import UBI python3.12-3.12.1-4.el9_4.1

SOURCES/00329-fips.patch

@@ -1,7 +1,7 @@
-From 5cedde59cde3f05af798a7cb5bc722cb0deb4835 Mon Sep 17 00:00:00 2001
+From 43ce74d971fad62db6ccd723fe6b01da9c7ff407 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Thu, 12 Dec 2019 16:58:31 +0100
-Subject: [PATCH 1/6] Expose blake2b and blake2s hashes from OpenSSL
+Subject: [PATCH 1/5] Expose blake2b and blake2s hashes from OpenSSL
 
 These aren't as powerful as Python's own implementation, but they can be
 used under FIPS.
@@ -251,13 +251,13 @@ index fb61a44..1e42b87 100644
 -/*[clinic end generated code: output=b339e255db698147 input=a9049054013a1b77]*/
 +/*[clinic end generated code: output=1d988d457a8beebe input=a9049054013a1b77]*/
 -- 
-2.43.0
+2.45.0
 
 
-From 2a12baa9e201f54560ec99ad5ee1fa5b0006aa39 Mon Sep 17 00:00:00 2001
+From 6872b634078a2c69644235781ebffb07f8edcb83 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 25 Jul 2019 17:19:06 +0200
-Subject: [PATCH 2/6] Disable Python's hash implementations in FIPS mode,
+Subject: [PATCH 2/5] Disable Python's hash implementations in FIPS mode,
  forcing OpenSSL
 
 ---
@@ -445,10 +445,10 @@ index a8bad9d..1b1d937 100644
 +    if (_Py_hashlib_fips_error(exc, name)) return NULL; \
 +} while (0)
 diff --git a/configure.ac b/configure.ac
-index 1876f77..1875d1e 100644
+index 65ad1c2..b5f9ab5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -7439,7 +7439,8 @@ PY_STDLIB_MOD([_sha2],
+@@ -7463,7 +7463,8 @@ PY_STDLIB_MOD([_sha2],
  PY_STDLIB_MOD([_sha3], [test "$with_builtin_sha3" = yes])
  PY_STDLIB_MOD([_blake2],
    [test "$with_builtin_blake2" = yes], [],
@@ -459,13 +459,13 @@ index 1876f77..1875d1e 100644
  PY_STDLIB_MOD([_crypt],
    [], [test "$ac_cv_crypt_crypt" = yes],
 -- 
-2.43.0
+2.45.0
 
 
-From bca05b7fdb8dcab21ef80db1d59dd5daa835d84b Mon Sep 17 00:00:00 2001
+From f904abdd7a607282c2cdfd18288045cedfa28414 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Fri, 29 Jan 2021 14:16:21 +0100
-Subject: [PATCH 3/6] Use python's fall back crypto implementations only if we
+Subject: [PATCH 3/5] Use python's fall back crypto implementations only if we
  are not in FIPS mode
 
 ---
@@ -552,13 +552,13 @@ index dd61a9a..6031b02 100644
          get_builtin_constructor = getattr(hashlib,
                                            '__get_builtin_constructor')
 -- 
-2.43.0
+2.45.0
 
 
-From c9a79f0aafd28677e3e0b8a1f6410105a71ff071 Mon Sep 17 00:00:00 2001
+From 9bf0a53b7831409613c44fd7feecb56476f5e5e7 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Wed, 31 Jul 2019 15:43:43 +0200
-Subject: [PATCH 4/6] Test equivalence of hashes for the various digests with
+Subject: [PATCH 4/5] Test equivalence of hashes for the various digests with
  usedforsecurity=True/False
 
 ---
@@ -712,13 +712,13 @@ index 6031b02..5bd5297 100644
  class KDFTests(unittest.TestCase):
  
 -- 
-2.43.0
+2.45.0
 
 
-From e972a838729ea84a0f2e0ca8e88ae1bfc129e7d8 Mon Sep 17 00:00:00 2001
+From 8a76571515a64a57b4ea0586ae8376cf2ef0ac60 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 26 Aug 2019 19:39:48 +0200
-Subject: [PATCH 5/6] Guard against Python HMAC in FIPS mode
+Subject: [PATCH 5/5] Guard against Python HMAC in FIPS mode
 
 ---
  Lib/hmac.py           | 13 +++++++++----
@@ -726,7 +726,7 @@ Subject: [PATCH 5/6] Guard against Python HMAC in FIPS mode
  2 files changed, 19 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/hmac.py b/Lib/hmac.py
-index 8b4f920..20ef96c 100644
+index 8b4eb2f..e8e4864 100644
 --- a/Lib/hmac.py
 +++ b/Lib/hmac.py
 @@ -16,8 +16,9 @@ else:
@@ -773,7 +773,7 @@ index 8b4f920..20ef96c 100644
              digest_cons = digestmod
          elif isinstance(digestmod, str):
 diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
-index a39a2c4..b7b24ab 100644
+index 1502fba..7997073 100644
 --- a/Lib/test/test_hmac.py
 +++ b/Lib/test/test_hmac.py
 @@ -5,6 +5,7 @@ import hashlib
@@ -812,7 +812,7 @@ index a39a2c4..b7b24ab 100644
      @unittest.skipUnless(sha256_module is not None, 'need _sha256')
      def test_with_sha256_module(self):
          h = hmac.HMAC(b"key", b"hash this!", digestmod=sha256_module.sha256)
-@@ -481,6 +489,7 @@ class SanityTestCase(unittest.TestCase):
+@@ -489,6 +497,7 @@ class UpdateTestCase(unittest.TestCase):
  
  class CopyTestCase(unittest.TestCase):
  
@@ -820,7 +820,7 @@ index a39a2c4..b7b24ab 100644
      @hashlib_helper.requires_hashdigest('sha256')
      def test_attributes_old(self):
          # Testing if attributes are of same type.
-@@ -492,6 +501,7 @@ class CopyTestCase(unittest.TestCase):
+@@ -500,6 +509,7 @@ class CopyTestCase(unittest.TestCase):
          self.assertEqual(type(h1._outer), type(h2._outer),
              "Types of outer don't match.")
  
@@ -829,270 +829,5 @@ index a39a2c4..b7b24ab 100644
      def test_realcopy_old(self):
          # Testing if the copy method created a real copy.
 -- 
-2.43.0
+2.45.0
-
-
-From b12202196a78b877dcd32cfea273051b60038a41 Mon Sep 17 00:00:00 2001
-From: Petr Viktorin <encukou@gmail.com>
-Date: Wed, 25 Aug 2021 16:44:43 +0200
-Subject: [PATCH 6/6] Disable hash-based PYCs in FIPS mode
-
-If FIPS mode is on, we can't use siphash-based HMAC
-(_Py_KeyedHash), so:
-
-- Unchecked hash PYCs can be imported, but not created
-- Checked hash PYCs can not be imported nor created
-- The default mode is timestamp-based PYCs, even if
-  SOURCE_DATE_EPOCH is set.
-
-If FIPS mode is off, there are no changes in behavior.
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1835169
----
- Lib/py_compile.py                             |  4 +++-
- Lib/test/support/__init__.py                  | 14 +++++++++++++
- Lib/test/test_cmd_line_script.py              |  2 ++
- Lib/test/test_compileall.py                   | 11 +++++++++-
- .../test_importlib/source/test_file_loader.py |  6 ++++++
- Lib/test/test_py_compile.py                   | 11 ++++++++--
- Lib/test/test_zipimport.py                    |  2 ++
- Python/import.c                               | 20 +++++++++++++++++++
- 8 files changed, 66 insertions(+), 4 deletions(-)
-
-diff --git a/Lib/py_compile.py b/Lib/py_compile.py
-index 388614e..fd9a139 100644
---- a/Lib/py_compile.py
-+++ b/Lib/py_compile.py
-@@ -70,7 +70,9 @@ class PycInvalidationMode(enum.Enum):
- 
- 
- def _get_default_invalidation_mode():
--    if os.environ.get('SOURCE_DATE_EPOCH'):
-+    import _hashlib
-+    if (os.environ.get('SOURCE_DATE_EPOCH') and not
-+          _hashlib.get_fips_mode()):
-         return PycInvalidationMode.CHECKED_HASH
-     else:
-         return PycInvalidationMode.TIMESTAMP
-diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
-index fd9265c..fcd1ea7 100644
---- a/Lib/test/support/__init__.py
-+++ b/Lib/test/support/__init__.py
-@@ -2346,6 +2346,20 @@ def sleeping_retry(timeout, err_msg=None, /,
-         delay = min(delay * 2, max_delay)
- 
- 
-+def fails_in_fips_mode(expected_error):
-+    import _hashlib
-+    if _hashlib.get_fips_mode():
-+        def _decorator(func):
-+            def _wrapper(self, *args, **kwargs):
-+                with self.assertRaises(expected_error):
-+                    func(self, *args, **kwargs)
-+            return _wrapper
-+    else:
-+        def _decorator(func):
-+            return func
-+    return _decorator
-+
-+
- @contextlib.contextmanager
- def adjust_int_max_str_digits(max_digits):
-     """Temporarily change the integer string conversion length limit."""
-diff --git a/Lib/test/test_cmd_line_script.py b/Lib/test/test_cmd_line_script.py
-index 1b58882..d6caff1 100644
---- a/Lib/test/test_cmd_line_script.py
-+++ b/Lib/test/test_cmd_line_script.py
-@@ -286,6 +286,7 @@ class CmdLineTest(unittest.TestCase):
-             self._check_script(zip_name, run_name, zip_name, zip_name, '',
-                                zipimport.zipimporter)
- 
-+    @support.fails_in_fips_mode(ImportError)
-     def test_zipfile_compiled_checked_hash(self):
-         with os_helper.temp_dir() as script_dir:
-             script_name = _make_test_script(script_dir, '__main__')
-@@ -296,6 +297,7 @@ class CmdLineTest(unittest.TestCase):
-             self._check_script(zip_name, run_name, zip_name, zip_name, '',
-                                zipimport.zipimporter)
- 
-+    @support.fails_in_fips_mode(ImportError)
-     def test_zipfile_compiled_unchecked_hash(self):
-         with os_helper.temp_dir() as script_dir:
-             script_name = _make_test_script(script_dir, '__main__')
-diff --git a/Lib/test/test_compileall.py b/Lib/test/test_compileall.py
-index 9cd92ad..4ec29a1 100644
---- a/Lib/test/test_compileall.py
-+++ b/Lib/test/test_compileall.py
-@@ -806,14 +806,23 @@ class CommandLineTestsBase:
-         out = self.assertRunOK('badfilename')
-         self.assertRegex(out, b"Can't list 'badfilename'")
- 
--    def test_pyc_invalidation_mode(self):
-+    @support.fails_in_fips_mode(AssertionError)
-+    def test_pyc_invalidation_mode_checked(self):
-         script_helper.make_script(self.pkgdir, 'f1', '')
-         pyc = importlib.util.cache_from_source(
-             os.path.join(self.pkgdir, 'f1.py'))
-+
-         self.assertRunOK('--invalidation-mode=checked-hash', self.pkgdir)
-         with open(pyc, 'rb') as fp:
-             data = fp.read()
-         self.assertEqual(int.from_bytes(data[4:8], 'little'), 0b11)
-+
-+    @support.fails_in_fips_mode(AssertionError)
-+    def test_pyc_invalidation_mode_unchecked(self):
-+        script_helper.make_script(self.pkgdir, 'f1', '')
-+        pyc = importlib.util.cache_from_source(
-+            os.path.join(self.pkgdir, 'f1.py'))
-+
-         self.assertRunOK('--invalidation-mode=unchecked-hash', self.pkgdir)
-         with open(pyc, 'rb') as fp:
-             data = fp.read()
-diff --git a/Lib/test/test_importlib/source/test_file_loader.py b/Lib/test/test_importlib/source/test_file_loader.py
-index f35adec..62087c6 100644
---- a/Lib/test/test_importlib/source/test_file_loader.py
-+++ b/Lib/test/test_importlib/source/test_file_loader.py
-@@ -16,6 +16,7 @@ import types
- import unittest
- import warnings
- 
-+from test import support
- from test.support.import_helper import make_legacy_pyc, unload
- 
- from test.test_py_compile import without_source_date_epoch
-@@ -237,6 +238,7 @@ class SimpleTest(abc.LoaderTests):
-                 loader.load_module('bad name')
- 
-     @util.writes_bytecode_files
-+    @support.fails_in_fips_mode(ImportError)
-     def test_checked_hash_based_pyc(self):
-         with util.create_modules('_temp') as mapping:
-             source = mapping['_temp']
-@@ -268,6 +270,7 @@ class SimpleTest(abc.LoaderTests):
-             )
- 
-     @util.writes_bytecode_files
-+    @support.fails_in_fips_mode(ImportError)
-     def test_overridden_checked_hash_based_pyc(self):
-         with util.create_modules('_temp') as mapping, \
-              unittest.mock.patch('_imp.check_hash_based_pycs', 'never'):
-@@ -293,6 +296,7 @@ class SimpleTest(abc.LoaderTests):
-             self.assertEqual(mod.state, 'old')
- 
-     @util.writes_bytecode_files
-+    @support.fails_in_fips_mode(ImportError)
-     def test_unchecked_hash_based_pyc(self):
-         with util.create_modules('_temp') as mapping:
-             source = mapping['_temp']
-@@ -323,6 +327,7 @@ class SimpleTest(abc.LoaderTests):
-             )
- 
-     @util.writes_bytecode_files
-+    @support.fails_in_fips_mode(ImportError)
-     def test_overridden_unchecked_hash_based_pyc(self):
-         with util.create_modules('_temp') as mapping, \
-              unittest.mock.patch('_imp.check_hash_based_pycs', 'always'):
-@@ -432,6 +437,7 @@ class BadBytecodeTest:
-                                                del_source=del_source)
-             test('_temp', mapping, bc_path)
- 
-+    @support.fails_in_fips_mode(ImportError)
-     def _test_partial_hash(self, test, *, del_source=False):
-         with util.create_modules('_temp') as mapping:
-             bc_path = self.manipulate_bytecode(
-diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
-index c4e6551..81fd962 100644
---- a/Lib/test/test_py_compile.py
-+++ b/Lib/test/test_py_compile.py
-@@ -141,13 +141,16 @@ class PyCompileTestsBase:
-             importlib.util.cache_from_source(bad_coding)))
- 
-     def test_source_date_epoch(self):
-+        import _hashlib
-         py_compile.compile(self.source_path, self.pyc_path)
-         self.assertTrue(os.path.exists(self.pyc_path))
-         self.assertFalse(os.path.exists(self.cache_path))
-         with open(self.pyc_path, 'rb') as fp:
-             flags = importlib._bootstrap_external._classify_pyc(
-                 fp.read(), 'test', {})
--        if os.environ.get('SOURCE_DATE_EPOCH'):
-+        if _hashlib.get_fips_mode():
-+            expected_flags = 0b00
-+        elif os.environ.get('SOURCE_DATE_EPOCH'):
-             expected_flags = 0b11
-         else:
-             expected_flags = 0b00
-@@ -178,7 +181,8 @@ class PyCompileTestsBase:
-         # Specifying optimized bytecode should lead to a path reflecting that.
-         self.assertIn('opt-2', py_compile.compile(self.source_path, optimize=2))
- 
--    def test_invalidation_mode(self):
-+    @support.fails_in_fips_mode(ImportError)
-+    def test_invalidation_mode_checked(self):
-         py_compile.compile(
-             self.source_path,
-             invalidation_mode=py_compile.PycInvalidationMode.CHECKED_HASH,
-@@ -187,6 +191,9 @@ class PyCompileTestsBase:
-             flags = importlib._bootstrap_external._classify_pyc(
-                 fp.read(), 'test', {})
-         self.assertEqual(flags, 0b11)
-+
-+    @support.fails_in_fips_mode(ImportError)
-+    def test_invalidation_mode_unchecked(self):
-         py_compile.compile(
-             self.source_path,
-             invalidation_mode=py_compile.PycInvalidationMode.UNCHECKED_HASH,
-diff --git a/Lib/test/test_zipimport.py b/Lib/test/test_zipimport.py
-index 14c1971..bcd1466 100644
---- a/Lib/test/test_zipimport.py
-+++ b/Lib/test/test_zipimport.py
-@@ -190,6 +190,7 @@ class UncompressedZipImportTestCase(ImportHooksBaseTestCase):
-                  TESTMOD + pyc_ext: (NOW, test_pyc)}
-         self.doTest(pyc_ext, files, TESTMOD)
- 
-+    @support.fails_in_fips_mode(ImportError)
-     def testUncheckedHashBasedPyc(self):
-         source = b"state = 'old'"
-         source_hash = importlib.util.source_hash(source)
-@@ -204,6 +205,7 @@ class UncompressedZipImportTestCase(ImportHooksBaseTestCase):
-             self.assertEqual(mod.state, 'old')
-         self.doTest(None, files, TESTMOD, call=check)
- 
-+    @support.fails_in_fips_mode(ImportError)
-     @unittest.mock.patch('_imp.check_hash_based_pycs', 'always')
-     def test_checked_hash_based_change_pyc(self):
-         source = b"state = 'old'"
-diff --git a/Python/import.c b/Python/import.c
-index 54232a1..236786b 100644
---- a/Python/import.c
-+++ b/Python/import.c
-@@ -3829,6 +3829,26 @@ static PyObject *
- _imp_source_hash_impl(PyObject *module, long key, Py_buffer *source)
- /*[clinic end generated code: output=edb292448cf399ea input=9aaad1e590089789]*/
- {
-+    PyObject *_hashlib = PyImport_ImportModule("_hashlib");
-+    if (_hashlib == NULL) {
-+        return NULL;
-+    }
-+    PyObject *fips_mode_obj = PyObject_CallMethod(_hashlib, "get_fips_mode", NULL);
-+    Py_DECREF(_hashlib);
-+    if (fips_mode_obj == NULL) {
-+        return NULL;
-+    }
-+    int fips_mode = PyObject_IsTrue(fips_mode_obj);
-+    Py_DECREF(fips_mode_obj);
-+    if (fips_mode < 0) {
-+        return NULL;
-+    }
-+    if (fips_mode) {
-+        PyErr_SetString(
-+            PyExc_ImportError,
-+            "hash-based PYC validation (siphash24) not available in FIPS mode");
-+        return NULL;
-+    };
-     union {
-         uint64_t x;
-         char data[sizeof(uint64_t)];
--- 
-2.43.0
 

SOURCES/00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch

@@ -0,0 +1,88 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Serhiy Storchaka <storchaka@gmail.com>
+Date: Sun, 11 Feb 2024 12:08:39 +0200
+Subject: [PATCH] 00422: gh-115133: Fix tests for XMLPullParser with Expat
+ 2.6.0
+
+Feeding the parser by too small chunks defers parsing to prevent
+CVE-2023-52425. Future versions of Expat may be more reactive.
+
+(cherry picked from commit 4a08e7b3431cd32a0daf22a33421cd3035343dc4)
+---
+ Lib/test/test_xml_etree.py                    | 58 ++++++++++++-------
+ ...-02-08-14-21-28.gh-issue-115133.ycl4ko.rst |  2 +
+ 2 files changed, 38 insertions(+), 22 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+
+diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
+index b50898f1d1..6fb888cb21 100644
+--- a/Lib/test/test_xml_etree.py
++++ b/Lib/test/test_xml_etree.py
+@@ -1400,28 +1400,37 @@ class XMLPullParserTest(unittest.TestCase):
+         self.assertEqual([(action, elem.tag) for action, elem in events],
+                          expected)
+ 
+-    def test_simple_xml(self):
+-        for chunk_size in (None, 1, 5):
+-            with self.subTest(chunk_size=chunk_size):
+-                parser = ET.XMLPullParser()
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser, "<!-- comment -->\n", chunk_size)
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser,
+-                           "<root>\n  <element key='value'>text</element",
+-                           chunk_size)
+-                self.assert_event_tags(parser, [])
+-                self._feed(parser, ">\n", chunk_size)
+-                self.assert_event_tags(parser, [('end', 'element')])
+-                self._feed(parser, "<element>text</element>tail\n", chunk_size)
+-                self._feed(parser, "<empty-element/>\n", chunk_size)
+-                self.assert_event_tags(parser, [
+-                    ('end', 'element'),
+-                    ('end', 'empty-element'),
+-                    ])
+-                self._feed(parser, "</root>\n", chunk_size)
+-                self.assert_event_tags(parser, [('end', 'root')])
+-                self.assertIsNone(parser.close())
++    def test_simple_xml(self, chunk_size=None):
++        parser = ET.XMLPullParser()
++        self.assert_event_tags(parser, [])
++        self._feed(parser, "<!-- comment -->\n", chunk_size)
++        self.assert_event_tags(parser, [])
++        self._feed(parser,
++                   "<root>\n  <element key='value'>text</element",
++                   chunk_size)
++        self.assert_event_tags(parser, [])
++        self._feed(parser, ">\n", chunk_size)
++        self.assert_event_tags(parser, [('end', 'element')])
++        self._feed(parser, "<element>text</element>tail\n", chunk_size)
++        self._feed(parser, "<empty-element/>\n", chunk_size)
++        self.assert_event_tags(parser, [
++            ('end', 'element'),
++            ('end', 'empty-element'),
++            ])
++        self._feed(parser, "</root>\n", chunk_size)
++        self.assert_event_tags(parser, [('end', 'root')])
++        self.assertIsNone(parser.close())
++
++    @unittest.expectedFailure
++    def test_simple_xml_chunk_1(self):
++        self.test_simple_xml(chunk_size=1)
++
++    @unittest.expectedFailure
++    def test_simple_xml_chunk_5(self):
++        self.test_simple_xml(chunk_size=5)
++
++    def test_simple_xml_chunk_22(self):
++        self.test_simple_xml(chunk_size=22)
+ 
+     def test_feed_while_iterating(self):
+         parser = ET.XMLPullParser()
+diff --git a/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+new file mode 100644
+index 0000000000..6f1015235c
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2024-02-08-14-21-28.gh-issue-115133.ycl4ko.rst
+@@ -0,0 +1,2 @@
++Fix tests for :class:`~xml.etree.ElementTree.XMLPullParser` with Expat
++2.6.0.

SOURCES/check-pyc-timestamps.py

@@ -16,7 +16,6 @@ LEVELS = (None, 1, 2)
 # list of globs of test and other files that we expect not to have bytecode
 not_compiled = [
     '/usr/bin/*',
-    '/usr/lib/rpm/redhat/*',
     '*/test/badsyntax_*.py',
     '*/tokenizedata/bad_coding.py',
     '*/tokenizedata/bad_coding2.py',

SOURCES/import_all_modules_py3_12.py

@@ -1,171 +0,0 @@
-'''Script to perform import of each module given to %%py_check_import
-'''
-import argparse
-import importlib
-import fnmatch
-import os
-import re
-import site
-import sys
-
-from contextlib import contextmanager
-from pathlib import Path
-
-
-def read_modules_files(file_paths):
-    '''Read module names from the files (modules must be newline separated).
-
-    Return the module names list or, if no files were provided, an empty list.
-    '''
-
-    if not file_paths:
-        return []
-
-    modules = []
-    for file in file_paths:
-        file_contents = file.read_text()
-        modules.extend(file_contents.split())
-    return modules
-
-
-def read_modules_from_cli(argv):
-    '''Read module names from command-line arguments (space or comma separated).
-
-    Return the module names list.
-    '''
-
-    if not argv:
-        return []
-
-    # %%py3_check_import allows to separate module list with comma or whitespace,
-    # we need to unify the output to a list of particular elements
-    modules_as_str = ' '.join(argv)
-    modules = re.split(r'[\s,]+', modules_as_str)
-    # Because of shell expansion in some less typical cases it may happen
-    # that a trailing space will occur at the end of the list.
-    # Remove the empty items from the list before passing it further
-    modules = [m for m in modules if m]
-    return modules
-
-
-def filter_top_level_modules_only(modules):
-    '''Filter out entries with nested modules (containing dot) ie. 'foo.bar'.
-
-    Return the list of top-level modules.
-    '''
-
-    return [module for module in modules if '.' not in module]
-
-
-def any_match(text, globs):
-    '''Return True if any of given globs fnmatchcase's the given text.'''
-
-    return any(fnmatch.fnmatchcase(text, g) for g in globs)
-
-
-def exclude_unwanted_module_globs(globs, modules):
-    '''Filter out entries which match the either of the globs given as argv.
-
-    Return the list of filtered modules.
-    '''
-
-    return [m for m in modules if not any_match(m, globs)]
-
-
-def read_modules_from_all_args(args):
-    '''Return a joined list of modules from all given command-line arguments.
-    '''
-
-    modules = read_modules_files(args.filename)
-    modules.extend(read_modules_from_cli(args.modules))
-    if args.exclude:
-        modules = exclude_unwanted_module_globs(args.exclude, modules)
-
-    if args.top_level:
-        modules = filter_top_level_modules_only(modules)
-
-    # Error when someone accidentally managed to filter out everything
-    if len(modules) == 0:
-        raise ValueError('No modules to check were left')
-
-    return modules
-
-
-def import_modules(modules):
-    '''Procedure to perform import check for each module name from the given list of modules.
-    '''
-
-    for module in modules:
-        print('Check import:', module, file=sys.stderr)
-        importlib.import_module(module)
-
-
-def argparser():
-    parser = argparse.ArgumentParser(
-        description='Generate list of all importable modules for import check.'
-    )
-    parser.add_argument(
-        'modules', nargs='*',
-        help=('Add modules to check the import (space or comma separated).'),
-    )
-    parser.add_argument(
-        '-f', '--filename', action='append', type=Path,
-        help='Add importable module names list from file.',
-    )
-    parser.add_argument(
-        '-t', '--top-level', action='store_true',
-        help='Check only top-level modules.',
-    )
-    parser.add_argument(
-        '-e', '--exclude', action='append',
-        help='Provide modules globs to be excluded from the check.',
-    )
-    return parser
-
-
-@contextmanager
-def remove_unwanteds_from_sys_path():
-    '''Remove cwd and this script's parent from sys.path for the import test.
-    Bring the original contents back after import is done (or failed)
-    '''
-
-    cwd_absolute = Path.cwd().absolute()
-    this_file_parent = Path(__file__).parent.absolute()
-    old_sys_path = list(sys.path)
-    for path in old_sys_path:
-        if Path(path).absolute() in (cwd_absolute, this_file_parent):
-            sys.path.remove(path)
-    try:
-        yield
-    finally:
-        sys.path = old_sys_path
-
-
-def addsitedirs_from_environ():
-    '''Load directories from the _PYTHONSITE environment variable (separated by :)
-    and load the ones already present in sys.path via site.addsitedir()
-    to handle .pth files in them.
-
-    This is needed to properly import old-style namespace packages with nspkg.pth files.
-    See https://bugzilla.redhat.com/2018551 for a more detailed rationale.'''
-    for path in os.getenv('_PYTHONSITE', '').split(':'):
-        if path in sys.path:
-            site.addsitedir(path)
-
-
-def main(argv=None):
-
-    cli_args = argparser().parse_args(argv)
-
-    if not cli_args.modules and not cli_args.filename:
-        raise ValueError('No modules to check were provided')
-
-    modules = read_modules_from_all_args(cli_args)
-
-    with remove_unwanteds_from_sys_path():
-        addsitedirs_from_environ()
-        import_modules(modules)
-
-
-if __name__ == '__main__':
-    main()

SOURCES/macros.python3.12

@@ -1,91 +0,0 @@
-%__python3 /usr/bin/python3.12
-%python3_pkgversion 3.12
-
-# The following are macros from macros.python3 in Fedora that are newer/different than those in the python3-rpm-macros package in RHEL 8.
-# These macros overwrite/supercede some of the macros in the python3-rpm-macros package in RHEL.
-
-# nb: $RPM_BUILD_ROOT is not set when the macros are expanded (at spec parse time)
-#     so we set it manually (to empty string), making our Python prefer the correct install scheme location
-# platbase/base is explicitly set to %%{_prefix} to support custom values, such as /app for flatpaks
-%python3_sitelib %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '%{_prefix}', 'base': '%{_prefix}'}))")
-%python3_sitearch %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_path('platlib', vars={'platbase': '%{_prefix}', 'base': '%{_prefix}'}))")
-%python3_version %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; sys.stdout.write('{0.major}.{0.minor}'.format(sys.version_info))")
-%python3_version_nodots %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; sys.stdout.write('{0.major}{0.minor}'.format(sys.version_info))")
-%python3_platform %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_platform())")
-%python3_platform_triplet %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_config_var('MULTIARCH'))")
-%python3_ext_suffix %(RPM_BUILD_ROOT= %{__python3} -Ic "import sysconfig; print(sysconfig.get_config_var('EXT_SUFFIX'))")
-%python3_cache_tag %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print(sys.implementation.cache_tag)")
-
-%_py3_shebang_s s
-%_py3_shebang_P %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print('P' if hasattr(sys.flags, 'safe_path') else '')")
-%py3_shbang_opts -%{?_py3_shebang_s}%{?_py3_shebang_P}
-
-%py3_shebang_fix %{expand:\\\
-  if [ -z "%{?py3_shebang_flags}" ]; then
-    shebang_flags="-k"
-  else
-    shebang_flags="-ka%{py3_shebang_flags}"
-  fi
-  %{__python3} -B %{_rpmconfigdir}/redhat/pathfix_py3_12.py -pni %{__python3} $shebang_flags}
-
-%py3_install() %{expand:\\\
-  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
-  %{__python3} %{py_setup} %{?py_setup_args} install -O1 --skip-build --root %{buildroot} --prefix %{_prefix} %{?*}
-  rm -rfv %{buildroot}%{_bindir}/__pycache__
-}
-
-%py3_install_egg() %{expand:\\\
-  mkdir -p %{buildroot}%{python3_sitelib}
-  %{__python3} -m easy_install -m --prefix %{buildroot}%{_prefix} -Z dist/*-py%{python3_version}.egg %{?*}
-  rm -rfv %{buildroot}%{_bindir}/__pycache__
-}
-
-%py3_install_wheel() %{expand:\\\
-  %{__python3} -m pip install -I dist/%{1} --root %{buildroot} --prefix %{_prefix} --no-deps --no-index --no-warn-script-location
-  rm -rfv %{buildroot}%{_bindir}/__pycache__
-  for distinfo in %{buildroot}%{python3_sitelib}/*.dist-info %{buildroot}%{python3_sitearch}/*.dist-info; do
-    if [ -f ${distinfo}/direct_url.json ]; then
-      rm -fv ${distinfo}/direct_url.json
-      sed -i '/direct_url.json/d' ${distinfo}/RECORD
-    fi
-  done
-}
-
-# With $PATH and $PYTHONPATH set to the %%buildroot,
-# try to import the Python 3 module(s) given as command-line args or read from file (-f).
-# Respect the custom values of %%py3_shebang_flags or set nothing if it's undefined.
-# Filter and check import on only top-level modules using -t flag.
-# Exclude unwanted modules by passing their globs to -e option.
-# Useful as a smoke test in %%check when running tests is not feasible.
-# Use spaces or commas as separators if providing list directly.
-# Use newlines as separators if providing list in a file.
-%py3_check_import(e:tf:) %{expand:\\\
-  PATH="%{buildroot}%{_bindir}:$PATH"\\\
-  PYTHONPATH="${PYTHONPATH:-%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}}"\\\
-  _PYTHONSITE="%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}"\\\
-  PYTHONDONTWRITEBYTECODE=1\\\
-  %{lua:
-  local command = "%{__python3} "
-  if rpm.expand("%{?py3_shebang_flags}") ~= "" then
-    command = command .. "-%{py3_shebang_flags}"
-  end
-  command = command .. " %{_rpmconfigdir}/redhat/import_all_modules_py3_12.py "
-  -- handle multiline arguments correctly, see https://bugzilla.redhat.com/2018809
-  local args=rpm.expand('%{?**}'):gsub("[%s\\\\]*%s+", " ")
-  print(command .. args)
-  }
-}
-
-# Environment variables used by %%pytest, %%tox or standalone, e.g.:
-#  %%{py3_test_envvars} %%{python3} -m unittest
-%py3_test_envvars %{expand:\\\
-  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
-  PATH="%{buildroot}%{_bindir}:$PATH"\\\
-  PYTHONPATH="${PYTHONPATH:-%{buildroot}%{python3_sitearch}:%{buildroot}%{python3_sitelib}}"\\\
-  PYTHONDONTWRITEBYTECODE=1\\\
-  %{?__pytest_addopts:PYTEST_ADDOPTS="${PYTEST_ADDOPTS:-} %{__pytest_addopts}"}\\\
-  PYTEST_XDIST_AUTO_NUM_WORKERS=%{_smp_build_ncpus}}
-
-# This is intended for Python 3 only, hence also no Python version in the name.
-%__pytest /usr/bin/pytest-%{python3_version}
-%pytest %py3_test_envvars %__pytest

SOURCES/pathfix_py3_12.py

@@ -1,199 +0,0 @@
-#!/usr/bin/env python3
-
-import sys
-import os
-from stat import *
-import getopt
-
-err = sys.stderr.write
-dbg = err
-rep = sys.stdout.write
-
-new_interpreter = None
-preserve_timestamps = False
-create_backup = True
-keep_flags = False
-add_flags = b''
-
-
-def main():
-    global new_interpreter
-    global preserve_timestamps
-    global create_backup
-    global keep_flags
-    global add_flags
-
-    usage = ('usage: %s -i /interpreter -p -n -k -a file-or-directory ...\n' %
-             sys.argv[0])
-    try:
-        opts, args = getopt.getopt(sys.argv[1:], 'i:a:kpn')
-    except getopt.error as msg:
-        err(str(msg) + '\n')
-        err(usage)
-        sys.exit(2)
-    for o, a in opts:
-        if o == '-i':
-            new_interpreter = a.encode()
-        if o == '-p':
-            preserve_timestamps = True
-        if o == '-n':
-            create_backup = False
-        if o == '-k':
-            keep_flags = True
-        if o == '-a':
-            add_flags = a.encode()
-            if b' ' in add_flags:
-                err("-a option doesn't support whitespaces")
-                sys.exit(2)
-    if not new_interpreter or not new_interpreter.startswith(b'/') or \
-           not args:
-        err('-i option or file-or-directory missing\n')
-        err(usage)
-        sys.exit(2)
-    bad = 0
-    for arg in args:
-        if os.path.isdir(arg):
-            if recursedown(arg): bad = 1
-        elif os.path.islink(arg):
-            err(arg + ': will not process symbolic links\n')
-            bad = 1
-        else:
-            if fix(arg): bad = 1
-    sys.exit(bad)
-
-
-def ispython(name):
-    return name.endswith('.py')
-
-
-def recursedown(dirname):
-    dbg('recursedown(%r)\n' % (dirname,))
-    bad = 0
-    try:
-        names = os.listdir(dirname)
-    except OSError as msg:
-        err('%s: cannot list directory: %r\n' % (dirname, msg))
-        return 1
-    names.sort()
-    subdirs = []
-    for name in names:
-        if name in (os.curdir, os.pardir): continue
-        fullname = os.path.join(dirname, name)
-        if os.path.islink(fullname): pass
-        elif os.path.isdir(fullname):
-            subdirs.append(fullname)
-        elif ispython(name):
-            if fix(fullname): bad = 1
-    for fullname in subdirs:
-        if recursedown(fullname): bad = 1
-    return bad
-
-
-def fix(filename):
-##  dbg('fix(%r)\n' % (filename,))
-    try:
-        f = open(filename, 'rb')
-    except IOError as msg:
-        err('%s: cannot open: %r\n' % (filename, msg))
-        return 1
-    with f:
-        line = f.readline()
-        fixed = fixline(line)
-        if line == fixed:
-            rep(filename+': no change\n')
-            return
-        head, tail = os.path.split(filename)
-        tempname = os.path.join(head, '@' + tail)
-        try:
-            g = open(tempname, 'wb')
-        except IOError as msg:
-            err('%s: cannot create: %r\n' % (tempname, msg))
-            return 1
-        with g:
-            rep(filename + ': updating\n')
-            g.write(fixed)
-            BUFSIZE = 8*1024
-            while 1:
-                buf = f.read(BUFSIZE)
-                if not buf: break
-                g.write(buf)
-
-    # Finishing touch -- move files
-
-    mtime = None
-    atime = None
-    # First copy the file's mode to the temp file
-    try:
-        statbuf = os.stat(filename)
-        mtime = statbuf.st_mtime
-        atime = statbuf.st_atime
-        os.chmod(tempname, statbuf[ST_MODE] & 0o7777)
-    except OSError as msg:
-        err('%s: warning: chmod failed (%r)\n' % (tempname, msg))
-    # Then make a backup of the original file as filename~
-    if create_backup:
-        try:
-            os.rename(filename, filename + '~')
-        except OSError as msg:
-            err('%s: warning: backup failed (%r)\n' % (filename, msg))
-    else:
-        try:
-            os.remove(filename)
-        except OSError as msg:
-            err('%s: warning: removing failed (%r)\n' % (filename, msg))
-    # Now move the temp file to the original file
-    try:
-        os.rename(tempname, filename)
-    except OSError as msg:
-        err('%s: rename failed (%r)\n' % (filename, msg))
-        return 1
-    if preserve_timestamps:
-        if atime and mtime:
-            try:
-                os.utime(filename, (atime, mtime))
-            except OSError as msg:
-                err('%s: reset of timestamp failed (%r)\n' % (filename, msg))
-                return 1
-    # Return success
-    return 0
-
-
-def parse_shebang(shebangline):
-    shebangline = shebangline.rstrip(b'\n')
-    start = shebangline.find(b' -')
-    if start == -1:
-        return b''
-    return shebangline[start:]
-
-
-def populate_flags(shebangline):
-    old_flags = b''
-    if keep_flags:
-        old_flags = parse_shebang(shebangline)
-        if old_flags:
-            old_flags = old_flags[2:]
-    if not (old_flags or add_flags):
-        return b''
-    # On Linux, the entire string following the interpreter name
-    # is passed as a single argument to the interpreter.
-    # e.g. "#! /usr/bin/python3 -W Error -s" runs "/usr/bin/python3 "-W Error -s"
-    # so shebang should have single '-' where flags are given and
-    # flag might need argument for that reasons adding new flags is
-    # between '-' and original flags
-    # e.g. #! /usr/bin/python3 -sW Error
-    return b' -' + add_flags + old_flags
-
-
-def fixline(line):
-    if not line.startswith(b'#!'):
-        return line
-
-    if b"python" not in line:
-        return line
-
-    flags = populate_flags(line)
-    return b'#! ' + new_interpreter + flags + b'\n'
-
-
-if __name__ == '__main__':
-    main()

SPECS/python3.12.spec

@@ -20,7 +20,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 4%{?dist}
+Release: 4%{?dist}.1
 License: Python
 
 
@@ -62,6 +62,7 @@ License: Python
 # Whether to use RPM build wheels from the python-{pip,setuptools,wheel}-wheel packages
 # Uses upstream bundled prebuilt wheels otherwise
 %bcond_without rpmwheels
+
 # If the rpmwheels condition is disabled, we use the bundled wheel packages
 # from Python with the versions below.
 # This needs to be manually updated when we update Python.
@@ -313,11 +314,6 @@ Source1: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz.a
 # The release manager for Python 3.12 is Thomas Wouters
 Source2: https://github.com/Yhg1s.gpg
 
-# Sources for the python3.12-rpm-macros
-Source3: macros.python3.12
-Source4: import_all_modules_py3_12.py
-Source5: pathfix_py3_12.py
-
 # A simple script to check timestamps of bytecode files
 # Run in check section with Python that is currently being built
 # Originally written by bkabrda
@@ -389,6 +385,13 @@ Patch397: 00397-tarfile-filter.patch
 # Thomas Dwyer.
 Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-parseaddr-111116.patch
 
+# 00422 # a353cebef737c41420dc7ae2469dd657371b8881
+# gh-115133: Fix tests for XMLPullParser with Expat 2.6.0
+#
+# Feeding the parser by too small chunks defers parsing to prevent
+# CVE-2023-52425. Future versions of Expat may be more reactive.
+Patch422: 00422-gh-115133-fix-tests-for-xmlpullparser-with-expat-2-6-0.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -407,14 +410,6 @@ Patch415: 00415-cve-2023-27043-gh-102988-reject-malformed-addresses-in-email-par
 # Descriptions, and metadata for subpackages
 # ==========================================
 
-# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
-Requires:         alternatives >= 1.19.2-1
-Requires(post):   alternatives >= 1.19.2-1
-Requires(postun): alternatives >= 1.19.2-1
-
-# When the user tries to `yum install python`, yum will list this package among
-# the possible alternatives
-Provides: alternative-for(python)
 
 %if %{with main_python}
 # Description for the python3X SRPM only:
@@ -489,7 +484,6 @@ Documentation for Python is provided in the %{pkgname}-docs package.
 Packages containing additional libraries for Python are generally named with
 the "%{pkgname}-" prefix.
 
-For the unversioned "python" executable, see manual page "unversioned-python".
 
 %if %{with main_python}
 # https://fedoraproject.org/wiki/Changes/Move_usr_bin_python_into_separate_package
@@ -570,12 +564,9 @@ Requires: (python3-rpm-macros if rpm-build)
 # On Fedora, we keep this to avoid one additional round of %%generate_buildrequires.
 %{!?rhel:Requires: (pyproject-rpm-macros if rpm-build)}
 
-# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
+# We provide the python3.12-rpm-macros here to make it possible to
-Requires(postun): alternatives >= 1.19.2-1
+# BuildRequire them in the same manner as RHEL8.
-
+Provides: %{pkgname}-rpm-macros = %{version}-%{release}
-# python3.12 installs the alternatives master symlink to which we attach a slave
-Requires(post): %{pkgname}
-Requires(postun): %{pkgname}
 
 %unversioned_obsoletes_of_python3_X_if_main devel
 
@@ -624,13 +615,6 @@ Provides: idle = %{version}-%{release}
 Provides: %{pkgname}-tools = %{version}-%{release}
 Provides: %{pkgname}-tools%{?_isa} = %{version}-%{release}
 
-# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
-Requires(postun): alternatives >= 1.19.2-1
-
-# python3.12 installs the alternatives master symlink to which we attach a slave
-Requires(post): %{pkgname}
-Requires(postun): %{pkgname}
-
 %description -n %{pkgname}-idle
 IDLE is Python’s Integrated Development and Learning Environment.
 
@@ -702,13 +686,6 @@ Requires: %{pkgname}-idle%{?_isa} = %{version}-%{release}
 
 %unversioned_obsoletes_of_python3_X_if_main debug
 
-# Require alternatives version that implements the --keep-foreign flag and fixes rhbz#2203820
-Requires(postun): alternatives >= 1.19.2-1
-
-# python3.12 installs the alternatives master symlink to which we attach a slave
-Requires(post): %{pkgname}
-Requires(postun): %{pkgname}
-
 %description -n %{pkgname}-debug
 python3-debug provides a version of the Python runtime with numerous debugging
 features enabled, aimed at advanced Python users such as developers of Python
@@ -727,24 +704,6 @@ The debug runtime additionally supports debug builds of C-API extensions
 %endif # with debug_build
 
 
-# We package the python3.12-rpm-macros in RHEL8 as to properly set the
-# %%__python3 and %%python3_pkgversion macros as well as provide modern
-# versions the current base macros.
-%package -n %{pkgname}-rpm-macros
-Summary:    RPM macros for building RPMs with Python %{pybasever}
-License:    MIT
-Provides:   python-modular-rpm-macros == %{pybasever}
-Conflicts:  python-modular-rpm-macros > %{pybasever}
-Requires:   python3-rpm-macros
-BuildArch:  noarch
-
-%description -n %{pkgname}-rpm-macros
-RPM macros for building RPMs with Python %{pybasever} from the python%{pyshortver} module.
-If you want to build an RPM against the python%{pyshortver} module, you need to add:
-
-    BuildRequire: %{pkgname}-rpm-macros.
-
-
 # ======================================================
 # The prep phase of the build:
 # ======================================================
@@ -753,6 +712,14 @@ If you want to build an RPM against the python%{pyshortver} module, you need to
 %gpgverify -k2 -s1 -d0
 %autosetup -S git_am -n Python-%{upstream_version}
 
+# Verify the second level of bundled provides is up to date
+# Arguably this should be done in %%check, but %%prep has a faster feedback loop
+# setuptools.whl does not contain the vendored.txt files
+if [ -f %{_rpmconfigdir}/pythonbundles.py ]; then
+  %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/ensurepip/_bundled/pip-*.whl pip/_vendor/vendor.txt) --compare-with '%pip_bundled_provides'
+  %{_rpmconfigdir}/pythonbundles.py <(unzip -p Lib/test/wheel-*.whl wheel/vendored/vendor.txt) --compare-with '%wheel_bundled_provides'
+fi
+
 %if %{with rpmwheels}
 rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
 rm Lib/test/setuptools-%{setuptools_version}-py3-none-any.whl
@@ -1059,11 +1026,8 @@ done
 # Switch all shebangs to refer to the specific Python version.
 # This currently only covers files matching ^[a-zA-Z0-9_]+\.py$,
 # so handle files named using other naming scheme separately.
-# - RHEL 8 note: we use %%{SOURCE5} instead of pathfix.py, because in RHEL 8 we
-#   ship our own versioned pathfix_py3_12.py in this package, but during
-#   bootstrap it's not yet installed.
 LD_LIBRARY_PATH=./build/optimized ./build/optimized/python \
-  %{SOURCE5} \
+  %{_rpmconfigdir}/redhat/pathfix.py \
   -i "%{_bindir}/python%{pybasever}" -pn \
   %{buildroot} \
   %{buildroot}%{_bindir}/*%{pybasever}.py \
@@ -1165,29 +1129,6 @@ for file in %{buildroot}%{pylibdir}/pydoc_data/topics.py $(grep --include='*.py'
     rm ${directory}/{__pycache__/${module}.cpython-%{pyshortver}.opt-?.pyc,${module}.py}
 done
 
-# Python RPM macros for python3.12-rpm-macros
-mkdir -p %{buildroot}%{rpmmacrodir}/
-install -m 644 %{SOURCE3} \
-    %{buildroot}/%{rpmmacrodir}/
-
-# Add scripts that are being used by python3.12-rpm-macros
-mkdir -p %{buildroot}%{_rpmconfigdir}/redhat
-install -m 644 %{SOURCE4} %{buildroot}%{_rpmconfigdir}/redhat/
-install -m 644 %{SOURCE5} %{buildroot}%{_rpmconfigdir}/redhat/
-
-# All ghost files controlled by alternatives need to exist for the files
-# section check to succeed
-# - Don't list /usr/bin/python as a ghost file so `yum install /usr/bin/python`
-#   doesn't install this package
-touch %{buildroot}%{_bindir}/unversioned-python
-touch %{buildroot}%{_mandir}/man1/python.1.gz
-touch %{buildroot}%{_bindir}/python3
-touch %{buildroot}%{_mandir}/man1/python3.1.gz
-touch %{buildroot}%{_bindir}/pydoc3
-touch %{buildroot}%{_bindir}/pydoc-3
-touch %{buildroot}%{_bindir}/idle3
-touch %{buildroot}%{_bindir}/python3-config
-
 # ======================================================
 # Checks for packaging issues
 # ======================================================
@@ -1272,119 +1213,10 @@ CheckPython optimized
 
 %endif # with tests
 
-# ======================================================
-# Scriptlets for alternatives on rhel8
-# ======================================================
-%post
-# Alternative for /usr/bin/python -> /usr/bin/python3 + man page
-alternatives --install %{_bindir}/unversioned-python \
-                        python \
-                        %{_bindir}/python3 \
-                        300 \
-              --slave   %{_bindir}/python \
-                        unversioned-python \
-                        %{_bindir}/python3 \
-              --slave   %{_mandir}/man1/python.1.gz \
-                        unversioned-python-man \
-                        %{_mandir}/man1/python3.1.gz
-
-# Alternative for /usr/bin/python -> /usr/bin/python3.12 + man page
-alternatives --install %{_bindir}/unversioned-python \
-                        python \
-                        %{_bindir}/python3.12 \
-                        211 \
-              --slave   %{_bindir}/python \
-                        unversioned-python \
-                        %{_bindir}/python3.12 \
-              --slave   %{_mandir}/man1/python.1.gz \
-                        unversioned-python-man \
-                        %{_mandir}/man1/python3.12.1.gz
-
-# Alternative for /usr/bin/python3 -> /usr/bin/python3.12 + related files
-# Create only if it doesn't exist already
-EXISTS=`alternatives --display python3 | \
-         grep -c "^/usr/bin/python3.12 - priority [0-9]*"`
-
-if [ $EXISTS -eq 0 ]; then
-     alternatives --install %{_bindir}/python3 \
-                            python3 \
-                            %{_bindir}/python3.12 \
-                            31200 \
-                  --slave   %{_mandir}/man1/python3.1.gz \
-                            python3-man \
-                            %{_mandir}/man1/python3.12.1.gz \
-                  --slave   %{_bindir}/pydoc3 \
-                            pydoc3 \
-                            %{_bindir}/pydoc3.12 \
-                  --slave   %{_bindir}/pydoc-3 \
-                            pydoc-3 \
-                            %{_bindir}/pydoc3.12
-fi
-
-%postun
-# Do this only during uninstall process (not during update)
-if [ $1 -eq 0 ]; then
-     alternatives --keep-foreign --remove python \
-                         %{_bindir}/python3.12
-
-     alternatives --keep-foreign --remove python3 \
-                         %{_bindir}/python3.12
-
-     # Remove link python → python3 if no other python3.* exists
-     if ! alternatives --display python3 > /dev/null; then
-         alternatives --keep-foreign --remove python \
-                             %{_bindir}/python3
-     fi
-fi
-
-
-%post devel
-alternatives --add-slave python3 %{_bindir}/python3.12 \
-     %{_bindir}/python3-config \
-     python3-config \
-     %{_bindir}/python3.12-config
-
-%postun devel
-# Do this only during uninstall process (not during update)
-if [ $1 -eq 0 ]; then
-     alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.12 \
-         python3-config
-fi
-
-%post idle
-alternatives --add-slave python3 %{_bindir}/python3.12 \
-     %{_bindir}/idle3 \
-     idle3 \
-     %{_bindir}/idle3.12
-
-%postun idle
-# Do this only during uninstall process (not during update)
-if [ $1 -eq 0 ]; then
-     alternatives --keep-foreign --remove-slave python3 %{_bindir}/python3.12 \
-        idle3
-fi
-
-# ======================================================
-# Files for each RPM (sub)package
-# ======================================================
-
-%files -n %{pkgname}-rpm-macros
-%{rpmmacrodir}/macros.python%{pybasever}
-%{_rpmconfigdir}/redhat/import_all_modules_py3_12.py
-%{_rpmconfigdir}/redhat/pathfix_py3_12.py
-
 
 %files -n %{pkgname}
 %doc README.rst
 
-# Alternatives
-%ghost %{_bindir}/unversioned-python
-%ghost %{_mandir}/man1/python.1.gz
-%ghost %{_bindir}/python3
-%ghost %{_mandir}/man1/python3.1.gz
-%ghost %{_bindir}/pydoc3
-%ghost %{_bindir}/pydoc-3
-
 %if %{with main_python}
 %{_bindir}/pydoc*
 %{_bindir}/python3
@@ -1676,9 +1508,6 @@ fi
 %{_bindir}/python%{pybasever}-config
 %{_bindir}/python%{LDVERSION_optimized}-config
 %{_bindir}/python%{LDVERSION_optimized}-*-config
-# Alternatives
-%ghost %{_bindir}/python3-config
-
 %{_libdir}/libpython%{LDVERSION_optimized}.so
 %{_libdir}/pkgconfig/python-%{LDVERSION_optimized}.pc
 %{_libdir}/pkgconfig/python-%{LDVERSION_optimized}-embed.pc
@@ -1691,8 +1520,6 @@ fi
 %{_bindir}/idle*
 %else
 %{_bindir}/idle%{pybasever}
-# Alternatives
-%ghost %{_bindir}/idle3
 %endif
 
 %{pylibdir}/idlelib
@@ -1876,6 +1703,11 @@ fi
 # ======================================================
 
 %changelog
+* Fri May 03 2024 Lumír Balhar <lbalhar@redhat.com> - 3.12.1-4.1
+- Fix tests for XMLPullParser with Expat with fixed CVE
+- Enable importing of hash-based .pyc files under FIPS mode
+Resolves: RHEL-40773
+
 * Mon Feb 19 2024 Charalampos Stratakis <cstratak@redhat.com> - 3.12.1-4
 - Add Red Hat configuration for CVE-2007-4559
 
@@ -1932,4 +1764,3 @@ fi
       Ville Skyttä <ville.skytta@iki.fi>
       Yaakov Selkowitz <yselkowi@redhat.com>
       Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
-