.gitignore

@@ -1 +1 @@
-SOURCES/Python-3.8.17-noexe.tar.xz
+SOURCES/Python-3.8.13-noexe.tar.xz

.python38.metadata

@@ -1 +0,0 @@
-5ecdca78a141bb6d7e13732920886affd7338fca SOURCES/Python-3.8.17-noexe.tar.xz

00189-use-rpm-wheels.patch

@@ -29,7 +29,7 @@ index b291e9a..798d0f4 100644
  __all__ = ["version", "bootstrap"]
  _PACKAGE_NAMES = ('setuptools', 'pip')
 -_SETUPTOOLS_VERSION = "56.0.0"
--_PIP_VERSION = "23.0.1"
+-_PIP_VERSION = "22.0.4"
 +
 +_WHEEL_DIR = "/usr/share/python38-wheels/"
 +

00329-fips.patch

@@ -1,4 +1,4 @@
-From 31ae5d3189a0b8ec07c55df3785d27d769bc90a5 Mon Sep 17 00:00:00 2001
+From 9e1da6c093529d7b314f3703158a213824c3521e Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 25 Jul 2019 16:19:52 +0200
 Subject: [PATCH 01/36] Expose OpenSSL FIPS_mode() as hashlib.get_fips_mode()
@@ -123,10 +123,10 @@ index 9aaea47..30fd8a9 100644
 -/*[clinic end generated code: output=38c2637f67e9bb79 input=a9049054013a1b77]*/
 +/*[clinic end generated code: output=5467006d93e7479e input=a9049054013a1b77]*/
 -- 
-2.38.1
+2.31.1
 
 
-From 9e12b2fdecca4fba5d777923f7742fffb7b6240d Mon Sep 17 00:00:00 2001
+From 5a8faeb61d7acd6c7036efe24efe269c683dc1a0 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Thu, 25 Jul 2019 17:04:06 +0200
 Subject: [PATCH 02/36] Use python's fall backs for the crypto it implements
@@ -410,10 +410,10 @@ index 63ae836..1bcfdf9 100644
 +if not get_fips_mode():
 +    del __py_new
 diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
-index e6cec4e..f40cc83 100644
+index 8b53d23..e9abcbb 100644
 --- a/Lib/test/test_hashlib.py
 +++ b/Lib/test/test_hashlib.py
-@@ -954,6 +954,7 @@ class KDFTests(unittest.TestCase):
+@@ -945,6 +945,7 @@ class KDFTests(unittest.TestCase):
              iterations=1, dklen=None)
          self.assertEqual(out, self.pbkdf2_results['sha1'][0][0])
  
@@ -422,10 +422,10 @@ index e6cec4e..f40cc83 100644
          self._test_pbkdf2_hmac(py_hashlib.pbkdf2_hmac)
  
 -- 
-2.38.1
+2.31.1
 
 
-From a7711c418ea72f9ea18bbb70a2d52ab44489066b Mon Sep 17 00:00:00 2001
+From d21c5a098dda889de21985e57f12852ce9fbbcf1 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 25 Jul 2019 17:19:06 +0200
 Subject: [PATCH 03/36] Disable Python's hash implementations in FIPS mode,
@@ -695,10 +695,10 @@ index c1fb618..34d09b4 100644
          return NULL;
      }
 diff --git a/setup.py b/setup.py
-index 0b24dd6..f7c4be1 100644
+index c28c096..a11bbda 100644
 --- a/setup.py
 +++ b/setup.py
-@@ -1677,7 +1677,6 @@ class PyBuildExt(build_ext):
+@@ -1673,7 +1673,6 @@ class PyBuildExt(build_ext):
      def detect_modules(self):
          self.configure_compiler()
          self.init_inc_lib_dirs()
@@ -706,7 +706,7 @@ index 0b24dd6..f7c4be1 100644
          self.detect_simple_extensions()
          if TEST_EXTENSIONS:
              self.detect_test_extensions()
-@@ -2165,7 +2164,7 @@ class PyBuildExt(build_ext):
+@@ -2161,7 +2160,7 @@ class PyBuildExt(build_ext):
                             sources=sources,
                             depends=depends))
  
@@ -715,7 +715,7 @@ index 0b24dd6..f7c4be1 100644
          # Detect SSL support for the socket module (via _ssl)
          config_vars = sysconfig.get_config_vars()
  
-@@ -2186,7 +2185,7 @@ class PyBuildExt(build_ext):
+@@ -2182,7 +2181,7 @@ class PyBuildExt(build_ext):
          if not openssl_libs:
              # libssl and libcrypto not found
              self.missing.extend(['_ssl', '_hashlib'])
@@ -724,7 +724,7 @@ index 0b24dd6..f7c4be1 100644
  
          # Find OpenSSL includes
          ssl_incs = find_file(
-@@ -2194,7 +2193,7 @@ class PyBuildExt(build_ext):
+@@ -2190,7 +2189,7 @@ class PyBuildExt(build_ext):
          )
          if ssl_incs is None:
              self.missing.extend(['_ssl', '_hashlib'])
@@ -733,7 +733,7 @@ index 0b24dd6..f7c4be1 100644
  
          # OpenSSL 1.0.2 uses Kerberos for KRB5 ciphers
          krb5_h = find_file(
-@@ -2204,12 +2203,24 @@ class PyBuildExt(build_ext):
+@@ -2200,12 +2199,24 @@ class PyBuildExt(build_ext):
          if krb5_h:
              ssl_incs.extend(krb5_h)
  
@@ -761,7 +761,7 @@ index 0b24dd6..f7c4be1 100644
                  depends=[
                      'socketmodule.h',
                      '_ssl/debughelpers.c',
-@@ -2222,22 +2233,12 @@ class PyBuildExt(build_ext):
+@@ -2218,22 +2229,12 @@ class PyBuildExt(build_ext):
  
          self.add(Extension('_hashlib', ['_hashopenssl.c'],
                             depends=['hashlib.h'],
@@ -788,7 +788,7 @@ index 0b24dd6..f7c4be1 100644
  
          blake2_deps = glob(os.path.join(escape(self.srcdir),
                                          'Modules/_blake2/impl/*'))
-@@ -2247,6 +2248,7 @@ class PyBuildExt(build_ext):
+@@ -2243,6 +2244,7 @@ class PyBuildExt(build_ext):
                             ['_blake2/blake2module.c',
                              '_blake2/blake2b_impl.c',
                              '_blake2/blake2s_impl.c'],
@@ -796,7 +796,7 @@ index 0b24dd6..f7c4be1 100644
                             depends=blake2_deps))
  
          sha3_deps = glob(os.path.join(escape(self.srcdir),
-@@ -2254,7 +2256,9 @@ class PyBuildExt(build_ext):
+@@ -2250,7 +2252,9 @@ class PyBuildExt(build_ext):
          sha3_deps.append('hashlib.h')
          self.add(Extension('_sha3',
                             ['_sha3/sha3module.c'],
@@ -808,10 +808,10 @@ index 0b24dd6..f7c4be1 100644
      def detect_nis(self):
          if MS_WINDOWS or CYGWIN or HOST_PLATFORM == 'qnx6':
 -- 
-2.38.1
+2.31.1
 
 
-From 5928affee1e8306877918efc417090512faea14d Mon Sep 17 00:00:00 2001
+From 668177d86702b10da881f76cf17bda44d8823be9 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Thu, 12 Dec 2019 16:58:31 +0100
 Subject: [PATCH 04/36] Expose all hashes available to OpenSSL
@@ -1310,10 +1310,10 @@ index 30fd8a9..e96a752 100644
 -/*[clinic end generated code: output=5467006d93e7479e input=a9049054013a1b77]*/
 +/*[clinic end generated code: output=be8e21a10dff71e7 input=a9049054013a1b77]*/
 -- 
-2.38.1
+2.31.1
 
 
-From eb264b74a2a6fc820813edbfa611b782edcda088 Mon Sep 17 00:00:00 2001
+From 7137c003853b8672eed4d28fe8703756b75ab790 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 25 Jul 2019 18:13:45 +0200
 Subject: [PATCH 05/36] Fix tests
@@ -1323,7 +1323,7 @@ Subject: [PATCH 05/36] Fix tests
  1 file changed, 45 insertions(+), 13 deletions(-)
 
 diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
-index f40cc83..972eda1 100644
+index e9abcbb..2a55fd4 100644
 --- a/Lib/test/test_hashlib.py
 +++ b/Lib/test/test_hashlib.py
 @@ -190,7 +190,9 @@ class HashLibTestCase(unittest.TestCase):
@@ -1442,10 +1442,10 @@ index f40cc83..972eda1 100644
      @requires_sha3
      def test_extra_sha3(self):
 -- 
-2.38.1
+2.31.1
 
 
-From 7c34172f398cdea804e8a4671f996e9b3706ec7d Mon Sep 17 00:00:00 2001
+From 94f13c68d2a4845e58d4c7b7adf01e64f993c4f5 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Fri, 26 Jul 2019 11:27:57 +0200
 Subject: [PATCH 06/36] Change FIPS exceptions from _blake2, _sha3 module init
@@ -1584,10 +1584,10 @@ index 34d09b4..3079e1e 100644
      if ((m = PyModule_Create(&_SHA3module)) == NULL) {
          return NULL;
 -- 
-2.38.1
+2.31.1
 
 
-From c968e85d077123510f8b6441b169b46f6e0e9d26 Mon Sep 17 00:00:00 2001
+From 805af2c3dcbe1855a9fb8eb534b985aed338c2ba Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Fri, 26 Jul 2019 11:24:09 +0200
 Subject: [PATCH 07/36] Make hashlib importable under FIPS mode
@@ -1619,10 +1619,10 @@ index 1bcfdf9..898e6dc 100644
  
  
 -- 
-2.38.1
+2.31.1
 
 
-From ea2a87a494c36eae2cc2cf343074ff0214e37517 Mon Sep 17 00:00:00 2001
+From bc3f033f0a832e6b7ddf50e1059de8fc5df08d3f Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Fri, 26 Jul 2019 15:41:10 +0200
 Subject: [PATCH 08/36] Implement hmac.new using new built-in module,
@@ -2250,10 +2250,10 @@ index 0000000..b472a6e
 +}
 +/*[clinic end generated code: output=10b6e8cac6d7a2c9 input=a9049054013a1b77]*/
 diff --git a/setup.py b/setup.py
-index f7c4be1..6fc7e72 100644
+index a11bbda..ca30105 100644
 --- a/setup.py
 +++ b/setup.py
-@@ -2235,6 +2235,10 @@ class PyBuildExt(build_ext):
+@@ -2231,6 +2231,10 @@ class PyBuildExt(build_ext):
                             depends=['hashlib.h'],
                             **self.detect_openssl_args()) )
  
@@ -2265,10 +2265,10 @@ index f7c4be1..6fc7e72 100644
          # RHEL: Always force OpenSSL for md5, sha1, sha256, sha512;
          # don't build Python's implementations.
 -- 
-2.38.1
+2.31.1
 
 
-From 03ac0fc03e418f73ed76b203f779a083312aaff9 Mon Sep 17 00:00:00 2001
+From da75615e1f3e6b8f44a16e5113a4a6fd55e48629 Mon Sep 17 00:00:00 2001
 From: Marcel Plch <mplch@redhat.com>
 Date: Mon, 29 Jul 2019 12:45:11 +0200
 Subject: [PATCH 09/36] FIPS review
@@ -2480,10 +2480,10 @@ index ca95d72..216ed04 100644
 +    return PyModuleDef_Init(&_hmacopenssl_def);
  }
 -- 
-2.38.1
+2.31.1
 
 
-From f130424124b4cbd4b61f1dd84b69f1f4f9e766f6 Mon Sep 17 00:00:00 2001
+From f48fab4946308008e989d845ce0dbc2cff6ce9ff Mon Sep 17 00:00:00 2001
 From: Marcel Plch <mplch@redhat.com>
 Date: Mon, 29 Jul 2019 13:05:04 +0200
 Subject: [PATCH 10/36] revert cosmetic nitpick and remove trailing whitespace
@@ -2529,10 +2529,10 @@ index 216ed04..221714c 100644
      .m_methods = hmacopenssl_functions,
      .m_slots = hmacopenssl_slots,
 -- 
-2.38.1
+2.31.1
 
 
-From 5259a4c7bd3d1ce2f0bdbcd0c95583c95d7d0d23 Mon Sep 17 00:00:00 2001
+From dc55436077250ba791ee67692fdc8704a900987b Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Wed, 31 Jul 2019 15:43:43 +0200
 Subject: [PATCH 11/36] Add initial tests for various hashes under FIPS mode
@@ -2613,10 +2613,10 @@ index 0000000..bee911e
 +if __name__ == "__main__":
 +    unittest.main()
 -- 
-2.38.1
+2.31.1
 
 
-From c2b7ebc17d79f8c91572a790d425f9106d4dd70e Mon Sep 17 00:00:00 2001
+From 446c6a790ef878bda6137ebfc570f36dee01c380 Mon Sep 17 00:00:00 2001
 From: Marcel Plch <mplch@redhat.com>
 Date: Thu, 1 Aug 2019 16:39:37 +0200
 Subject: [PATCH 12/36] Initialize HMAC type.
@@ -2682,10 +2682,10 @@ index 221714c..239445a 100644
  
  fail:
 -- 
-2.38.1
+2.31.1
 
 
-From 931784f1a431538486905ef1d3958dfefd5478e6 Mon Sep 17 00:00:00 2001
+From 357007a6034cc3409ad2e2fe9fc77974ea6de626 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 1 Aug 2019 17:57:05 +0200
 Subject: [PATCH 13/36] Use a stronger hash in multiprocessing handshake
@@ -2730,10 +2730,10 @@ index 8e2facf..bb4acb6 100644
      response = connection.recv_bytes(256)        # reject large message
      if response != WELCOME:
 -- 
-2.38.1
+2.31.1
 
 
-From 8a68ba81a66181d9a4b6c7b1e77f944efada2aae Mon Sep 17 00:00:00 2001
+From fddd82fedc5ea8b49ceab49296c7bddb9f3f1204 Mon Sep 17 00:00:00 2001
 From: Marcel Plch <mplch@redhat.com>
 Date: Fri, 2 Aug 2019 17:36:01 +0200
 Subject: [PATCH 14/36] Fix refcounting
@@ -2804,10 +2804,10 @@ index 239445a..9c28828 100644
  
  
 -- 
-2.38.1
+2.31.1
 
 
-From 5d835c236b392e8741fabe9b9d83d5482842dd87 Mon Sep 17 00:00:00 2001
+From 42f7d2fbefe161607ad146f44d2abd19fe804810 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 5 Aug 2019 13:37:05 +0200
 Subject: [PATCH 15/36] hmac: Don't default to md5 in FIPS mode
@@ -2830,10 +2830,10 @@ index daabc8c..0302364 100644
          result = _hmacopenssl.new(key, digestmod=name)
          if msg:
 -- 
-2.38.1
+2.31.1
 
 
-From d865fb5a73ffaf39de68b69c9ccb81ca17b6c430 Mon Sep 17 00:00:00 2001
+From e285342c3b17de9b13ccbf2dbdb68cce5b4df86c Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 5 Aug 2019 14:20:58 +0200
 Subject: [PATCH 16/36] Make _hmacopenssl.HMAC subclassable; subclass it as
@@ -3121,10 +3121,10 @@ index b472a6e..861acc1 100644
 -/*[clinic end generated code: output=10b6e8cac6d7a2c9 input=a9049054013a1b77]*/
 +/*[clinic end generated code: output=d93ad460795d49b5 input=a9049054013a1b77]*/
 -- 
-2.38.1
+2.31.1
 
 
-From 0a75e9886721aa076542a40159b02fbd18bd8cd3 Mon Sep 17 00:00:00 2001
+From 5dab92e1f96fc0940a2d5d365708329e8c282587 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 5 Aug 2019 16:10:36 +0200
 Subject: [PATCH 17/36] Fix _hmacopenssl.HMAC.block_size
@@ -3147,10 +3147,10 @@ index 7d3d973..a24c8ba 100644
  
  static PyMethodDef Hmac_methods[] = {
 -- 
-2.38.1
+2.31.1
 
 
-From 68b4ee700ed23422472c9b96cf0631cb5a5dab6e Mon Sep 17 00:00:00 2001
+From d39cc2e44d6debffce096b82d30909e2662379ab Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 5 Aug 2019 15:02:08 +0200
 Subject: [PATCH 18/36] distutils upload: Skip md5 checksum in FIPS mode
@@ -3229,10 +3229,10 @@ index c17d8e7..b4b64e9 100644
  
      def test_upload_fails(self):
 -- 
-2.38.1
+2.31.1
 
 
-From 62c8250c2996af8e4d112676c0995616583fafa7 Mon Sep 17 00:00:00 2001
+From 124f7e862bdbf6615e64fedfa73a76e199d68644 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 5 Aug 2019 15:32:25 +0200
 Subject: [PATCH 19/36] Fix HMAC tests on FIPS mode
@@ -3322,10 +3322,10 @@ index 23c108f..0a85981 100644
      def test_equality(self):
          # Testing if the copy has the same digests.
 -- 
-2.38.1
+2.31.1
 
 
-From a7f5d3a4712694e6b74295ba6980c554b56d7227 Mon Sep 17 00:00:00 2001
+From 6bc6c745da5c2d860de9f76402ccf554e398bbbc Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 5 Aug 2019 16:37:12 +0200
 Subject: [PATCH 20/36] test_tools: Skip md5sum tests in FIPS mode
@@ -3355,10 +3355,10 @@ index fb565b7..7028a4d 100644
      @classmethod
      def setUpClass(cls):
 -- 
-2.38.1
+2.31.1
 
 
-From 9e6cfe34f7377761f758d57a1b68a62fd4d0f2d1 Mon Sep 17 00:00:00 2001
+From 22f2476f2a19dfc4e4c25e5df2f059bf8e15d397 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 5 Aug 2019 18:23:57 +0200
 Subject: [PATCH 21/36] Make hashlib tests pass in FIPS mode
@@ -3368,7 +3368,7 @@ Subject: [PATCH 21/36] Make hashlib tests pass in FIPS mode
  1 file changed, 48 insertions(+), 19 deletions(-)
 
 diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
-index 972eda1..19a9868 100644
+index 2a55fd4..9ae5efc 100644
 --- a/Lib/test/test_hashlib.py
 +++ b/Lib/test/test_hashlib.py
 @@ -28,6 +28,11 @@ COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount')
@@ -3528,7 +3528,7 @@ index 972eda1..19a9868 100644
      @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems')
      @bigmemtest(size=_4G - 1, memuse=1, dry_run=False)
      def test_case_md5_uintmax(self, size):
-@@ -851,14 +878,16 @@ class HashLibTestCase(unittest.TestCase):
+@@ -842,14 +869,16 @@ class HashLibTestCase(unittest.TestCase):
              m = cons(b'x' * gil_minsize)
              m.update(b'1')
  
@@ -3550,10 +3550,10 @@ index 972eda1..19a9868 100644
      @support.reap_threads
      def test_threaded_hashing(self):
 -- 
-2.38.1
+2.31.1
 
 
-From 22b6dcc045d87d130852bc4f017cfb6305b329dd Mon Sep 17 00:00:00 2001
+From ca8655cc0f8c1bcfb5ae970d33a826c092746203 Mon Sep 17 00:00:00 2001
 From: Lumir Balhar <lbalhar@redhat.com>
 Date: Wed, 14 Aug 2019 14:43:07 +0200
 Subject: [PATCH 22/36] distutils upload: only add md5 if available, but
@@ -3620,10 +3620,10 @@ index b4b64e9..f720a79 100644
  
      def test_upload_fails(self):
 -- 
-2.38.1
+2.31.1
 
 
-From b02daa9dbf4fcd2d1e067d63873d276bd7bf132f Mon Sep 17 00:00:00 2001
+From 12f506902ee04749565485bb60f0b927b2895e71 Mon Sep 17 00:00:00 2001
 From: Christian Heimes <christian@python.org>
 Date: Fri, 13 Sep 2019 02:30:00 +0200
 Subject: [PATCH 23/36] bpo-9216: Add usedforsecurity to hashlib constructors
@@ -3709,7 +3709,7 @@ index f5da6ec..86b9f65 100644
  
  These functions return the corresponding hash objects for calculating
 diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
-index 19a9868..3ee9b14 100644
+index 9ae5efc..08bb91f 100644
 --- a/Lib/test/test_hashlib.py
 +++ b/Lib/test/test_hashlib.py
 @@ -226,6 +226,15 @@ class HashLibTestCase(unittest.TestCase):
@@ -5854,10 +5854,10 @@ index 4167fd3..504d40a 100644
      SHAobject *new;
      Py_buffer buf;
 -- 
-2.38.1
+2.31.1
 
 
-From 0ee86826a425528d1f129788ad3e9e144e81da83 Mon Sep 17 00:00:00 2001
+From 041f34e22d7c458b611a72e3927deb85f20d1a85 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 26 Aug 2019 19:09:39 +0200
 Subject: [PATCH 24/36] Test the usedforsecurity flag
@@ -5867,7 +5867,7 @@ Subject: [PATCH 24/36] Test the usedforsecurity flag
  1 file changed, 54 insertions(+), 34 deletions(-)
 
 diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
-index 3ee9b14..a991f0a 100644
+index 08bb91f..1368e91 100644
 --- a/Lib/test/test_hashlib.py
 +++ b/Lib/test/test_hashlib.py
 @@ -21,6 +21,7 @@ from test import support
@@ -6080,9 +6080,9 @@ index 3ee9b14..a991f0a 100644
 -        self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3')
 +        self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3', usedforsecurity=False)
  
-     @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems')
+     # use the three examples from Federal Information Processing Standards
-     @bigmemtest(size=_4G - 1, memuse=1, dry_run=False)
+     # Publication 180-1, Secure Hash Standard,  1995 April 17
-@@ -934,6 +944,16 @@ class HashLibTestCase(unittest.TestCase):
+@@ -925,6 +935,16 @@ class HashLibTestCase(unittest.TestCase):
  
          self.assertEqual(expected_hash, hasher.hexdigest())
  
@@ -6100,10 +6100,10 @@ index 3ee9b14..a991f0a 100644
  class KDFTests(unittest.TestCase):
  
 -- 
-2.38.1
+2.31.1
 
 
-From 7602d70630fa0e736ad518b243079b658893d653 Mon Sep 17 00:00:00 2001
+From 6ae69003979add3243d700e1f5154cf83818ea62 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 29 Aug 2019 10:25:28 +0200
 Subject: [PATCH 25/36] Skip error checking in _hashlib.get_fips_mode
@@ -6155,10 +6155,10 @@ index b4d05ab..a48b607 100644
  
  
 -- 
-2.38.1
+2.31.1
 
 
-From 07552e7758fdc9c9610d773b4100d4686b5353a3 Mon Sep 17 00:00:00 2001
+From 95b58ae12206c7889e0159a720c1a96fcb2dc050 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Thu, 10 Oct 2019 13:04:50 +0200
 Subject: [PATCH 26/36] Skip error checking in _Py_hashlib_fips_error
@@ -6193,10 +6193,10 @@ index 47ed003..d4cbdef 100644
      }
      PyErr_Format(exc, "%s is not available in FIPS mode", name);
 -- 
-2.38.1
+2.31.1
 
 
-From 8be15a9faf79a062be4b0f27605737bc34687e68 Mon Sep 17 00:00:00 2001
+From ba0462edf8fb3ae3cb04151460002cf687758605 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 5 Aug 2019 19:12:38 +0200
 Subject: [PATCH 27/36] Fixups
@@ -6235,10 +6235,10 @@ index 0a85981..0b481ec 100644
          h1 = hmac.HMAC(b"key", digestmod="sha1")
          h2 = h1.copy()
 -- 
-2.38.1
+2.31.1
 
 
-From 112646fbf2af81df1750140f7486b32296518099 Mon Sep 17 00:00:00 2001
+From d2596ea3fab68d2fc586abaae64323599c2a74c8 Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Mon, 26 Aug 2019 19:39:48 +0200
 Subject: [PATCH 28/36] Don't re-export get_fips_mode from hashlib
@@ -6446,7 +6446,7 @@ index 34812e6..86e61e2 100644
          self.compare_hashes(hashlib.shake_128(b'abc'), _hashlib.openssl_shake_128(b'abc'))
          self.compare_hashes(hashlib.shake_256(b'abc'), _hashlib.openssl_shake_256(b'abc'))
 diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
-index a991f0a..b535059 100644
+index 1368e91..a4b7840 100644
 --- a/Lib/test/test_hashlib.py
 +++ b/Lib/test/test_hashlib.py
 @@ -29,7 +29,9 @@ COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount')
@@ -6502,7 +6502,7 @@ index a991f0a..b535059 100644
              self.check_blocksize_name('md5', 64, 16)
          self.check_blocksize_name('sha1', 64, 20)
          self.check_blocksize_name('sha224', 64, 28)
-@@ -944,7 +946,7 @@ class HashLibTestCase(unittest.TestCase):
+@@ -935,7 +937,7 @@ class HashLibTestCase(unittest.TestCase):
  
          self.assertEqual(expected_hash, hasher.hexdigest())
  
@@ -6551,7 +6551,7 @@ index 0b481ec..cc77928 100644
      def test_realcopy(self):
          # Testing if the copy method created a real copy.
 diff --git a/Lib/test/test_smtplib.py b/Lib/test/test_smtplib.py
-index d14eb45..af53ec9 100644
+index c9205ae..e4d7fb4 100644
 --- a/Lib/test/test_smtplib.py
 +++ b/Lib/test/test_smtplib.py
 @@ -17,6 +17,8 @@ import select
@@ -6563,7 +6563,7 @@ index d14eb45..af53ec9 100644
  
  import unittest
  from test import support, mock_socket
-@@ -1114,7 +1116,7 @@ class SMTPSimTests(unittest.TestCase):
+@@ -1059,7 +1061,7 @@ class SMTPSimTests(unittest.TestCase):
  
      def testAUTH_multiple(self):
          # Test that multiple authentication methods are tried.
@@ -6605,10 +6605,10 @@ index 1cb358f..6f5cb7f 100644
  from test import support
  
 -- 
-2.38.1
+2.31.1
 
 
-From 69a0ddba408a9595aa0fc5b3fdfe7e59838acea2 Mon Sep 17 00:00:00 2001
+From 7873a4a314732768bc4d11a095ae50f0553bdebd Mon Sep 17 00:00:00 2001
 From: Christian Heimes <christian@python.org>
 Date: Wed, 20 Nov 2019 10:59:25 +0100
 Subject: [PATCH 29/36] Use FIPS compliant CSPRNG
@@ -6773,10 +6773,10 @@ index eb2b6d0..cb38cfe 100644
      return win32_urandom((unsigned char *)buffer, size, raise);
  #else
 -- 
-2.38.1
+2.31.1
 
 
-From 72894033d2c1d29897204c5272d8f2878c17254c Mon Sep 17 00:00:00 2001
+From 99ee25369116bf17731502e77a81bd0c5ac59b38 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Thu, 28 Nov 2019 17:26:02 +0100
 Subject: [PATCH 30/36] Fixups for FIPS compliant CSPRNG
@@ -6872,10 +6872,10 @@ index cb38cfe..08fa29a 100644
          return 0;
      }
 -- 
-2.38.1
+2.31.1
 
 
-From d8bc6ab755acf0e2feffda802aeed032a2319df8 Mon Sep 17 00:00:00 2001
+From 3750c8b8b4c09c6bc795721bc353da23b015fe4d Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Thu, 2 Apr 2020 16:50:37 +0200
 Subject: [PATCH 31/36] Do not raise a ValueError if digestmod is missing in
@@ -6902,10 +6902,10 @@ index 5055027..ee1ad76 100644
          return digestmod.lower()
      elif callable(digestmod):
 -- 
-2.38.1
+2.31.1
 
 
-From 9dd6dc8c11b96ac74abf220ed76d1176041c3711 Mon Sep 17 00:00:00 2001
+From 737af204f04bb39e5f87d53fe07713137639234e Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Thu, 2 Apr 2020 16:55:36 +0200
 Subject: [PATCH 32/36] Regenerate the clinic files
@@ -6989,10 +6989,10 @@ index 861acc1..527be83 100644
 -/*[clinic end generated code: output=d93ad460795d49b5 input=a9049054013a1b77]*/
 +/*[clinic end generated code: output=9b75c31e1116bf6f input=a9049054013a1b77]*/
 -- 
-2.38.1
+2.31.1
 
 
-From f646402958e8d284519ef7f72d0225ace210ffa7 Mon Sep 17 00:00:00 2001
+From d0e7edf46ceef6ffb6075bb8b8b966f31df018fc Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Tue, 7 Apr 2020 15:16:45 +0200
 Subject: [PATCH 33/36] Pass kwargs (like usedforsecurity) through __hash_new
@@ -7024,10 +7024,10 @@ index 2fc214e..785858f 100644
  
  try:
 -- 
-2.38.1
+2.31.1
 
 
-From bd206ed69e7c19b62f0174a649b5c2d03f0d9f5b Mon Sep 17 00:00:00 2001
+From 0e3f635871d22831cbb5f0bffb9962f2a1ad29eb Mon Sep 17 00:00:00 2001
 From: Petr Viktorin <pviktori@redhat.com>
 Date: Tue, 7 Apr 2020 15:18:48 +0200
 Subject: [PATCH 34/36] Adjust new upstream test for failing hashes with
@@ -7038,7 +7038,7 @@ Subject: [PATCH 34/36] Adjust new upstream test for failing hashes with
  1 file changed, 12 insertions(+), 4 deletions(-)
 
 diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
-index b535059..6e846c4 100644
+index a4b7840..a858bf4 100644
 --- a/Lib/test/test_hashlib.py
 +++ b/Lib/test/test_hashlib.py
 @@ -239,15 +239,23 @@ class HashLibTestCase(unittest.TestCase):
@@ -7070,10 +7070,10 @@ index b535059..6e846c4 100644
          self.assertRaises(ValueError, hashlib.new, 'spam spam spam spam spam')
          self.assertRaises(TypeError, hashlib.new, 1)
 -- 
-2.38.1
+2.31.1
 
 
-From d1ce20110573989382948a901896169eb637b265 Mon Sep 17 00:00:00 2001
+From 8145cfd2f71749a9fe844e5abc725f36e9085b22 Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Fri, 24 Apr 2020 19:57:16 +0200
 Subject: [PATCH 35/36] Skip the test_with_digestmod_no_default under FIPS
@@ -7116,10 +7116,10 @@ index cc77928..fd068e0 100644
  class ConstructorTestCase(unittest.TestCase):
  
 -- 
-2.38.1
+2.31.1
 
 
-From bff06e176e60200582a42611d4fe3c240da314a3 Mon Sep 17 00:00:00 2001
+From 969498fda9699b2e9d2df4a78a671e37d578daea Mon Sep 17 00:00:00 2001
 From: Charalampos Stratakis <cstratak@redhat.com>
 Date: Tue, 31 Mar 2020 18:00:42 +0200
 Subject: [PATCH 36/36] Add a sentinel value on the Hmac_members table of the
@@ -7142,5 +7142,5 @@ index 9577cad..4bd7c15 100644
  
  PyDoc_STRVAR(hmactype_doc,
 -- 
-2.38.1
+2.31.1
 

00382-cve-2015-20107.patch

@@ -0,0 +1,150 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Fri, 3 Jun 2022 11:43:35 +0200
+Subject: [PATCH] 00382: CVE-2015-20107
+
+Make mailcap refuse to match unsafe filenames/types/params (GH-91993)
+
+Upstream: https://github.com/python/cpython/issues/68966
+
+Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390
+---
+ Doc/library/mailcap.rst                       | 12 +++++++++
+ Lib/mailcap.py                                | 26 +++++++++++++++++--
+ Lib/test/test_mailcap.py                      |  8 ++++--
+ ...2-04-27-18-25-30.gh-issue-68966.gjS8zs.rst |  4 +++
+ 4 files changed, 46 insertions(+), 4 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
+
+diff --git a/Doc/library/mailcap.rst b/Doc/library/mailcap.rst
+index bf9639bdac..a75857be62 100644
+--- a/Doc/library/mailcap.rst
++++ b/Doc/library/mailcap.rst
+@@ -54,6 +54,18 @@ standard.  However, mailcap files are supported on most Unix systems.
+    use) to determine whether or not the mailcap line applies.  :func:`findmatch`
+    will automatically check such conditions and skip the entry if the check fails.
+ 
++   .. versionchanged:: 3.11
++
++      To prevent security issues with shell metacharacters (symbols that have
++      special effects in a shell command line), ``findmatch`` will refuse
++      to inject ASCII characters other than alphanumerics and ``@+=:,./-_``
++      into the returned command line.
++
++      If a disallowed character appears in *filename*, ``findmatch`` will always
++      return ``(None, None)`` as if no entry was found.
++      If such a character appears elsewhere (a value in *plist* or in *MIMEtype*),
++      ``findmatch`` will ignore all mailcap entries which use that value.
++      A :mod:`warning <warnings>` will be raised in either case.
+ 
+ .. function:: getcaps()
+ 
+diff --git a/Lib/mailcap.py b/Lib/mailcap.py
+index bd0fc0981c..dcd4b449e8 100644
+--- a/Lib/mailcap.py
++++ b/Lib/mailcap.py
+@@ -2,6 +2,7 @@
+ 
+ import os
+ import warnings
++import re
+ 
+ __all__ = ["getcaps","findmatch"]
+ 
+@@ -13,6 +14,11 @@ def lineno_sort_key(entry):
+     else:
+         return 1, 0
+ 
++_find_unsafe = re.compile(r'[^\xa1-\U0010FFFF\w@+=:,./-]').search
++
++class UnsafeMailcapInput(Warning):
++    """Warning raised when refusing unsafe input"""
++
+ 
+ # Part 1: top-level interface.
+ 
+@@ -165,15 +171,22 @@ def findmatch(caps, MIMEtype, key='view', filename="/dev/null", plist=[]):
+     entry to use.
+ 
+     """
++    if _find_unsafe(filename):
++        msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,)
++        warnings.warn(msg, UnsafeMailcapInput)
++        return None, None
+     entries = lookup(caps, MIMEtype, key)
+     # XXX This code should somehow check for the needsterminal flag.
+     for e in entries:
+         if 'test' in e:
+             test = subst(e['test'], filename, plist)
++            if test is None:
++                continue
+             if test and os.system(test) != 0:
+                 continue
+         command = subst(e[key], MIMEtype, filename, plist)
+-        return command, e
++        if command is not None:
++            return command, e
+     return None, None
+ 
+ def lookup(caps, MIMEtype, key=None):
+@@ -206,6 +219,10 @@ def subst(field, MIMEtype, filename, plist=[]):
+             elif c == 's':
+                 res = res + filename
+             elif c == 't':
++                if _find_unsafe(MIMEtype):
++                    msg = "Refusing to substitute MIME type %r into a shell command." % (MIMEtype,)
++                    warnings.warn(msg, UnsafeMailcapInput)
++                    return None
+                 res = res + MIMEtype
+             elif c == '{':
+                 start = i
+@@ -213,7 +230,12 @@ def subst(field, MIMEtype, filename, plist=[]):
+                     i = i+1
+                 name = field[start:i]
+                 i = i+1
+-                res = res + findparam(name, plist)
++                param = findparam(name, plist)
++                if _find_unsafe(param):
++                    msg = "Refusing to substitute parameter %r (%s) into a shell command" % (param, name)
++                    warnings.warn(msg, UnsafeMailcapInput)
++                    return None
++                res = res + param
+             # XXX To do:
+             # %n == number of parts if type is multipart/*
+             # %F == list of alternating type and filename for parts
+diff --git a/Lib/test/test_mailcap.py b/Lib/test/test_mailcap.py
+index c08423c670..920283d9a2 100644
+--- a/Lib/test/test_mailcap.py
++++ b/Lib/test/test_mailcap.py
+@@ -121,7 +121,8 @@ class HelperFunctionTest(unittest.TestCase):
+             (["", "audio/*", "foo.txt"], ""),
+             (["echo foo", "audio/*", "foo.txt"], "echo foo"),
+             (["echo %s", "audio/*", "foo.txt"], "echo foo.txt"),
+-            (["echo %t", "audio/*", "foo.txt"], "echo audio/*"),
++            (["echo %t", "audio/*", "foo.txt"], None),
++            (["echo %t", "audio/wav", "foo.txt"], "echo audio/wav"),
+             (["echo \\%t", "audio/*", "foo.txt"], "echo %t"),
+             (["echo foo", "audio/*", "foo.txt", plist], "echo foo"),
+             (["echo %{total}", "audio/*", "foo.txt", plist], "echo 3")
+@@ -205,7 +206,10 @@ class FindmatchTest(unittest.TestCase):
+              ('"An audio fragment"', audio_basic_entry)),
+             ([c, "audio/*"],
+              {"filename": fname},
+-             ("/usr/local/bin/showaudio audio/*", audio_entry)),
++             (None, None)),
++            ([c, "audio/wav"],
++             {"filename": fname},
++             ("/usr/local/bin/showaudio audio/wav", audio_entry)),
+             ([c, "message/external-body"],
+              {"plist": plist},
+              ("showexternal /dev/null default john python.org     /tmp foo bar", message_entry))
+diff --git a/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
+new file mode 100644
+index 0000000000..da81a1f699
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2022-04-27-18-25-30.gh-issue-68966.gjS8zs.rst
+@@ -0,0 +1,4 @@
++The deprecated mailcap module now refuses to inject unsafe text (filenames,
++MIME types, parameters) into shell commands. Instead of using such text, it
++will warn and act as if a match was not found (or for test commands, as if
++the test failed).

SOURCES/00397-tarfile-filter.patch

@@ -1,357 +0,0 @@
-From f36519078bde3cce4328c03fffccb846121fb5bc Mon Sep 17 00:00:00 2001
-From: Petr Viktorin <encukou@gmail.com>
-Date: Wed, 9 Aug 2023 20:23:03 +0200
-Subject: [PATCH] Fix symlink handling for tarfile.data_filter
-
----
- Doc/library/tarfile.rst  |  5 +++++
- Lib/tarfile.py           |  9 ++++++++-
- Lib/test/test_tarfile.py | 26 ++++++++++++++++++++++++--
- 3 files changed, 37 insertions(+), 3 deletions(-)
-
-diff --git a/Doc/library/tarfile.rst b/Doc/library/tarfile.rst
-index 00f3070324e..e0511bfeb64 100644
---- a/Doc/library/tarfile.rst
-+++ b/Doc/library/tarfile.rst
-@@ -740,6 +740,11 @@ A ``TarInfo`` object has the following public data attributes:
-    Name of the target file name, which is only present in :class:`TarInfo` objects
-    of type :const:`LNKTYPE` and :const:`SYMTYPE`.
- 
-+   For symbolic links (``SYMTYPE``), the linkname is relative to the directory
-+   that contains the link.
-+   For hard links (``LNKTYPE``), the linkname is relative to the root of
-+   the archive.
-+
- 
- .. attribute:: TarInfo.uid
-    :type: int
-diff --git a/Lib/tarfile.py b/Lib/tarfile.py
-index df4e41f7a0d..d62323715b4 100755
---- a/Lib/tarfile.py
-+++ b/Lib/tarfile.py
-@@ -802,7 +802,14 @@ def _get_filtered_attrs(member, dest_path, for_data=True):
-         if member.islnk() or member.issym():
-             if os.path.isabs(member.linkname):
-                 raise AbsoluteLinkError(member)
--            target_path = os.path.realpath(os.path.join(dest_path, member.linkname))
-+            if member.issym():
-+                target_path = os.path.join(dest_path,
-+                                           os.path.dirname(name),
-+                                           member.linkname)
-+            else:
-+                target_path = os.path.join(dest_path,
-+                                           member.linkname)
-+            target_path = os.path.realpath(target_path)
-             if os.path.commonpath([target_path, dest_path]) != dest_path:
-                 raise LinkOutsideDestinationError(member, target_path)
-     return new_attrs
-diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
-index 2eda7fc4cea..79fc35c2895 100644
---- a/Lib/test/test_tarfile.py
-+++ b/Lib/test/test_tarfile.py
-@@ -3337,10 +3337,12 @@ def __exit__(self, *exc):
-         self.bio = None
- 
-     def add(self, name, *, type=None, symlink_to=None, hardlink_to=None,
--            mode=None, **kwargs):
-+            mode=None, size=None, **kwargs):
-         """Add a member to the test archive. Call within `with`."""
-         name = str(name)
-         tarinfo = tarfile.TarInfo(name).replace(**kwargs)
-+        if size is not None:
-+            tarinfo.size = size
-         if mode:
-             tarinfo.mode = _filemode_to_int(mode)
-         if symlink_to is not None:
-@@ -3416,7 +3418,8 @@ def check_context(self, tar, filter):
-                 raise self.raised_exception
-             self.assertEqual(self.expected_paths, set())
- 
--    def expect_file(self, name, type=None, symlink_to=None, mode=None):
-+    def expect_file(self, name, type=None, symlink_to=None, mode=None,
-+                    size=None):
-         """Check a single file. See check_context."""
-         if self.raised_exception:
-             raise self.raised_exception
-@@ -3445,6 +3448,8 @@ def expect_file(self, name, type=None, symlink_to=None, mode=None):
-             self.assertTrue(path.is_fifo())
-         else:
-             raise NotImplementedError(type)
-+        if size is not None:
-+            self.assertEqual(path.stat().st_size, size)
-         for parent in path.parents:
-             self.expected_paths.discard(parent)
- 
-@@ -3649,6 +3654,22 @@ def test_sly_relative2(self):
-                     + """['"].*moo['"], which is outside the """
-                     + "destination")
- 
-+    def test_deep_symlink(self):
-+        with ArchiveMaker() as arc:
-+            arc.add('targetdir/target', size=3)
-+            arc.add('linkdir/hardlink', hardlink_to='targetdir/target')
-+            arc.add('linkdir/symlink', symlink_to='../targetdir/target')
-+
-+        for filter in 'tar', 'data', 'fully_trusted':
-+            with self.check_context(arc.open(), filter):
-+                self.expect_file('targetdir/target', size=3)
-+                self.expect_file('linkdir/hardlink', size=3)
-+                if support.can_symlink():
-+                    self.expect_file('linkdir/symlink', size=3,
-+                                     symlink_to='../targetdir/target')
-+                else:
-+                    self.expect_file('linkdir/symlink', size=3)
-+
-     def test_modes(self):
-         # Test how file modes are extracted
-         # (Note that the modes are ignored on platforms without working chmod)
--- 
-2.41.0
-
-From dc84087083c5ad99a5016e8349c96d9654a08f46 Mon Sep 17 00:00:00 2001
-From: Petr Viktorin <encukou@gmail.com>
-Date: Mon, 6 Mar 2023 17:24:24 +0100
-Subject: [PATCH 2/2] CVE-2007-4559, PEP-706: Add filters for tarfile
- extraction (downstream)
-
-Add and test RHEL-specific ways of configuring the default behavior: environment
-variable and config file.
----
- Lib/tarfile.py           |  42 +++++++++++++
- Lib/test/test_shutil.py  |   3 +-
- Lib/test/test_tarfile.py | 124 ++++++++++++++++++++++++++++++++++++++-
- 3 files changed, 165 insertions(+), 4 deletions(-)
-
-diff --git a/Lib/tarfile.py b/Lib/tarfile.py
-index 5291622ab8e..12ab00d748a 100755
---- a/Lib/tarfile.py
-+++ b/Lib/tarfile.py
-@@ -72,6 +72,13 @@ __all__ = ["TarFile", "TarInfo", "is_tarfile", "TarError", "ReadError",
-            "ENCODING", "USTAR_FORMAT", "GNU_FORMAT", "PAX_FORMAT",
-            "DEFAULT_FORMAT", "open"]
- 
-+# If true, use the safer (but backwards-incompatible) 'tar' extraction filter,
-+# rather than 'fully_trusted', by default.
-+# The emitted warning is changed to match.
-+_RH_SAFER_DEFAULT = True
-+
-+# System-wide configuration file
-+_CONFIG_FILENAME = '/etc/python/tarfile.cfg'
- 
- #---------------------------------------------------------
- # tar constants
-@@ -2188,6 +2195,41 @@ class TarFile(object):
-         if filter is None:
-             filter = self.extraction_filter
-             if filter is None:
-+                name = os.environ.get('PYTHON_TARFILE_EXTRACTION_FILTER')
-+                if name is None:
-+                    try:
-+                        file = bltn_open(_CONFIG_FILENAME)
-+                    except FileNotFoundError:
-+                        pass
-+                    else:
-+                        import configparser
-+                        conf = configparser.ConfigParser(
-+                            interpolation=None,
-+                            comment_prefixes=('#', ),
-+                        )
-+                        with file:
-+                            conf.read_file(file)
-+                        name = conf.get('tarfile',
-+                                        'PYTHON_TARFILE_EXTRACTION_FILTER',
-+                                        fallback='')
-+                if name:
-+                    try:
-+                        filter = _NAMED_FILTERS[name]
-+                    except KeyError:
-+                        raise ValueError(f"filter {filter!r} not found") from None
-+                    self.extraction_filter = filter
-+                    return filter
-+                if _RH_SAFER_DEFAULT:
-+                    warnings.warn(
-+                        'The default behavior of tarfile extraction has been '
-+                        + 'changed to disallow common exploits '
-+                        + '(including CVE-2007-4559). '
-+                        + 'By default, absolute/parent paths are disallowed '
-+                        + 'and some mode bits are cleared. '
-+                        + 'See https://access.redhat.com/articles/7004769 '
-+                        + 'for more details.',
-+                        RuntimeWarning)
-+                    return tar_filter
-                 return fully_trusted_filter
-             if isinstance(filter, str):
-                 raise TypeError(
-diff --git a/Lib/test/test_shutil.py b/Lib/test/test_shutil.py
-index 5cef59ea9c6..73fffe0fd33 100644
---- a/Lib/test/test_shutil.py
-+++ b/Lib/test/test_shutil.py
-@@ -1494,7 +1494,8 @@ class TestShutil(unittest.TestCase):
-     def check_unpack_tarball(self, format):
-         self.check_unpack_archive(format, filter='fully_trusted')
-         self.check_unpack_archive(format, filter='data')
--        with support.check_no_warnings(self):
-+        with support.check_warnings(
-+                ('.*CVE-2007-4559', RuntimeWarning)):
-             self.check_unpack_archive(format)
- 
-     def test_unpack_archive_tar(self):
-diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
-index 03be10b1fee..15df6a9ced6 100644
---- a/Lib/test/test_tarfile.py
-+++ b/Lib/test/test_tarfile.py
-@@ -2,7 +2,7 @@
- import os
- import io
- from hashlib import sha256
--from contextlib import contextmanager
-+from contextlib import contextmanager, ExitStack
- from random import Random
- import pathlib
- import shutil
-@@ -2744,7 +2744,11 @@ class NoneInfoExtractTests(ReadTest):
-         tar = tarfile.open(tarname, mode='r', encoding="iso8859-1")
-         cls.control_dir = pathlib.Path(TEMPDIR) / "extractall_ctrl"
-         tar.errorlevel = 0
--        tar.extractall(cls.control_dir, filter=cls.extraction_filter)
-+        with ExitStack() as cm:
-+            if cls.extraction_filter is None:
-+                cm.enter_context(warnings.catch_warnings())
-+                warnings.simplefilter(action="ignore", category=RuntimeWarning)
-+            tar.extractall(cls.control_dir, filter=cls.extraction_filter)
-         tar.close()
-         cls.control_paths = set(
-             p.relative_to(cls.control_dir)
-@@ -3407,7 +3411,8 @@ class TestExtractionFilters(unittest.TestCase):
-         """Ensure the default filter does not warn (like in 3.12)"""
-         with ArchiveMaker() as arc:
-             arc.add('foo')
--        with support.check_no_warnings(self):
-+        with support.check_warnings(
-+                ('.*CVE-2007-4559', RuntimeWarning)):
-             with self.check_context(arc.open(), None):
-                 self.expect_file('foo')
- 
-@@ -3577,6 +3582,119 @@ class TestExtractionFilters(unittest.TestCase):
-             self.expect_exception(TypeError)  # errorlevel is not int
- 
- 
-+    @contextmanager
-+    def rh_config_context(self, config_lines=None):
-+        """Set up for testing various ways of overriding the default filter
-+
-+        return a triple with:
-+        - temporary directory
-+        - EnvironmentVarGuard()
-+        - a test archive for use with check_* methods below
-+
-+        If config_lines is given, write them to the config file. Otherwise
-+        the config file is missing.
-+        """
-+        tempdir = pathlib.Path(TEMPDIR) / 'tmp'
-+        configfile = tempdir / 'tarfile.cfg'
-+        with ArchiveMaker() as arc:
-+            arc.add('good')
-+            arc.add('ugly', symlink_to='/etc/passwd')
-+            arc.add('../bad')
-+        with ExitStack() as cm:
-+            cm.enter_context(support.temp_dir(tempdir))
-+            cm.enter_context(support.swap_attr(tarfile, '_CONFIG_FILENAME', str(configfile)))
-+            env = cm.enter_context(support.EnvironmentVarGuard())
-+            tar = cm.enter_context(arc.open())
-+            if config_lines is not None:
-+                with configfile.open('w') as f:
-+                    for line in config_lines:
-+                        print(line, file=f)
-+            yield tempdir, env, tar
-+
-+    def check_rh_default_behavior(self, tar, tempdir):
-+        """Check RH default: warn and refuse to extract dangerous files."""
-+        with ExitStack() as cm:
-+            cm.enter_context(support.check_warnings(
-+                    ('.*CVE-2007-4559', RuntimeWarning)))
-+            cm.enter_context(self.assertRaises(tarfile.OutsideDestinationError))
-+            tar.extractall(tempdir / 'outdir')
-+
-+    def check_trusted_default(self, tar, tempdir):
-+        """Check 'fully_trusted' is configured as the default filter."""
-+        with support.check_no_warnings(self):
-+            tar.extractall(tempdir / 'outdir')
-+            self.assertTrue((tempdir / 'outdir/good').exists())
-+            self.assertEqual(os.readlink(str(tempdir / 'outdir/ugly')),
-+                             '/etc/passwd')
-+            self.assertTrue((tempdir / 'bad').exists())
-+
-+    def test_rh_default_no_conf(self):
-+        with self.rh_config_context() as (tempdir, env, tar):
-+            self.check_rh_default_behavior(tar, tempdir)
-+
-+    def test_rh_default_from_file(self):
-+        lines = ['[tarfile]', 'PYTHON_TARFILE_EXTRACTION_FILTER=fully_trusted']
-+        with self.rh_config_context(lines) as (tempdir, env, tar):
-+            self.check_trusted_default(tar, tempdir)
-+
-+    def test_rh_empty_config_file(self):
-+        """Empty config file -> default behavior"""
-+        lines = []
-+        with self.rh_config_context(lines) as (tempdir, env, tar):
-+            self.check_rh_default_behavior(tar, tempdir)
-+
-+    def test_empty_config_section(self):
-+        """Empty section in config file -> default behavior"""
-+        lines = ['[tarfile]']
-+        with self.rh_config_context(lines) as (tempdir, env, tar):
-+            self.check_rh_default_behavior(tar, tempdir)
-+
-+    def test_rh_default_empty_config_option(self):
-+        """Empty option value in config file -> default behavior"""
-+        lines = ['[tarfile]', 'PYTHON_TARFILE_EXTRACTION_FILTER=']
-+        with self.rh_config_context(lines) as (tempdir, env, tar):
-+            self.check_rh_default_behavior(tar, tempdir)
-+
-+    def test_bad_config_option(self):
-+        """Bad option value in config file -> ValueError"""
-+        lines = ['[tarfile]', 'PYTHON_TARFILE_EXTRACTION_FILTER=unknown!']
-+        with self.rh_config_context(lines) as (tempdir, env, tar):
-+            with self.assertRaises(ValueError):
-+                tar.extractall(tempdir / 'outdir')
-+
-+    def test_default_from_envvar(self):
-+        with self.rh_config_context() as (tempdir, env, tar):
-+            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = 'fully_trusted'
-+            self.check_trusted_default(tar, tempdir)
-+
-+    def test_empty_envvar(self):
-+        """Empty env variable -> default behavior"""
-+        with self.rh_config_context() as (tempdir, env, tar):
-+            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = ''
-+            self.check_rh_default_behavior(tar, tempdir)
-+
-+    def test_bad_envvar(self):
-+        with self.rh_config_context() as (tempdir, env, tar):
-+            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = 'unknown!'
-+            with self.assertRaises(ValueError):
-+                tar.extractall(tempdir / 'outdir')
-+
-+    def test_envvar_overrides_file(self):
-+        lines = ['[tarfile]', 'PYTHON_TARFILE_EXTRACTION_FILTER=data']
-+        with self.rh_config_context(lines) as (tempdir, env, tar):
-+            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = 'fully_trusted'
-+            self.check_trusted_default(tar, tempdir)
-+
-+    def test_monkeypatch_overrides_envvar(self):
-+        with self.rh_config_context(None) as (tempdir, env, tar):
-+            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = 'data'
-+            with support.swap_attr(
-+                    tarfile.TarFile, 'extraction_filter',
-+                    staticmethod(tarfile.fully_trusted_filter)
-+            ):
-+                self.check_trusted_default(tar, tempdir)
-+
-+
- def setUpModule():
-     support.unlink(TEMPDIR)
-     os.makedirs(TEMPDIR)
--- 
-2.41.0
-

python38.spec

@@ -13,11 +13,11 @@ URL: https://www.python.org/
 
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
-%global general_version %{pybasever}.17
+%global general_version %{pybasever}.13
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 1%{?dist}
 License: Python
 
 # Exclude i686 arch. Due to a modularity issue it's being added to the
@@ -382,15 +382,15 @@ Patch359: 00359-CVE-2021-23336.patch
 # Upstream: https://bugs.python.org/issue46811
 Patch378: 00378-support-expat-2-4-5.patch
 
-# 00397 #
+# 00382 #
-# Add filters for tarfile extraction (CVE-2007-4559, PEP-706)
+# CVE-2015-20107
-# First patch fixes determination of symlink targets, which were treated
+#
-# as relative to the root of the archive,
+# Make mailcap refuse to match unsafe filenames/types/params (GH-91993)
-# rather than the directory containing the symlink.
+#
-# Not yet upstream as of this writing.
+# Upstream: https://github.com/python/cpython/issues/68966
-# The second patch is Red Hat configuration, see KB for documentation:
+#
-# - https://access.redhat.com/articles/7004769
+# Tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=2075390
-Patch397: 00397-tarfile-filter.patch
+Patch382: 00382-cve-2015-20107.patch
 
 # (New patches go here ^^^)
 #
@@ -515,8 +515,8 @@ Summary:        Python runtime libraries
 Requires: python38-setuptools-wheel
 Requires: python38-pip-wheel
 %else
-Provides: bundled(python38-pip) = 23.0.1
+Provides: bundled(python38-pip) = 19.2.3
-Provides: bundled(python38-setuptools) = 56.0.0
+Provides: bundled(python38-setuptools) = 41.2.0
 %endif
 
 %{?python_provide:%python_provide python38-libs}
@@ -684,7 +684,7 @@ The debug runtime additionally supports debug builds of C-API extensions
 Requires: python38-setuptools-wheel
 Requires: python38-pip-wheel
 %else
-Provides: bundled(python38-pip) = 23.0.1
+Provides: bundled(python38-pip) = 21.1.1
 Provides: bundled(python38-setuptools) = 56.0.0
 %endif
 
@@ -749,7 +749,7 @@ rm Lib/ensurepip/_bundled/*.whl
 %patch353 -p1
 %patch359 -p1
 %patch378 -p1
-%patch397 -p1
+%patch382 -p1
 
 # Remove files that should be generated by the build
 # (This is after patching, so that we can use patches directly from upstream)
@@ -1132,11 +1132,6 @@ touch %{buildroot}%{_bindir}/python3-config
 touch %{buildroot}%{_bindir}/python3-debug
 touch %{buildroot}%{_bindir}/python3-debug-config
 
-# Strip the LTO bytecode from python.o
-# Based on the fedora brp-strip-lto scriptlet
-# https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/9dd5528cf9805ebfe31cff04fe7828ad06a6023f/f/brp-strip-lto
-find %{buildroot} -type f -name 'python.o' -print0 | xargs -0 \
-bash -c "strip -p -R .gnu.lto_* -R .gnu.debuglto_* -N __gnu_lto_v1 \"\$@\"" ARG0
 
 # ======================================================
 # Checks for packaging issues
@@ -1843,30 +1838,6 @@ fi
 # ======================================================
 
 %changelog
-* Wed Aug 09 2023 Petr Viktorin <pviktori@redhat.com> - 3.8.17-2
-- Fix symlink handling in the fix for CVE-2023-24329
-Resolves: rhbz#263261
-
-* Mon Aug 07 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.8.17-1
-- Update to 3.8.17
-- Security fix for CVE-2023-24329
-- Add filters for tarfile extraction (CVE-2007-4559, PEP-706)
-Resolves: rhbz#2173917, rhbz#263261
-
-* Tue Jul 18 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.8.16-2
-- Strip the LTO bytecode from python.o
-Resolves: rhbz#2213526
-
-* Tue Dec 13 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.8.16-1
-- Update to 3.8.16
-- Security fix for CVE-2022-45061
-Resolves: rhbz#2144072
-
-* Mon Sep 12 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.8.14-1
-- Rebase to 3.8.14
-- Security fixes for CVE-2020-10735 and CVE-2021-28861
-Resolves: rhbz#1834423, rhbz#2120642
-
 * Tue Jun 14 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.8.13-1
 - Rebase to 3.8.13
 - Security fix for CVE-2015-20107

sources

@@ -0,0 +1 @@
+SHA512 (Python-3.8.13-noexe.tar.xz) = a82ff60ebd993be496778d79513918e9925f27165d20003ea716a6defe8008ef644ca32857d2a8f13402faf7c2d61eb13dd7a9aebfaf5c8b872bb9104d95c6dc