires:         alternatives >= 1.19.2-1
 Requires(post):   alternatives >= 1.19.2-1
 Requires(postun): alternatives >= 1.19.2-1
 # When the user tries to `yum install python`, yum will list this package among
 # the possible alternatives
 Provides: alternative-for(python)
 %if %{with main_python}
 # Description for the python3X SRPM only:
@ -485,7 +490,6 @@ Documentation for Python is provided in the %{pkgname}-docs package.
 Packages containing additional libraries for Python are generally named with
 the "%{pkgname}-" prefix.
 For the unversioned "python" executable, see manual page "unversioned-python".
 %if %{with main_python}
 # https://fedoraproject.org/wiki/Changes/Move_usr_bin_python_into_separate_package
@ -554,12 +558,9 @@ Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 Requires: (python-rpm-macros if rpm-build)
 Requires: (python3-rpm-macros if rpm-build)
-# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
+# We provide the python3.11-rpm-macros here to make it possible to
-Requires(postun): alternatives >= 1.19.2-1
+# BuildRequire them in the same manner as RHEL8.
-
+Provides: %{pkgname}-rpm-macros = %{version}-%{release}
 # python3.11 installs the alternatives master symlink to which we attach a slave
 Requires(post): %{pkgname}
 Requires(postun): %{pkgname}
 %unversioned_obsoletes_of_python3_X_if_main devel
@ -608,13 +609,6 @@ Provides: idle = %{version}-%{release}
 Provides: %{pkgname}-tools = %{version}-%{release}
 Provides: %{pkgname}-tools%{?_isa} = %{version}-%{release}
 # Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
 Requires(postun): alternatives >= 1.19.2-1
 # python3.11 installs the alternatives master symlink to which we attach a slave
 Requires(post): %{pkgname}
 Requires(postun): %{pkgname}
 %description -n %{pkgname}-idle
 IDLE is Python’s Integrated Development and Learning Environment.
@ -674,13 +668,6 @@ Requires: %{pkgname}-idle%{?_isa} = %{version}-%{release}
 %unversioned_obsoletes_of_python3_X_if_main debug
 # Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
 Requires(postun): alternatives >= 1.19.2-1
 # python3.11 installs the alternatives master symlink to which we attach a slave
 Requires(post): %{pkgname}
 Requires(postun): %{pkgname}
 %description -n %{pkgname}-debug
 python3-debug provides a version of the Python runtime with numerous debugging
 features enabled, aimed at advanced Python users such as developers of Python
@ -698,23 +685,6 @@ The debug runtime additionally supports debug builds of C-API extensions
 (with the "d" ABI flag) for debugging issues in those extensions.
 %endif # with debug_build
 # We package the python3.11-rpm-macros in RHEL8 as to properly set the
 # %%__python3 and %%python3_pkgversion macros as well as provide modern
 # versions the current base macros.
 %package -n %{pkgname}-rpm-macros
 Summary:    RPM macros for building RPMs with Python %{pybasever}
 License:    MIT
 Provides:   python-modular-rpm-macros == %{pybasever}
 Conflicts:  python-modular-rpm-macros > %{pybasever}
 Requires:   python3-rpm-macros
 BuildArch:  noarch
 %description -n %{pkgname}-rpm-macros
 RPM macros for building RPMs with Python %{pybasever} from the python%{pyshortver} module.
 If you want to build an RPM against the python%{pyshortver} module, you need to add:
    BuildRequire: %{pkgname}-rpm-macros.
 # ======================================================
 # The prep phase of the build:
 # ======================================================
@ -798,6 +768,7 @@ BuildPython() {
  ConfName=$1
  ExtraConfigArgs=$2
  MoreCFlags=$3
  MoreCFlagsNodist=$4
  # Each build is done in its own directory
  ConfDir=build/$ConfName
@ -837,7 +808,7 @@ BuildPython() {
  $ExtraConfigArgs \
  %{nil}
-%global flags_override EXTRA_CFLAGS="$MoreCFlags" CFLAGS_NODIST="$CFLAGS_NODIST $MoreCFlags"
+%global flags_override EXTRA_CFLAGS="$MoreCFlags" CFLAGS_NODIST="$CFLAGS_NODIST $MoreCFlags $MoreCFlagsNodist"
 %if %{without bootstrap}
  # Regenerate generated files (needs python3)
@ -860,12 +831,14 @@ BuildPython() {
 # See also: https://bugzilla.redhat.com/show_bug.cgi?id=1818857
 BuildPython debug \
  "--without-ensurepip --with-pydebug" \
-  "-O0 -Wno-cpp"
+  "%{optflags_debug}" \
  ""
 %endif # with debug_build
 BuildPython optimized \
  "--without-ensurepip %{optimizations_flag}" \
-  ""
+  "" \
  "%{optflags_optimized}"
 # ======================================================
 # Installing the built code:
@ -964,7 +937,7 @@ EOF
 %if %{with debug_build}
 InstallPython debug \
  %{py_INSTSONAME_debug} \
-  -O0 \
+  "%{optflags_debug}" \
  %{LDVERSION_debug}
 %endif # with debug_build
@ -1124,28 +1097,6 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
    rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done
 # Python RPM macros
 mkdir -p %{buildroot}%{rpmmacrodir}/
 install -m 644 %{SOURCE3} \
    %{buildroot}/%{rpmmacrodir}/
 # Add a script that is being used by python3.11-rpm-macros
 mkdir -p %{buildroot}%{_rpmconfigdir}/redhat
 install -m 644 %{SOURCE4} %{buildroot}%{_rpmconfigdir}/redhat/
 # All ghost files controlled by alternatives need to exist for the files
 # section check to succeed
 # - Don't list /usr/bin/python as a ghost file so `yum install /usr/bin/python`
 #   doesn't install this package
 touch %{buildroot}%{_bindir}/unversioned-python
 touch %{buildroot}%{_mandir}/man1/python.1.gz
 touch %{buildroot}%{_bindir}/python3
 touch %{buildroot}%{_mandir}/man1/python3.1.gz
 touch %{buildroot}%{_bindir}/pydoc3
 touch %{buildroot}%{_bindir}/pydoc-3
 touch %{buildroot}%{_bindir}/idle3
 touch %{buildroot}%{_bindir}/python3-config
 # ======================================================
 # Checks for packaging issues
 # ======================================================
@ -1236,118 +1187,9 @@ CheckPython optimized
 %endif # with tests
 # ======================================================
 # Scriptlets for alternatives on rhel8
 # ======================================================
 %post
 # Alternative for /usr/bin/python -> /usr/bin/python3 + man page
 alternatives --install %{_bindir}/unversioned-python \
                        python \
                        %{_bindir}/python3 \
                        300 \
              --slave   %{_bindir}/python \
                        unversioned-python \
                        %{_bindir}/python3 \
              --slave   %{_mandir}/man1/python.1.gz \
                        unversioned-python-man \
                        %{_mandir}/man1/python3.1.gz
 # Alternative for /usr/bin/python -> /usr/bin/python3.11 + man page
 alternatives --install %{_bindir}/unversioned-python \
                        python \
                        %{_bindir}/python3.11 \
                        211 \
              --slave   %{_bindir}/python \
                        unversioned-python \
                        %{_bindir}/python3.11 \
              --slave   %{_mandir}/man1/python.1.gz \
                        unversioned-python-man \
                        %{_mandir}/man1/python3.11.1.gz
 # Alternative for /usr/bin/python3 -> /usr/bin/python3.11 + related files
 # Create only if it doesn't exist already
 EXISTS=`alternatives --display python3 | \
         grep -c "^/usr/bin/python3.11 - priority [0-9]*"`
 if [ $EXISTS -eq 0 ]; then
     alternatives --install %{_bindir}/python3 \
                            python3 \
                            %{_bindir}/python3.11 \
                            31100 \
                  --slave   %{_mandir}/man1/python3.1.gz \
                            python3-man \
                            %{_mandir}/man1/python3.11.1.gz \
                  --slave   %{_bindir}/pydoc3 \
                            pydoc3 \
                            %{_bindir}/pydoc3.11 \
                  --slave   %{_bindir}/pydoc-3 \
                            pydoc-3 \
                            %{_bindir}/pydoc3.11
 fi
 %postun
 # Do this only during uninstall process (not during update)
 if [ $1 -eq 0 ]; then
     alternatives --keep-foreign --remove python \
                         %{_bindir}/python3.11
     alternatives --keep-foreign --remove python3 \
                         %{_bindir}/python3.11
     # Remove link python → python3 if no other python3.* exists
     if ! alternatives --display python3 > /dev/null; then
         alternatives --keep-foreign --remove python \
                             %{_bindir}/python3
     fi
 fi
 %post devel
 alternatives --add-slave python3 %{_bindir}/python3.11 \
     %{_bindir}/python3-config \
     python3-config \
     %{_bindir}/python3.11-config
 %postun devel
 # Do this only during uninstall process (not during update)
 if [ $1 -eq 0 ]; then
     alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.11 \
         python3-config
 fi
 %post idle
 alternatives --add-slave python3 %{_bindir}/python3.11 \
     %{_bindir}/idle3 \
     idle3 \
     %{_bindir}/idle3.11
 %postun idle
 # Do this only during uninstall process (not during update)
 if [ $1 -eq 0 ]; then
     alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.11 \
        idle3
 fi
 # ======================================================
 # Files for each RPM (sub)package
 # ======================================================
 %files -n %{pkgname}-rpm-macros
 %{rpmmacrodir}/macros.python%{pybasever}
 %{_rpmconfigdir}/redhat/import_all_modules_py3_11.py
 %files -n %{pkgname}
 %doc README.rst
 # Alternatives
 %ghost %{_bindir}/unversioned-python
 %ghost %{_mandir}/man1/python.1.gz
 %ghost %{_bindir}/python3
 %ghost %{_mandir}/man1/python3.1.gz
 %ghost %{_bindir}/pydoc3
 %ghost %{_bindir}/pydoc-3
 %if %{with main_python}
 %{_bindir}/pydoc*
 %{_bindir}/python3
@ -1637,9 +1479,6 @@ fi
 %{_bindir}/python%{pybasever}-config
 %{_bindir}/python%{LDVERSION_optimized}-config
 %{_bindir}/python%{LDVERSION_optimized}-*-config
 # Alternatives
 %ghost %{_bindir}/python3-config
 %{_libdir}/libpython%{LDVERSION_optimized}.so
 %{_libdir}/pkgconfig/python-%{LDVERSION_optimized}.pc
 %{_libdir}/pkgconfig/python-%{LDVERSION_optimized}-embed.pc
@ -1652,8 +1491,6 @@ fi
 %{_bindir}/idle*
 %else
 %{_bindir}/idle%{pybasever}
 # Alternatives
 %ghost %{_bindir}/idle3
 %endif
 %{pylibdir}/idlelib
@ -1839,22 +1676,47 @@ fi
 # ======================================================
 %changelog
 * Fri Aug 23 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-7
 - Security fix for CVE-2024-8088
 Resolves: RHEL-55959
 * Thu Aug 15 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-6
 - Security fix for CVE-2024-6923
 Resolves: RHEL-53038
 * Thu Jul 25 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-5
 - Properly propagate the optimization flags to C extensions
 * Thu Jul 18 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-4
 - Build Python with -O3
 - https://fedoraproject.org/wiki/Changes/Python_built_with_gcc_O3
 * Thu Jul 18 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-3
 - Security fix for CVE-2024-4032
 Resolves: RHEL-44099
 * Tue Jun 11 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-2
 - Enable importing of hash-based .pyc files under FIPS mode
 Resolves: RHEL-40779
 * Mon Apr 22 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-1
 - Rebase to 3.11.9
 - Security fixes for CVE-2023-6597 and CVE-2024-0450
 - Fix expat tests for the latest expat security release
 Resolves: RHEL-33677, RHEL-33689
 * Mon Jan 22 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.7-1
 - Rebase to 3.11.7
-Resolves: RHEL-21915
+Resolves: RHEL-20233
 * Tue Jan 09 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.5-2
 - Security fix for CVE-2023-27043
-Resolves: RHEL-7842
+Resolves: RHEL-21325
 * Thu Sep 07 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.5-1
 - Rebase to 3.11.5
 - Security fixes for CVE-2023-40217 and CVE-2023-41105
-Resolves: RHEL-3047, RHEL-3267
+Resolves: RHEL-3045, RHEL-3269
 * Thu Aug 10 2023 Tomas Orsava <torsava@redhat.com> - 3.11.4-4
 - Add the import_all_modules_py3_11.py file for the python3.11-rpm-macros subpackage
 Resolves: rhbz#2207631
 * Wed Aug 09 2023 Petr Viktorin <pviktori@redhat.com> - 3.11.4-3
 - Fix symlink handling in the fix for CVE-2023-24329
@ -1880,10 +1742,7 @@ Resolves: rhbz#2173917
 * Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-3
 - Disable bootstrap
- Revert python3.11-rpm-macros requirement
+- Bump release to sync with RHEL8
 * Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-2
 - Fix macros requirements
 * Tue Dec 13 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-1
 - Initial package
`@ -1 +1 @@`
	`SOURCES/Python-3.11.7.tar.xz`	`SOURCES/Python-3.11.9.tar.xz`
`@ -1 +1 @@`
	`f2534d591121f3845388fbdd6a121b96dfe305a6 SOURCES/Python-3.11.7.tar.xz`	`926cd6a577b2e8dcbb17671b30eda04019328ada SOURCES/Python-3.11.9.tar.xz`