Update to 3.10.7, with security fix for CVE-2020-10735

Resolves: rhbz#2075390

00251-change-user-install-location.patch

@@ -1,38 +1,30 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
-Date: Mon, 15 Feb 2021 12:19:27 +0100
+From: Michal Cyprian <m.cyprian@gmail.com>
+Date: Mon, 26 Jun 2017 16:32:56 +0200
 Subject: [PATCH] 00251: Change user install location
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
-Set values of base and platbase in sysconfig from /usr
-to /usr/local when RPM build is not detected
-to make pip and similar tools install into separate location.
-
 Set values of prefix and exec_prefix in distutils install command
 to /usr/local if executable is /usr/bin/python* and RPM build
-is not detected to make distutils and pypa/distutils install into separate location.
+is not detected to make pip and distutils install into separate location.
 
 Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-Downstream only.
-
-We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
-but we have identified serious problems with that approach,
-see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
+Downstream only: Reworked in Fedora 36+ to follow https://bugs.python.org/issue43976
 
 pypa/distutils integration: https://github.com/pypa/distutils/pull/70
 
-Co-authored-by: Petr Viktorin <encukou@gmail.com>
+Also set sysconfig._PIP_USE_SYSCONFIG = False, to force pip-upgraded-pip
+to respect this patched distutils install command.
+See https://bugzilla.redhat.com/show_bug.cgi?id=2014513
+
 Co-authored-by: Miro Hrončok <miro@hroncok.cz>
-Co-authored-by: Michal Cyprian <m.cyprian@gmail.com>
-Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
 ---
- Lib/distutils/command/install.py |  8 +++--
- Lib/site.py                      |  9 +++++-
- Lib/sysconfig.py                 | 53 +++++++++++++++++++++++++++++++-
- Lib/test/test_sysconfig.py       | 17 ++++++++--
- 4 files changed, 81 insertions(+), 6 deletions(-)
+ Lib/distutils/command/install.py |  8 ++++++--
+ Lib/site.py                      |  9 ++++++++-
+ Lib/sysconfig.py                 | 16 ++++++++++++++++
+ 3 files changed, 30 insertions(+), 3 deletions(-)
 
 diff --git a/Lib/distutils/command/install.py b/Lib/distutils/command/install.py
 index 01d5331a63..79f70f0de4 100644
@@ -82,30 +74,17 @@ index 939893eb5e..d1316c3355 100644
          if os.path.isdir(sitedir):
              addsitedir(sitedir, known_paths)
 diff --git a/Lib/sysconfig.py b/Lib/sysconfig.py
-index daf9f00006..10368c92a7 100644
+index daf9f00006..b88f9a9de0 100644
 --- a/Lib/sysconfig.py
 +++ b/Lib/sysconfig.py
-@@ -58,6 +58,16 @@
+@@ -58,6 +58,22 @@
          },
      }
  
-+# For a brief period of time in the Fedora 36 life cycle,
-+# this installation scheme existed and was documented in the release notes.
-+# For backwards compatibility, we keep it here (at least on 3.10 and 3.11).
-+_INSTALL_SCHEMES['rpm_prefix'] = _INSTALL_SCHEMES['posix_prefix']
-+# Virtualenv >= 20.10.0 favors the "venv" scheme over the defaults when creating virtual environments.
-+# See: https://github.com/pypa/virtualenv/commit/8da79db86d8a5c74d03667a40e64ff832076445e
-+# See: https://bugs.python.org/issue45413
-+# "venv" should be the same as the posix_prefix for us,
-+# so new virtual environments aren't created with paths like venv/local/bin/python.
-+_INSTALL_SCHEMES['venv'] = _INSTALL_SCHEMES['posix_prefix']
- 
- # NOTE: site.py has copy of this function.
- # Sync it when modify this function.
-@@ -117,6 +127,19 @@ def joinuser(*args):
-             },
-     }
- 
++# Force pip to use distutils paths instead of sysconfig
++# https://github.com/pypa/pip/issues/10647
++_PIP_USE_SYSCONFIG = False
++
 +# This is used by distutils.command.install in the stdlib
 +# as well as pypa/distutils (e.g. bundled in setuptools).
 +# The self.prefix value is set to sys.prefix + /local/
@@ -116,93 +95,8 @@ index daf9f00006..10368c92a7 100644
 +if (not (hasattr(sys, 'real_prefix') or
 +    sys.prefix != sys.base_prefix) and
 +    'RPM_BUILD_ROOT' not in os.environ):
-+    _prefix_addition = '/local'
++    _prefix_addition = "/local"
 +
-+
- _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
-                 'scripts', 'data')
  
-@@ -211,11 +234,39 @@ def _extend_dict(target_dict, other_dict):
-         target_dict[key] = value
- 
- 
-+_CONFIG_VARS_LOCAL = None
-+
-+
-+def _config_vars_local():
-+    # This function returns the config vars with prefixes amended to /usr/local
-+    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-+    global _CONFIG_VARS_LOCAL
-+    if _CONFIG_VARS_LOCAL is None:
-+        _CONFIG_VARS_LOCAL = dict(get_config_vars())
-+        _CONFIG_VARS_LOCAL['base'] = '/usr/local'
-+        _CONFIG_VARS_LOCAL['platbase'] = '/usr/local'
-+    return _CONFIG_VARS_LOCAL
-+
-+
- def _expand_vars(scheme, vars):
-     res = {}
-     if vars is None:
-         vars = {}
--    _extend_dict(vars, get_config_vars())
-+
-+    # when we are not in a virtual environment or an RPM build
-+    # we change '/usr' to '/usr/local'
-+    # to avoid surprises, we explicitly check for the /usr/ prefix
-+    # Python virtual environments have different prefixes
-+    # we only do this for posix_prefix, not to mangle the venv scheme
-+    # posix_prefix is used by sudo pip install
-+    # we only change the defaults here, so explicit --prefix will take precedence
-+    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-+    if (scheme == 'posix_prefix' and
-+        _PREFIX == '/usr' and
-+        'RPM_BUILD_ROOT' not in os.environ):
-+            _extend_dict(vars, _config_vars_local())
-+    else:
-+        _extend_dict(vars, get_config_vars())
- 
-     for key, value in _INSTALL_SCHEMES[scheme].items():
-         if os.name in ('posix', 'nt'):
-diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
-index 5ee9839c04..16e92ca86f 100644
---- a/Lib/test/test_sysconfig.py
-+++ b/Lib/test/test_sysconfig.py
-@@ -105,8 +105,19 @@ def test_get_path(self):
-         for scheme in _INSTALL_SCHEMES:
-             for name in _INSTALL_SCHEMES[scheme]:
-                 expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
-+                tested = get_path(name, scheme)
-+                # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-+                if tested.startswith('/usr/local'):
-+                    # /usr/local should only be used in posix_prefix
-+                    self.assertEqual(scheme, 'posix_prefix')
-+                    # Fedora CI runs tests for venv and virtualenv that check for other prefixes
-+                    self.assertEqual(sys.prefix, '/usr')
-+                    # When building the RPM of Python, %check runs this with RPM_BUILD_ROOT set
-+                    # Fedora CI runs this with RPM_BUILD_ROOT unset
-+                    self.assertNotIn('RPM_BUILD_ROOT', os.environ)
-+                    tested = tested.replace('/usr/local', '/usr')
-                 self.assertEqual(
--                    os.path.normpath(get_path(name, scheme)),
-+                    os.path.normpath(tested),
-                     os.path.normpath(expected),
-                 )
- 
-@@ -263,7 +274,7 @@ def test_get_config_h_filename(self):
-         self.assertTrue(os.path.isfile(config_h), config_h)
- 
-     def test_get_scheme_names(self):
--        wanted = ['nt', 'posix_home', 'posix_prefix']
-+        wanted = ['nt', 'posix_home', 'posix_prefix', 'rpm_prefix', 'venv']
-         if HAS_USER_BASE:
-             wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
-         self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
-@@ -274,6 +285,8 @@ def test_symlink(self): # Issue 7880
-             cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
-             self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
- 
-+    @unittest.skipIf('RPM_BUILD_ROOT' not in os.environ,
-+                     "Test doesn't expect Fedora's paths")
-     def test_user_similar(self):
-         # Issue #8759: make sure the posix scheme for the users
-         # is similar to the global posix_prefix one
+ # NOTE: site.py has copy of this function.
+ # Sync it when modify this function.

python3.10.spec

@@ -235,8 +235,8 @@ BuildRequires: /usr/bin/dtrace
 BuildRequires: /usr/sbin/ifconfig
 
 %if %{with rpmwheels}
-BuildRequires: %{python_wheel_pkg_prefix}-setuptools-wheel
-BuildRequires: %{python_wheel_pkg_prefix}-pip-wheel
+BuildRequires: python-setuptools-wheel
+BuildRequires: python-pip-wheel
 %endif
 
 %if %{without bootstrap}
@@ -276,25 +276,21 @@ Source11: idle3.appdata.xml
 # Was Patch0 in ivazquez' python3000 specfile
 Patch1: 00001-rpath.patch
 
-# 00251 # 8448a0d6edd44d0818b8c02dc603b769b5363e5b
+# 00251 # 08a62456431df182dfad18ad75838f769aca2d08
 # Change user install location
 #
-# Set values of base and platbase in sysconfig from /usr
-# to /usr/local when RPM build is not detected
-# to make pip and similar tools install into separate location.
-#
 # Set values of prefix and exec_prefix in distutils install command
 # to /usr/local if executable is /usr/bin/python* and RPM build
-# is not detected to make distutils and pypa/distutils install into separate location.
+# is not detected to make pip and distutils install into separate location.
 #
 # Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
-# Downstream only.
-#
-# We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
-# but we have identified serious problems with that approach,
-# see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
+# Downstream only: Reworked in Fedora 36+ to follow https://bugs.python.org/issue43976
 #
 # pypa/distutils integration: https://github.com/pypa/distutils/pull/70
+#
+# Also set sysconfig._PIP_USE_SYSCONFIG = False, to force pip-upgraded-pip
+# to respect this patched distutils install command.
+# See https://bugzilla.redhat.com/show_bug.cgi?id=2014513
 Patch251: 00251-change-user-install-location.patch
 
 # 00328 # 318e500c98f5e59eb1f23e0fcd32db69b9bd17e1
@@ -454,8 +450,8 @@ This package contains /usr/bin/python - the "python" command that runs Python 3.
 Summary:        Python runtime libraries
 
 %if %{with rpmwheels}
-Requires: %{python_wheel_pkg_prefix}-setuptools-wheel
-Requires: %{python_wheel_pkg_prefix}-pip-wheel
+Requires: python-setuptools-wheel
+Requires: python-pip-wheel
 %else
 Provides: bundled(python3dist(pip)) = %{pip_version}
 Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
@@ -477,10 +473,6 @@ Recommends: (%{pkgname}-tkinter%{?_isa} = %{version}-%{release} if tk%{?_isa})
 # The zoneinfo module needs tzdata
 Requires: tzdata
 
-# Since patch 251 changed from distutils to sysconfig, pip needed to be adapted
-# The previous versions could cause serious bugs during `sudo pip install --upgrade ...`
-# Better safe than sorry
-Conflicts: %{pkgname}-pip < 21.2.3-3
 
 %description -n %{pkgname}-libs
 This package contains runtime libraries for use by Python:
@@ -495,10 +487,8 @@ Requires: %{pkgname} = %{version}-%{release}
 Requires: %{pkgname}-libs%{?_isa} = %{version}-%{release}
 # The RPM related dependencies bring nothing to a non-RPM Python developer
 # But we want them when packages BuildRequire python3-devel
-# 3.10-9 macros started to set $RPM_BUILD_ROOT when expanding macros like %%python3_sitearch,
-# which is necessary since patch 251 changed from distutils to sysconfig
-Requires: (python-rpm-macros >= 3.10-9 if rpm-build)
-Requires: (python3-rpm-macros >= 3.10-9 if rpm-build)
+Requires: (python-rpm-macros if rpm-build)
+Requires: (python3-rpm-macros if rpm-build)
 Requires: (pyproject-rpm-macros if rpm-build)
 
 %unversioned_obsoletes_of_python3_X_if_main devel
@@ -621,7 +611,6 @@ The debug runtime additionally supports debug builds of C-API extensions
 (with the "d" ABI flag) for debugging issues in those extensions.
 %endif # with debug_build
 
-
 # ======================================================
 # The prep phase of the build:
 # ======================================================
@@ -735,7 +724,7 @@ BuildPython() {
   --with-ssl-default-suites=openssl \
   --without-static-libpython \
 %if %{with rpmwheels}
-  --with-wheel-pkg-dir=%{python_wheel_dir} \
+  --with-wheel-pkg-dir=%{_datadir}/python-wheels \
 %endif
 %if %{with valgrind}
   --with-valgrind \
@@ -1593,20 +1582,9 @@ CheckPython optimized
 - Update to 3.10.7
 - Contains security fix for CVE-2020-10735
 
-* Mon Aug 22 2022 Miro Hrončok <mhroncok@redhat.com> - 3.10.6-2
-- Don't use custom installation schemes
-- Fixes rhbz#2026979
-- Fixes rhbz#2097183
-
 * Tue Aug 02 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.6-1
 - Update to 3.10.6
 
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.5-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Mon Jun 13 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.5-3
-- Rebuilt for Python 3.11
-
 * Thu Jun 09 2022 Charalampos Stratakis <cstratak@redhat.com> - 3.10.5-2
 - Security fix for CVE-2015-20107
 Resolves: rhbz#2075390
@@ -1623,13 +1601,6 @@ Resolves: rhbz#2075390
 * Fri Mar 18 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.3-1
 - Update to 3.10.3
 
-* Tue Feb 01 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.2-3
-- Backport AC_C_CHAR_UNSIGNED/__CHAR_UNSIGNED__ removal
-- Fixes: rhbz#2043555
-
-* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
 * Mon Jan 17 2022 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.2-1
 - Update to 3.10.2
 
@@ -1638,23 +1609,14 @@ Resolves: rhbz#2075390
 - Fixes: rhbz#2030621
 - Fixes: rhbz#2034962
 
-* Sat Jan 08 2022 Miro Hrončok <mhroncok@redhat.com> - 3.10.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Changes/LIBFFI34
+* Thu Dec 09 2021 Miro Hrončok <mhroncok@redhat.com> - 3.10.1-2
+- Instruct pip to use distutils
+- Instruct pypa/distutils to add /local/ addition to prefix
+- Fixes rhbz#2014513
 
 * Tue Dec 07 2021 Tomáš Hrnčiar <thrnciar@redhat.com> - 3.10.1-1
 - Update to 3.10.1
 
-* Fri Nov 12 2021 Björn Esser <besser82@fedoraproject.org> - 3.10.0-4
-- Rebuild(libnsl2)
-
-* Tue Nov 09 2021 Lumír Balhar <lbalhar@redhat.com> - 3.10.0-3
-- Update patch 251 to include specific install scheme for virtualenv
-
-* Tue Oct 05 2021 Miro Hrončok <mhroncok@redhat.com> - 3.10.0-2
-- Change the values of sysconfig's "posix_prefix" install scheme to /usr/local
-  when RPM build or venv/virtualenv is not detected,
-  instead of patching distutils
-
 * Mon Oct 04 2021 Miro Hrončok <mhroncok@redhat.com> - 3.10.0-1
 - Update to 3.10.0 final
 

rpminspect.yaml

@@ -9,13 +9,6 @@ badfuncs:
     ignore:
         - /usr/lib*/python*/lib-dynload/_socket.*
 
-# exclude the debug build from annocheck entirely
-annocheck:
-    ignore:
-        - /usr/bin/python*d
-        - /usr/lib*/libpython*d.so.1.0
-        - /usr/lib*/python*/lib-dynload/*.cpython-*d-*-*-*.so
-
 # don't report changed content of compiled files
 # that is expected with every toolchain update and not reproducible yet
 changedfiles:

tests/tests.yml

@@ -15,39 +15,38 @@
     repositories:
     - repo: "https://src.fedoraproject.org/tests/python.git"
       dest: "python"
-    pybasever: "3.10"
     tests:
     - rpm_qa:
         run: rpm -qa
     - smoke:
         dir: python/smoke
-        run: "VERSION={{ pybasever }} ./venv.sh"
+        run: VERSION=3.10 ./venv.sh
     - smoke_virtualenv:
         dir: python/smoke
-        run: "VERSION={{ pybasever }} METHOD=virtualenv ./venv.sh"
+        run: VERSION=3.10 METHOD=virtualenv ./venv.sh
     - debugsmoke:
         dir: python/smoke
-        run: "PYTHON=python{{ pybasever }}d TOX=false VERSION={{ pybasever }} ./venv.sh"
+        run: PYTHON=python3-debug TOX=false VERSION=3.10 ./venv.sh
     - selftest:
         dir: python/selftest
-        run: "VERSION={{ pybasever }} X='' ./parallel.sh"
+        run: VERSION=3.10 X="" ./parallel.sh
     - debugtest:
         dir: python/selftest
-        run: "VERSION={{ pybasever }} PYTHON=python{{ pybasever }}d X='' ./parallel.sh"
+        run: VERSION=3.10 PYTHON=python3-debug X="" ./parallel.sh
     - debugflags:
         dir: python/flags
-        run: "python{{ pybasever }}d ./assertflags.py -O0"
+        run: python3-debug ./assertflags.py -O0
     - marshalparser:
         dir: python/marshalparser
-        run: "VERSION={{ pybasever }} SAMPLE=10 test_marshalparser_compatibility.sh"
+        run: VERSION=3.10 SAMPLE=10 test_marshalparser_compatibility.sh
     required_packages:
     - gcc  # for extension building in venv and selftest
     - gdb  # for test_gdb
-    - "python{{ pybasever }}"  # the test subject
-    - "python{{ pybasever }}-debug"  # for leak testing
-    - "python{{ pybasever }}-devel"  # for extension building in venv and selftest
-    - "python{{ pybasever }}-tkinter"  # for selftest
-    - "python{{ pybasever }}-test"  # for selftest
+    - python3.10  # the test subject
+    - python3-debug  # for leak testing
+    - python3-devel  # for extension building in venv and selftest
+    - python3-tkinter  # for selftest
+    - python3-test  # for selftest
     - tox  # for venv tests
     - virtualenv  # for virtualenv tests
     - glibc-all-langpacks # for locale tests