- Update to 3.9.7:

- Security
    - Replaced usage of tempfile.mktemp() with TemporaryDirectory
      to avoid a potential race condition.
    - Add auditing events to the marshal module, and stop raising
      code.__init__ events for every unmarshalled code object.
      Directly instantiated code objects will continue to raise
      an event, and audit event handlers should inspect or
      collect the raw marshal data. This reduces a significant
      performance overhead when loading from .pyc files.
    - Made the internal putcmd function in smtplib sanitize input
      for presence of \r and \n characters to avoid (unlikely)
      command injection.
  - Core and Builtins
    - Fixed pickling of range iterators that iterated for over
      2**32 times.
    - Fix a race in WeakKeyDictionary, WeakValueDictionary and
      WeakSet when two threads attempt to commit the last pending
      removal. This fixes asyncio.create_task and fixes a data
      loss in asyncio.run where shutdown_asyncgens is not run
    - Fixed a corner case bug where the result of
      float.fromhex('0x.8p-1074') was rounded the wrong way.
    - Refine the syntax error for trailing commas in import
      statements. Patch by Pablo Galindo.
    - Restore behaviour of complex exponentiation with
      integer-valued exponent of type float or complex.
    - Correct the ast locations of f-strings with format specs
      and repeated expressions. Patch by Pablo Galindo
    - Use new trashcan macros (Py_TRASHCAN_BEGIN/END) in
      frameobject.c instead of the old ones

OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python39?expand=0&rev=83

Python-3.9.6.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:397920af33efc5b97f2e0b57e91923512ef89fc5b3c1d21dbfc8c4828ce0108a
-size 19051972

Python-3.9.6.tar.xz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEE4/8oOcBIslwITevpsmmV4xAlBWgFAmDZkQMACgkQsmmV4xAl
-BWj09RAAoAJZTivNUSuw9H4UBr5Y7O/y09t2SoSDnyQTv8OWXhFh6uSQQvUah8oh
-BtyfIHHJrPK+h6oX5mNmFcuv0GVKpmn5yuIYExeMBvG78mqSybYuQuHqWISEK5Vt
-NUt0ZBbOzQyqidO2Q++kRf+zfrc5BK5SZ/iCaT8fTcxISs/GuKmG2R/SoRzjYDNa
-XSqJi0/3jH/hSS/XIhKzDRzlkSemOCBuGeBi8rLCEtLE1faeeMYBB/StLzs8lkpb
-VIZ26jMN5BDtT2Srm2tJk3Yze3I4jSvhkDLVS3gWd5IKH0jrFFoGwswXuc8V6aLP
-tt87artPasOhLvEBy7y/1c3MZw+WOsZS5ogKrfI2QSMbuXT4HMOyFnrb7zz3nsKy
-wtwRP0I03P1KbI0RrM4LQj1r05RSvMSSJsbslIThL274Fh44/xanNgIM1xyf1Ios
-GiKkfo9xkkwB2/et2WJd9M4MfWcLiGvkRoFGxyon5uoNDrIaZaQF8JWZeXctIyDP
-MbdoLQod7PevKnr+XNxZNN1JVQ1uatghuTtXQcZ34WWkSGxb1zf+uh2ghayEKSeC
-nOhk2/j3CDHh5j+9oYqmDi1yvQGLucVIhu7cc2mFk6nljROzOu5Ga7M1+XSv7RNe
-cB0N1XRmpD075HEPHDmV7HSQc9A3B6fdDa5bHgyDBML7flIj5Vs=
-=j4X2
------END PGP SIGNATURE-----

Python-3.9.7.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f8145616e68c00041d1a6399b76387390388f8359581abc24432bb969b5e3c57
+size 19123232

Python-3.9.7.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEE4/8oOcBIslwITevpsmmV4xAlBWgFAmEtNmkACgkQsmmV4xAl
+BWgFxA/+PbfnJKXOLH5s4cUARd5K1WAB7BvPKb5C3dxILvn7tp6nPFrMknhjGj5h
+cAe/2uaAm6IsMXLm0hJLE1fZy1ht5M6U7e7gxSNWIjX/qKQYVKBlP7w9BK1BALE/
+YGyv3jDH7tgECkELGE0bePtuTLVr7HzdTmyKeI6BHHIklOeJBmYl/4JuUi2UxZKD
+76dq0a7XTuk6ce5BUvsWsOoZ80+lms5mfVq5mNkiERdxPYvGrrxkqQz89xHU08qw
+ISIBF8hX62zmRzzmuTQCPRGYsd00jPYrZ5d2aKMI36wTA/O2ICVSrzeQB6ixYOfP
+ex2DbYRfMMghQ942Q9wM53TYhieibVMxEJD8MPlxleDe7O5jbe+djuwgKE9mnfCI
+MZrOOuXOk4pY0l6CwgIyCWCuDNQYTip9HYqP4AMjwM1Rt1UjMsvjIds1bWgL3pEc
+EV3r1f2RpuAL7kKpjzrw5qFgg87z4IVKp21Ikg2T5rvKZrSmMFyz/tr8Kuw7W0LP
+KYKDKrh+J0haTpZyIOxYL+WQZ3GaXqQQaIyLI1rx2Qt9jbIt7/ieguKOx44hTLuc
+sUE5I+q5Nv/nI4BsJiKiK/Oa7nDJX1xNNaaX/7p/MjAP5waGWowZutQtpSTMSm6U
+ymmtmVg8xrt3zrEHJl4HQWhBvf0if1dsWvbtcP+iOdyFOw2Bn/c=
+=+3CX
+-----END PGP SIGNATURE-----

decimal.patch

@@ -1,7 +1,11 @@
-diff -ur a/Modules/_decimal/_decimal.c b/Modules/_decimal/_decimal.c
+---
---- a/Modules/_decimal/_decimal.c	2021-02-19 13:31:44.000000000 +0100
+ Modules/_decimal/_decimal.c |    4 ++--
-+++ b/Modules/_decimal/_decimal.c	2021-02-21 10:25:28.240876775 +0100
+ setup.py                    |    2 +-
-@@ -3280,7 +3280,7 @@
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/Modules/_decimal/_decimal.c
++++ b/Modules/_decimal/_decimal.c
+@@ -3279,7 +3279,7 @@ dec_format(PyObject *dec, PyObject *args
      }
      else {
          size_t n = strlen(spec.dot);
@@ -10,7 +14,7 @@ diff -ur a/Modules/_decimal/_decimal.c b/Modules/_decimal/_decimal.c
              /* fix locale dependent non-ascii characters */
              dot = dotsep_as_utf8(spec.dot);
              if (dot == NULL) {
-@@ -3289,7 +3289,7 @@
+@@ -3288,7 +3288,7 @@ dec_format(PyObject *dec, PyObject *args
              spec.dot = PyBytes_AS_STRING(dot);
          }
          n = strlen(spec.sep);
@@ -19,10 +23,9 @@ diff -ur a/Modules/_decimal/_decimal.c b/Modules/_decimal/_decimal.c
              /* fix locale dependent non-ascii characters */
              sep = dotsep_as_utf8(spec.sep);
              if (sep == NULL) {
-diff -ur a/setup.py b/setup.py
+--- a/setup.py
---- a/setup.py	2021-02-19 13:31:44.000000000 +0100
++++ b/setup.py
-+++ b/setup.py	2021-02-21 10:25:28.240876775 +0100
+@@ -2201,7 +2201,7 @@ class PyBuildExt(build_ext):
-@@ -2196,7 +2196,7 @@
          undef_macros = []
          if '--with-system-libmpdec' in sysconfig.get_config_var("CONFIG_ARGS"):
              include_dirs = []

python39.changes

@@ -1,3 +1,225 @@
+-------------------------------------------------------------------
+Tue Aug 31 10:17:28 UTC 2021 - Matej Cepl <mcepl@suse.com>
+
+- Update to 3.9.7:
+  - Security
+    - Replaced usage of tempfile.mktemp() with TemporaryDirectory
+      to avoid a potential race condition.
+    - Add auditing events to the marshal module, and stop raising
+      code.__init__ events for every unmarshalled code object.
+      Directly instantiated code objects will continue to raise
+      an event, and audit event handlers should inspect or
+      collect the raw marshal data. This reduces a significant
+      performance overhead when loading from .pyc files.
+    - Made the internal putcmd function in smtplib sanitize input
+      for presence of \r and \n characters to avoid (unlikely)
+      command injection.
+  - Core and Builtins
+    - Fixed pickling of range iterators that iterated for over
+      2**32 times.
+    - Fix a race in WeakKeyDictionary, WeakValueDictionary and
+      WeakSet when two threads attempt to commit the last pending
+      removal. This fixes asyncio.create_task and fixes a data
+      loss in asyncio.run where shutdown_asyncgens is not run
+    - Fixed a corner case bug where the result of
+      float.fromhex('0x.8p-1074') was rounded the wrong way.
+    - Refine the syntax error for trailing commas in import
+      statements. Patch by Pablo Galindo.
+    - Restore behaviour of complex exponentiation with
+      integer-valued exponent of type float or complex.
+    - Correct the ast locations of f-strings with format specs
+      and repeated expressions. Patch by Pablo Galindo
+    - Use new trashcan macros (Py_TRASHCAN_BEGIN/END) in
+      frameobject.c instead of the old ones
+      (Py_TRASHCAN_SAFE_BEGIN/END).
+    - Fix segmentation fault with deep recursion when cleaning
+      method objects. Patch by Augusto Goulart and Pablo Galindo.
+    - Fix bug where PyErr_SetObject hangs when the current
+      exception has a cycle in its context chain.
+    - Fix reference leaks in the error paths of update_bases()
+      and __build_class__. Patch by Pablo Galindo.
+    - Fix undefined behaviour in complex object exponentiation.
+    - Remove uses of PyObject_GC_Del() in error path when
+      initializing types.GenericAlias.
+    - Remove the pass-through for hash() of weakref.proxy objects
+      to prevent unintended consequences when the original
+      referred object dies while the proxy is part of a hashable
+      object. Patch by Pablo Galindo.
+    - Fix ltrace functionality when exceptions are raised. Patch
+      by Pablo Galindo
+    - Fix a crash at Python exit when a deallocator function
+      removes the last strong reference to a heap type. Patch by
+      Victor Stinner.
+    - Fix crash when using passing a non-exception to
+      a generator’s throw() method. Patch by Noah Oxer
+  - Library
+    - run() now always return a TestResult instance. Previously
+      it returned None if the test class or method was decorated
+      with a skipping decorator.
+    - Fix bugs in cleaning up classes and modules in unittest:
+        - Functions registered with addModuleCleanup() were not
+          called unless the user defines tearDownModule() in
+          their test module.
+        - Functions registered with addClassCleanup() were not
+          called if tearDownClass is set to None.
+        - Buffering in TestResult did not work with functions
+          registered with addClassCleanup() and
+          addModuleCleanup().
+        - Errors in functions registered with addClassCleanup()
+          and addModuleCleanup() were not handled correctly in
+          buffered and debug modes.
+        - Errors in setUpModule() and functions registered with
+          addModuleCleanup() were reported in wrong order.
+        - And several lesser bugs.
+    - Made email date parsing more robust against malformed
+      input, namely a whitespace-only Date: header. Patch by
+      Wouter Bolsterlee.
+    - Fix a crash in the signal handler of the faulthandler
+      module: no longer modify the reference count of frame
+      objects. Patch by Victor Stinner.
+    - Method stopTestRun() is now always called in pair with
+      method startTestRun() for TestResult objects implicitly
+      created in run(). Previously it was not called for test
+      methods and classes decorated with a skipping decorator.
+    - argparse.BooleanOptionalAction’s default value is no longer
+      printed twice when used with
+      argparse.ArgumentDefaultsHelpFormatter.
+    - Upgrade bundled pip to 21.2.3 and setuptools to 57.4.0
+    - Fix the os.set_inheritable() function on FreeBSD 14 for
+      file descriptor opened with the O_PATH flag: ignore the
+      EBADF error on ioctl(), fallback on the fcntl()
+      implementation. Patch by Victor Stinner.
+    - The @functools.total_ordering() decorator now works with
+      metaclasses.
+    - sqlite3 user-defined functions and aggregators returning
+      strings with embedded NUL characters are no longer
+      truncated. Patch by Erlend E. Aasland.
+    - Always show loop= arg deprecations in asyncio.gather() and
+      asyncio.sleep()
+    - Non-protocol subclasses of typing.Protocol ignore now the
+      __init__ method inherited from protocol base classes.
+    - The tokenize.tokenize() doesn’t incorrectly generate
+      a NEWLINE token if the source doesn’t end with a new line
+      character but the last line is a comment, as the function
+      is already generating a NL token. Patch by Pablo Galindo
+    - Fix http.client.HTTPSConnection fails to download >2GiB
+      data.
+    - rcompleter does not call getattr() on property objects to
+      avoid the side-effect of evaluating the corresponding
+      method.
+    - weakref.proxy objects referencing non-iterators now raise
+      TypeError rather than dereferencing the null tp_iternext
+      slot and crashing.
+    - The implementation of collections.abc.Set._hash() now
+      matches that of frozenset.__hash__().
+    - Fixed issue in compileall.compile_file() when sys.stdout is
+      redirected. Patch by Stefan Hölzl.
+    - Give priority to using the current class constructor in
+      inspect.signature(). Patch by Weipeng Hong.
+    - Fix memory leak in _tkinter._flatten() if it is called with
+      a sequence or set, but not list or tuple.
+    - Update shutil.copyfile() to raise FileNotFoundError instead
+      of confusing IsADirectoryError when a path ending with
+      a os.path.sep does not exist; shutil.copy() and
+      shutil.copy2() are also affected.
+    - handle StopIteration subclass raised from
+      @contextlib.contextmanager generator
+    - Make the implementation consistency of indexOf() between
+      C and Python versions. Patch by Dong-hee Na.
+    - Fixes TypedDict to work with typing.get_type_hints() and
+      postponed evaluation of annotations across modules.
+    - Fix bug with pdb’s handling of import error due to
+      a package which does not have a __main__ module
+    - Fixed an exception thrown while parsing a malformed
+      multipart email by email.message.EmailMessage.
+    - pathlib.PureWindowsPath.is_reserved() now identifies
+      a greater range of reserved filenames, including those with
+      trailing spaces or colons.
+    - Handle exceptions from parsing the arg of pdb’s run/restart
+      command.
+    - The sqlite3 context manager now performs a rollback (thus
+      releasing the database lock) if commit failed. Patch by
+      Luca Citi and Erlend E. Aasland.
+    - Improved string handling for sqlite3 user-defined functions
+      and aggregates:
+        - It is now possible to pass strings with embedded null
+          characters to UDFs
+        - Conversion failures now correctly raise MemoryError
+    - Patch by Erlend E. Aasland.
+    - Handle RecursionError in TracebackException’s constructor,
+      so that long exceptions chains are truncated instead of
+      causing traceback formatting to fail.
+    - Fix email.message.EmailMessage.set_content() when called
+      with binary data and 7bit content transfer encoding.
+    - The compresslevel and preset keyword arguments of
+      tarfile.open() are now both documented and tested.
+    - Fixed a Y2k38 bug in the compileall module where it would
+      fail to compile files with a modification time after the
+      year 2038.
+    - Fix test___all__ on platforms lacking a shared memory
+      implementation.
+    - Pass multiprocessing BaseProxy argument manager_owned
+      through AutoProxy.
+    - email.utils.getaddresses() now accepts email.header.Header
+      objects along with string values. Patch by Zackery Spytz.
+    - lib2to3 now recognizes async generators everywhere.
+    - Fix TypeError when required subparsers without dest do not
+      receive arguments. Patch by Anthony Sottile.
+  - Documentation
+    - Removed the othergui.rst file, any references to it, and
+      the list of GUI frameworks in the FAQ. In their place I’ve
+      added links to the Python Wiki page on GUI frameworks.
+    - Update the definition of __future__ in the glossary by
+      replacing the confusing word “pseudo-module” with a more
+      accurate description.
+    - Add typical examples to os.path.splitext docs
+    - Clarify that shutil.make_archive() is not thread-safe due
+      to reliance on changing the current working directory.
+    - Update of three expired hyperlinks in
+      Doc/distributing/index.rst: “Project structure”, “Building
+      and packaging the project”, and “Uploading the project to
+      the Python Packaging Index”.
+    - Updated the docstring and docs of filecmp.cmp() to be more
+      accurate and less confusing especially in respect to
+      shallow arg.
+    - Match the docstring and python implementation of countOf()
+      to the behavior of its c implementation.
+    - List all kwargs for textwrap.wrap(), textwrap.fill(), and
+      textwrap.shorten(). Now, there are nav links to attributes
+      of TextWrap, which makes navigation much easier while
+      minimizing duplication in the documentation.
+    - Clarify that atexit uses equality comparisons internally.
+    - Documentation of csv.Dialect is more descriptive.
+    - Fix documentation for the return type of
+      sysconfig.get_path().
+    - Add a “Security Considerations” index which links to
+      standard library modules that have explicitly documented
+      security considerations.
+    - Remove the unqualified claim that tkinter is threadsafe. It
+      has not been true for several years and likely never was.
+      An explanation of what is true may be added later, after
+      more discussion, and possibly after patching _tkinter.c,
+  - Tests
+    - Add calls of gc.collect() in tests to support PyPy.
+    - Made tests relying on the _asyncio C extension module
+      optional to allow running on alternative Python
+      implementations. Patch by Serhiy Storchaka.
+    - Fix auto history tests of test_readline: sometimes, the
+      newline character is not written at the end, so don’t
+      expect it in the output.
+    - Add ability to wholesale silence DeprecationWarnings while
+      running the regression test suite.
+    - Notify users running test_decimal regression tests on macOS
+      of potential harmless “malloc can’t allocate region”
+      messages spewed by test_decimal.
+    - Fixed floating point precision issue in turtle tests.
+    - Regression tests, when run with -w, are now re-running only
+      the affected test methods instead of re-running the entire
+      test file.
+    - Add test for nested queues when using multiprocessing
+      shared objects AutoProxy[Queue] inside ListProxy and
+      DictProxy
+
 -------------------------------------------------------------------
 Fri Aug 27 12:00:12 UTC 2021 - Matej Cepl <mcepl@suse.com>
 

python39.spec

@@ -53,7 +53,7 @@
 # Will do the /usr/bin/python3 and all the core links
 %define         primary_interpreter 0
 # We don't process beta signs well
-%define         folderversion 3.9.6
+%define         folderversion 3.9.7
 %define         tarname    Python-%{tarversion}
 %define         sitedir         %{_libdir}/python%{python_version}
 # three possible ABI kinds: m - pymalloc, d - debug build; see PEP 3149
@@ -89,7 +89,7 @@
 %define dynlib() %{sitedir}/lib-dynload/%{1}.cpython-%{abi_tag}-%{archname}-%{_os}%{?_gnu}%{?armsuffix}.so
 %bcond_without profileopt
 Name:           %{python_pkg_name}%{psuffix}
-Version:        3.9.6
+Version:        3.9.7
 Release:        0
 Summary:        Python 3 Interpreter
 License:        Python-2.0
@@ -111,7 +111,8 @@ Source20:       idle3.appdata.xml
 # 3. mkdir Vendor && mv usr/include/* Vendor/
 # 4. tar cJf bluez-devel-vendor.tar.xz Vendor/
 Source21:       bluez-devel-vendor.tar.xz
-Source99:       https://www.python.org/static/files/pubkeys.txt#/python.keyring
+# https://keybase.io/ambv/pgp_keys.asc?fingerprint=e3ff2839c048b25c084debe9b26995e310250568
+Source99:       python.keyring
 # The following files are not used in the build.
 # They are listed here to work around missing functionality in rpmbuild,
 # which would otherwise exclude them from distributed src.rpm files.