diff --git a/bpo36302-sort-module-sources.patch b/bpo36302-sort-module-sources.patch
new file mode 100644
index 0000000..e6a140b
--- /dev/null
+++ b/bpo36302-sort-module-sources.patch
@@ -0,0 +1,13 @@
+diff --git a/Lib/distutils/command/build_ext.py b/Lib/distutils/command/build_ext.py
+index 86a85c1..66bf0c2 100644
+--- a/Lib/distutils/command/build_ext.py
++++ b/Lib/distutils/command/build_ext.py
+@@ -455,7 +455,7 @@ class build_ext (Command):
+                   ("in 'ext_modules' option (extension '%s'), " +
+                    "'sources' must be present and must be " +
+                    "a list of source filenames") % ext.name
+-        sources = list(sources)
++        sources = sorted(sources)
+ 
+         ext_path = self.get_ext_fullpath(ext.name)
+         depends = sources + ext.depends
diff --git a/python-base.changes b/python-base.changes
index abf088e..41a3322 100644
--- a/python-base.changes
+++ b/python-base.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Wed Sep 25 13:25:33 UTC 2019 - Bernhard Wiedemann <bwiedemann@suse.com>
+
+- Add bpo36302-sort-module-sources.patch (boo#1041090)
+
 -------------------------------------------------------------------
 Fri Jul 19 13:28:16 CEST 2019 - Matej Cepl <mcepl@suse.com>
 
diff --git a/python-base.spec b/python-base.spec
index eb86062..6cfdfc4 100644
--- a/python-base.spec
+++ b/python-base.spec
@@ -84,6 +84,8 @@ Patch53:        CVE-2019-9947-no-ctrl-char-http.patch
 # PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
 # http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
 Patch54:        CVE-2018-20852-cookie-domain-check.patch
+# PATCH-FIX-UPSTREAM https://github.com/python/cpython/pull/12341
+Patch55:        bpo36302-sort-module-sources.patch
 # COMMON-PATCH-END
 %define         python_version    %(echo %{tarversion} | head -c 3)
 BuildRequires:  automake
@@ -199,6 +201,7 @@ other applications.
 %patch52 -p1
 %patch53 -p1
 %patch54 -p1
+%patch55 -p1
 
 # drop Autoconf version requirement
 sed -i 's/^version_required/dnl version_required/' configure.ac
diff --git a/python-doc.spec b/python-doc.spec
index f18c2f4..6114f15 100644
--- a/python-doc.spec
+++ b/python-doc.spec
@@ -15,7 +15,6 @@
 # Please submit bugfixes or comments via https://bugs.opensuse.org/
 #
 
-
 Name:           python-doc
 Version:        2.7.16
 Release:        0
@@ -84,6 +83,8 @@ Patch53:        CVE-2019-9947-no-ctrl-char-http.patch
 # PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
 # http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
 Patch54:        CVE-2018-20852-cookie-domain-check.patch
+# PATCH-FIX-UPSTREAM https://github.com/python/cpython/pull/12341
+Patch55:        bpo36302-sort-module-sources.patch
 # COMMON-PATCH-END
 Provides:       pyth_doc
 Provides:       pyth_ps
@@ -145,6 +146,7 @@ Python, and Macintosh Module Reference in PDF format.
 %patch52 -p1
 %patch53 -p1
 %patch54 -p1
+%patch55 -p1
 
 # drop Autoconf version requirement
 sed -i 's/^version_required/dnl version_required/' configure.ac
diff --git a/python.spec b/python.spec
index 47f6d45..f86919b 100644
--- a/python.spec
+++ b/python.spec
@@ -15,7 +15,6 @@
 # Please submit bugfixes or comments via https://bugs.opensuse.org/
 #
 
-
 Name:           python
 Version:        2.7.16
 Release:        0
@@ -89,6 +88,8 @@ Patch53:        CVE-2019-9947-no-ctrl-char-http.patch
 # PATCH-FIX-UPSTREAM CVE-2018-20852-cookie-domain-check.patch bsc#1141853 mcepl@suse.com
 # http.cookiejar.DefaultPolicy.domain_return_ok does not correctly validate the domain
 Patch54:        CVE-2018-20852-cookie-domain-check.patch
+# PATCH-FIX-UPSTREAM https://github.com/python/cpython/pull/12341
+Patch55:        bpo36302-sort-module-sources.patch
 # COMMON-PATCH-END
 BuildRequires:  automake
 BuildRequires:  db-devel
@@ -250,6 +251,7 @@ that rely on earlier non-verification behavior.
 %patch52 -p1
 %patch53 -p1
 %patch54 -p1
+%patch55 -p1
 
 # drop Autoconf version requirement
 sed -i 's/^version_required/dnl version_required/' configure.ac