RHEL: Import from Fedora

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -0,0 +1,3 @@
+/*.tar.*
+/*.src.rpm
+/results_python3*

00251-change-user-install-location.patch

@@ -0,0 +1,174 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Mon, 15 Feb 2021 12:19:27 +0100
+Subject: 00251: Change user install location
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Set values of base and platbase in sysconfig from /usr
+to /usr/local when RPM build is not detected
+to make pip and similar tools install into separate location.
+
+Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+Downstream only.
+
+We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
+but we have identified serious problems with that approach,
+see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
+
+pypa/distutils integration: https://github.com/pypa/distutils/pull/70
+
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+Co-authored-by: Miro Hrončok <miro@hroncok.cz>
+Co-authored-by: Michal Cyprian <m.cyprian@gmail.com>
+Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
+---
+ Lib/site.py                |  9 ++++++-
+ Lib/sysconfig/__init__.py  | 50 +++++++++++++++++++++++++++++++++++++-
+ Lib/test/test_sysconfig.py | 17 +++++++++++--
+ 3 files changed, 72 insertions(+), 4 deletions(-)
+
+diff --git a/Lib/site.py b/Lib/site.py
+index f932719715..e4ef914ec2 100644
+--- a/Lib/site.py
++++ b/Lib/site.py
+@@ -421,8 +421,15 @@ def getsitepackages(prefixes=None):
+     return sitepackages
+ 
+ def addsitepackages(known_paths, prefixes=None):
+-    """Add site-packages to sys.path"""
++    """Add site-packages to sys.path
++
++    '/usr/local' is included in PREFIXES if RPM build is not detected
++    to make packages installed into this location visible.
++
++    """
+     _trace("Processing global site-packages")
++    if ENABLE_USER_SITE and 'RPM_BUILD_ROOT' not in os.environ:
++        PREFIXES.insert(0, "/usr/local")
+     for sitedir in getsitepackages(prefixes):
+         if os.path.isdir(sitedir):
+             addsitedir(sitedir, known_paths)
+diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py
+index 2ecbff222f..7211773bad 100644
+--- a/Lib/sysconfig/__init__.py
++++ b/Lib/sysconfig/__init__.py
+@@ -106,6 +106,12 @@
+ else:
+     _INSTALL_SCHEMES['venv'] = _INSTALL_SCHEMES['posix_venv']
+ 
++# For a brief period of time in the Fedora 36 life cycle,
++# this installation scheme existed and was documented in the release notes.
++# For backwards compatibility, we keep it here (at least on 3.10 and 3.11).
++_INSTALL_SCHEMES['rpm_prefix'] = _INSTALL_SCHEMES['posix_prefix']
++
++
+ def _get_implementation():
+     return 'Python'
+ 
+@@ -169,6 +175,19 @@ def joinuser(*args):
+             },
+     }
+ 
++# This is used by distutils.command.install in the stdlib
++# as well as pypa/distutils (e.g. bundled in setuptools).
++# The self.prefix value is set to sys.prefix + /local/
++# if neither RPM build nor virtual environment is
++# detected to make distutils install packages
++# into the separate location.
++# https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++if (not (hasattr(sys, 'real_prefix') or
++    sys.prefix != sys.base_prefix) and
++    'RPM_BUILD_ROOT' not in os.environ):
++    _prefix_addition = '/local'
++
++
+ _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
+                 'scripts', 'data')
+ 
+@@ -268,11 +287,40 @@ def _extend_dict(target_dict, other_dict):
+         target_dict[key] = value
+ 
+ 
++_CONFIG_VARS_LOCAL = None
++
++
++def _config_vars_local():
++    # This function returns the config vars with prefixes amended to /usr/local
++    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++    global _CONFIG_VARS_LOCAL
++    if _CONFIG_VARS_LOCAL is None:
++        _CONFIG_VARS_LOCAL = dict(get_config_vars())
++        _CONFIG_VARS_LOCAL['base'] = '/usr/local'
++        _CONFIG_VARS_LOCAL['platbase'] = '/usr/local'
++    return _CONFIG_VARS_LOCAL
++
++
+ def _expand_vars(scheme, vars):
+     res = {}
+     if vars is None:
+         vars = {}
+-    _extend_dict(vars, get_config_vars())
++
++    # when we are not in a virtual environment or an RPM build
++    # we change '/usr' to '/usr/local'
++    # to avoid surprises, we explicitly check for the /usr/ prefix
++    # Python virtual environments have different prefixes
++    # we only do this for posix_prefix, not to mangle the venv scheme
++    # posix_prefix is used by sudo pip install
++    # we only change the defaults here, so explicit --prefix will take precedence
++    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++    if (scheme == 'posix_prefix' and
++        sys.prefix == '/usr' and
++        'RPM_BUILD_ROOT' not in os.environ):
++            _extend_dict(vars, _config_vars_local())
++    else:
++        _extend_dict(vars, get_config_vars())
++
+     if os.name == 'nt':
+         # On Windows we want to substitute 'lib' for schemes rather
+         # than the native value (without modifying vars, in case it
+diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
+index 09eff11179..c227815ebd 100644
+--- a/Lib/test/test_sysconfig.py
++++ b/Lib/test/test_sysconfig.py
+@@ -132,8 +132,19 @@ def test_get_path(self):
+         for scheme in _INSTALL_SCHEMES:
+             for name in _INSTALL_SCHEMES[scheme]:
+                 expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
++                tested = get_path(name, scheme)
++                # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
++                if tested.startswith('/usr/local'):
++                    # /usr/local should only be used in posix_prefix
++                    self.assertEqual(scheme, 'posix_prefix')
++                    # Fedora CI runs tests for venv and virtualenv that check for other prefixes
++                    self.assertEqual(sys.prefix, '/usr')
++                    # When building the RPM of Python, %check runs this with RPM_BUILD_ROOT set
++                    # Fedora CI runs this with RPM_BUILD_ROOT unset
++                    self.assertNotIn('RPM_BUILD_ROOT', os.environ)
++                    tested = tested.replace('/usr/local', '/usr')
+                 self.assertEqual(
+-                    os.path.normpath(get_path(name, scheme)),
++                    os.path.normpath(tested),
+                     os.path.normpath(expected),
+                 )
+ 
+@@ -395,7 +406,7 @@ def test_get_config_h_filename(self):
+         self.assertTrue(os.path.isfile(config_h), config_h)
+ 
+     def test_get_scheme_names(self):
+-        wanted = ['nt', 'posix_home', 'posix_prefix', 'posix_venv', 'nt_venv', 'venv']
++        wanted = ['nt', 'posix_home', 'posix_prefix', 'posix_venv', 'nt_venv', 'venv', 'rpm_prefix']
+         if HAS_USER_BASE:
+             wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
+         self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
+@@ -407,6 +418,8 @@ def test_symlink(self): # Issue 7880
+             cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
+             self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
+ 
++    @unittest.skipIf('RPM_BUILD_ROOT' not in os.environ,
++                     "Test doesn't expect Fedora's paths")
+     def test_user_similar(self):
+         # Issue #8759: make sure the posix scheme for the users
+         # is similar to the global posix_prefix one

00461-downstream-only-install-wheel-in-test-venvs-when-setuptools-71.patch

@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Fri, 25 Apr 2025 09:33:37 +0200
+Subject: 00461: Downstream only: Install wheel in test venvs when setuptools <
+ 71
+
+This can be removed when Fedora 41 goes EOL (or updates setuptools).
+---
+ Lib/test/support/__init__.py | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
+index 88f6110351..210ddcdbe3 100644
+--- a/Lib/test/support/__init__.py
++++ b/Lib/test/support/__init__.py
+@@ -2512,9 +2512,16 @@ def run_command(cmd):
+         else:
+             python = os.path.join(venv, 'bin', python_exe)
+ 
++        setuptools_whl = _findwheel('setuptools')
++        whl_filename = os.path.basename(setuptools_whl)
++        setuptools_major = int(whl_filename.split('-')[1].split('.')[0])
++        if setuptools_major >= 71:  # we need 70.1+, but that's OK
++            wheels = (setuptools_whl,)
++        else:
++            wheels = (setuptools_whl, _findwheel('wheel'))
+         cmd = (python, '-X', 'dev',
+                '-m', 'pip', 'install',
+-               _findwheel('setuptools'),
++               *wheels,
+                )
+         run_command(cmd)
+ 

00464-enable-pac-and-bti-protections-for-aarch64.patch

@@ -0,0 +1,102 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charalampos Stratakis <cstratak@redhat.com>
+Date: Tue, 3 Jun 2025 03:02:15 +0200
+Subject: 00464: Enable PAC and BTI protections for aarch64
+
+Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
+
+The BTI flag must be applied in the assembler sources for this class
+of attacks to be mitigated on newer aarch64 processors.
+
+Upstream PR: https://github.com/python/cpython/pull/130864/files
+
+The upstream patch is incomplete but only for the case where
+frame pointers are not used on 3.13+.
+
+Since on Fedora we always compile with frame pointers the BTI/PAC
+hardware protections can be enabled without losing Perf unwinding.
+---
+ Python/asm_trampoline.S         |  4 +++
+ Python/asm_trampoline_aarch64.h | 50 +++++++++++++++++++++++++++++++++
+ 2 files changed, 54 insertions(+)
+ create mode 100644 Python/asm_trampoline_aarch64.h
+
+diff --git a/Python/asm_trampoline.S b/Python/asm_trampoline.S
+index a14e68c0e8..2513cde4e7 100644
+--- a/Python/asm_trampoline.S
++++ b/Python/asm_trampoline.S
+@@ -1,3 +1,5 @@
++#include "asm_trampoline_aarch64.h"
++
+     .text
+     .globl	_Py_trampoline_func_start
+ # The following assembly is equivalent to:
+@@ -21,10 +23,12 @@ _Py_trampoline_func_start:
+ #if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__)
+     // ARM64 little endian, 64bit ABI
+     // generate with aarch64-linux-gnu-gcc 12.1
++    SIGN_LR
+     stp     x29, x30, [sp, -16]!
+     mov     x29, sp
+     blr     x3
+     ldp     x29, x30, [sp], 16
++    VERIFY_LR
+     ret
+ #endif
+ #ifdef __riscv
+diff --git a/Python/asm_trampoline_aarch64.h b/Python/asm_trampoline_aarch64.h
+new file mode 100644
+index 0000000000..4b0ec4a7dc
+--- /dev/null
++++ b/Python/asm_trampoline_aarch64.h
+@@ -0,0 +1,50 @@
++#ifndef ASM_TRAMPOLINE_AARCH_64_H_
++#define ASM_TRAMPOLINE_AARCH_64_H_
++
++/*
++ * References:
++ *  - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros
++ *  - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst
++ */
++
++#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
++  #define BTI_J hint 36 /* bti j: for jumps, IE br instructions */
++  #define BTI_C hint 34  /* bti c: for calls, IE bl instructions */
++  #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */
++#else
++  #define BTI_J
++  #define BTI_C
++  #define GNU_PROPERTY_AARCH64_BTI 0
++#endif
++
++#if defined(__ARM_FEATURE_PAC_DEFAULT)
++  #if __ARM_FEATURE_PAC_DEFAULT & 1
++    #define SIGN_LR hint 25 /* paciasp: sign with the A key */
++    #define VERIFY_LR hint 29 /* autiasp: verify with the A key */
++  #elif __ARM_FEATURE_PAC_DEFAULT & 2
++    #define SIGN_LR hint 27 /* pacibsp: sign with the b key */
++    #define VERIFY_LR hint 31 /* autibsp: verify with the b key */
++  #endif
++  #define GNU_PROPERTY_AARCH64_POINTER_AUTH 2 /* bit 1 GNU Notes is for PAC support */
++#else
++  #define SIGN_LR BTI_C
++  #define VERIFY_LR
++  #define GNU_PROPERTY_AARCH64_POINTER_AUTH 0
++#endif
++
++/* Add the BTI and PAC support to GNU Notes section */
++#if GNU_PROPERTY_AARCH64_BTI != 0 || GNU_PROPERTY_AARCH64_POINTER_AUTH != 0
++    .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */
++    .balign 8; /* align it on a byte boundry */
++    .long 4; /* size of "GNU\0" */
++    .long 0x10; /* size of descriptor */
++    .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */
++    .asciz "GNU";
++    .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
++    .long 4; /* Four bytes of data */
++    .long (GNU_PROPERTY_AARCH64_BTI|GNU_PROPERTY_AARCH64_POINTER_AUTH); /* BTI or PAC is enabled */
++    .long 0; /* padding for 8 byte alignment */
++    .popsection; /* end the section */
++#endif
++
++#endif

00466-downstream-only-skip-tests-not-working-with-older-expat-version.patch

@@ -0,0 +1,69 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Tue, 24 Jun 2025 11:12:13 +0200
+Subject: 00466: Downstream only: Skip tests not working with older expat
+ version
+
+We want to run these tests in Fedora and EPEL 10, but not in EPEL 9,
+which has too old version of expat. We set the upper bound version
+in the conditionalized skip to a release available in CentOS Stream 10,
+which is tested as working.
+---
+ Lib/test/test_pyexpat.py   | 2 ++
+ Lib/test/test_sax.py       | 2 ++
+ Lib/test/test_xml_etree.py | 6 ++++++
+ 3 files changed, 10 insertions(+)
+
+diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
+index a091430463..55ebf34c52 100644
+--- a/Lib/test/test_pyexpat.py
++++ b/Lib/test/test_pyexpat.py
+@@ -826,6 +826,8 @@ def start_element(name, _):
+ 
+         self.assertEqual(started, ['doc'])
+ 
++    @unittest.skipIf(expat.version_info < (2, 7, 1),
++                     f"Skip for expat < 2.7.1 (version available in RHEL 10)")
+     def test_reparse_deferral_disabled(self):
+         started = []
+ 
+diff --git a/Lib/test/test_sax.py b/Lib/test/test_sax.py
+index 5c10bcedc6..1fd7a273b5 100644
+--- a/Lib/test/test_sax.py
++++ b/Lib/test/test_sax.py
+@@ -1241,6 +1241,8 @@ def test_flush_reparse_deferral_enabled(self):
+ 
+         self.assertEqual(result.getvalue(), start + b"<doc></doc>")
+ 
++    @unittest.skipIf(pyexpat.version_info < (2, 7, 1),
++                     f"Skip for expat < 2.7.1 (version available in RHEL 10)")
+     def test_flush_reparse_deferral_disabled(self):
+         result = BytesIO()
+         xmlgen = XMLGenerator(result)
+diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
+index bf6d5074fd..6f8ef34590 100644
+--- a/Lib/test/test_xml_etree.py
++++ b/Lib/test/test_xml_etree.py
+@@ -1547,9 +1547,13 @@ def test_simple_xml(self, chunk_size=None, flush=False):
+         self.assert_event_tags(parser, [('end', 'root')])
+         self.assertIsNone(parser.close())
+ 
++    @unittest.skipIf(pyexpat.version_info < (2, 7, 1),
++                     f"Skip for expat < 2.7.1 (version available in RHEL 10)")
+     def test_simple_xml_chunk_1(self):
+         self.test_simple_xml(chunk_size=1, flush=True)
+ 
++    @unittest.skipIf(pyexpat.version_info < (2, 7, 1),
++                     f"Skip for expat < 2.7.1 (version available in RHEL 10)")
+     def test_simple_xml_chunk_5(self):
+         self.test_simple_xml(chunk_size=5, flush=True)
+ 
+@@ -1774,6 +1778,8 @@ def test_flush_reparse_deferral_enabled(self):
+ 
+         self.assert_event_tags(parser, [('end', 'doc')])
+ 
++    @unittest.skipIf(pyexpat.version_info < (2, 7, 1),
++                     f"Skip for expat < 2.7.1 (version available in RHEL 10)")
+     def test_flush_reparse_deferral_disabled(self):
+         parser = ET.XMLPullParser(events=('start', 'end'))
+ 

check-pyc-timestamps.py

@@ -0,0 +1,51 @@
+"""Checks if all *.pyc files have later mtime than their *.py files."""
+
+import os
+import sys
+from importlib.util import cache_from_source
+from pathlib import Path
+
+
+RPM_BUILD_ROOT = os.environ.get('RPM_BUILD_ROOT', '')
+
+# ...cpython-3X.pyc
+# ...cpython-3X.opt-1.pyc
+# ...cpython-3X.opt-2.pyc
+LEVELS = (None, 1, 2)
+
+# list of globs of test and other files that we expect not to have bytecode
+not_compiled = [
+    '/usr/bin/*',
+    '*/test/*/bad_coding.py',
+    '*/test/*/bad_coding2.py',
+    '*/test/*/badsyntax_*.py',
+    '*/test_future_stmt/badsyntax_*.py',
+    '*.debug-gdb.py',
+]
+
+
+def bytecode_expected(path):
+    path = Path(path[len(RPM_BUILD_ROOT):])
+    for glob in not_compiled:
+        if path.match(glob):
+            return False
+    return True
+
+
+failed = 0
+compiled = (path for path in sys.argv[1:] if bytecode_expected(path))
+for path in compiled:
+    to_check = (cache_from_source(path, optimization=opt) for opt in LEVELS)
+    f_mtime = os.path.getmtime(path)
+    for pyc in to_check:
+        c_mtime = os.path.getmtime(pyc)
+        if c_mtime < f_mtime:
+            print('Failed bytecompilation timestamps check: '
+                  f'Bytecode file {pyc} is older than source file {path}',
+                  file=sys.stderr)
+            failed += 1
+
+if failed:
+    print(f'\n{failed} files failed bytecompilation timestamps check.',
+          file=sys.stderr)
+    sys.exit(1)

idle3.appdata.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- Copyright 2017 Zbigniew Jędrzejewski-Szmek -->
+<application>
+  <id type="desktop">idle3.desktop</id>
+  <name>IDLE3</name>
+  <metadata_licence>CC0</metadata_licence>
+  <project_license>Python-2.0</project_license>
+  <summary>Python 3 Integrated Development and Learning Environment</summary>
+  <description>
+    <p>
+      IDLE is Python’s Integrated Development and Learning Environment.
+      The GUI is uniform between Windows, Unix, and Mac OS X.
+      IDLE provides an easy way to start writing, running, and debugging
+      Python code.
+    </p>
+    <p>
+      IDLE is written in pure Python, and uses the tkinter GUI toolkit.
+      It provides:
+    </p>
+    <ul>
+       <li>a Python shell window (interactive interpreter) with colorizing of code input, output, and error messages,</li>
+       <li>a multi-window text editor with multiple undo, Python colorizing, smart indent, call tips, auto completion, and other features,</li>
+       <li>search within any window, replace within editor windows, and search through multiple files (grep),</li>
+       <li>a debugger with persistent breakpoints, stepping, and viewing of global and local namespaces.</li>
+    </ul>
+  </description>
+  <url type="homepage">https://docs.python.org/3/library/idle.html</url>
+  <screenshots>
+    <screenshot type="default">http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-main-window.png</screenshot>
+    <screenshot>http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-class-browser.png</screenshot>
+    <screenshot>http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-code-viewer.png</screenshot>
+  </screenshots>
+  <update_contact>zbyszek@in.waw.pl</update_contact>
+</application>

idle3.desktop

@@ -0,0 +1,11 @@
+[Desktop Entry]
+Version=1.0
+Name=IDLE 3
+Comment=Python 3 Integrated Development and Learning Environment
+Exec=idle3 %F
+TryExec=idle3
+Terminal=false
+Type=Application
+Icon=idle3
+Categories=Development;IDE;
+MimeType=text/x-python;

plan.fmf

@@ -0,0 +1,75 @@
+execute:
+  how: tmt
+
+provision:
+  hardware:
+    memory: '>= 3 GB'
+
+environment:
+  pybasever: '3.14'
+
+discover:
+  - name: tests_python
+    how: shell
+    url: https://src.fedoraproject.org/tests/python.git
+    tests:
+    - name: smoke
+      path: /smoke
+      test: "VERSION=${pybasever} CYTHON=false ./venv.sh"
+    - name: smoke_virtualenv
+      path: /smoke
+      test: "VERSION=${pybasever} METHOD=virtualenv CYTHON=false ./venv.sh"
+    - name: debugsmoke
+      path: /smoke
+      test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} CYTHON=false ./venv.sh"
+    - name: selftest
+      path: /selftest
+      test: "VERSION=${pybasever} X='-i test_check_probes -i test_sysconfigdata_json' ./parallel.sh"
+    - name: debugtest
+      path: /selftest
+      # test_base_interpreter: https://github.com/python/cpython/issues/131372
+      # test_interrupt and test_interrupt_no_handler: https://github.com/python/cpython/issues/133651https://github.com/python/cpython/issues/133651
+      test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes -i test_sysconfigdata_json -i test_base_interpreter -i test_interrupt -i test_interrupt_no_handler' ./parallel.sh"
+    - name: optimizedflags
+      path: /flags
+      test: "python${pybasever} ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
+    - name: debugflags
+      path: /flags
+      test: "python${pybasever}d ./assertflags.py -O0  CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
+    - name: freethreadingflags
+      path: /flags
+      test: "python${pybasever}t ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
+    - name: freethreadingdebugflags
+      path: /flags
+      test: "python${pybasever}td ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
+    - name: marshalparser
+      path: /marshalparser
+      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
+
+prepare:
+  - name: Install dependencies
+    how: install
+    package:
+    - gcc  # for extension building in venv and selftest
+    - gcc-c++ # for test_cppext
+    - gdb  # for test_gdb
+    - "python${pybasever}"  # the test subject
+    - "python${pybasever}-debug"  # for leak testing
+    - "python${pybasever}-devel"  # for extension building in venv and selftest
+    - "python${pybasever}-tkinter"  # for selftest
+    - "python${pybasever}-test"  # for selftest
+    - "python${pybasever}-freethreading"  # for -O... flag test
+    - "python${pybasever}-freethreading-debug"  # for -O... flag test
+    - tox  # for venv tests
+    - virtualenv  # for virtualenv tests
+    - glibc-all-langpacks # for locale tests
+    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
+    - rpm  # for debugging
+    - dnf  # for upgrade
+  - name: Update packages
+    how: shell
+    script: dnf upgrade -y
+  - name: rpm_qa
+    order: 100
+    how: shell
+    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt

rpminspect.yaml

@@ -0,0 +1,37 @@
+# exclude test XML data (not always valid) from XML validity check:
+xml:
+    ignore:
+        - '/usr/lib*/python*/test/xmltestdata/*'
+        - '/usr/lib*/python*/test/xmltestdata/*/*'
+
+# exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
+badfuncs:
+    allowed:
+        '/usr/lib*/python*/lib-dynload/_socket.*':
+            - inet_aton
+            - inet_ntoa
+
+# exclude the debug build from annocheck entirely
+annocheck:
+    ignore:
+        - '/usr/bin/python*d'
+        - '/usr/lib*/libpython*d.so.1.0'
+        - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so'
+
+# don't report changed content of compiled files
+# that is expected with every toolchain update and not reproducible yet
+changedfiles:
+    # note that this is a posix regex, so no \d
+    exclude_path: (\.so(\.[0-9]+(\.[0-9]+)?)?$|^/usr/bin/python[0-9]+\.[0-9]+d?m?$)
+
+# files change size all the time, we don't need to VERIFY it
+# however, the INFO is useful, so we don't disable the check entirely
+filesize:
+    # artificially large number, TODO a better way
+    size_threshold: 100000
+
+
+# completely disabled inspections:
+inspections:
+    # we know about our patches, no need to report anything
+    patches: off

rpmlint.toml

@@ -0,0 +1,106 @@
+Filters = [
+
+    # KNOWN BUGS:
+    # https://bugzilla.redhat.com/show_bug.cgi?id=1489816
+    'crypto-policy-non-compliance-openssl',
+
+
+    # TESTS:
+    '(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+t?/test',
+
+
+    # OTHER DELIBERATES:
+    # chroot function
+    'missing-call-to-chdir-with-chroot',
+
+    # gethostbyname function calls gethostbyname
+    '(E|W): binary-or-shlib-calls-gethostbyname /usr/lib(64)?/python3\.\d+t?/lib-dynload/_socket\.',
+
+    # intentionally unversioned and selfobsoleted
+    'unversioned-explicit-obsoletes python',
+    'unversioned Obsoletes: Obsoletes: python3\.\d+$',
+    'self-obsoletion python3\.\d+(-\S+)? obsoletes python3\.\d+(-\S+)?',
+
+    # intentionally hardcoded
+    'hardcoded-library-path in %{_prefix}/lib/(debug/%{_libdir}|python%{pybasever})',
+
+    # we have non binary stuff, python files
+    'only-non-binary-in-usr-lib',
+
+    # some devel files that are deliberately needed
+    'devel-file-in-non-devel-package /usr/include/python3\.\d+m?t?/pyconfig-(32|64)\.h',
+    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+t?/distutils/tests/xxmodule\.c',
+    # ...or are used as test data
+    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+t?/test',
+
+    # some bytecode is shipped without sources on purpose, as a space optimization
+    # if this regex needs to be relaxed in the future, make sure it **does not** match pyc files in __pycache__
+    'python-bytecode-without-source /usr/lib(64)?/python3\.\d+t?/(encodings|pydoc_data)/[^/]+.pyc',
+
+    # DUPLICATE FILES
+    # test data are often duplicated
+    '(E|W): files-duplicate /usr/lib(64)?/python3\.\d+t?/(test|__phello__)/',
+    # duplicated inits or mains are also common
+    '(E|W): files-duplicate .+__init__\.py.+__init__\.py',
+    '(E|W): files-duplicate .+__main__\.py.+__main__\.py',
+    # files in the debugsource package
+    '(E|W): files-duplicate /usr/src/debug',
+    # general waste report
+    '(E|W): files-duplicated-waste',
+
+    # SORRY, NOT SORRY:
+    # manual pages
+    'no-manual-page-for-binary (idle|pydoc|pyvenv|2to3|python3?-debug|pathfix|msgfmt|pygettext)',
+    'no-manual-page-for-binary python3?.*-config$',
+    'no-manual-page-for-binary python3\.\d+t?dm?$',
+
+    # missing documentation from subpackages
+    '^python3(\.\d+)?-(freethreading(-debug)?|debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation',
+
+    # platform python is obsoleted, but not provided
+    'obsolete-not-provided platform-python',
+
+    # we have extra tokens at the end of %endif/%else directives, we consider them useful
+    'extra tokens at the end of %(endif|else) directive',
+
+
+    # RPMLINT IMPERFECTIONS
+    # https://github.com/rpm-software-management/rpmlint/issues/780
+    '/usr/lib/debug',
+
+    # we provide python(abi) manually to be sure. createrepo will merge this with the automatic
+    'python3(\.\d+)?\.[^:-]+: (E|W): useless-provides python\(abi\)',
+
+    # debugsource and debuginfo have no docs
+    '^python3(\.\d+)?-debug(source|info)\.[^:]+: (E|W): no-documentation',
+
+    # this is OK for F28+
+    'library-without-ldconfig-post',
+
+    # freethreading/debug package contains devel and non-devel files
+    'python3(\.\d+)?-(freethreading(-debug)?|debug)\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package',
+
+    # this goes to other subpackage, hence not actually dangling
+    'dangling-relative-symlink /usr/bin/python python3',
+    'dangling-relative-symlink /usr/share/man/man1/python\.1\.gz python3\.1\.gz',
+    'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+t?d?m?(-embed)?\.pc python-3\.\d+t?(-embed)?\.pc',
+
+    # the python-unversioned-command package contains dangling symlinks by design
+    '^python-unversioned-command\.[^:]+: (E|W): dangling-relative-symlink (/usr/bin/python \./python3|/usr/share/man/man1/python\.1\S* ./python3\.1\S*)$',
+
+    # we need this macro to evaluate, even if the line starts with #
+    'macro-in-comment %\{_pyconfig(32|64)_h\}',
+
+    # Python modules don't need to be linked against libc
+    # Since 3.8 they are no longer linked against libpython3.8.so.1.0
+    '(E|W): library-not-linked-against-libc /usr/lib(64)?/python3\.\d+/lib-dynload/',
+    '(E|W): shared-lib(rary)?-without-dependency-information /usr/lib(64)?/python3\.\d+/lib-dynload/',
+
+    # specfile-errors are listed twice, once with reason and once without
+    # we filter out the empty ones
+    '\bpython3(\.\d+)?\.(src|spec): (E|W): specfile-error\s+$',
+
+    # SPELLING ERRORS
+    'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest|unittest|gil) ',
+
+]

sources

@@ -0,0 +1 @@
+SHA512 (Python-3.14.0.tar.xz) = 46e9e205c3a084cba68bf7f267ab2fd0862a05430165e0eb713f2d6b3a1a4452f72f563de5de55caea824be9df56f66dd568f4814941667a9bb0954229772c53