- Update to 3.8.6, which contains various bug fixes including security

fix of included pip and setuptools (bpo#41490, bsc#1176262,
  CVE-2019-20916). Full list of changes is available at
  https://docs.python.org/release/3.8.6/whatsnew/changelog.html#python-3-8-6
- Revert previous patch, and readd bpo-31046_ensurepip_honours_prefix.patch.

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python38?expand=0&rev=36

Python-3.8.5.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:e3003ed57db17e617acb382b0cade29a248c6026b1bd8aad1f976e9af66a83b0
-size 18019640

Python-3.8.5.tar.xz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEE4/8oOcBIslwITevpsmmV4xAlBWgFAl8VnlAACgkQsmmV4xAl
-BWj2+Q/9FxlF7DPcVP3+9eHsW//aXpXNm/3hFZNlvpDX5Y0qsT4mOCFlqzBVVufY
-nXp+pz4l5HJGcvMfgW13aDVvl5HHK0WHEl7gI19wuE+1Ot3LO2Cq4sgNW3SzvmdF
-Dif3Ovvz1mE/S5LYXfLrsmOpU9oNe1oOiHX7l8WTBArMzCckc+e6TxRlLZw0NTr4
-8mgWu9+OTw8ltOSDyGZLrzXHoRssfSSLjjwxeDm2fLYo4YWj11Q6qIFp7dUEK23d
-Yv7o980fiw8VaxFFV3a/UH2EXVS+AL8Gxb7NpxS4ejtfPmLKnb0CHSjvnT45KqFi
-MfkV41ng4chW4CC14rugfd2QvC9a+EIKm3Hd1qt3iFIv1pn38w8wT5Nf7tMN9lhZ
-90eVh8nJAUHlAs+4Zz/crHwfxQ82pnf6TpIqJEJzaxQ3ncS0creG0jKwnWhLLheJ
-TVhqAxIENVbync7mfjHD2sNknC/YqiuUGSef13Wc3d15V26HqeUULiNupsZ9n6wr
-G1Llh+Wxld0kW7ht+1Gt1R1I9CsTYMWX3CvWCZVibh0ClT4r63n09kJGul4WdYp1
-IdjrEPgm0GMSRFuR1MN0qSCBkpGyYgikHJYw8fwykqi+MSp1Ibh/eO1DhuInyrbx
-Rb1FicRsRi7E9Tak9yXjKzAr67dPLcPwnblTkdRINFglAP3IiGo=
-=ussS
------END PGP SIGNATURE-----

Python-3.8.6.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a9e0b79d27aa056eb9cce8d63a427b5f9bab1465dee3f942dcfdb25a82f4ab8a
+size 18233864

Python-3.8.6.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEE4/8oOcBIslwITevpsmmV4xAlBWgFAl9rVG4ACgkQsmmV4xAl
+BWjO7Q//c53m2UmRypzJxgxF1EizNzmPGmc1w87X9oaDJNsMhNBwgHCbMkwDdyO3
+mh+MjfkvLhIS1tXj4X+FYl+XURB1FGO1qhtXlpPTHVw+z5l5RmZwyAJIm3TgjPL5
+p/3jG9p/LqB3sADhds2lhbc4cEtXOhrm789FqjEz6r1hAYieo/frx4RbrmIF+OER
+rmRp6Z7MdMwYDxaIvR5yZicbUFoMl8wvN0WAjLpXb7BAHb+l0zjc00803rmi9xaR
+u0tIjz3jn25Mw81gpgjfnnqOSncap1F6OHhw2AzUN5GzgoG3/cPA96VjqJuAXpSC
+RjhHdV7DMvVh806Ck6BX98Ed3wLGbAVAIXKsdZSSZ67s1CTXfyp+wf5NeIKU70wA
+1NCxPosQsrzGr6TpUts9MXed45dg9EPPuf7MjTeyKx8m7JaOsQOo8rkI8B5Sw+bf
+QIilcSHJnWOKjMQUsCqFI96ZF/zwfyFMKZ6zd+9bIH7iIqXgQ2wiWgR17AGH9uBW
+CVPIw5ucnt+1VR5+eZqYU+mLjqgJILkOkNlvpJBywtNOivUcBZVt8LHpt6tD60bI
+EbOBVrQveY8mmiQsXEDCza7PnRDk83iqHS2BPOCLFAeNdN6JAGfVdr0WA5ZM9EmT
+kbLICbAABfJSFXoPeEqnCLIFP4omsT7R7rTv29K8/lPGbc2VTaA=
+=/x9a
+-----END PGP SIGNATURE-----

bpo-31046_ensurepip_honours_prefix.patch

@@ -0,0 +1,163 @@
+From 5754521af1d51aa8e445cba07a093bbc0c88596d Mon Sep 17 00:00:00 2001
+From: Zackery Spytz <zspytz@gmail.com>
+Date: Mon, 16 Dec 2019 18:24:08 -0700
+Subject: [PATCH] bpo-31046: ensurepip does not honour the value of $(prefix)
+
+Co-Authored-By: Xavier de Gaye <xdegaye@gmail.com>
+---
+ Doc/library/ensurepip.rst                      |  9 +++++++--
+ Lib/ensurepip/__init__.py                      | 18 +++++++++++++-----
+ Lib/test/test_ensurepip.py                     | 11 +++++++++++
+ Makefile.pre.in                                |  4 ++--
+ .../2019-12-16-17-50-42.bpo-31046.XA-Qfr.rst   |  1 +
+ 5 files changed, 34 insertions(+), 9 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Build/2019-12-16-17-50-42.bpo-31046.XA-Qfr.rst
+
+--- a/Doc/library/ensurepip.rst
++++ b/Doc/library/ensurepip.rst
+@@ -56,8 +56,9 @@ is at least as recent as the one bundled
+ By default, ``pip`` is installed into the current virtual environment
+ (if one is active) or into the system site packages (if there is no
+ active virtual environment). The installation location can be controlled
+-through two additional command line options:
++through some additional command line options:
+ 
++* ``--prefix <dir>``: Installs ``pip`` using the given directory prefix.
+ * ``--root <dir>``: Installs ``pip`` relative to the given root directory
+   rather than the root of the currently active virtual environment (if any)
+   or the default root for the current Python installation.
+@@ -89,7 +90,7 @@ Module API
+    Returns a string specifying the bundled version of pip that will be
+    installed when bootstrapping an environment.
+ 
+-.. function:: bootstrap(root=None, upgrade=False, user=False, \
++.. function:: bootstrap(root=None, prefix=None, upgrade=False, user=False, \
+                         altinstall=False, default_pip=False, \
+                         verbosity=0)
+ 
+@@ -99,6 +100,8 @@ Module API
+    If *root* is ``None``, then installation uses the default install location
+    for the current environment.
+ 
++   *prefix* specifies the directory prefix to use when installing.
++
+    *upgrade* indicates whether or not to upgrade an existing installation
+    of an earlier version of ``pip`` to the bundled version.
+ 
+@@ -119,6 +122,8 @@ Module API
+    *verbosity* controls the level of output to :data:`sys.stdout` from the
+    bootstrapping operation.
+ 
++   .. versionchanged:: 3.9 the *prefix* parameter was added.
++
+    .. audit-event:: ensurepip.bootstrap root ensurepip.bootstrap
+ 
+    .. note::
+--- a/Lib/ensurepip/__init__.py
++++ b/Lib/ensurepip/__init__.py
+@@ -56,27 +56,27 @@ def _disable_pip_configuration_settings(
+     os.environ['PIP_CONFIG_FILE'] = os.devnull
+ 
+ 
+-def bootstrap(*, root=None, upgrade=False, user=False,
++def bootstrap(*, root=None, prefix=None, upgrade=False, user=False,
+               altinstall=False, default_pip=False,
+               verbosity=0):
+     """
+     Bootstrap pip into the current Python installation (or the given root
+-    directory).
++    and directory prefix).
+ 
+     Note that calling this function will alter both sys.path and os.environ.
+     """
+     # Discard the return value
+-    _bootstrap(root=root, upgrade=upgrade, user=user,
++    _bootstrap(root=root, prefix=prefix, upgrade=upgrade, user=user,
+                altinstall=altinstall, default_pip=default_pip,
+                verbosity=verbosity)
+ 
+ 
+-def _bootstrap(*, root=None, upgrade=False, user=False,
++def _bootstrap(*, root=None, prefix=None, upgrade=False, user=False,
+               altinstall=False, default_pip=False,
+               verbosity=0):
+     """
+     Bootstrap pip into the current Python installation (or the given root
+-    directory). Returns pip command status code.
++    and directory prefix). Returns pip command status code.
+ 
+     Note that calling this function will alter both sys.path and os.environ.
+     """
+@@ -119,6 +119,8 @@ def _bootstrap(*, root=None, upgrade=Fal
+         args = ["install", "--no-cache-dir", "--no-index", "--find-links", tmpdir]
+         if root:
+             args += ["--root", root]
++        if prefix:
++            args += ["--prefix", prefix]
+         if upgrade:
+             args += ["--upgrade"]
+         if user:
+@@ -191,6 +193,11 @@ def _main(argv=None):
+         help="Install everything relative to this alternate root directory.",
+     )
+     parser.add_argument(
++        "--prefix",
++        default=None,
++        help="Install everything using this prefix.",
++    )
++    parser.add_argument(
+         "--altinstall",
+         action="store_true",
+         default=False,
+@@ -209,6 +216,7 @@ def _main(argv=None):
+ 
+     return _bootstrap(
+         root=args.root,
++        prefix=args.prefix,
+         upgrade=args.upgrade,
+         user=args.user,
+         verbosity=args.verbosity,
+--- a/Lib/test/test_ensurepip.py
++++ b/Lib/test/test_ensurepip.py
+@@ -61,6 +61,17 @@ class TestBootstrap(EnsurepipMixin, unit
+             unittest.mock.ANY,
+         )
+ 
++    def test_bootstrapping_with_prefix(self):
++        ensurepip.bootstrap(prefix="/foo/bar/")
++        self.run_pip.assert_called_once_with(
++            [
++                "install", "--no-cache-dir", "--no-index", "--find-links",
++                unittest.mock.ANY, "--prefix", "/foo/bar/",
++                "setuptools", "pip",
++            ],
++            unittest.mock.ANY,
++        )
++
+     def test_bootstrapping_with_user(self):
+         ensurepip.bootstrap(user=True)
+ 
+--- a/Makefile.pre.in
++++ b/Makefile.pre.in
+@@ -1188,7 +1188,7 @@ install: @FRAMEWORKINSTALLFIRST@ commoni
+ 			install|*) ensurepip="" ;; \
+ 		esac; \
+ 		$(RUNSHARED) $(PYTHON_FOR_BUILD) -m ensurepip \
+-			$$ensurepip --root=$(DESTDIR)/ ; \
++			$$ensurepip --root=$(DESTDIR)/ --prefix=$(prefix) ; \
+ 	fi
+ 
+ altinstall: commoninstall
+@@ -1198,7 +1198,7 @@ altinstall: commoninstall
+ 			install|*) ensurepip="--altinstall" ;; \
+ 		esac; \
+ 		$(RUNSHARED) $(PYTHON_FOR_BUILD) -m ensurepip \
+-			$$ensurepip --root=$(DESTDIR)/ ; \
++			$$ensurepip --root=$(DESTDIR)/ --prefix=$(prefix) ; \
+ 	fi
+ 
+ commoninstall:  check-clean-src @FRAMEWORKALTINSTALLFIRST@ \
+--- /dev/null
++++ b/Misc/NEWS.d/next/Build/2019-12-16-17-50-42.bpo-31046.XA-Qfr.rst
+@@ -0,0 +1 @@
++A directory prefix can now be specified when using :mod:`ensurepip`.

python38.changes

@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Mon Nov  9 10:51:30 UTC 2020 - Matej Cepl <mcepl@suse.com>
+
+- Update to 3.8.6, which contains various bug fixes including security
+  fix of included pip and setuptools (bpo#41490, bsc#1176262,
+  CVE-2019-20916). Full list of changes is available at
+  https://docs.python.org/release/3.8.6/whatsnew/changelog.html#python-3-8-6
+- Revert previous patch, and readd bpo-31046_ensurepip_honours_prefix.patch.
+
 -------------------------------------------------------------------
 Fri Oct 30 17:49:32 CET 2020 - Matej Cepl <mcepl@suse.com>
 

python38.spec

@@ -87,7 +87,7 @@
 %bcond_without profileopt
 %endif
 Name:           %{python_pkg_name}%{psuffix}
-Version:        3.8.5
+Version:        3.8.6
 Release:        0
 Summary:        Python 3 Interpreter
 License:        Python-2.0
@@ -146,6 +146,9 @@ Patch27:        CVE-2019-5010-null-defer-x509-cert-DOS.patch
 # PATCH-FIX-UPSTREAM bpo36302-sort-module-sources.patch bsc#1041090 bwiedemann@suse.com
 # Sort list of sources to have stable order in the compiled .so library.
 Patch28:        bpo36302-sort-module-sources.patch
+# PATCH-FEATURE-UPSTREAM bpo-31046_ensurepip_honours_prefix.patch bpo#31046 mcepl@suse.com
+# ensurepip should honour the value of $(prefix)
+Patch29:        bpo-31046_ensurepip_honours_prefix.patch
 # PATCH-FIX-UPSTREAM bsc1167501-invalid-alignment.patch gh#python/cpython#19133 mcepl@suse.com
 # Fix wrong misalignment of pointer to vectorcallfunc
 Patch31:        bsc1167501-invalid-alignment.patch
@@ -285,6 +288,7 @@ Summary:        Python 3 Interpreter and Stdlib Core
 Requires:       libpython%{so_version} = %{version}
 Requires:       python-rpm-macros
 Recommends:     %{python_pkg_name} = %{version}
+#Recommends:     python3-ensurepip
 # python 3.1 didn't have a separate python-base, so it is wrongly
 # not a conflict to have python3-3.1 and python3-base > 3.1
 Obsoletes:      python3 < 3.2
@@ -408,6 +412,7 @@ other applications.
 %patch25 -p1
 %patch27 -p1
 %patch28 -p1
+%patch29 -p1
 %patch31 -p1
 
 # drop Autoconf version requirement
@@ -644,17 +649,6 @@ rm -fv %{buildroot}%{dynlib nis}
 # overwrite the copied binary with a link
 ln -sf python%{python_version} %{buildroot}%{_bindir}/python3
 
-# remove ensurepip (bsc#1176262)
-rm -rf %{buildroot}/%{sitedir}/ensurepip*
-cat > %{buildroot}/%{sitedir}/ensurepip.py <<EOF
-#!/usr/bin/python3
-import sys
-
-print("Install the package python3-pip and run pip directly.",
-      file=sys.stderr)
-sys.exit(255)
-EOF
-
 # decide to ship python3 or just python3.X
 %if !%{primary_interpreter}
 # base
@@ -946,6 +940,7 @@ echo %{sitedir}/_import_failed > %{buildroot}/%{sitedir}/site-packages/zzzz-impo
 %{sitedir}/distutils
 %{sitedir}/email
 %{sitedir}/encodings
+%{sitedir}/ensurepip
 %{sitedir}/html
 %{sitedir}/http
 %{sitedir}/importlib