import UBI python3.14-3.14.4-3.el9_8

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,3 +1 @@
-/*.tar.*
+SOURCES/Python-3.14.4.tar.xz
-/*.src.rpm
-/results_python3*

.python3.14.metadata

@@ -0,0 +1 @@
+567ffd2b4116db4cbcd3fb7adb304ec32687f99f SOURCES/Python-3.14.4.tar.xz

SPECS/python3.14.spec

@@ -49,7 +49,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -278,7 +278,7 @@ BuildRequires: pkgconfig
 BuildRequires: python-rpm-macros
 BuildRequires: readline-devel
 BuildRequires: redhat-rpm-config >= 127
-BuildRequires: sqlite-devel
+BuildRequires: sqlite-devel >= 3.34.1-10
 BuildRequires: systemtap-sdt-devel
 BuildRequires: tcl-devel
 BuildRequires: tk-devel
@@ -341,9 +341,6 @@ Source0: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz
 # Originally written by bkabrda
 Source8: check-pyc-timestamps.py
 
-# A script that determines the required expat version
-Source9: expat-requires.py
-
 # Desktop menu entry for idle3
 Source10: idle3.desktop
 
@@ -642,20 +639,8 @@ Recommends: (%{pkgname}-tkinter%{?_isa} if tk%{?_isa})
 # The zoneinfo module needs tzdata
 Requires: tzdata
 
-# The requirement on libexpat is generated, but we need to version it.
+# The sqlite3 needs version with (de)serialize API
-# When built with a specific expat version, but installed with an older one,
+Requires: sqlite-libs >= 3.34.1-10
-# we sometimes get:
-#   ImportError: /usr/lib64/python3.X/lib-dynload/pyexpat.cpython-....so:
-#   undefined symbol: XML_...
-# The pyexpat module has build-time checks for expat version to only use the
-# available symbols. However, there is no runtime protection, so when the module
-# is later installed with an older expat, it may error due to undefined symbols.
-# This breaks many things, including python -m venv.
-# We avoid this problem by requiring expat equal or greater than the latest known
-# version which introduced new symbols used by Python.
-# Other subpackages (like -debug) also need this, but they all depend on -libs.
-%global expat_min_version 2.7.2
-Requires: expat%{?_isa} >= %{expat_min_version}
 
 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
@@ -680,6 +665,10 @@ Requires: (python3-rpm-macros if rpm-build)
 # On Fedora, we keep this to avoid one additional round of %%generate_buildrequires.
 %{!?rhel:Requires: (pyproject-rpm-macros if rpm-build)}
 
+# We provide the python3.14-rpm-macros here to make it possible to
+# BuildRequire them in the same manner as RHEL8.
+Provides: %{pkgname}-rpm-macros = %{version}-%{release}
+
 %unversioned_obsoletes_of_python3_X_if_main devel
 
 %if %{with main_python}
@@ -853,7 +842,6 @@ License: %{libs_license} AND Apache-2.0 AND ISC AND LGPL-2.1-only AND MPL-2.0 AN
 # See the comments in the definition of main -libs subpackage for detailed explanations
 Provides: bundled(mimalloc) = 2.12
 Requires: tzdata
-Requires: expat%{?_isa} >= %{expat_min_version}
 
 # There are files in the standard library that have python shebang.
 # We've filtered the automatic requirement out so libs are installable without
@@ -1478,12 +1466,6 @@ for Module in %{buildroot}/%{dynload_dir}/*.so ; do
     esac
 done
 
-# Check the expat compatibility
-expat_found=$(LD_LIBRARY_PATH="%{buildroot}%{_libdir}" PYTHONPATH="%{buildroot}%{pylibdir}" %{buildroot}%{_bindir}/python%{pybasever} %{SOURCE9})
-if [ "${expat_found}" != "%{expat_min_version}" ]; then
-    echo "Found expat version is different than the declared one, found: ${expat_found}" ; exit 1
-fi
-
 
 # ======================================================
 # Running the upstream test suite
@@ -1999,32 +1981,33 @@ CheckPython freethreading
 # ======================================================
 
 %changelog
+* Mon Jun 01 2026 Lukáš Zachar <lzachar@redhat.com> - 3.14.4-3
+- Depend on sqlite-libs with (de)serialize API
+Resolves: RHEL-180476
+
 * Thu Apr 16 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.14.4-2
 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100
-Resolves: RHEL-168121, RHEL-167887
+Resolves: RHEL-167918, RHEL-168160
 
 * Wed Apr 08 2026 Karolina Surma <ksurma@redhat.com> - 3.14.4-1
 - Update to Python 3.14.4
 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865
-Related: RHEL-168121, RHEL-167887
+Related: RHEL-167918, RHEL-168160
 
 * Thu Mar 26 2026 Lumír Balhar <lbalhar@redhat.com> - 3.14.3-2
 - Security fix for CVE-2026-4519
-Resolves: RHEL-158114
+Resolves: RHEL-158115
 
 * Wed Feb 04 2026 Karolina Surma <ksurma@redhat.com> - 3.14.3-1
 - Update to Python 3.14.3
 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865,
 CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367
-Resolves: RHEL-144855, RHEL-143058, RHEL-143111
+Resolves: RHEL-144896, RHEL-143115, RHEL-143173
 
-* Mon Jan 19 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.14.2-3
+* Fri Jan 09 2026 Charalampos Stratakis <cstratak@redhat.com> - 3.14.2-3
 - Support OpenSSL FIPS mode
 - Disable the builtin hashlib hashes except blake2
-Related: RHEL-120788
+Related: RHEL-120823
-
-* Mon Jan 12 2026 Karolina Surma <ksurma@redhat.com> - 3.14.2-2
-- Explicitly require expat >= 2.7.2
 
 * Fri Dec 05 2025 Miro Hrončok <mhroncok@redhat.com> - 3.14.2-1
 - Update to Python 3.14.2

expat-requires.py

@@ -1,50 +0,0 @@
-import pathlib
-import pyexpat
-import sys
-
-
-# This will determine the version of currently installed expat
-EXPAT_VERSION = pyexpat.EXPAT_VERSION.removeprefix('expat_')
-MAJOR, MINOR, PATCH = (int(i) for i in EXPAT_VERSION.split('.'))
-EXPAT_COMBINED_VERSION = 10000*MAJOR + 100*MINOR + PATCH
-
-# For the listed files, we find all XML_COMBINED_VERSION-based #ifs
-SRC = pathlib.Path.cwd()
-SOURCES = [
-    SRC / 'Modules/pyexpat.c',
-    SRC / 'Modules/clinic/pyexpat.c.h',
-]
-versions = set()
-for source in SOURCES:
-    for line in source.read_text().splitlines():
-        if 'XML_COMBINED_VERSION' not in line:
-            continue
-        words = line.split()
-        if words[0] == '#define':
-            continue
-        if len(words) != 4:
-            continue
-        if words[0] not in ('#if', '#elif'):
-            continue
-        if words[1].startswith('(') and words[-1].endswith(')'):
-            words[1] = words[1][1:]
-            words[-1] = words[-1][:-1]
-        if words[1] == 'XML_COMBINED_VERSION':
-            version = int(words[3])
-            if words[2] == '>':
-                versions.add(version+1)
-                continue
-            if words[2] == '>=':
-                versions.add(version)
-                continue
-        raise ValueError(
-            'Unknown line with XML_COMBINED_VERSION, adjust this script:\n\n'
-            f'{line}'
-        )
-
-# We need the highest satisfiable version used in the #ifs, in x.y.z notation
-v = max({v for v in versions if v <= EXPAT_COMBINED_VERSION})
-major, minor_patch = divmod(v, 10000)
-minor, patch = divmod(minor_patch, 100)
-print(f"{major}.{minor}.{patch}")
-

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

plan.fmf

@@ -1,80 +0,0 @@
-execute:
-  how: tmt
-
-provision:
-  hardware:
-    memory: '>= 3 GB'
-
-environment:
-  pybasever: '3.14'
-
-discover:
-  - name: tests_python
-    how: shell
-    url: https://gitlab.com/redhat/centos-stream/tests/python.git
-    tests:
-    - name: smoke
-      path: /smoke
-      test: "VERSION=${pybasever} CYTHON=true ./venv.sh"
-    - name: smoke_virtualenv
-      path: /smoke
-      test: "VERSION=${pybasever} METHOD=virtualenv CYTHON=true ./venv.sh"
-    - name: debugsmoke
-      path: /smoke
-      test: "PYTHON=python${pybasever}d TOX=false VERSION=${pybasever} CYTHON=true ./venv.sh"
-    - name: selftest
-      path: /selftest
-      test: "VERSION=${pybasever} X='-i test_check_probes' ./parallel.sh"
-    - name: debugtest
-      path: /selftest
-      # test_base_interpreter: https://github.com/python/cpython/issues/131372
-      test: "VERSION=${pybasever} PYTHON=python${pybasever}d X='-i test_check_probes -i test_base_interpreter' ./parallel.sh"
-    - name: freethreadingtest
-      path: /selftest
-      test: "VERSION=${pybasever}t X='-i test_check_probes -i test_base_interpreter' ./parallel.sh"
-    - name: optimizedflags
-      path: /flags
-      test: "python${pybasever} ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
-    - name: debugflags
-      path: /flags
-      test: "python${pybasever}d ./assertflags.py -O0  CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
-    - name: freethreadingflags
-      path: /flags
-      test: "python${pybasever}t ./assertflags.py -O3 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
-    - name: freethreadingdebugflags
-      path: /flags
-      test: "python${pybasever}td ./assertflags.py -O0 CFLAGS PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS PY_CORE_CFLAGS PY_CFLAGS_NODIST PY_STDMODULE_CFLAGS"
-    - name: marshalparser
-      path: /marshalparser
-      test: "VERSION=${pybasever} SAMPLE=10 ./test_marshalparser_compatibility.sh"
-
-prepare:
-  - name: Install dependencies
-    how: install
-    package:
-    - 'https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm'
-    - gcc  # for extension building in venv and selftest
-    - gcc-c++ # for test_cppext
-    - gdb  # for test_gdb
-    - "python${pybasever}"  # the test subject
-    - "python${pybasever}-debug"  # for leak testing
-    - "python${pybasever}-devel"  # for extension building in venv and selftest
-    - "python${pybasever}-tkinter"  # for selftest
-    - "python${pybasever}-test"  # for selftest
-    - "python${pybasever}-freethreading"  # for -O... flag test
-    - "python${pybasever}-freethreading-debug"  # for -O... flag test
-    - "python${pybasever}-freethreading-tkinter"  # for freethreadingtest
-    - "python${pybasever}-freethreading-test"  # for freethreadingtest
-    - tox  # for venv tests
-    - virtualenv  # for virtualenv tests
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser
-    - rpm  # for debugging
-    - dnf  # for upgrade
-  - name: Update packages
-    how: shell
-    script: dnf upgrade -y
-  - name: rpm_qa
-    order: 100
-    how: shell
-    script: rpm -qa | sort | tee $TMT_PLAN_DATA/rpmqa.txt

rpminspect.yaml

@@ -1,37 +0,0 @@
-# exclude test XML data (not always valid) from XML validity check:
-xml:
-    ignore:
-        - '/usr/lib*/python*/test/xmltestdata/*'
-        - '/usr/lib*/python*/test/xmltestdata/*/*'
-
-# exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
-badfuncs:
-    allowed:
-        '/usr/lib*/python*/lib-dynload/_socket.*':
-            - inet_aton
-            - inet_ntoa
-
-# exclude the debug build from annocheck entirely
-annocheck:
-    ignore:
-        - '/usr/bin/python*d'
-        - '/usr/lib*/libpython*d.so.1.0'
-        - '/usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so'
-
-# don't report changed content of compiled files
-# that is expected with every toolchain update and not reproducible yet
-changedfiles:
-    # note that this is a posix regex, so no \d
-    exclude_path: (\.so(\.[0-9]+(\.[0-9]+)?)?$|^/usr/bin/python[0-9]+\.[0-9]+d?m?$)
-
-# files change size all the time, we don't need to VERIFY it
-# however, the INFO is useful, so we don't disable the check entirely
-filesize:
-    # artificially large number, TODO a better way
-    size_threshold: 100000
-
-
-# completely disabled inspections:
-inspections:
-    # we know about our patches, no need to report anything
-    patches: off

rpmlint.toml

@@ -1,106 +0,0 @@
-Filters = [
-
-    # KNOWN BUGS:
-    # https://bugzilla.redhat.com/show_bug.cgi?id=1489816
-    'crypto-policy-non-compliance-openssl',
-
-
-    # TESTS:
-    '(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+t?/test',
-
-
-    # OTHER DELIBERATES:
-    # chroot function
-    'missing-call-to-chdir-with-chroot',
-
-    # gethostbyname function calls gethostbyname
-    '(E|W): binary-or-shlib-calls-gethostbyname /usr/lib(64)?/python3\.\d+t?/lib-dynload/_socket\.',
-
-    # intentionally unversioned and selfobsoleted
-    'unversioned-explicit-obsoletes python',
-    'unversioned Obsoletes: Obsoletes: python3\.\d+$',
-    'self-obsoletion python3\.\d+(-\S+)? obsoletes python3\.\d+(-\S+)?',
-
-    # intentionally hardcoded
-    'hardcoded-library-path in %{_prefix}/lib/(debug/%{_libdir}|python%{pybasever})',
-
-    # we have non binary stuff, python files
-    'only-non-binary-in-usr-lib',
-
-    # some devel files that are deliberately needed
-    'devel-file-in-non-devel-package /usr/include/python3\.\d+m?t?/pyconfig-(32|64)\.h',
-    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+t?/distutils/tests/xxmodule\.c',
-    # ...or are used as test data
-    'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+t?/test',
-
-    # some bytecode is shipped without sources on purpose, as a space optimization
-    # if this regex needs to be relaxed in the future, make sure it **does not** match pyc files in __pycache__
-    'python-bytecode-without-source /usr/lib(64)?/python3\.\d+t?/(encodings|pydoc_data)/[^/]+.pyc',
-
-    # DUPLICATE FILES
-    # test data are often duplicated
-    '(E|W): files-duplicate /usr/lib(64)?/python3\.\d+t?/(test|__phello__)/',
-    # duplicated inits or mains are also common
-    '(E|W): files-duplicate .+__init__\.py.+__init__\.py',
-    '(E|W): files-duplicate .+__main__\.py.+__main__\.py',
-    # files in the debugsource package
-    '(E|W): files-duplicate /usr/src/debug',
-    # general waste report
-    '(E|W): files-duplicated-waste',
-
-    # SORRY, NOT SORRY:
-    # manual pages
-    'no-manual-page-for-binary (idle|pydoc|pyvenv|2to3|python3?-debug|pathfix|msgfmt|pygettext)',
-    'no-manual-page-for-binary python3?.*-config$',
-    'no-manual-page-for-binary python3\.\d+t?dm?$',
-
-    # missing documentation from subpackages
-    '^python3(\.\d+)?-(freethreading(-debug)?|debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation',
-
-    # platform python is obsoleted, but not provided
-    'obsolete-not-provided platform-python',
-
-    # we have extra tokens at the end of %endif/%else directives, we consider them useful
-    'extra tokens at the end of %(endif|else) directive',
-
-
-    # RPMLINT IMPERFECTIONS
-    # https://github.com/rpm-software-management/rpmlint/issues/780
-    '/usr/lib/debug',
-
-    # we provide python(abi) manually to be sure. createrepo will merge this with the automatic
-    'python3(\.\d+)?\.[^:-]+: (E|W): useless-provides python\(abi\)',
-
-    # debugsource and debuginfo have no docs
-    '^python3(\.\d+)?-debug(source|info)\.[^:]+: (E|W): no-documentation',
-
-    # this is OK for F28+
-    'library-without-ldconfig-post',
-
-    # freethreading/debug package contains devel and non-devel files
-    'python3(\.\d+)?-(freethreading(-debug)?|debug)\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package',
-
-    # this goes to other subpackage, hence not actually dangling
-    'dangling-relative-symlink /usr/bin/python python3',
-    'dangling-relative-symlink /usr/share/man/man1/python\.1\.gz python3\.1\.gz',
-    'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+t?d?m?(-embed)?\.pc python-3\.\d+t?(-embed)?\.pc',
-
-    # the python-unversioned-command package contains dangling symlinks by design
-    '^python-unversioned-command\.[^:]+: (E|W): dangling-relative-symlink (/usr/bin/python \./python3|/usr/share/man/man1/python\.1\S* ./python3\.1\S*)$',
-
-    # we need this macro to evaluate, even if the line starts with #
-    'macro-in-comment %\{_pyconfig(32|64)_h\}',
-
-    # Python modules don't need to be linked against libc
-    # Since 3.8 they are no longer linked against libpython3.8.so.1.0
-    '(E|W): library-not-linked-against-libc /usr/lib(64)?/python3\.\d+/lib-dynload/',
-    '(E|W): shared-lib(rary)?-without-dependency-information /usr/lib(64)?/python3\.\d+/lib-dynload/',
-
-    # specfile-errors are listed twice, once with reason and once without
-    # we filter out the empty ones
-    '\bpython3(\.\d+)?\.(src|spec): (E|W): specfile-error\s+$',
-
-    # SPELLING ERRORS
-    'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest|unittest|gil) ',
-
-]

sources

@@ -1 +0,0 @@
-SHA512 (Python-3.14.4.tar.xz) = 89a7f8b8a31f48d150badb4751df137d47d9014c9c422649a1a55aef5618aa7f0259dd18c151e6804fa8312c6a21544332a9f630ee81150dc00505637e62bb8c