7 changed files with 519 additions and 319 deletions
--- a/SOURCES/00378-support-expat-2-4-5.patch
+++ b/SOURCES/00378-support-expat-2-4-5.patch
@ -0,0 +1,47 @@
+From db083095e3bdb93e4f8170d814664c482b1e94da Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Tue, 14 Jun 2022 06:38:43 +0200
+Subject: [PATCH] Fix test suite for Expat >= 2.4.5
+
+---
+ Lib/test/test_minidom.py | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py
+index 9762025..5f52ed1 100644
+--- a/Lib/test/test_minidom.py
+++ b/Lib/test/test_minidom.py
+@@ -1149,14 +1149,10 @@ class MinidomTest(unittest.TestCase):
+ 
+         # Verify that character decoding errors raise exceptions instead
+         # of crashing
+-        if pyexpat.version_info >= (2, 4, 5):
+-            self.assertRaises(ExpatError, parseString,
+-                    b'<fran\xe7ais></fran\xe7ais>')
+-            self.assertRaises(ExpatError, parseString,
+-                    b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
+-        else:
+-            self.assertRaises(UnicodeDecodeError, parseString,
+-                b'<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
+        self.assertRaises(ExpatError, parseString,
+                b'<fran\xe7ais></fran\xe7ais>')
+        self.assertRaises(ExpatError, parseString,
+                b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
+ 
+         doc.unlink()
+ 
+@@ -1617,10 +1613,7 @@ class MinidomTest(unittest.TestCase):
+         self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE)
+ 
+     def testExceptionOnSpacesInXMLNSValue(self):
+-        if pyexpat.version_info >= (2, 4, 5):
+-            context = self.assertRaisesRegex(ExpatError, 'syntax error')
+-        else:
+-            context = self.assertRaisesRegex(ValueError, 'Unsupported syntax')
+        context = self.assertRaisesRegex(ExpatError, 'syntax error')
+ 
+         with context:
+             parseString('<element xmlns:abc="http:abc.com/de f g/hi/j k"><abc:foo /></element>')
+-- 
+2.35.3
+
--- a/SOURCES/00422-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
+++ b/SOURCES/00422-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
@ -1,77 +0,0 @@
-From c9364e8727ea2426519a74593ab03ebcb0da72b8 Mon Sep 17 00:00:00 2001
-From: Lumir Balhar <lbalhar@redhat.com>
-Date: Fri, 3 May 2024 14:17:48 +0200
-Subject: [PATCH] Expect failures in tests not working properly with expat with
- a fixed CVE in RHEL
-
---
- Lib/test/test_xml_etree.py | 53 ++++++++++++++++++++++----------------
- 1 file changed, 31 insertions(+), 22 deletions(-)
-
-diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
-index 7c346f2..24e0bb8 100644
--- a/Lib/test/test_xml_etree.py
-+++ b/Lib/test/test_xml_etree.py
-@@ -1391,28 +1391,37 @@ class XMLPullParserTest(unittest.TestCase):
-         self.assertEqual([(action, elem.tag) for action, elem in events],
-                          expected)
- 
-    def test_simple_xml(self):
-        for chunk_size in (None, 1, 5):
-            with self.subTest(chunk_size=chunk_size):
-                parser = ET.XMLPullParser()
-                self.assert_event_tags(parser, [])
-                self._feed(parser, "<!-- comment -->\n", chunk_size)
-                self.assert_event_tags(parser, [])
-                self._feed(parser,
-                           "<root>\n  <element key='value'>text</element",
-                           chunk_size)
-                self.assert_event_tags(parser, [])
-                self._feed(parser, ">\n", chunk_size)
-                self.assert_event_tags(parser, [('end', 'element')])
-                self._feed(parser, "<element>text</element>tail\n", chunk_size)
-                self._feed(parser, "<empty-element/>\n", chunk_size)
-                self.assert_event_tags(parser, [
-                    ('end', 'element'),
-                    ('end', 'empty-element'),
-                    ])
-                self._feed(parser, "</root>\n", chunk_size)
-                self.assert_event_tags(parser, [('end', 'root')])
-                self.assertIsNone(parser.close())
-+    def test_simple_xml(self, chunk_size=None):
-+        parser = ET.XMLPullParser()
-+        self.assert_event_tags(parser, [])
-+        self._feed(parser, "<!-- comment -->\n", chunk_size)
-+        self.assert_event_tags(parser, [])
-+        self._feed(parser,
-+                   "<root>\n  <element key='value'>text</element",
-+                   chunk_size)
-+        self.assert_event_tags(parser, [])
-+        self._feed(parser, ">\n", chunk_size)
-+        self.assert_event_tags(parser, [('end', 'element')])
-+        self._feed(parser, "<element>text</element>tail\n", chunk_size)
-+        self._feed(parser, "<empty-element/>\n", chunk_size)
-+        self.assert_event_tags(parser, [
-+            ('end', 'element'),
-+            ('end', 'empty-element'),
-+            ])
-+        self._feed(parser, "</root>\n", chunk_size)
-+        self.assert_event_tags(parser, [('end', 'root')])
-+        self.assertIsNone(parser.close())
-+
-+    @unittest.expectedFailure
-+    def test_simple_xml_chunk_1(self):
-+        self.test_simple_xml(chunk_size=1)
-+
-+    @unittest.expectedFailure
-+    def test_simple_xml_chunk_5(self):
-+        self.test_simple_xml(chunk_size=5)
-+
-+    def test_simple_xml_chunk_22(self):
-+        self.test_simple_xml(chunk_size=22)
- 
-     def test_feed_while_iterating(self):
-         parser = ET.XMLPullParser()
-- 
-2.45.0
-
--- a/SOURCES/00426-CVE-2023-6597.patch
+++ b/SOURCES/00426-CVE-2023-6597.patch
@ -1,215 +0,0 @@
-From 5585334d772b253a01a6730e8202ffb1607c3d25 Mon Sep 17 00:00:00 2001
-From: Serhiy Storchaka <storchaka@gmail.com>
-Date: Thu, 7 Dec 2023 18:37:10 +0200
-Subject: [PATCH] [3.11] gh-91133: tempfile.TemporaryDirectory: fix symlink bug
- in cleanup (GH-99930) (GH-112839)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-(cherry picked from commit 81c16cd94ec38d61aa478b9a452436dc3b1b524d)
-
-Co-authored-by: Søren Løvborg <sorenl@unity3d.com>
---
- Lib/tempfile.py                               |  27 +++--
- Lib/test/test_tempfile.py                     | 111 +++++++++++++++++-
- ...2-12-01-16-57-44.gh-issue-91133.LKMVCV.rst |   2 +
- 3 files changed, 125 insertions(+), 15 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Library/2022-12-01-16-57-44.gh-issue-91133.LKMVCV.rst
-
-diff --git a/Lib/tempfile.py b/Lib/tempfile.py
-index aace11fa7b19b9..f59a63a7b45b36 100644
--- a/Lib/tempfile.py
-+++ b/Lib/tempfile.py
-@@ -270,6 +270,22 @@ def _mkstemp_inner(dir, pre, suf, flags, output_type):
-     raise FileExistsError(_errno.EEXIST,
-                           "No usable temporary file name found")
- 
-+def _dont_follow_symlinks(func, path, *args):
-+    # Pass follow_symlinks=False, unless not supported on this platform.
-+    if func in _os.supports_follow_symlinks:
-+        func(path, *args, follow_symlinks=False)
-+    elif _os.name == 'nt' or not _os.path.islink(path):
-+        func(path, *args)
-+
-+def _resetperms(path):
-+    try:
-+        chflags = _os.chflags
-+    except AttributeError:
-+        pass
-+    else:
-+        _dont_follow_symlinks(chflags, path, 0)
-+    _dont_follow_symlinks(_os.chmod, path, 0o700)
-+
- 
- # User visible interfaces.
- 
-@@ -863,17 +879,10 @@ def __init__(self, suffix=None, prefix=None, dir=None,
-     def _rmtree(cls, name, ignore_errors=False):
-         def onerror(func, path, exc_info):
-             if issubclass(exc_info[0], PermissionError):
-                def resetperms(path):
-                    try:
-                        _os.chflags(path, 0)
-                    except AttributeError:
-                        pass
-                    _os.chmod(path, 0o700)
-
-                 try:
-                     if path != name:
-                        resetperms(_os.path.dirname(path))
-                    resetperms(path)
-+                        _resetperms(_os.path.dirname(path))
-+                    _resetperms(path)
- 
-                     try:
-                         _os.unlink(path)
-diff --git a/Lib/test/test_tempfile.py b/Lib/test/test_tempfile.py
-index 1242ec7e3cc9a1..675edc8de9cca5 100644
--- a/Lib/test/test_tempfile.py
-+++ b/Lib/test/test_tempfile.py
-@@ -1565,6 +1565,103 @@ def test_cleanup_with_symlink_to_a_directory(self):
-                          "were deleted")
-         d2.cleanup()
- 
-+    @os_helper.skip_unless_symlink
-+    def test_cleanup_with_symlink_modes(self):
-+        # cleanup() should not follow symlinks when fixing mode bits (#91133)
-+        with self.do_create(recurse=0) as d2:
-+            file1 = os.path.join(d2, 'file1')
-+            open(file1, 'wb').close()
-+            dir1 = os.path.join(d2, 'dir1')
-+            os.mkdir(dir1)
-+            for mode in range(8):
-+                mode <<= 6
-+                with self.subTest(mode=format(mode, '03o')):
-+                    def test(target, target_is_directory):
-+                        d1 = self.do_create(recurse=0)
-+                        symlink = os.path.join(d1.name, 'symlink')
-+                        os.symlink(target, symlink,
-+                                target_is_directory=target_is_directory)
-+                        try:
-+                            os.chmod(symlink, mode, follow_symlinks=False)
-+                        except NotImplementedError:
-+                            pass
-+                        try:
-+                            os.chmod(symlink, mode)
-+                        except FileNotFoundError:
-+                            pass
-+                        os.chmod(d1.name, mode)
-+                        d1.cleanup()
-+                        self.assertFalse(os.path.exists(d1.name))
-+
-+                    with self.subTest('nonexisting file'):
-+                        test('nonexisting', target_is_directory=False)
-+                    with self.subTest('nonexisting dir'):
-+                        test('nonexisting', target_is_directory=True)
-+
-+                    with self.subTest('existing file'):
-+                        os.chmod(file1, mode)
-+                        old_mode = os.stat(file1).st_mode
-+                        test(file1, target_is_directory=False)
-+                        new_mode = os.stat(file1).st_mode
-+                        self.assertEqual(new_mode, old_mode,
-+                                         '%03o != %03o' % (new_mode, old_mode))
-+
-+                    with self.subTest('existing dir'):
-+                        os.chmod(dir1, mode)
-+                        old_mode = os.stat(dir1).st_mode
-+                        test(dir1, target_is_directory=True)
-+                        new_mode = os.stat(dir1).st_mode
-+                        self.assertEqual(new_mode, old_mode,
-+                                         '%03o != %03o' % (new_mode, old_mode))
-+
-+    @unittest.skipUnless(hasattr(os, 'chflags'), 'requires os.chflags')
-+    @os_helper.skip_unless_symlink
-+    def test_cleanup_with_symlink_flags(self):
-+        # cleanup() should not follow symlinks when fixing flags (#91133)
-+        flags = stat.UF_IMMUTABLE | stat.UF_NOUNLINK
-+        self.check_flags(flags)
-+
-+        with self.do_create(recurse=0) as d2:
-+            file1 = os.path.join(d2, 'file1')
-+            open(file1, 'wb').close()
-+            dir1 = os.path.join(d2, 'dir1')
-+            os.mkdir(dir1)
-+            def test(target, target_is_directory):
-+                d1 = self.do_create(recurse=0)
-+                symlink = os.path.join(d1.name, 'symlink')
-+                os.symlink(target, symlink,
-+                           target_is_directory=target_is_directory)
-+                try:
-+                    os.chflags(symlink, flags, follow_symlinks=False)
-+                except NotImplementedError:
-+                    pass
-+                try:
-+                    os.chflags(symlink, flags)
-+                except FileNotFoundError:
-+                    pass
-+                os.chflags(d1.name, flags)
-+                d1.cleanup()
-+                self.assertFalse(os.path.exists(d1.name))
-+
-+            with self.subTest('nonexisting file'):
-+                test('nonexisting', target_is_directory=False)
-+            with self.subTest('nonexisting dir'):
-+                test('nonexisting', target_is_directory=True)
-+
-+            with self.subTest('existing file'):
-+                os.chflags(file1, flags)
-+                old_flags = os.stat(file1).st_flags
-+                test(file1, target_is_directory=False)
-+                new_flags = os.stat(file1).st_flags
-+                self.assertEqual(new_flags, old_flags)
-+
-+            with self.subTest('existing dir'):
-+                os.chflags(dir1, flags)
-+                old_flags = os.stat(dir1).st_flags
-+                test(dir1, target_is_directory=True)
-+                new_flags = os.stat(dir1).st_flags
-+                self.assertEqual(new_flags, old_flags)
-+
-     @support.cpython_only
-     def test_del_on_collection(self):
-         # A TemporaryDirectory is deleted when garbage collected
-@@ -1737,10 +1834,7 @@ def test_modes(self):
-                     d.cleanup()
-                 self.assertFalse(os.path.exists(d.name))
- 
-    @unittest.skipUnless(hasattr(os, 'chflags'), 'requires os.chflags')
-    def test_flags(self):
-        flags = stat.UF_IMMUTABLE | stat.UF_NOUNLINK
-
-+    def check_flags(self, flags):
-         # skip the test if these flags are not supported (ex: FreeBSD 13)
-         filename = os_helper.TESTFN
-         try:
-@@ -1749,13 +1843,18 @@ def test_flags(self):
-                 os.chflags(filename, flags)
-             except OSError as exc:
-                 # "OSError: [Errno 45] Operation not supported"
-                self.skipTest(f"chflags() doesn't support "
-                              f"UF_IMMUTABLE|UF_NOUNLINK: {exc}")
-+                self.skipTest(f"chflags() doesn't support flags "
-+                              f"{flags:#b}: {exc}")
-             else:
-                 os.chflags(filename, 0)
-         finally:
-             os_helper.unlink(filename)
- 
-+    @unittest.skipUnless(hasattr(os, 'chflags'), 'requires os.chflags')
-+    def test_flags(self):
-+        flags = stat.UF_IMMUTABLE | stat.UF_NOUNLINK
-+        self.check_flags(flags)
-+
-         d = self.do_create(recurse=3, dirs=2, files=2)
-         with d:
-             # Change files and directories flags recursively.
-diff --git a/Misc/NEWS.d/next/Library/2022-12-01-16-57-44.gh-issue-91133.LKMVCV.rst b/Misc/NEWS.d/next/Library/2022-12-01-16-57-44.gh-issue-91133.LKMVCV.rst
-new file mode 100644
-index 00000000000000..7991048fc48e03
--- /dev/null
-+++ b/Misc/NEWS.d/next/Library/2022-12-01-16-57-44.gh-issue-91133.LKMVCV.rst
-@@ -0,0 +1,2 @@
-+Fix a bug in :class:`tempfile.TemporaryDirectory` cleanup, which now no longer
-+dereferences symlinks when working around file system permission errors.
--- a/SOURCES/check-pyc-timestamps.py
+++ b/SOURCES/check-pyc-timestamps.py
@ -16,6 +16,7 @@ LEVELS = (None, 1, 2)
 # list of globs of test and other files that we expect not to have bytecode
 not_compiled = [
    '/usr/bin/*',
+    '/usr/lib/rpm/redhat/*',
    '*/test/*/bad_coding.py',
    '*/test/*/bad_coding2.py',
    '*/test/*/badsyntax_*.py',
--- a/SOURCES/import_all_modules_py3_11.py
+++ b/SOURCES/import_all_modules_py3_11.py
@ -0,0 +1,171 @@
+'''Script to perform import of each module given to %%py_check_import
+'''
+import argparse
+import importlib
+import fnmatch
+import os
+import re
+import site
+import sys
+
+from contextlib import contextmanager
+from pathlib import Path
+
+
+def read_modules_files(file_paths):
+    '''Read module names from the files (modules must be newline separated).
+
+    Return the module names list or, if no files were provided, an empty list.
+    '''
+
+    if not file_paths:
+        return []
+
+    modules = []
+    for file in file_paths:
+        file_contents = file.read_text()
+        modules.extend(file_contents.split())
+    return modules
+
+
+def read_modules_from_cli(argv):
+    '''Read module names from command-line arguments (space or comma separated).
+
+    Return the module names list.
+    '''
+
+    if not argv:
+        return []
+
+    # %%py3_check_import allows to separate module list with comma or whitespace,
+    # we need to unify the output to a list of particular elements
+    modules_as_str = ' '.join(argv)
+    modules = re.split(r'[\s,]+', modules_as_str)
+    # Because of shell expansion in some less typical cases it may happen
+    # that a trailing space will occur at the end of the list.
+    # Remove the empty items from the list before passing it further
+    modules = [m for m in modules if m]
+    return modules
+
+
+def filter_top_level_modules_only(modules):
+    '''Filter out entries with nested modules (containing dot) ie. 'foo.bar'.
+
+    Return the list of top-level modules.
+    '''
+
+    return [module for module in modules if '.' not in module]
+
+
+def any_match(text, globs):
+    '''Return True if any of given globs fnmatchcase's the given text.'''
+
+    return any(fnmatch.fnmatchcase(text, g) for g in globs)
+
+
+def exclude_unwanted_module_globs(globs, modules):
+    '''Filter out entries which match the either of the globs given as argv.
+
+    Return the list of filtered modules.
+    '''
+
+    return [m for m in modules if not any_match(m, globs)]
+
+
+def read_modules_from_all_args(args):
+    '''Return a joined list of modules from all given command-line arguments.
+    '''
+
+    modules = read_modules_files(args.filename)
+    modules.extend(read_modules_from_cli(args.modules))
+    if args.exclude:
+        modules = exclude_unwanted_module_globs(args.exclude, modules)
+
+    if args.top_level:
+        modules = filter_top_level_modules_only(modules)
+
+    # Error when someone accidentally managed to filter out everything
+    if len(modules) == 0:
+        raise ValueError('No modules to check were left')
+
+    return modules
+
+
+def import_modules(modules):
+    '''Procedure to perform import check for each module name from the given list of modules.
+    '''
+
+    for module in modules:
+        print('Check import:', module, file=sys.stderr)
+        importlib.import_module(module)
+
+
+def argparser():
+    parser = argparse.ArgumentParser(
+        description='Generate list of all importable modules for import check.'
+    )
+    parser.add_argument(
+        'modules', nargs='*',
+        help=('Add modules to check the import (space or comma separated).'),
+    )
+    parser.add_argument(
+        '-f', '--filename', action='append', type=Path,
+        help='Add importable module names list from file.',
+    )
+    parser.add_argument(
+        '-t', '--top-level', action='store_true',
+        help='Check only top-level modules.',
+    )
+    parser.add_argument(
+        '-e', '--exclude', action='append',
+        help='Provide modules globs to be excluded from the check.',
+    )
+    return parser
+
+
+@contextmanager
+def remove_unwanteds_from_sys_path():
+    '''Remove cwd and this script's parent from sys.path for the import test.
+    Bring the original contents back after import is done (or failed)
+    '''
+
+    cwd_absolute = Path.cwd().absolute()
+    this_file_parent = Path(__file__).parent.absolute()
+    old_sys_path = list(sys.path)
+    for path in old_sys_path:
+        if Path(path).absolute() in (cwd_absolute, this_file_parent):
+            sys.path.remove(path)
+    try:
+        yield
+    finally:
+        sys.path = old_sys_path
+
+
+def addsitedirs_from_environ():
+    '''Load directories from the _PYTHONSITE environment variable (separated by :)
+    and load the ones already present in sys.path via site.addsitedir()
+    to handle .pth files in them.
+
+    This is needed to properly import old-style namespace packages with nspkg.pth files.
+    See https://bugzilla.redhat.com/2018551 for a more detailed rationale.'''
+    for path in os.getenv('_PYTHONSITE', '').split(':'):
+        if path in sys.path:
+            site.addsitedir(path)
+
+
+def main(argv=None):
+
+    cli_args = argparser().parse_args(argv)
+
+    if not cli_args.modules and not cli_args.filename:
+        raise ValueError('No modules to check were provided')
+
+    modules = read_modules_from_all_args(cli_args)
+
+    with remove_unwanteds_from_sys_path():
+        addsitedirs_from_environ()
+        import_modules(modules)
+
+
+if __name__ == '__main__':
+    main()
--- a/SOURCES/macros.python3.11
+++ b/SOURCES/macros.python3.11
@ -0,0 +1,77 @@
+%__python3 /usr/bin/python3.11
+%python3_pkgversion 3.11
+
+# The following are macros from macros.python3 in Fedora that are newer/different than those in the python3-rpm-macros package in RHEL.
+# These macros overwrite/supercede some of the macros in the python3-rpm-macros package in RHEL.
+
+# nb: $RPM_BUILD_ROOT is not set when the macros are expanded (at spec parse time)
+#     so we set it manually (to empty string), making our Python prefer the correct install scheme location
+# platbase/base is explicitly set to %%{_prefix} to support custom values, such as /app for flatpaks
+%python3_sitelib %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '%{_prefix}', 'base': '%{_prefix}'}))")
+%python3_sitearch %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_path('platlib', vars={'platbase': '%{_prefix}', 'base': '%{_prefix}'}))")
+%python3_version %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; sys.stdout.write('{0.major}.{0.minor}'.format(sys.version_info))")
+%python3_version_nodots %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; sys.stdout.write('{0.major}{0.minor}'.format(sys.version_info))")
+%python3_platform %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_platform())")
+%python3_platform_triplet %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_config_var('MULTIARCH'))")
+%python3_ext_suffix %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_config_var('EXT_SUFFIX'))")
+%python3_cache_tag %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print(sys.implementation.cache_tag)")
+
+%_py3_shebang_s s
+%_py3_shebang_P %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print('P' if hasattr(sys.flags, 'safe_path') else '')")
+%py3_shbang_opts -%{?_py3_shebang_s}%{?_py3_shebang_P}
+
+%py3_install() %{expand:\\\
+  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
+  %{__python3} %{py_setup} %{?py_setup_args} install -O1 --skip-build --root %{buildroot} --prefix %{_prefix} %{?*}
+  rm -rfv %{buildroot}%{_bindir}/__pycache__
+}
+
+%py3_install_egg() %{expand:\\\
+  mkdir -p %{buildroot}%{python3_sitelib}
+  %{__python3} -m easy_install -m --prefix %{buildroot}%{_prefix} -Z dist/*-py%{python3_version}.egg %{?*}
+  rm -rfv %{buildroot}%{_bindir}/__pycache__
+}
+
+%py3_install_wheel() %{expand:\\\
+  %{__python3} -m pip install -I dist/%{1} --root %{buildroot} --prefix %{_prefix} --no-deps --no-index --no-warn-script-location
+  rm -rfv %{buildroot}%{_bindir}/__pycache__
+  for distinfo in %{buildroot}%{python3_sitelib}/*.dist-info %{buildroot}%{python3_sitearch}/*.dist-info; do
+    if [ -f ${distinfo}/direct_url.json ]; then
+      rm -fv ${distinfo}/direct_url.json
+      sed -i '/direct_url.json/d' ${distinfo}/RECORD
+    fi
+  done
+}
+
+# With $PATH and $PYTHONPATH set to the %%buildroot,
+# try to import the Python 3 module(s) given as command-line args or read from file (-f).
+# Respect the custom values of %%py3_shebang_flags or set nothing if it's undefined.
+# Filter and check import on only top-level modules using -t flag.
+# Exclude unwanted modules by passing their globs to -e option.
+# Useful as a smoke test in %%check when running tests is not feasible.
+# Use spaces or commas as separators if providing list directly.
+# Use newlines as separators if providing list in a file.
+%py3_check_import(e:tf:) %{expand:\\\
+  PATH="%{buildroot}%{_bindir}:$PATH"\\\
+  PYTHONPATH="${PYTHONPATH:-%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}}"\\\
+  _PYTHONSITE="%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}"\\\
+  PYTHONDONTWRITEBYTECODE=1\\\
+  %{lua:
+  local command = "%{__python3} "
+  if rpm.expand("%{?py3_shebang_flags}") ~= "" then
+    command = command .. "-%{py3_shebang_flags}"
+  end
+  command = command .. " %{_rpmconfigdir}/redhat/import_all_modules_py3_11.py "
+  -- handle multiline arguments correctly, see https://bugzilla.redhat.com/2018809
+  local args=rpm.expand('%{?**}'):gsub("[%s\\\\]*%s+", " ")
+  print(command .. args)
+  }
+}
+
+%pytest %{expand:\\\
+  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
+  PATH="%{buildroot}%{_bindir}:$PATH"\\\
+  PYTHONPATH="${PYTHONPATH:-%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}}"\\\
+  PYTHONDONTWRITEBYTECODE=1\\\
+  %{?__pytest_addopts:PYTEST_ADDOPTS="${PYTEST_ADDOPTS:-} %{__pytest_addopts}"}\\\
+  %__pytest}
--- a/SPECS/python3.11.spec
+++ b/SPECS/python3.11.spec
@ -20,7 +20,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 1%{?dist}.1
+Release: 1%{?dist}
 License: Python


@ -253,6 +253,10 @@ Source1: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz.a
 # The release manager for Python 3.11 is pablogsal
 Source2: https://keybase.io/pablogsal/pgp_keys.asc

+# Sources for the python3.11-rpm-macros
+Source3: macros.python3.11
+Source4: import_all_modules_py3_11.py
+
 # A simple script to check timestamps of bytecode files
 # Run in check section with Python that is currently being built
 # Originally written by bkabrda
@ -332,6 +336,31 @@ Patch329: 00329-fips.patch
 # https://github.com/GrahamDumpleton/mod_wsgi/issues/730
 Patch371: 00371-revert-bpo-1596321-fix-threading-_shutdown-for-the-main-thread-gh-28549-gh-28589.patch

+# 00378 #
+# Support expat 2.4.5
+#
+# Curly brackets were never allowed in namespace URIs
+# according to RFC 3986, and so-called namespace-validating
+# XML parsers have the right to reject them a invalid URIs.
+#
+# libexpat >=2.4.5 has become strcter in that regard due to
+# related security issues; with ET.XML instantiating a
+# namespace-aware parser under the hood, this test has no
+# future in CPython.
+#
+# References:
+# - https://datatracker.ietf.org/doc/html/rfc3968
+# - https://www.w3.org/TR/xml-names/
+#
+# Also, test_minidom.py: Support Expat >=2.4.5
+#
+# The patch has diverged from upstream as the python test
+# suite was relying on checking the expat version, whereas
+# in RHEL fixes get backported instead of rebasing packages.
+#
+# Upstream: https://bugs.python.org/issue46811
+Patch378: 00378-support-expat-2-4-5.patch
+
 # 00397 #
 # Filters for tarfile extraction (CVE-2007-4559, PEP-706)
 # First patch fixes determination of symlink targets, which were treated
@ -356,20 +385,6 @@ Patch397: 00397-tarfile-filter.patch
 # config file or environment variable.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch

-# 00422 #
-# Fix tests for XMLPullParser with Expat 2.6.0
-#
-# Feeding the parser by too small chunks defers parsing to prevent
-# CVE-2023-52425. Future versions of Expat may be more reactive.
-Patch422: 00422-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
-
-# 00426 #
-# CVE-2023-6597: Path traversal on tempfile.TemporaryDirectory
-# Fixed upstream:
-# https://github.com/python/cpython/commit/5585334d772b253a01a6730e8202ffb1607c3d25
-# Tracking bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2276518
-Patch426: 00426-CVE-2023-6597.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@ -388,6 +403,14 @@ Patch426: 00426-CVE-2023-6597.patch
 # Descriptions, and metadata for subpackages
 # ==========================================

+# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
+Requires:         alternatives >= 1.19.2-1
+Requires(post):   alternatives >= 1.19.2-1
+Requires(postun): alternatives >= 1.19.2-1
+
+# When the user tries to `yum install python`, yum will list this package among
+# the possible alternatives
+Provides: alternative-for(python)

 %if %{with main_python}
 # Description for the python3X SRPM only:
@ -462,6 +485,7 @@ Documentation for Python is provided in the %{pkgname}-docs package.
 Packages containing additional libraries for Python are generally named with
 the "%{pkgname}-" prefix.

+For the unversioned "python" executable, see manual page "unversioned-python".

 %if %{with main_python}
 # https://fedoraproject.org/wiki/Changes/Move_usr_bin_python_into_separate_package
@ -530,9 +554,12 @@ Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 Requires: (python-rpm-macros if rpm-build)
 Requires: (python3-rpm-macros if rpm-build)

-# We provide the python3.11-rpm-macros here to make it possible to
-# BuildRequire them in the same manner as RHEL8.
-Provides: %{pkgname}-rpm-macros = %{version}-%{release}
+# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
+Requires(postun): alternatives >= 1.19.2-1
+
+# python3.11 installs the alternatives master symlink to which we attach a slave
+Requires(post): %{pkgname}
+Requires(postun): %{pkgname}

 %unversioned_obsoletes_of_python3_X_if_main devel

@ -581,6 +608,13 @@ Provides: idle = %{version}-%{release}
 Provides: %{pkgname}-tools = %{version}-%{release}
 Provides: %{pkgname}-tools%{?_isa} = %{version}-%{release}

+# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
+Requires(postun): alternatives >= 1.19.2-1
+
+# python3.11 installs the alternatives master symlink to which we attach a slave
+Requires(post): %{pkgname}
+Requires(postun): %{pkgname}
+
 %description -n %{pkgname}-idle
 IDLE is Python’s Integrated Development and Learning Environment.

@ -640,6 +674,13 @@ Requires: %{pkgname}-idle%{?_isa} = %{version}-%{release}

 %unversioned_obsoletes_of_python3_X_if_main debug

+# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
+Requires(postun): alternatives >= 1.19.2-1
+
+# python3.11 installs the alternatives master symlink to which we attach a slave
+Requires(post): %{pkgname}
+Requires(postun): %{pkgname}
+
 %description -n %{pkgname}-debug
 python3-debug provides a version of the Python runtime with numerous debugging
 features enabled, aimed at advanced Python users such as developers of Python
@ -657,6 +698,23 @@ The debug runtime additionally supports debug builds of C-API extensions
 (with the "d" ABI flag) for debugging issues in those extensions.
 %endif # with debug_build

+# We package the python3.11-rpm-macros in RHEL8 as to properly set the
+# %%__python3 and %%python3_pkgversion macros as well as provide modern
+# versions the current base macros.
+%package -n %{pkgname}-rpm-macros
+Summary:    RPM macros for building RPMs with Python %{pybasever}
+License:    MIT
+Provides:   python-modular-rpm-macros == %{pybasever}
+Conflicts:  python-modular-rpm-macros > %{pybasever}
+Requires:   python3-rpm-macros
+BuildArch:  noarch
+
+%description -n %{pkgname}-rpm-macros
+RPM macros for building RPMs with Python %{pybasever} from the python%{pyshortver} module.
+If you want to build an RPM against the python%{pyshortver} module, you need to add:
+
+    BuildRequire: %{pkgname}-rpm-macros.
+
 # ======================================================
 # The prep phase of the build:
 # ======================================================
@ -1066,6 +1124,28 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
    rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done

+# Python RPM macros
+mkdir -p %{buildroot}%{rpmmacrodir}/
+install -m 644 %{SOURCE3} \
+    %{buildroot}/%{rpmmacrodir}/
+
+# Add a script that is being used by python3.11-rpm-macros
+mkdir -p %{buildroot}%{_rpmconfigdir}/redhat
+install -m 644 %{SOURCE4} %{buildroot}%{_rpmconfigdir}/redhat/
+
+# All ghost files controlled by alternatives need to exist for the files
+# section check to succeed
+# - Don't list /usr/bin/python as a ghost file so `yum install /usr/bin/python`
+#   doesn't install this package
+touch %{buildroot}%{_bindir}/unversioned-python
+touch %{buildroot}%{_mandir}/man1/python.1.gz
+touch %{buildroot}%{_bindir}/python3
+touch %{buildroot}%{_mandir}/man1/python3.1.gz
+touch %{buildroot}%{_bindir}/pydoc3
+touch %{buildroot}%{_bindir}/pydoc-3
+touch %{buildroot}%{_bindir}/idle3
+touch %{buildroot}%{_bindir}/python3-config
+
 # ======================================================
 # Checks for packaging issues
 # ======================================================
@ -1156,9 +1236,118 @@ CheckPython optimized

 %endif # with tests

+
+# ======================================================
+# Scriptlets for alternatives on rhel8
+# ======================================================
+%post
+# Alternative for /usr/bin/python -> /usr/bin/python3 + man page
+alternatives --install %{_bindir}/unversioned-python \
+                        python \
+                        %{_bindir}/python3 \
+                        300 \
+              --slave   %{_bindir}/python \
+                        unversioned-python \
+                        %{_bindir}/python3 \
+              --slave   %{_mandir}/man1/python.1.gz \
+                        unversioned-python-man \
+                        %{_mandir}/man1/python3.1.gz
+
+# Alternative for /usr/bin/python -> /usr/bin/python3.11 + man page
+alternatives --install %{_bindir}/unversioned-python \
+                        python \
+                        %{_bindir}/python3.11 \
+                        211 \
+              --slave   %{_bindir}/python \
+                        unversioned-python \
+                        %{_bindir}/python3.11 \
+              --slave   %{_mandir}/man1/python.1.gz \
+                        unversioned-python-man \
+                        %{_mandir}/man1/python3.11.1.gz
+
+# Alternative for /usr/bin/python3 -> /usr/bin/python3.11 + related files
+# Create only if it doesn't exist already
+EXISTS=`alternatives --display python3 | \
+         grep -c "^/usr/bin/python3.11 - priority [0-9]*"`
+
+if [ $EXISTS -eq 0 ]; then
+     alternatives --install %{_bindir}/python3 \
+                            python3 \
+                            %{_bindir}/python3.11 \
+                            31100 \
+                  --slave   %{_mandir}/man1/python3.1.gz \
+                            python3-man \
+                            %{_mandir}/man1/python3.11.1.gz \
+                  --slave   %{_bindir}/pydoc3 \
+                            pydoc3 \
+                            %{_bindir}/pydoc3.11 \
+                  --slave   %{_bindir}/pydoc-3 \
+                            pydoc-3 \
+                            %{_bindir}/pydoc3.11
+fi
+
+%postun
+# Do this only during uninstall process (not during update)
+if [ $1 -eq 0 ]; then
+     alternatives --keep-foreign --remove python \
+                         %{_bindir}/python3.11
+
+     alternatives --keep-foreign --remove python3 \
+                         %{_bindir}/python3.11
+
+     # Remove link python → python3 if no other python3.* exists
+     if ! alternatives --display python3 > /dev/null; then
+         alternatives --keep-foreign --remove python \
+                             %{_bindir}/python3
+     fi
+fi
+
+
+%post devel
+alternatives --add-slave python3 %{_bindir}/python3.11 \
+     %{_bindir}/python3-config \
+     python3-config \
+     %{_bindir}/python3.11-config
+
+%postun devel
+# Do this only during uninstall process (not during update)
+if [ $1 -eq 0 ]; then
+     alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.11 \
+         python3-config
+fi
+
+%post idle
+alternatives --add-slave python3 %{_bindir}/python3.11 \
+     %{_bindir}/idle3 \
+     idle3 \
+     %{_bindir}/idle3.11
+
+%postun idle
+# Do this only during uninstall process (not during update)
+if [ $1 -eq 0 ]; then
+     alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.11 \
+        idle3
+fi
+
+# ======================================================
+# Files for each RPM (sub)package
+# ======================================================
+
+%files -n %{pkgname}-rpm-macros
+%{rpmmacrodir}/macros.python%{pybasever}
+%{_rpmconfigdir}/redhat/import_all_modules_py3_11.py
+
 %files -n %{pkgname}
 %doc README.rst

+# Alternatives
+%ghost %{_bindir}/unversioned-python
+%ghost %{_mandir}/man1/python.1.gz
+%ghost %{_bindir}/python3
+%ghost %{_mandir}/man1/python3.1.gz
+%ghost %{_bindir}/pydoc3
+%ghost %{_bindir}/pydoc-3
+
 %if %{with main_python}
 %{_bindir}/pydoc*
 %{_bindir}/python3
@ -1448,6 +1637,9 @@ CheckPython optimized
 %{_bindir}/python%{pybasever}-config
 %{_bindir}/python%{LDVERSION_optimized}-config
 %{_bindir}/python%{LDVERSION_optimized}-*-config
+# Alternatives
+%ghost %{_bindir}/python3-config
+
 %{_libdir}/libpython%{LDVERSION_optimized}.so
 %{_libdir}/pkgconfig/python-%{LDVERSION_optimized}.pc
 %{_libdir}/pkgconfig/python-%{LDVERSION_optimized}-embed.pc
@ -1460,6 +1652,8 @@ CheckPython optimized
 %{_bindir}/idle*
 %else
 %{_bindir}/idle%{pybasever}
+# Alternatives
+%ghost %{_bindir}/idle3
 %endif

 %{pylibdir}/idlelib
@ -1645,23 +1839,22 @@ CheckPython optimized
 # ======================================================

 %changelog
-* Thu May 16 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.7-1.1
- Security fix for CVE-2023-6597
- Fix tests for XMLPullParser with Expat with fixed CVE
-Resolves: RHEL-33884
-
 * Mon Jan 22 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.11.7-1
 - Rebase to 3.11.7
-Resolves: RHEL-20233
+Resolves: RHEL-21915

 * Tue Jan 09 2024 Lumír Balhar <lbalhar@redhat.com> - 3.11.5-2
 - Security fix for CVE-2023-27043
-Resolves: RHEL-21325
+Resolves: RHEL-7842

 * Thu Sep 07 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.5-1
 - Rebase to 3.11.5
 - Security fixes for CVE-2023-40217 and CVE-2023-41105
-Resolves: RHEL-3045, RHEL-3269
+Resolves: RHEL-3047, RHEL-3267
+
+* Thu Aug 10 2023 Tomas Orsava <torsava@redhat.com> - 3.11.4-4
+- Add the import_all_modules_py3_11.py file for the python3.11-rpm-macros subpackage
+Resolves: rhbz#2207631

 * Wed Aug 09 2023 Petr Viktorin <pviktori@redhat.com> - 3.11.4-3
 - Fix symlink handling in the fix for CVE-2023-24329
@ -1687,7 +1880,10 @@ Resolves: rhbz#2173917

 * Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-3
 - Disable bootstrap
- Bump release to sync with RHEL8
+- Revert python3.11-rpm-macros requirement
+
+* Mon Jan 30 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-2
+- Fix macros requirements

 * Tue Dec 13 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.11.1-1
 - Initial package