.gitignore

@@ -1,3 +1 @@
-/*.tar.*
-/*.src.rpm
-/results_python3*
+SOURCES/Python-3.9.25.tar.xz

.python3.9.metadata

@@ -0,0 +1 @@
+36c7257ec30dca042679626d0dff79715acd4efb SOURCES/Python-3.9.25.tar.xz

00492-cve-2026-11940.patch

@@ -1,93 +0,0 @@
-From 8db3857331be8920c65f641c2d57e4e51f71d6bc Mon Sep 17 00:00:00 2001
-From: Stan Ulbrych <stan@python.org>
-Date: Tue, 23 Jun 2026 14:31:38 +0100
-Subject: [PATCH 1/2] gh-151558: Fix symlink escape via `tarfile`
- hardlink-extraction fallback (GH-151559)
-
----
- Lib/tarfile.py           |  3 +++
- Lib/test/test_tarfile.py | 25 +++++++++++++++++++++++++
- 2 files changed, 28 insertions(+)
-
-diff --git a/Lib/tarfile.py b/Lib/tarfile.py
-index fa3f922647..191fd38cba 100755
---- a/Lib/tarfile.py
-+++ b/Lib/tarfile.py
-@@ -2668,6 +2668,9 @@ class TarFile(object):
-                     "makelink_with_filter: if filter_function is not None, "
-                     + "extraction_root must also not be None")
-             try:
-+                filter_function(
-+                    unfiltered.replace(name=tarinfo.name, deep=False),
-+                    extraction_root)
-                 filtered = filter_function(unfiltered, extraction_root)
-             except _FILTER_ERRORS as cause:
-                 raise LinkFallbackError(tarinfo, unfiltered.name) from cause
-diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
-index 8b9aea223c..34d0cff17b 100644
---- a/Lib/test/test_tarfile.py
-+++ b/Lib/test/test_tarfile.py
-@@ -3854,6 +3854,31 @@ class TestExtractionFilters(unittest.TestCase):
-                     self.expect_file("boom", symlink_to='../../link_here')
-                     self.expect_file("c", symlink_to='b')
- 
-+    @symlink_test
-+    def test_sneaky_hardlink_fallback_deep(self):
-+        # (CVE-2026-11940)
-+        with ArchiveMaker() as arc:
-+            arc.add("a/b/s", symlink_to=os.path.join("..", "escape"))
-+            arc.add("s", hardlink_to=os.path.join("a", "b", "s"))
-+
-+        with self.check_context(arc.open(), 'data'):
-+            e = self.expect_exception(
-+                tarfile.LinkFallbackError,
-+                "link 's' would be extracted as a copy of "
-+                + "'a/b/s', which was rejected")
-+            self.assertIsInstance(e.__cause__,
-+                                  tarfile.LinkOutsideDestinationError)
-+
-+        for filter in 'tar', 'fully_trusted':
-+            with self.subTest(filter), self.check_context(arc.open(), filter):
-+                if not support.can_symlink():
-+                    self.expect_file("a/")
-+                    self.expect_file("a/b/")
-+                else:
-+                    self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape'))
-+                    self.expect_file("s", symlink_to=os.path.join('..', 'escape'))
-+
-+    @symlink_test
-     def test_exfiltration_via_symlink(self):
-         # (CVE-2025-4138)
-         # Test changing symlinks that result in a symlink pointing outside
-
-From b803c1f883f01db47a9ae28a79c5caedb859cfce Mon Sep 17 00:00:00 2001
-From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
-Date: Thu, 6 Aug 2026 09:39:24 +0000
-Subject: [PATCH 2/2] Fix: replace undefined symlink_test decorator with
- support.skip_unless_symlink for Python 3.9
-
----
- Lib/test/test_tarfile.py | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
-index 34d0cff17b..e45ca141c9 100644
---- a/Lib/test/test_tarfile.py
-+++ b/Lib/test/test_tarfile.py
-@@ -3854,7 +3854,7 @@ class TestExtractionFilters(unittest.TestCase):
-                     self.expect_file("boom", symlink_to='../../link_here')
-                     self.expect_file("c", symlink_to='b')
- 
--    @symlink_test
-+    @support.skip_unless_symlink
-     def test_sneaky_hardlink_fallback_deep(self):
-         # (CVE-2026-11940)
-         with ArchiveMaker() as arc:
-@@ -3878,7 +3878,6 @@ class TestExtractionFilters(unittest.TestCase):
-                     self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape'))
-                     self.expect_file("s", symlink_to=os.path.join('..', 'escape'))
- 
--    @symlink_test
-     def test_exfiltration_via_symlink(self):
-         # (CVE-2025-4138)
-         # Test changing symlinks that result in a symlink pointing outside

SOURCES/Python-3.9.25.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEE4/8oOcBIslwITevpsmmV4xAlBWgFAmkFBpsACgkQsmmV4xAl
+BWgwbw//Tx78tZg3/tJ47YDzDCf68XurBPbdgSfmmGTRrveMt6nQbV+c7XKS5MKK
+6hP0jt4W8tP6zC/zRPTexqYwetTaM7+ZKuxzwXABXzi+rfmL/L6BtQQpzwK+vesE
+hSSkjl4R2FF3YBrTBNqG0ewf5j4Y41yc4V9UHJWXbmQt6sg/nF+lDvG3K3wzP6zV
+rs6LsayeO3AXhi7+c0q7d2oYTFhv/RPOGl6/fLy5j1bxNNE1i2yeIfcR9BqjqB9y
+Ue1Tea8RGjh3dSq06/8ubpcqf+tlE4cCDkLERqDWSafZnNA5X4eymAQP9urUoH2n
+78X8DXkGbKqyJ+3w97S6zqVnZvL2jSOog8R+yvT5snqzJDp+UK0lcbowPILsOGm4
+BE54dQTG5bT+1bUicvQZIbP4vOswZufl8LGmodkW06edSEcylwO8bHWNcY/gC5HO
+WcTbqTFyV+FtwAJxsfgkqKcI6xUyYHqeMhqCUvkpHFFMjsinVOBFVbow8fgiJGUV
+GIo3kMNPZPirqgl9bhc3F7qvdgVDQsCqnKJ8B1WegdIlKWxXBj3qQB0U4Qbecpdt
+2AhVQAmcOu4LzJYtatDp/0tw6KMr8nWGdofrLVJgzQuu6MmhGW+2cJ0e+wUAxw6v
+OBjQ0o42ylQKeS8VGP4yFbYv1umeeWHje26z9az3uOVUFaAoptk=
+=5qMt
+-----END PGP SIGNATURE-----

SPECS/python3.9.spec

@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 10%{?dist}
+Release: 9%{?dist}
 License: Python
 
 
@@ -519,12 +519,6 @@ Patch489: 00489-openssl-3.5.7.patch
 # only joined and parsed once enough has piled up.
 Patch490: 00490-cve-2026-15308.patch
 
-# 00492 #
-# CVE-2026-11940
-#
-# Fix symlink escape via tarfile hardlink-extraction fallback
-Patch492: 00492-cve-2026-11940.patch
-
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1936,10 +1930,6 @@ CheckPython optimized
 # ======================================================
 
 %changelog
-* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.9.25-10
-- Security fix for CVE-2026-11940
-Resolves: RHEL-227223
-
 * Mon Jul 13 2026 Lukáš Zachar <lzachar@redhat.com> - 3.9.25-9
 - Security fix for CVE-2026-15308
 Resolves: RHEL-193783

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-9
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

python3.9.rpmlintrc

@@ -1,90 +0,0 @@
-# KNOWN BUGS:
-# https://bugzilla.redhat.com/show_bug.cgi?id=1489816
-addFilter(r'crypto-policy-non-compliance-openssl')
-
-
-# TESTS:
-addFilter(r'(zero-length|pem-certificate|uncompressed-zip) /usr/lib(64)?/python3\.\d+/test')
-
-
-# OTHER DELIBERATES:
-# chroot function
-addFilter(r'missing-call-to-chdir-with-chroot')
-
-# intentionally unversioned and selfobsoleted
-addFilter(r'unversioned-explicit-obsoletes python')
-addFilter(r'self-obsoletion python3\.\d+ obsoletes python3\.\d+')
-
-# intentionally hardcoded
-addFilter(r'hardcoded-library-path in %{_prefix}/lib/(debug/%{_libdir}|python%{pybasever})')
-
-# intentional for our pythonXY package
-addFilter(r'python3\.\d+\.[^:]+: (E|W): devel-file-in-non-devel-package')
-
-# we have non binary stuff, python files
-addFilter(r'only-non-binary-in-usr-lib')
-
-# some devel files that are deliberately needed
-addFilter(r'devel-file-in-non-devel-package /usr/include/python3\.\d+m?/pyconfig-(32|64)\.h')
-addFilter(r'devel-file-in-non-devel-package /usr/lib(64)?/python3\.\d+/distutils/tests/xxmodule\.c')
-
-# some bytecode is shipped without sources on purpose, as a space optimization
-# if this regex needs to be relaxed in the future, make sure it **does not** match pyc files in __pycache__
-addFilter(r'python-bytecode-without-source /usr/lib(64)?/python3\.\d+/(encodings|pydoc_data)/[^/]+.pyc')
-
-# SORRY, NOT SORRY:
-# manual pages
-addFilter(r'no-manual-page-for-binary (idle|pydoc|pyvenv|2to3|python3?-debug|pathfix|msgfmt|pygettext)')
-addFilter(r'no-manual-page-for-binary python3?.*-config$')
-addFilter(r'no-manual-page-for-binary python3\.\d+dm?$')
-
-# missing documentation from subpackages
-addFilter(r'^python3(\.\d+)?-(debug|tkinter|test|idle)\.[^:]+: (E|W): no-documentation')
-
-# platform python is obsoleted, but not provided
-addFilter(r'obsolete-not-provided platform-python')
-
-
-# RPMLINT IMPERFECTIONS
-# https://github.com/rpm-software-management/rpmlint/issues/123
-addFilter(r'python-bytecode-wrong-magic-value .* expected 33\d\d \(3\.7\), found 3393')
-# https://github.com/rpm-software-management/rpmlint/pull/133
-addFilter(r'python-bytecode-wrong-magic-value .* expected 33\d\d \(3\.7\), found 3394')
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=1550562
-# https://github.com/rpm-software-management/rpmlint/issues/128
-addFilter(r'python-bytecode-inconsistent-mtime .* 1970')
-
-# we provide python(abi) manually to be sure. createrepo will merge this with the automatic
-addFilter(r'python3(\.\d+)?\.[^:-]+: (E|W): useless-provides python\(abi\)')
-
-# debugsource
-addFilter(r'^python3(\.\d+)?-debugsource\.[^:]+: (E|W): no-documentation')
-
-# debuginfo
-addFilter(r'^python3(\.\d+)?-debuginfo\.[^:]+: (E|W): useless-provides debuginfo\(build-id\)')
-
-# this is OK for F28+
-addFilter(r'library-without-ldconfig-post')
-
-# debug package contains devel and non-devel files
-addFilter(r'python3(\.\d+)?-debug\.[^:]+: (E|W): (non-)?devel-file-in-(non-)?devel-package')
-
-# this goes to other subpackage, hence not actually dangling, the read error is bogus
-addFilter(r'dangling-relative-symlink /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc python-3\.\d+(-embed)?\.pc')
-addFilter(r'read-error /usr/lib(64)?/pkgconfig/python-3\.\d+dm?(-embed)?\.pc \[Errno 2\]')
-
-# the python-unversioned-command package contains dangling symlinks by design
-addFilter(r'^python-unversioned-command\.[^:]+: (E|W): dangling-relative-symlink '
-          r'(/usr/bin/python \./python3|/usr/share/man/man1/python\.1\S* ./python3\.1\S*)$')
-
-# we need this macro to evaluate, even if the line starts with #
-addFilter(r'macro-in-comment %\{_pyconfig(32|64)_h\}')
-
-# Python modules don't need to be linked against libc
-# Since 3.8 they are no longer linked against libpython3.8.so.1.0
-addFilter(r'E: library-not-linked-against-libc /usr/lib(64)?/python3\.\d+/lib-dynload/')
-addFilter(r'E: shared-lib-without-dependency-information /usr/lib(64)?/python3\.\d+/lib-dynload/')
-
-# SPELLING ERRORS
-addFilter(r'spelling-error .* en_US (bytecode|pyc|filename|tkinter|namespaces|pytest) ')

rpminspect.yaml

@@ -1,32 +0,0 @@
-# exclude test XML data (not always valid) from XML validity check:
-xml:
-    ignore:
-        - /usr/lib*/python*/test/xmltestdata/*
-        - /usr/lib*/python*/test/xmltestdata/*/*
-
-# exclude _socket from ipv4 only functions check, it has both ipv4 and ipv6 only
-badfuncs:
-    ignore:
-        - /usr/lib*/python*/lib-dynload/_socket.*
-
-# don't report changed content of compiled files
-# that is expected with every toolchain update and not reproducible yet
-changedfiles:
-    # note that this is a posix regex, so no \d
-    exclude_path: (\.so(\.[0-9]+(\.[0-9]+)?)?$|^/usr/bin/python[0-9]+\.[0-9]+d?m?$)
-
-# files change size all the time, we don't need to VERIFY it
-# however, the INFO is useful, so we don't disable the check entirely
-filesize:
-    # artificially large number, TODO a better way
-    size_threshold: 100000
-
-debuginfo:
-    ignore:
-        # libpython3.so doesn't contain compiled code
-        - /usr/lib/debug/usr/lib*/libpython3.so*debug
-
-# completely disabled inspections:
-inspections:
-    # we know about our patches, no need to report anything
-    patches: off

sources

@@ -1,2 +0,0 @@
-SHA512 (Python-3.9.25.tar.xz) = 33fd65952cc3ce5df83825aa32a103935815bdd5a016e5fd9896cafb068a3f89b3a6134458a2694e4f0f4f8a9fbe84739b53116264728b32cde0f03ab210cb19
-SHA512 (Python-3.9.25.tar.xz.asc) = 83f0a0e558aa89a106bdffeeb9b0fa2685fbd7be5c5954f9176c59c6c7023716207b07239f202b3508cbb98ca34572161955f0bfd3732fdb9265721cd6723dbe

tests/.fmf/version

@@ -1 +0,0 @@
-1

tests/provision.fmf

@@ -1,4 +0,0 @@
----
-standard-inventory-qcow2:
-  qemu:
-    m: 3G  # Amount of VM memory

tests/tests.yml

@@ -1,59 +0,0 @@
----
-- hosts: localhost
-  tags:
-    - classic
-  tasks:
-    - dnf:
-        name: "*"
-        state: latest
-    - dnf:
-        name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm"
-        state: installed
-    - dnf:
-        name: "https://dl.fedoraproject.org/pub/epel/epel-next-release-latest-9.noarch.rpm"
-        state: installed
-
-- hosts: localhost
-  roles:
-  - role: standard-test-basic
-    tags:
-    - classic
-    repositories:
-    - repo: "https://gitlab.com/redhat/centos-stream/tests/python.git"
-      dest: "python"
-    tests:
-    - smoke:
-        dir: python/smoke
-        run: VERSION=3.9 ./venv.sh
-    - debugsmoke:
-        dir: python/smoke
-        run: PYTHON=python3-debug TOX=false VERSION=3.9 ./venv.sh
-    - selftest:
-        dir: python/selftest
-        run: VERSION=3.9 X="-x test_wsgiref" ./parallel.sh
-    - debugtest:
-        dir: python/selftest
-        run: VERSION=3.9 PYTHON=python3-debug X="-x test_wsgiref" ./parallel.sh
-    - optimizedflags_self:
-        dir: python/flags
-        run: python3 ./assertflags.py -O3 PY_BUILTIN_MODULE_CFLAGS PY_CFLAGS_NODIST PY_CORE_CFLAGS PY_STDMODULE_CFLAGS
-    - optimizedflags_3rd:
-        dir: python/flags
-        run: python3 ./assertflags.py -O2 CFLAGS PY_CFLAGS
-    - debugflags:
-        dir: python/flags
-        run: python3-debug ./assertflags.py -O0
-    - marshalparser:
-        dir: python/marshalparser
-        run: VERSION=3.9 SAMPLE=10 test_marshalparser_compatibility.sh
-    required_packages:
-    - gcc  # for extension building in venv and selftest
-    - gdb  # for test_gdb
-    - python3.9  # the test subject
-    - python3-debug  # for leak testing
-    - python3-devel  # for extension building in venv and selftest
-    - python3-tkinter  # for selftest
-    - python3-test  # for selftest
-    - python3-tox  # for venv tests
-    - glibc-all-langpacks # for locale tests
-    - marshalparser  # for testing compatibility (magic numbers) with marshalparser