import python39-3.9.17-1.module_el8+629+901725d5

.gitignore

@@ -0,0 +1 @@
+SOURCES/Python-3.9.17.tar.xz

.python39.metadata

@@ -0,0 +1 @@
+34a6d24cef87fbf22b943d4fe22100a9bf0b3782 SOURCES/Python-3.9.17.tar.xz

SOURCES/00001-rpath.patch

@@ -0,0 +1,30 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: David Malcolm <dmalcolm@redhat.com>
+Date: Wed, 13 Jan 2010 21:25:18 +0000
+Subject: [PATCH] 00001: Fixup distutils/unixccompiler.py to remove standard
+ library path from rpath Was Patch0 in ivazquez' python3000 specfile
+
+---
+ Lib/distutils/unixccompiler.py | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/Lib/distutils/unixccompiler.py b/Lib/distutils/unixccompiler.py
+index f0792de74a..4d837936c6 100644
+--- a/Lib/distutils/unixccompiler.py
++++ b/Lib/distutils/unixccompiler.py
+@@ -82,6 +82,15 @@ class UnixCCompiler(CCompiler):
+     if sys.platform == "cygwin":
+         exe_extension = ".exe"
+ 
++    def _fix_lib_args(self, libraries, library_dirs, runtime_library_dirs):
++        """Remove standard library path from rpath"""
++        libraries, library_dirs, runtime_library_dirs = super()._fix_lib_args(
++            libraries, library_dirs, runtime_library_dirs)
++        libdir = sysconfig.get_config_var('LIBDIR')
++        if runtime_library_dirs and (libdir in runtime_library_dirs):
++            runtime_library_dirs.remove(libdir)
++        return libraries, library_dirs, runtime_library_dirs
++
+     def preprocess(self, source, output_file=None, macros=None,
+                    include_dirs=None, extra_preargs=None, extra_postargs=None):
+         fixed_args = self._fix_compile_args(None, macros, include_dirs)

SOURCES/00111-no-static-lib.patch

@@ -0,0 +1,75 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: David Malcolm <dmalcolm@redhat.com>
+Date: Mon, 18 Jan 2010 17:59:07 +0000
+Subject: [PATCH] 00111: Don't try to build a libpythonMAJOR.MINOR.a
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Downstream only: not appropriate for upstream.
+
+See https://bugzilla.redhat.com/show_bug.cgi?id=556092
+
+Co-authored-by: David Malcolm <dmalcolm@redhat.com>
+Co-authored-by: Bohuslav Kabrda <bkabrda@redhat.com>
+Co-authored-by: Matej Stuchlik <mstuchli@redhat.com>
+Co-authored-by: Robert Kuska <rkuska@redhat.com>
+Co-authored-by: Charalampos Stratakis <cstratak@redhat.com>
+Co-authored-by: Miro Hrončok <miro@hroncok.cz>
+---
+ Makefile.pre.in | 21 ++-------------------
+ 1 file changed, 2 insertions(+), 19 deletions(-)
+
+diff --git a/Makefile.pre.in b/Makefile.pre.in
+index f128444b98..22f25e159d 100644
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -586,7 +586,7 @@ clinic: check-clean-src $(srcdir)/Modules/_blake2/blake2s_impl.c
+ 	$(PYTHON_FOR_REGEN) $(srcdir)/Tools/clinic/clinic.py --make --srcdir $(srcdir)
+ 
+ # Build the interpreter
+-$(BUILDPYTHON):	Programs/python.o $(LIBRARY) $(LDLIBRARY) $(PY3LIBRARY) $(EXPORTSYMS)
++$(BUILDPYTHON):	Programs/python.o $(LDLIBRARY) $(PY3LIBRARY) $(EXPORTSYMS)
+ 	$(LINKCC) $(PY_CORE_LDFLAGS) $(LINKFORSHARED) -o $@ Programs/python.o $(BLDLIBRARY) $(LIBS) $(MODLIBS) $(SYSLIBS)
+ 
+ platform: $(BUILDPYTHON) pybuilddir.txt
+@@ -634,12 +634,6 @@ sharedmods: $(BUILDPYTHON) pybuilddir.txt Modules/_math.o
+ 		_TCLTK_INCLUDES='$(TCLTK_INCLUDES)' _TCLTK_LIBS='$(TCLTK_LIBS)' \
+ 		$(PYTHON_FOR_BUILD) $(srcdir)/setup.py $$quiet build
+ 
+-
+-# Build static library
+-$(LIBRARY): $(LIBRARY_OBJS)
+-	-rm -f $@
+-	$(AR) $(ARFLAGS) $@ $(LIBRARY_OBJS)
+-
+ libpython$(LDVERSION).so: $(LIBRARY_OBJS) $(DTRACE_OBJS)
+ 	if test $(INSTSONAME) != $(LDLIBRARY); then \
+ 		$(BLDSHARED) -Wl,-h$(INSTSONAME) -o $(INSTSONAME) $(LIBRARY_OBJS) $(MODLIBS) $(SHLIBS) $(LIBC) $(LIBM); \
+@@ -721,7 +715,7 @@ Makefile Modules/config.c: Makefile.pre \
+ 	@echo "The Makefile was updated, you may need to re-run make."
+ 
+ 
+-Programs/_testembed: Programs/_testembed.o $(LIBRARY) $(LDLIBRARY) $(PY3LIBRARY) $(EXPORTSYMS)
++Programs/_testembed: Programs/_testembed.o $(LDLIBRARY) $(PY3LIBRARY) $(EXPORTSYMS)
+ 	$(LINKCC) $(PY_CORE_LDFLAGS) $(LINKFORSHARED) -o $@ Programs/_testembed.o $(BLDLIBRARY) $(LIBS) $(MODLIBS) $(SYSLIBS)
+ 
+ ############################################################################
+@@ -1631,17 +1625,6 @@ libainstall:	@DEF_MAKE_RULE@ python-config
+ 		else	true; \
+ 		fi; \
+ 	done
+-	@if test -d $(LIBRARY); then :; else \
+-		if test "$(PYTHONFRAMEWORKDIR)" = no-framework; then \
+-			if test "$(SHLIB_SUFFIX)" = .dll; then \
+-				$(INSTALL_DATA) $(LDLIBRARY) $(DESTDIR)$(LIBPL) ; \
+-			else \
+-				$(INSTALL_DATA) $(LIBRARY) $(DESTDIR)$(LIBPL)/$(LIBRARY) ; \
+-			fi; \
+-		else \
+-			echo Skip install of $(LIBRARY) - use make frameworkinstall; \
+-		fi; \
+-	fi
+ 	$(INSTALL_DATA) Modules/config.c $(DESTDIR)$(LIBPL)/config.c
+ 	$(INSTALL_DATA) Programs/python.o $(DESTDIR)$(LIBPL)/python.o
+ 	$(INSTALL_DATA) $(srcdir)/Modules/config.c.in $(DESTDIR)$(LIBPL)/config.c.in

SOURCES/00189-use-rpm-wheels.patch

@@ -0,0 +1,78 @@
+From 2c91575950d4de95d308e30cc4ab20d032b1aceb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Wed, 15 Aug 2018 15:36:29 +0200
+Subject: [PATCH] 00189: Instead of bundled wheels, use our RPM packaged wheels
+
+We keep them in /usr/share/python-wheels
+
+Downstream only: upstream bundles
+We might eventually pursuit upstream support, but it's low prio
+---
+ Lib/ensurepip/__init__.py | 37 ++++++++++++++++++++++++++-----------
+ 1 file changed, 26 insertions(+), 11 deletions(-)
+
+diff --git a/Lib/ensurepip/__init__.py b/Lib/ensurepip/__init__.py
+index e510cc7..8de2e55 100644
+--- a/Lib/ensurepip/__init__.py
++++ b/Lib/ensurepip/__init__.py
+@@ -1,3 +1,5 @@
++import distutils.version
++import glob
+ import os
+ import os.path
+ import sys
+@@ -6,13 +8,29 @@ import tempfile
+ import subprocess
+ from importlib import resources
+ 
+-from . import _bundled
+-
+ 
+ 
+ __all__ = ["version", "bootstrap"]
+-_SETUPTOOLS_VERSION = "58.1.0"
+-_PIP_VERSION = "23.0.1"
++
++_WHEEL_DIR = "/usr/share/python39-wheels/"
++
++_wheels = {}
++
++def _get_most_recent_wheel_version(pkg):
++    prefix = os.path.join(_WHEEL_DIR, "{}-".format(pkg))
++    _wheels[pkg] = {}
++    for suffix in "-py2.py3-none-any.whl", "-py3-none-any.whl":
++        pattern = "{}*{}".format(prefix, suffix)
++        for path in glob.glob(pattern):
++            version_str = path[len(prefix):-len(suffix)]
++            _wheels[pkg][version_str] = os.path.basename(path)
++    return str(max(_wheels[pkg], key=distutils.version.LooseVersion))
++
++
++_SETUPTOOLS_VERSION = _get_most_recent_wheel_version("setuptools")
++
++_PIP_VERSION = _get_most_recent_wheel_version("pip")
++
+ _PROJECTS = [
+     ("setuptools", _SETUPTOOLS_VERSION, "py3"),
+     ("pip", _PIP_VERSION, "py3"),
+@@ -101,13 +119,10 @@ def _bootstrap(*, root=None, upgrade=False, user=False,
+         # additional paths that need added to sys.path
+         additional_paths = []
+         for project, version, py_tag in _PROJECTS:
+-            wheel_name = "{}-{}-{}-none-any.whl".format(project, version, py_tag)
+-            whl = resources.read_binary(
+-                _bundled,
+-                wheel_name,
+-            )
+-            with open(os.path.join(tmpdir, wheel_name), "wb") as fp:
+-                fp.write(whl)
++            wheel_name = _wheels[project][version]
++            with open(os.path.join(_WHEEL_DIR, wheel_name), "rb") as sfp:
++                with open(os.path.join(tmpdir, wheel_name), "wb") as fp:
++                    fp.write(sfp.read())
+ 
+             additional_paths.append(os.path.join(tmpdir, wheel_name))
+ 
+-- 
+2.35.3
+

SOURCES/00251-change-user-install-location.patch

@@ -0,0 +1,62 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michal Cyprian <m.cyprian@gmail.com>
+Date: Mon, 26 Jun 2017 16:32:56 +0200
+Subject: [PATCH] 00251: Change user install location
+
+Set values of prefix and exec_prefix in distutils install command
+to /usr/local if executable is /usr/bin/python* and RPM build
+is not detected to make pip and distutils install into separate location.
+
+Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+Downstream only: Awaiting resources to work on upstream PEP
+---
+ Lib/distutils/command/install.py | 15 +++++++++++++--
+ Lib/site.py                      |  9 ++++++++-
+ 2 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/Lib/distutils/command/install.py b/Lib/distutils/command/install.py
+index aaa300efa9..f8d453912a 100644
+--- a/Lib/distutils/command/install.py
++++ b/Lib/distutils/command/install.py
+@@ -419,8 +419,19 @@ class install(Command):
+                     raise DistutilsOptionError(
+                           "must not supply exec-prefix without prefix")
+ 
+-                self.prefix = os.path.normpath(sys.prefix)
+-                self.exec_prefix = os.path.normpath(sys.exec_prefix)
++                # self.prefix is set to sys.prefix + /local/
++                # if neither RPM build nor virtual environment is
++                # detected to make pip and distutils install packages
++                # into the separate location.
++                if (not (hasattr(sys, 'real_prefix') or
++                    sys.prefix != sys.base_prefix) and
++                    'RPM_BUILD_ROOT' not in os.environ):
++                    addition = "/local"
++                else:
++                    addition = ""
++
++                self.prefix = os.path.normpath(sys.prefix) + addition
++                self.exec_prefix = os.path.normpath(sys.exec_prefix) + addition
+ 
+             else:
+                 if self.exec_prefix is None:
+diff --git a/Lib/site.py b/Lib/site.py
+index 9e617afb00..db14f715f9 100644
+--- a/Lib/site.py
++++ b/Lib/site.py
+@@ -353,7 +353,14 @@ def getsitepackages(prefixes=None):
+     return sitepackages
+ 
+ def addsitepackages(known_paths, prefixes=None):
+-    """Add site-packages to sys.path"""
++    """Add site-packages to sys.path
++
++    '/usr/local' is included in PREFIXES if RPM build is not detected
++    to make packages installed into this location visible.
++
++    """
++    if ENABLE_USER_SITE and 'RPM_BUILD_ROOT' not in os.environ:
++        PREFIXES.insert(0, "/usr/local")
+     for sitedir in getsitepackages(prefixes):
+         if os.path.isdir(sitedir):
+             addsitedir(sitedir, known_paths)

SOURCES/00328-pyc-timestamp-invalidation-mode.patch

@@ -0,0 +1,54 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Thu, 11 Jul 2019 13:44:13 +0200
+Subject: [PATCH] 00328: Restore pyc to TIMESTAMP invalidation mode as default
+ in rpmbuild
+
+Since Fedora 31, the $SOURCE_DATE_EPOCH is set in rpmbuild to the latest
+%changelog date. This makes Python default to the CHECKED_HASH pyc
+invalidation mode, bringing more reproducible builds traded for an import
+performance decrease. To avoid that, we don't default to CHECKED_HASH
+when $RPM_BUILD_ROOT is set (i.e. when we are building RPM packages).
+
+See https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/57#comment-27426
+Downstream only: only used when building RPM packages
+Ideally, we should talk to upstream and explain why we don't want this
+---
+ Lib/py_compile.py           | 3 ++-
+ Lib/test/test_py_compile.py | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/py_compile.py b/Lib/py_compile.py
+index a81f493731..bba3642bf2 100644
+--- a/Lib/py_compile.py
++++ b/Lib/py_compile.py
+@@ -70,7 +70,8 @@ class PycInvalidationMode(enum.Enum):
+ 
+ 
+ def _get_default_invalidation_mode():
+-    if os.environ.get('SOURCE_DATE_EPOCH'):
++    if (os.environ.get('SOURCE_DATE_EPOCH') and not
++            os.environ.get('RPM_BUILD_ROOT')):
+         return PycInvalidationMode.CHECKED_HASH
+     else:
+         return PycInvalidationMode.TIMESTAMP
+diff --git a/Lib/test/test_py_compile.py b/Lib/test/test_py_compile.py
+index e6791c6916..b2d3dcf7fb 100644
+--- a/Lib/test/test_py_compile.py
++++ b/Lib/test/test_py_compile.py
+@@ -19,6 +19,7 @@ def without_source_date_epoch(fxn):
+     def wrapper(*args, **kwargs):
+         with support.EnvironmentVarGuard() as env:
+             env.unset('SOURCE_DATE_EPOCH')
++            env.unset('RPM_BUILD_ROOT')
+             return fxn(*args, **kwargs)
+     return wrapper
+ 
+@@ -29,6 +30,7 @@ def with_source_date_epoch(fxn):
+     def wrapper(*args, **kwargs):
+         with support.EnvironmentVarGuard() as env:
+             env['SOURCE_DATE_EPOCH'] = '123456789'
++            env.unset('RPM_BUILD_ROOT')
+             return fxn(*args, **kwargs)
+     return wrapper
+ 

SOURCES/00353-architecture-names-upstream-downstream.patch

@@ -0,0 +1,97 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Tue, 4 Aug 2020 12:04:03 +0200
+Subject: [PATCH] 00353: Original names for architectures with different names
+ downstream
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names
+
+Pythons in RHEL/Fedora used different names for some architectures
+than upstream and other distros (for example ppc64 vs. powerpc64).
+This was patched in patch 274, now it is sedded if %with legacy_archnames.
+
+That meant that an extension built with the default upstream settings
+(on other distro or as an manylinux wheel) could not been found by Python
+on RHEL/Fedora because it had a different suffix.
+This patch adds the legacy names to importlib so Python is able
+to import extensions with a legacy architecture name in its
+file name.
+It work both ways, so it support both %with and %without legacy_archnames.
+
+WARNING: This patch has no effect on Python built with bootstrap
+enabled because Python/importlib_external.h is not regenerated
+and therefore Python during bootstrap contains importlib from
+upstream without this feature. It's possible to include
+Python/importlib_external.h to this patch but it'd make rebasing
+a nightmare because it's basically a binary file.
+
+Co-authored-by: Miro Hrončok <miro@hroncok.cz>
+---
+ Lib/importlib/_bootstrap_external.py | 40 ++++++++++++++++++++++++++--
+ 1 file changed, 38 insertions(+), 2 deletions(-)
+
+diff --git a/Lib/importlib/_bootstrap_external.py b/Lib/importlib/_bootstrap_external.py
+index 25a3f8c0e0..a2edbebc88 100644
+--- a/Lib/importlib/_bootstrap_external.py
++++ b/Lib/importlib/_bootstrap_external.py
+@@ -1566,7 +1566,7 @@ def _get_supported_file_loaders():
+ 
+     Each item is a tuple (loader, suffixes).
+     """
+-    extensions = ExtensionFileLoader, _imp.extension_suffixes()
++    extensions = ExtensionFileLoader, _alternative_architectures(_imp.extension_suffixes())
+     source = SourceFileLoader, SOURCE_SUFFIXES
+     bytecode = SourcelessFileLoader, BYTECODE_SUFFIXES
+     return [extensions, source, bytecode]
+@@ -1622,7 +1622,7 @@ def _setup(_bootstrap_module):
+ 
+     # Constants
+     setattr(self_module, '_relax_case', _make_relax_case())
+-    EXTENSION_SUFFIXES.extend(_imp.extension_suffixes())
++    EXTENSION_SUFFIXES.extend(_alternative_architectures(_imp.extension_suffixes()))
+     if builtin_os == 'nt':
+         SOURCE_SUFFIXES.append('.pyw')
+         if '_d.pyd' in EXTENSION_SUFFIXES:
+@@ -1635,3 +1635,39 @@ def _install(_bootstrap_module):
+     supported_loaders = _get_supported_file_loaders()
+     sys.path_hooks.extend([FileFinder.path_hook(*supported_loaders)])
+     sys.meta_path.append(PathFinder)
++
++
++_ARCH_MAP = {
++    "-arm-linux-gnueabi.": "-arm-linux-gnueabihf.",
++    "-armeb-linux-gnueabi.": "-armeb-linux-gnueabihf.",
++    "-mips64-linux-gnu.": "-mips64-linux-gnuabi64.",
++    "-mips64el-linux-gnu.": "-mips64el-linux-gnuabi64.",
++    "-ppc-linux-gnu.": "-powerpc-linux-gnu.",
++    "-ppc-linux-gnuspe.": "-powerpc-linux-gnuspe.",
++    "-ppc64-linux-gnu.": "-powerpc64-linux-gnu.",
++    "-ppc64le-linux-gnu.": "-powerpc64le-linux-gnu.",
++    # The above, but the other way around:
++    "-arm-linux-gnueabihf.": "-arm-linux-gnueabi.",
++    "-armeb-linux-gnueabihf.": "-armeb-linux-gnueabi.",
++    "-mips64-linux-gnuabi64.": "-mips64-linux-gnu.",
++    "-mips64el-linux-gnuabi64.": "-mips64el-linux-gnu.",
++    "-powerpc-linux-gnu.": "-ppc-linux-gnu.",
++    "-powerpc-linux-gnuspe.": "-ppc-linux-gnuspe.",
++    "-powerpc64-linux-gnu.": "-ppc64-linux-gnu.",
++    "-powerpc64le-linux-gnu.": "-ppc64le-linux-gnu.",
++}
++
++
++def _alternative_architectures(suffixes):
++    """Add a suffix with an alternative architecture name
++    to the list of suffixes so an extension built with
++    the default (upstream) setting is loadable with our Pythons
++    """
++
++    for suffix in suffixes:
++        for original, alternative in _ARCH_MAP.items():
++            if original in suffix:
++                suffixes.append(suffix.replace(original, alternative))
++                return suffixes
++
++    return suffixes

SOURCES/00378-support-expat-2-4-5.patch

@@ -0,0 +1,47 @@
+From db083095e3bdb93e4f8170d814664c482b1e94da Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Tue, 14 Jun 2022 06:38:43 +0200
+Subject: [PATCH] Fix test suite for Expat >= 2.4.5
+
+---
+ Lib/test/test_minidom.py | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py
+index 9762025..5f52ed1 100644
+--- a/Lib/test/test_minidom.py
++++ b/Lib/test/test_minidom.py
+@@ -1149,14 +1149,10 @@ class MinidomTest(unittest.TestCase):
+ 
+         # Verify that character decoding errors raise exceptions instead
+         # of crashing
+-        if pyexpat.version_info >= (2, 4, 5):
+-            self.assertRaises(ExpatError, parseString,
+-                    b'<fran\xe7ais></fran\xe7ais>')
+-            self.assertRaises(ExpatError, parseString,
+-                    b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
+-        else:
+-            self.assertRaises(UnicodeDecodeError, parseString,
+-                b'<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
++        self.assertRaises(ExpatError, parseString,
++                b'<fran\xe7ais></fran\xe7ais>')
++        self.assertRaises(ExpatError, parseString,
++                b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
+ 
+         doc.unlink()
+ 
+@@ -1617,10 +1613,7 @@ class MinidomTest(unittest.TestCase):
+         self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE)
+ 
+     def testExceptionOnSpacesInXMLNSValue(self):
+-        if pyexpat.version_info >= (2, 4, 5):
+-            context = self.assertRaisesRegex(ExpatError, 'syntax error')
+-        else:
+-            context = self.assertRaisesRegex(ValueError, 'Unsupported syntax')
++        context = self.assertRaisesRegex(ExpatError, 'syntax error')
+ 
+         with context:
+             parseString('<element xmlns:abc="http:abc.com/de f g/hi/j k"><abc:foo /></element>')
+-- 
+2.35.3
+

SOURCES/00397-tarfile-filter.patch

@@ -0,0 +1,251 @@
+From 8b70605b594b3831331a9340ba764ff751871612 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Mon, 6 Mar 2023 17:24:24 +0100
+Subject: [PATCH 2/2] CVE-2007-4559, PEP-706: Add filters for tarfile
+ extraction (downstream)
+
+Add and test RHEL-specific ways of configuring the default behavior: environment
+variable and config file.
+---
+ Lib/tarfile.py           |  42 +++++++++++++
+ Lib/test/test_shutil.py  |   3 +-
+ Lib/test/test_tarfile.py | 128 ++++++++++++++++++++++++++++++++++++++-
+ 3 files changed, 169 insertions(+), 4 deletions(-)
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index b6ad7dbe2a4..dc7050b2c63 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -72,6 +72,13 @@ __all__ = ["TarFile", "TarInfo", "is_tarfile", "TarError", "ReadError",
+            "ENCODING", "USTAR_FORMAT", "GNU_FORMAT", "PAX_FORMAT",
+            "DEFAULT_FORMAT", "open"]
+ 
++# If true, use the safer (but backwards-incompatible) 'tar' extraction filter,
++# rather than 'fully_trusted', by default.
++# The emitted warning is changed to match.
++_RH_SAFER_DEFAULT = True
++
++# System-wide configuration file
++_CONFIG_FILENAME = '/etc/python/tarfile.cfg'
+ 
+ #---------------------------------------------------------
+ # tar constants
+@@ -2197,6 +2204,41 @@ class TarFile(object):
+         if filter is None:
+             filter = self.extraction_filter
+             if filter is None:
++                name = os.environ.get('PYTHON_TARFILE_EXTRACTION_FILTER')
++                if name is None:
++                    try:
++                        file = bltn_open(_CONFIG_FILENAME)
++                    except FileNotFoundError:
++                        pass
++                    else:
++                        import configparser
++                        conf = configparser.ConfigParser(
++                            interpolation=None,
++                            comment_prefixes=('#', ),
++                        )
++                        with file:
++                            conf.read_file(file)
++                        name = conf.get('tarfile',
++                                        'PYTHON_TARFILE_EXTRACTION_FILTER',
++                                        fallback='')
++                if name:
++                    try:
++                        filter = _NAMED_FILTERS[name]
++                    except KeyError:
++                        raise ValueError(f"filter {filter!r} not found") from None
++                    self.extraction_filter = filter
++                    return filter
++                if _RH_SAFER_DEFAULT:
++                    warnings.warn(
++                        'The default behavior of tarfile extraction has been '
++                        + 'changed to disallow common exploits '
++                        + '(including CVE-2007-4559). '
++                        + 'By default, absolute/parent paths are disallowed '
++                        + 'and some mode bits are cleared. '
++                        + 'See https://access.redhat.com/articles/7004769 '
++                        + 'for more details.',
++                        RuntimeWarning)
++                    return tar_filter
+                 return fully_trusted_filter
+             if isinstance(filter, str):
+                 raise TypeError(
+diff --git a/Lib/test/test_shutil.py b/Lib/test/test_shutil.py
+index 9041e7aa368..1eb1116cc10 100644
+--- a/Lib/test/test_shutil.py
++++ b/Lib/test/test_shutil.py
+@@ -1613,7 +1613,8 @@ class TestArchives(BaseTest, unittest.TestCase):
+     def check_unpack_tarball(self, format):
+         self.check_unpack_archive(format, filter='fully_trusted')
+         self.check_unpack_archive(format, filter='data')
+-        with warnings_helper.check_no_warnings(self):
++        with warnings_helper.check_warnings(
++                ('.*CVE-2007-4559', RuntimeWarning)):
+             self.check_unpack_archive(format)
+ 
+     def test_unpack_archive_tar(self):
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index a66f7efd2d6..6fd3c384b5c 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -2,7 +2,7 @@ import sys
+ import os
+ import io
+ from hashlib import sha256
+-from contextlib import contextmanager
++from contextlib import contextmanager, ExitStack
+ from random import Random
+ import pathlib
+ import shutil
+@@ -2929,7 +2929,11 @@ class NoneInfoExtractTests(ReadTest):
+         tar = tarfile.open(tarname, mode='r', encoding="iso8859-1")
+         cls.control_dir = pathlib.Path(TEMPDIR) / "extractall_ctrl"
+         tar.errorlevel = 0
+-        tar.extractall(cls.control_dir, filter=cls.extraction_filter)
++        with ExitStack() as cm:
++            if cls.extraction_filter is None:
++                cm.enter_context(warnings.catch_warnings())
++                warnings.simplefilter(action="ignore", category=RuntimeWarning)
++            tar.extractall(cls.control_dir, filter=cls.extraction_filter)
+         tar.close()
+         cls.control_paths = set(
+             p.relative_to(cls.control_dir)
+@@ -3592,7 +3596,8 @@ class TestExtractionFilters(unittest.TestCase):
+         """Ensure the default filter does not warn (like in 3.12)"""
+         with ArchiveMaker() as arc:
+             arc.add('foo')
+-        with warnings_helper.check_no_warnings(self):
++        with warnings_helper.check_warnings(
++                ('.*CVE-2007-4559', RuntimeWarning)):
+             with self.check_context(arc.open(), None):
+                 self.expect_file('foo')
+ 
+@@ -3762,6 +3767,123 @@ class TestExtractionFilters(unittest.TestCase):
+             self.expect_exception(TypeError)  # errorlevel is not int
+ 
+ 
++    @contextmanager
++    def rh_config_context(self, config_lines=None):
++        """Set up for testing various ways of overriding the default filter
++
++        return a triple with:
++        - temporary directory
++        - EnvironmentVarGuard()
++        - a test archive for use with check_* methods below
++
++        If config_lines is given, write them to the config file. Otherwise
++        the config file is missing.
++        """
++        tempdir = pathlib.Path(TEMPDIR) / 'tmp'
++        configfile = tempdir / 'tarfile.cfg'
++        with ArchiveMaker() as arc:
++            arc.add('good')
++            arc.add('ugly', symlink_to='/etc/passwd')
++            arc.add('../bad')
++        with (
++                support.temp_dir(tempdir),
++                support.swap_attr(tarfile, '_CONFIG_FILENAME', str(configfile)),
++                support.EnvironmentVarGuard() as env,
++                arc.open() as tar,
++        ):
++            if config_lines is not None:
++                with configfile.open('w') as f:
++                    for line in config_lines:
++                        print(line, file=f)
++            yield tempdir, env, tar
++
++    def check_rh_default_behavior(self, tar, tempdir):
++        """Check RH default: warn and refuse to extract dangerous files."""
++        with (
++                warnings_helper.check_warnings(
++                    ('.*CVE-2007-4559', RuntimeWarning)),
++                self.assertRaises(tarfile.OutsideDestinationError),
++        ):
++            tar.extractall(tempdir / 'outdir')
++
++    def check_trusted_default(self, tar, tempdir):
++        """Check 'fully_trusted' is configured as the default filter."""
++        with (
++                warnings_helper.check_no_warnings(self),
++        ):
++            tar.extractall(tempdir / 'outdir')
++            self.assertTrue((tempdir / 'outdir/good').exists())
++            self.assertEqual((tempdir / 'outdir/ugly').readlink(),
++                             pathlib.Path('/etc/passwd'))
++            self.assertTrue((tempdir / 'bad').exists())
++
++    def test_rh_default_no_conf(self):
++        with self.rh_config_context() as (tempdir, env, tar):
++            self.check_rh_default_behavior(tar, tempdir)
++
++    def test_rh_default_from_file(self):
++        lines = ['[tarfile]', 'PYTHON_TARFILE_EXTRACTION_FILTER=fully_trusted']
++        with self.rh_config_context(lines) as (tempdir, env, tar):
++            self.check_trusted_default(tar, tempdir)
++
++    def test_rh_empty_config_file(self):
++        """Empty config file -> default behavior"""
++        lines = []
++        with self.rh_config_context(lines) as (tempdir, env, tar):
++            self.check_rh_default_behavior(tar, tempdir)
++
++    def test_empty_config_section(self):
++        """Empty section in config file -> default behavior"""
++        lines = ['[tarfile]']
++        with self.rh_config_context(lines) as (tempdir, env, tar):
++            self.check_rh_default_behavior(tar, tempdir)
++
++    def test_rh_default_empty_config_option(self):
++        """Empty option value in config file -> default behavior"""
++        lines = ['[tarfile]', 'PYTHON_TARFILE_EXTRACTION_FILTER=']
++        with self.rh_config_context(lines) as (tempdir, env, tar):
++            self.check_rh_default_behavior(tar, tempdir)
++
++    def test_bad_config_option(self):
++        """Bad option value in config file -> ValueError"""
++        lines = ['[tarfile]', 'PYTHON_TARFILE_EXTRACTION_FILTER=unknown!']
++        with self.rh_config_context(lines) as (tempdir, env, tar):
++            with self.assertRaises(ValueError):
++                tar.extractall(tempdir / 'outdir')
++
++    def test_default_from_envvar(self):
++        with self.rh_config_context() as (tempdir, env, tar):
++            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = 'fully_trusted'
++            self.check_trusted_default(tar, tempdir)
++
++    def test_empty_envvar(self):
++        """Empty env variable -> default behavior"""
++        with self.rh_config_context() as (tempdir, env, tar):
++            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = ''
++            self.check_rh_default_behavior(tar, tempdir)
++
++    def test_bad_envvar(self):
++        with self.rh_config_context() as (tempdir, env, tar):
++            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = 'unknown!'
++            with self.assertRaises(ValueError):
++                tar.extractall(tempdir / 'outdir')
++
++    def test_envvar_overrides_file(self):
++        lines = ['[tarfile]', 'PYTHON_TARFILE_EXTRACTION_FILTER=data']
++        with self.rh_config_context(lines) as (tempdir, env, tar):
++            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = 'fully_trusted'
++            self.check_trusted_default(tar, tempdir)
++
++    def test_monkeypatch_overrides_envvar(self):
++        with self.rh_config_context(None) as (tempdir, env, tar):
++            env['PYTHON_TARFILE_EXTRACTION_FILTER'] = 'data'
++            with support.swap_attr(
++                    tarfile.TarFile, 'extraction_filter',
++                    staticmethod(tarfile.fully_trusted_filter)
++            ):
++                self.check_trusted_default(tar, tempdir)
++
++
+ def setUpModule():
+     support.unlink(TEMPDIR)
+     os.makedirs(TEMPDIR)
+-- 
+2.40.1
+

SOURCES/Python-3.9.17.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEE4/8oOcBIslwITevpsmmV4xAlBWgFAmR/AFcACgkQsmmV4xAl
+BWg7Fg/7Bq3qKbUD+4LYCOEESdu1MQm4bxfySqFLrzfe0YML/Xvei3ot/MsoTxY+
+9dwLivBab6YVDw3x65Zm2Y1sKAwcKn80qcwfxkxKPFVzeFAIYaO48zACJ5gvNEwk
+tXxEcDV0Nirs5ksqjs439eWXFFSZJJjHUxrBKwVVXoVTl9P3wbvKzeAUGuWMdvBt
+8RYtaHMt24w+mtFBdBM5ODl9qHD30HvEdHItF1HFtnnIR2mvE5W3dNkytrEWckq7
+urrQZlIFqSffnK89oNrQBGQC1dipzfgb3Vdk52usIVq+3J9VeWEmw8my/HUtf6LM
+uSETKCDM6POcC1Hjn3Zar8pVg/5IrGfag2aOWPQwRf5+py+nHO9a8P0nAz1TvygJ
+Q4FPcGCRyxa6gw9TEoO3zutQrHG2q+bvr61hSx3bcnlTk5EwTgblxOw9A5L++uzQ
+JK6vkPIaid4KboIOgpgw2xYWu8uVl2KtEyOeNrvZubuYqKh3xy25lNZT0tT6Axtv
+jOKC84FSvp5fLRAAHAr9B6uycKRlNY2Ca6t8FkkD0v2NgsRVM2Mc11/i/NS+EFKc
+hCZgAvbIEX17DQQNcmki1FWeJ0LfoE7PZgte7f6o1J9lcBYhmfC6nIWJ6Q3zZX/y
+96EESfeEshigdMEwlkCtYSJTc5/WpdiZ0LQyI0x/RQFb8Q4XHS0=
+=xjRt
+-----END PGP SIGNATURE-----

SOURCES/check-pyc-timestamps.py

@@ -0,0 +1,55 @@
+"""Checks if all *.pyc files have later mtime than their *.py files."""
+
+import os
+import sys
+from importlib.util import cache_from_source
+from pathlib import Path
+
+
+RPM_BUILD_ROOT = os.environ.get('RPM_BUILD_ROOT', '')
+
+# ...cpython-3X.pyc
+# ...cpython-3X.opt-1.pyc
+# ...cpython-3X.opt-2.pyc
+LEVELS = (None, 1, 2)
+
+# list of globs of test and other files that we expect not to have bytecode
+not_compiled = [
+    '/usr/bin/*',
+    '*/test/bad_coding.py',
+    '*/test/bad_coding2.py',
+    '*/test/badsyntax_*.py',
+    '*/lib2to3/tests/data/bom.py',
+    '*/lib2to3/tests/data/crlf.py',
+    '*/lib2to3/tests/data/different_encoding.py',
+    '*/lib2to3/tests/data/false_encoding.py',
+    '*/lib2to3/tests/data/py2_test_grammar.py',
+    '*.debug-gdb.py',
+]
+
+
+def bytecode_expected(path):
+    path = Path(path[len(RPM_BUILD_ROOT):])
+    for glob in not_compiled:
+        if path.match(glob):
+            return False
+    return True
+
+
+failed = 0
+compiled = (path for path in sys.argv[1:] if bytecode_expected(path))
+for path in compiled:
+    to_check = (cache_from_source(path, optimization=opt) for opt in LEVELS)
+    f_mtime = os.path.getmtime(path)
+    for pyc in to_check:
+        c_mtime = os.path.getmtime(pyc)
+        if c_mtime < f_mtime:
+            print('Failed bytecompilation timestamps check: '
+                  f'Bytecode file {pyc} is older than source file {path}',
+                  file=sys.stderr)
+            failed += 1
+
+if failed:
+    print(f'\n{failed} files failed bytecompilation timestamps check.',
+          file=sys.stderr)
+    sys.exit(1)

SOURCES/idle3.appdata.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- Copyright 2017 Zbigniew Jędrzejewski-Szmek -->
+<application>
+  <id type="desktop">idle3.desktop</id>
+  <name>IDLE3</name>
+  <metadata_licence>CC0</metadata_licence>
+  <project_license>Python-2.0</project_license>
+  <summary>Python 3 Integrated Development and Learning Environment</summary>
+  <description>
+    <p>
+      IDLE is Python’s Integrated Development and Learning Environment.
+      The GUI is uniform between Windows, Unix, and Mac OS X.
+      IDLE provides an easy way to start writing, running, and debugging
+      Python code.
+    </p>
+    <p>
+      IDLE is written in pure Python, and uses the tkinter GUI toolkit.
+      It provides:
+    </p>
+    <ul>
+       <li>a Python shell window (interactive interpreter) with colorizing of code input, output, and error messages,</li>
+       <li>a multi-window text editor with multiple undo, Python colorizing, smart indent, call tips, auto completion, and other features,</li>
+       <li>search within any window, replace within editor windows, and search through multiple files (grep),</li>
+       <li>a debugger with persistent breakpoints, stepping, and viewing of global and local namespaces.</li>
+    </ul>
+  </description>
+  <url type="homepage">https://docs.python.org/3/library/idle.html</url>
+  <screenshots>
+    <screenshot type="default">http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-main-window.png</screenshot>
+    <screenshot>http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-class-browser.png</screenshot>
+    <screenshot>http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-code-viewer.png</screenshot>
+  </screenshots>
+  <update_contact>zbyszek@in.waw.pl</update_contact>
+</application>

SOURCES/idle3.desktop

@@ -0,0 +1,11 @@
+[Desktop Entry]
+Version=1.0
+Name=IDLE 3
+Comment=Python 3 Integrated Development and Learning Environment
+Exec=idle3 %F
+TryExec=idle3
+Terminal=false
+Type=Application
+Icon=idle3
+Categories=Development;IDE;
+MimeType=text/x-python;

SOURCES/macros.python39

@@ -0,0 +1,32 @@
+%__python3 /usr/bin/python3.9
+%python3_pkgversion 39
+%__pytest /usr/bin/pytest-3.9
+
+# The following are macros from macros.python3 in Fedora that are newer/different than those in the python3-rpm-macros package in RHEL.
+# These macros overwrite/supercede some of the macros in the python3-rpm-macros package in RHEL.
+
+%python3_version %(%{__python3} -Ic "import sys; sys.stdout.write('{0.major}.{0.minor}'.format(sys.version_info))")
+%python3_version_nodots %(%{__python3} -Ic "import sys; sys.stdout.write('{0.major}{0.minor}'.format(sys.version_info))")
+
+%py3_install() %{expand:\\\
+  CFLAGS="${CFLAGS:-${RPM_OPT_FLAGS}}" LDFLAGS="${LDFLAGS:-${RPM_LD_FLAGS}}"\\\
+  %{__python3} %{py_setup} %{?py_setup_args} install -O1 --skip-build --root %{buildroot} %{?*}
+  rm -rfv %{buildroot}%{_bindir}/__pycache__
+}
+
+%py3_install_egg() %{expand:\\\
+  mkdir -p %{buildroot}%{python3_sitelib}
+  CFLAGS="%{optflags}" %{__python3} -m easy_install -m --prefix %{buildroot}%{_prefix} -Z dist/*-py%{python3_version}.egg %{?*}
+  rm -rfv %{buildroot}%{_bindir}/__pycache__
+}
+
+%py3_install_wheel() %{expand:\\\
+  CFLAGS="%{optflags}" %{__python3} -m pip install -I dist/%{1} --root %{buildroot} --no-deps --no-index --no-warn-script-location
+  rm -rfv %{buildroot}%{_bindir}/__pycache__
+  for distinfo in %{buildroot}%{python3_sitelib}/*.dist-info %{buildroot}%{python3_sitearch}/*.dist-info; do
+    if [ -f ${distinfo}/direct_url.json ]; then
+      rm -fv ${distinfo}/direct_url.json
+      sed -i '/direct_url.json/d' ${distinfo}/RECORD
+    fi
+  done
+}