- Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now

validates archives to ensure member offsets are non-negative (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249). OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python311?expand=0&rev=191
2025-08-01 20:18:10 +00:00
commit 0c195902dd
50 changed files with 10244 additions and 0 deletions
@@ -0,0 +1,4 @@
+<multibuild>
+  <package>base</package>
+  <package>doc</package>
+</multibuild>
@@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text
@@ -0,0 +1 @@
+.osc
@@ -0,0 +1,233 @@
+---
+ Lib/test/support/__init__.py |   16 ++++++++++++++--
+ Lib/test/test_minidom.py     |   23 +++++++++--------------
+ Lib/test/test_pyexpat.py     |   12 +++++-------
+ Lib/test/test_sax.py         |   18 +++++++++---------
+ Lib/test/test_xml_etree.py   |   12 ------------
+ 5 files changed, 37 insertions(+), 44 deletions(-)
+
+Index: Python-3.11.12/Lib/test/support/__init__.py
+===================================================================
+--- Python-3.11.12.orig/Lib/test/support/__init__.py	2025-04-11 10:52:43.191010503 +0200
+++ Python-3.11.12/Lib/test/support/__init__.py	2025-04-11 10:52:44.802161741 +0200
+@@ -8,6 +8,7 @@
+ import functools
+ import os
+ import re
+import pyexpat
+ import stat
+ import sys
+ import sysconfig
+@@ -56,7 +57,7 @@
+     "run_with_tz", "PGO", "missing_compiler_executable",
+     "ALWAYS_EQ", "NEVER_EQ", "LARGEST", "SMALLEST",
+     "LOOPBACK_TIMEOUT", "INTERNET_TIMEOUT", "SHORT_TIMEOUT", "LONG_TIMEOUT",
+-    "skip_on_s390x",
+    "skip_on_s390x", "fails_with_expat_2_6_0", "is_expat_2_6_0"
+     ]
+ 
+ 
+@@ -2244,6 +2245,17 @@
+         }
+     return ignored
+ 
+-#Windows doesn't have os.uname() but it doesn't support s390x.
+
+# Windows doesn't have os.uname() but it doesn't support s390x.
+ skip_on_s390x = unittest.skipIf(hasattr(os, 'uname') and os.uname().machine == 's390x',
+                                 'skipped on s390x')
+
+
+@functools.lru_cache
+def _is_expat_2_6_0():
+    return hasattr(pyexpat.ParserCreate(), 'SetReparseDeferralEnabled')
+is_expat_2_6_0 = _is_expat_2_6_0()
+
+fails_with_expat_2_6_0 = (unittest.expectedFailure
+                          if is_expat_2_6_0
+                          else lambda test: test)
+Index: Python-3.11.12/Lib/test/test_minidom.py
+===================================================================
+--- Python-3.11.12.orig/Lib/test/test_minidom.py	2025-04-11 10:52:21.907086938 +0200
+++ Python-3.11.12/Lib/test/test_minidom.py	2025-04-11 10:52:44.802522893 +0200
+@@ -6,7 +6,6 @@
+ from test import support
+ import unittest
+ 
+-import pyexpat
+ import xml.dom.minidom
+ 
+ from xml.dom.minidom import parse, Attr, Node, Document, parseString
+@@ -1163,13 +1162,11 @@
+ 
+         # Verify that character decoding errors raise exceptions instead
+         # of crashing
+-        if pyexpat.version_info >= (2, 4, 5):
+-            self.assertRaises(ExpatError, parseString,
+-                    b'<fran\xe7ais></fran\xe7ais>')
+-            self.assertRaises(ExpatError, parseString,
+-                    b'<franais>Comment \xe7a va ? Tr\xe8s bien ?</franais>')
+-        else:
+-            self.assertRaises(UnicodeDecodeError, parseString,
+        # It doesn’t make any sense to insist on the exact text of the
+        # error message, or even the exact Exception … it is enough that
+        # the error has been discovered.
+        with self.assertRaises((UnicodeDecodeError, ExpatError)):
+            parseString(
+                 b'<fran\xe7ais>Comment \xe7a va ? Tr\xe8s bien ?</fran\xe7ais>')
+ 
+         doc.unlink()
+@@ -1631,12 +1628,10 @@
+         self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE)
+ 
+     def testExceptionOnSpacesInXMLNSValue(self):
+-        if pyexpat.version_info >= (2, 4, 5):
+-            context = self.assertRaisesRegex(ExpatError, 'syntax error')
+-        else:
+-            context = self.assertRaisesRegex(ValueError, 'Unsupported syntax')
+-
+-        with context:
+        # It doesn’t make any sense to insist on the exact text of the
+        # error message, or even the exact Exception … it is enough that
+        # the error has been discovered.
+        with self.assertRaises((ExpatError, ValueError)):
+             parseString('<element xmlns:abc="http:abc.com/de f g/hi/j k"><abc:foo /></element>')
+ 
+     def testDocRemoveChild(self):
+Index: Python-3.11.12/Lib/test/test_pyexpat.py
+===================================================================
+--- Python-3.11.12.orig/Lib/test/test_pyexpat.py	2025-04-11 10:52:22.076696906 +0200
+++ Python-3.11.12/Lib/test/test_pyexpat.py	2025-04-11 10:52:44.803228085 +0200
+@@ -14,8 +14,7 @@
+ from xml.parsers import expat
+ from xml.parsers.expat import errors
+ 
+-from test.support import sortdict, is_emscripten, is_wasi
+-
+from test.support import sortdict, is_emscripten, is_wasi, is_expat_2_6_0
+ 
+ class SetAttributeTest(unittest.TestCase):
+     def setUp(self):
+@@ -770,9 +769,8 @@
+         self.assertIs(parser.GetReparseDeferralEnabled(), enabled)
+ 
+     def test_reparse_deferral_enabled(self):
+-        if expat.version_info < (2, 6, 0):
+-            self.skipTest(f'Expat {expat.version_info} does not '
+-                          'support reparse deferral')
+        if not is_expat_2_6_0:
+            self.skipTest("Linked libexpat doesn't support reparse deferral")
+ 
+         started = []
+ 
+@@ -801,9 +799,9 @@
+ 
+         parser = expat.ParserCreate()
+         parser.StartElementHandler = start_element
+-        if expat.version_info >= (2, 6, 0):
+        if is_expat_2_6_0:
+             parser.SetReparseDeferralEnabled(False)
+-        self.assertFalse(parser.GetReparseDeferralEnabled())
+            self.assertFalse(parser.GetReparseDeferralEnabled())
+ 
+         for chunk in (b'<doc', b'/>'):
+             parser.Parse(chunk, False)
+Index: Python-3.11.12/Lib/test/test_sax.py
+===================================================================
+--- Python-3.11.12.orig/Lib/test/test_sax.py	2025-04-11 10:52:22.111440337 +0200
+++ Python-3.11.12/Lib/test/test_sax.py	2025-04-11 10:52:44.803567098 +0200
+@@ -19,13 +19,11 @@
+ from io import BytesIO, StringIO
+ import codecs
+ import os.path
+-import pyexpat
+ import shutil
+ import sys
+ from urllib.error import URLError
+ import urllib.request
+-from test.support import os_helper
+-from test.support import findfile
+from test.support import os_helper, findfile, is_expat_2_6_0
+ from test.support.os_helper import FakePath, TESTFN
+ 
+ 
+@@ -1215,10 +1213,10 @@
+ 
+         self.assertEqual(result.getvalue(), start + b"<doc>text</doc>")
+ 
+-    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
+-                     f'Expat {pyexpat.version_info} does not '
+-                     'support reparse deferral')
+     def test_flush_reparse_deferral_enabled(self):
+        if not is_expat_2_6_0:
+            self.skipTest("Linked libexpat doesn't support reparse deferral")
+
+         result = BytesIO()
+         xmlgen = XMLGenerator(result)
+         parser = create_parser()
+@@ -1241,6 +1239,9 @@
+         self.assertEqual(result.getvalue(), start + b"<doc></doc>")
+ 
+     def test_flush_reparse_deferral_disabled(self):
+        if not is_expat_2_6_0:
+            self.skipTest("Linked libexpat doesn't support reparse deferral")
+
+         result = BytesIO()
+         xmlgen = XMLGenerator(result)
+         parser = create_parser()
+@@ -1249,9 +1250,8 @@
+         for chunk in ("<doc", ">"):
+             parser.feed(chunk)
+ 
+-        if pyexpat.version_info >= (2, 6, 0):
+-            parser._parser.SetReparseDeferralEnabled(False)
+-            self.assertEqual(result.getvalue(), start)  # i.e. no elements started
+        parser._parser.SetReparseDeferralEnabled(False)
+        self.assertEqual(result.getvalue(), start)  # i.e. no elements started
+ 
+         self.assertFalse(parser._parser.GetReparseDeferralEnabled())
+ 
+Index: Python-3.11.12/Lib/test/test_xml_etree.py
+===================================================================
+--- Python-3.11.12.orig/Lib/test/test_xml_etree.py	2025-04-11 10:52:22.425637912 +0200
+++ Python-3.11.12/Lib/test/test_xml_etree.py	2025-04-11 10:52:44.804234785 +0200
+@@ -13,7 +13,6 @@
+ import operator
+ import os
+ import pickle
+-import pyexpat
+ import sys
+ import textwrap
+ import types
+@@ -1424,12 +1423,6 @@
+         self.assert_event_tags(parser, [('end', 'root')])
+         self.assertIsNone(parser.close())
+ 
+-    def test_simple_xml_chunk_1(self):
+-        self.test_simple_xml(chunk_size=1, flush=True)
+-
+-    def test_simple_xml_chunk_5(self):
+-        self.test_simple_xml(chunk_size=5, flush=True)
+-
+     def test_simple_xml_chunk_22(self):
+         self.test_simple_xml(chunk_size=22)
+ 
+@@ -1627,9 +1620,6 @@
+         with self.assertRaises(ValueError):
+             ET.XMLPullParser(events=('start', 'end', 'bogus'))
+ 
+-    @unittest.skipIf(pyexpat.version_info < (2, 6, 0),
+-                     f'Expat {pyexpat.version_info} does not '
+-                     'support reparse deferral')
+     def test_flush_reparse_deferral_enabled(self):
+         parser = ET.XMLPullParser(events=('start', 'end'))
+ 
+@@ -1656,8 +1646,6 @@
+ 
+         for chunk in ("<doc", ">"):
+             parser.feed(chunk)
+-
+-        if pyexpat.version_info >= (2, 6, 0):
+             if not ET is pyET:
+                 self.skipTest(f'XMLParser.(Get|Set)ReparseDeferralEnabled '
+                               'methods not available in C')
@@ -0,0 +1,60 @@
+---
+ Lib/test/test_pyexpat.py   |    2 ++
+ Lib/test/test_sax.py       |    2 ++
+ Lib/test/test_xml_etree.py |    2 ++
+ 3 files changed, 6 insertions(+)
+
+--- a/Lib/test/test_pyexpat.py
+++ b/Lib/test/test_pyexpat.py
+@@ -768,6 +768,7 @@ class ReparseDeferralTest(unittest.TestC
+         parser.SetReparseDeferralEnabled(True)
+         self.assertIs(parser.GetReparseDeferralEnabled(), enabled)
+ 
+    @unittest.skip('Tests are failing.')
+     def test_reparse_deferral_enabled(self):
+         if not is_expat_2_6_0:
+             self.skipTest("Linked libexpat doesn't support reparse deferral")
+@@ -791,6 +792,7 @@ class ReparseDeferralTest(unittest.TestC
+ 
+         self.assertEqual(started, ['doc'])
+ 
+    @unittest.skip('Tests are failing.')
+     def test_reparse_deferral_disabled(self):
+         started = []
+ 
+--- a/Lib/test/test_sax.py
+++ b/Lib/test/test_sax.py
+@@ -1213,6 +1213,7 @@ class ExpatReaderTest(XmlTestBase):
+ 
+         self.assertEqual(result.getvalue(), start + b"<doc>text</doc>")
+ 
+    @unittest.skip('Tests are failing.')
+     def test_flush_reparse_deferral_enabled(self):
+         if not is_expat_2_6_0:
+             self.skipTest("Linked libexpat doesn't support reparse deferral")
+@@ -1238,6 +1239,7 @@ class ExpatReaderTest(XmlTestBase):
+ 
+         self.assertEqual(result.getvalue(), start + b"<doc></doc>")
+ 
+    @unittest.skip('Tests are failing.')
+     def test_flush_reparse_deferral_disabled(self):
+         if not is_expat_2_6_0:
+             self.skipTest("Linked libexpat doesn't support reparse deferral")
+--- a/Lib/test/test_xml_etree.py
+++ b/Lib/test/test_xml_etree.py
+@@ -1620,6 +1620,7 @@ class XMLPullParserTest(unittest.TestCas
+         with self.assertRaises(ValueError):
+             ET.XMLPullParser(events=('start', 'end', 'bogus'))
+ 
+    @unittest.skip('Tests are failing.')
+     def test_flush_reparse_deferral_enabled(self):
+         parser = ET.XMLPullParser(events=('start', 'end'))
+ 
+@@ -1641,6 +1642,7 @@ class XMLPullParserTest(unittest.TestCas
+ 
+         self.assert_event_tags(parser, [('end', 'doc')])
+ 
+    @unittest.skip('Tests are failing.')
+     def test_flush_reparse_deferral_disabled(self):
+         parser = ET.XMLPullParser(events=('start', 'end'))
+ 
@@ -0,0 +1,299 @@
+From 1408cc9bf9e8b19968761548c30b78d37074c21c Mon Sep 17 00:00:00 2001
+From: Y5 <124019959+y5c4l3@users.noreply.github.com>
+Date: Tue, 22 Oct 2024 04:48:04 +0800
+Subject: [PATCH] gh-124651: Quote template strings in `venv` activation
+ scripts (GH-124712)
+
+This patch properly quotes template strings in `venv` activation
+scripts. This mitigates potential command injection.
+
+(cherry picked from commit d48cc82ed25e26b02eb97c6263d95dcaa1e9111b)
+---
+ Lib/test/test_venv.py                                                   |   81 ++++++++++
+ Lib/venv/__init__.py                                                    |   42 ++++-
+ Lib/venv/scripts/common/activate                                        |    8 
+ Lib/venv/scripts/nt/activate.bat                                        |    6 
+ Lib/venv/scripts/posix/activate.csh                                     |    8 
+ Lib/venv/scripts/posix/activate.fish                                    |    8 
+ Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst |    1 
+ 7 files changed, 134 insertions(+), 20 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
+
+--- a/Lib/test/test_venv.py
+++ b/Lib/test/test_venv.py
+@@ -11,6 +11,7 @@ import os
+ import os.path
+ import pathlib
+ import re
+import shlex
+ import shutil
+ import struct
+ import subprocess
+@@ -96,6 +97,10 @@ class BaseTest(unittest.TestCase):
+             result = f.read()
+         return result
+ 
+    def assertEndsWith(self, string, tail):
+        if not string.endswith(tail):
+            self.fail(f"String {string!r} does not end with {tail!r}")
+
+ class BasicTest(BaseTest):
+     """Test venv module functionality."""
+ 
+@@ -446,6 +451,82 @@ class BasicTest(BaseTest):
+             'import sys; print(sys.executable)'])
+         self.assertEqual(out.strip(), envpy.encode())
+ 
+    # gh-124651: test quoted strings
+    @unittest.skipIf(os.name == 'nt', 'contains invalid characters on Windows')
+    def test_special_chars_bash(self):
+        """
+        Test that the template strings are quoted properly (bash)
+        """
+        rmtree(self.env_dir)
+        bash = shutil.which('bash')
+        if bash is None:
+            self.skipTest('bash required for this test')
+        env_name = '"\';&&$e|\'"'
+        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
+        builder = venv.EnvBuilder(clear=True)
+        builder.create(env_dir)
+        activate = os.path.join(env_dir, self.bindir, 'activate')
+        test_script = os.path.join(self.env_dir, 'test_special_chars.sh')
+        with open(test_script, "w") as f:
+            f.write(f'source {shlex.quote(activate)}\n'
+                    'python -c \'import sys; print(sys.executable)\'\n'
+                    'python -c \'import os; print(os.environ["VIRTUAL_ENV"])\'\n'
+                    'deactivate\n')
+        out, err = check_output([bash, test_script])
+        lines = out.splitlines()
+        self.assertTrue(env_name.encode() in lines[0])
+        self.assertEndsWith(lines[1], env_name.encode())
+
+    # gh-124651: test quoted strings
+    @unittest.skipIf(os.name == 'nt', 'contains invalid characters on Windows')
+    def test_special_chars_csh(self):
+        """
+        Test that the template strings are quoted properly (csh)
+        """
+        rmtree(self.env_dir)
+        csh = shutil.which('tcsh') or shutil.which('csh')
+        if csh is None:
+            self.skipTest('csh required for this test')
+        env_name = '"\';&&$e|\'"'
+        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
+        builder = venv.EnvBuilder(clear=True)
+        builder.create(env_dir)
+        activate = os.path.join(env_dir, self.bindir, 'activate.csh')
+        test_script = os.path.join(self.env_dir, 'test_special_chars.csh')
+        with open(test_script, "w") as f:
+            f.write(f'source {shlex.quote(activate)}\n'
+                    'python -c \'import sys; print(sys.executable)\'\n'
+                    'python -c \'import os; print(os.environ["VIRTUAL_ENV"])\'\n'
+                    'deactivate\n')
+        out, err = check_output([csh, test_script])
+        lines = out.splitlines()
+        self.assertTrue(env_name.encode() in lines[0])
+        self.assertEndsWith(lines[1], env_name.encode())
+
+    # gh-124651: test quoted strings on Windows
+    @unittest.skipUnless(os.name == 'nt', 'only relevant on Windows')
+    def test_special_chars_windows(self):
+        """
+        Test that the template strings are quoted properly on Windows
+        """
+        rmtree(self.env_dir)
+        env_name = "'&&^$e"
+        env_dir = os.path.join(os.path.realpath(self.env_dir), env_name)
+        builder = venv.EnvBuilder(clear=True)
+        builder.create(env_dir)
+        activate = os.path.join(env_dir, self.bindir, 'activate.bat')
+        test_batch = os.path.join(self.env_dir, 'test_special_chars.bat')
+        with open(test_batch, "w") as f:
+            f.write('@echo off\n'
+                    f'"{activate}" & '
+                    f'{self.exe} -c "import sys; print(sys.executable)" & '
+                    f'{self.exe} -c "import os; print(os.environ[\'VIRTUAL_ENV\'])" & '
+                    'deactivate')
+        out, err = check_output([test_batch])
+        lines = out.splitlines()
+        self.assertTrue(env_name.encode() in lines[0])
+        self.assertEndsWith(lines[1], env_name.encode())
+
+     @unittest.skipUnless(os.name == 'nt', 'only relevant on Windows')
+     def test_unicode_in_batch_file(self):
+         """
+--- a/Lib/venv/__init__.py
+++ b/Lib/venv/__init__.py
+@@ -11,6 +11,7 @@ import subprocess
+ import sys
+ import sysconfig
+ import types
+import shlex
+ 
+ 
+ CORE_VENV_DEPS = ('pip', 'setuptools')
+@@ -394,11 +395,41 @@ class EnvBuilder:
+         :param context: The information for the environment creation request
+                         being processed.
+         """
+-        text = text.replace('__VENV_DIR__', context.env_dir)
+-        text = text.replace('__VENV_NAME__', context.env_name)
+-        text = text.replace('__VENV_PROMPT__', context.prompt)
+-        text = text.replace('__VENV_BIN_NAME__', context.bin_name)
+-        text = text.replace('__VENV_PYTHON__', context.env_exe)
+        replacements = {
+            '__VENV_DIR__': context.env_dir,
+            '__VENV_NAME__': context.env_name,
+            '__VENV_PROMPT__': context.prompt,
+            '__VENV_BIN_NAME__': context.bin_name,
+            '__VENV_PYTHON__': context.env_exe,
+        }
+
+        def quote_ps1(s):
+            """
+            This should satisfy PowerShell quoting rules [1], unless the quoted
+            string is passed directly to Windows native commands [2].
+            [1]: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules
+            [2]: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_parsing#passing-arguments-that-contain-quote-characters
+            """
+            s = s.replace("'", "''")
+            return f"'{s}'"
+
+        def quote_bat(s):
+            return s
+
+        # gh-124651: need to quote the template strings properly
+        quote = shlex.quote
+        script_path = context.script_path
+        if script_path.endswith('.ps1'):
+            quote = quote_ps1
+        elif script_path.endswith('.bat'):
+            quote = quote_bat
+        else:
+            # fallbacks to POSIX shell compliant quote
+            quote = shlex.quote
+
+        replacements = {key: quote(s) for key, s in replacements.items()}
+        for key, quoted in replacements.items():
+            text = text.replace(key, quoted)
+         return text
+ 
+     def install_scripts(self, context, path):
+@@ -438,6 +469,7 @@ class EnvBuilder:
+                 with open(srcfile, 'rb') as f:
+                     data = f.read()
+                 if not srcfile.endswith(('.exe', '.pdb')):
+                    context.script_path = srcfile
+                     try:
+                         data = data.decode('utf-8')
+                         data = self.replace_variables(data, context)
+--- a/Lib/venv/scripts/common/activate
+++ b/Lib/venv/scripts/common/activate
+@@ -35,11 +35,11 @@ deactivate () {
+ # unset irrelevant variables
+ deactivate nondestructive
+ 
+-VIRTUAL_ENV="__VENV_DIR__"
+VIRTUAL_ENV=__VENV_DIR__
+ export VIRTUAL_ENV
+ 
+ _OLD_VIRTUAL_PATH="$PATH"
+-PATH="$VIRTUAL_ENV/__VENV_BIN_NAME__:$PATH"
+PATH="$VIRTUAL_ENV/"__VENV_BIN_NAME__":$PATH"
+ export PATH
+ 
+ # unset PYTHONHOME if set
+@@ -52,9 +52,9 @@ fi
+ 
+ if [ -z "${VIRTUAL_ENV_DISABLE_PROMPT:-}" ] ; then
+     _OLD_VIRTUAL_PS1="${PS1:-}"
+-    PS1="__VENV_PROMPT__${PS1:-}"
+    PS1=__VENV_PROMPT__"${PS1:-}"
+     export PS1
+-    VIRTUAL_ENV_PROMPT="__VENV_PROMPT__"
+    VIRTUAL_ENV_PROMPT=__VENV_PROMPT__
+     export VIRTUAL_ENV_PROMPT
+ fi
+ 
+--- a/Lib/venv/scripts/nt/activate.bat
+++ b/Lib/venv/scripts/nt/activate.bat
+@@ -8,7 +8,7 @@ if defined _OLD_CODEPAGE (
+     "%SystemRoot%\System32\chcp.com" 65001 > nul
+ )
+ 
+-set VIRTUAL_ENV=__VENV_DIR__
+set "VIRTUAL_ENV=__VENV_DIR__"
+ 
+ if not defined PROMPT set PROMPT=$P$G
+ 
+@@ -24,8 +24,8 @@ set PYTHONHOME=
+ if defined _OLD_VIRTUAL_PATH set PATH=%_OLD_VIRTUAL_PATH%
+ if not defined _OLD_VIRTUAL_PATH set _OLD_VIRTUAL_PATH=%PATH%
+ 
+-set PATH=%VIRTUAL_ENV%\__VENV_BIN_NAME__;%PATH%
+-set VIRTUAL_ENV_PROMPT=__VENV_PROMPT__
+set "PATH=%VIRTUAL_ENV%\__VENV_BIN_NAME__;%PATH%"
+set "VIRTUAL_ENV_PROMPT=__VENV_PROMPT__"
+ 
+ :END
+ if defined _OLD_CODEPAGE (
+--- a/Lib/venv/scripts/posix/activate.csh
+++ b/Lib/venv/scripts/posix/activate.csh
+@@ -8,17 +8,17 @@ alias deactivate 'test $?_OLD_VIRTUAL_PA
+ # Unset irrelevant variables.
+ deactivate nondestructive
+ 
+-setenv VIRTUAL_ENV "__VENV_DIR__"
+setenv VIRTUAL_ENV __VENV_DIR__
+ 
+ set _OLD_VIRTUAL_PATH="$PATH"
+-setenv PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__:$PATH"
+setenv PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__":$PATH"
+ 
+ 
+ set _OLD_VIRTUAL_PROMPT="$prompt"
+ 
+ if (! "$?VIRTUAL_ENV_DISABLE_PROMPT") then
+-    set prompt = "__VENV_PROMPT__$prompt"
+-    setenv VIRTUAL_ENV_PROMPT "__VENV_PROMPT__"
+    set prompt = __VENV_PROMPT__"$prompt"
+    setenv VIRTUAL_ENV_PROMPT __VENV_PROMPT__
+ endif
+ 
+ alias pydoc python -m pydoc
+--- a/Lib/venv/scripts/posix/activate.fish
+++ b/Lib/venv/scripts/posix/activate.fish
+@@ -33,10 +33,10 @@ end
+ # Unset irrelevant variables.
+ deactivate nondestructive
+ 
+-set -gx VIRTUAL_ENV "__VENV_DIR__"
+set -gx VIRTUAL_ENV __VENV_DIR__
+ 
+ set -gx _OLD_VIRTUAL_PATH $PATH
+-set -gx PATH "$VIRTUAL_ENV/__VENV_BIN_NAME__" $PATH
+set -gx PATH "$VIRTUAL_ENV/"__VENV_BIN_NAME__ $PATH
+ 
+ # Unset PYTHONHOME if set.
+ if set -q PYTHONHOME
+@@ -56,7 +56,7 @@ if test -z "$VIRTUAL_ENV_DISABLE_PROMPT"
+         set -l old_status $status
+ 
+         # Output the venv prompt; color taken from the blue of the Python logo.
+-        printf "%s%s%s" (set_color 4B8BBE) "__VENV_PROMPT__" (set_color normal)
+        printf "%s%s%s" (set_color 4B8BBE) __VENV_PROMPT__ (set_color normal)
+ 
+         # Restore the return status of the previous command.
+         echo "exit $old_status" | .
+@@ -65,5 +65,5 @@ if test -z "$VIRTUAL_ENV_DISABLE_PROMPT"
+     end
+ 
+     set -gx _OLD_FISH_PROMPT_OVERRIDE "$VIRTUAL_ENV"
+-    set -gx VIRTUAL_ENV_PROMPT "__VENV_PROMPT__"
+    set -gx VIRTUAL_ENV_PROMPT __VENV_PROMPT__
+ end
+--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2024-09-28-02-03-04.gh-issue-124651.bLBGtH.rst
+@@ -0,0 +1 @@
+Properly quote template strings in :mod:`venv` activation scripts.
@@ -0,0 +1,127 @@
+From d91e2c740890837edafaee24d68112b776cda9c5 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Fri, 31 Jan 2025 11:41:34 -0600
+Subject: [PATCH] gh-105704: Disallow square brackets (`[` and `]`) in domain
+ names for parsed URLs (GH-129418)
+
+* gh-105704: Disallow square brackets ( and ) in domain names for parsed URLs
+
+* Use Sphinx references
+
+Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
+
+* Add mismatched bracket test cases, fix news format
+
+* Add more test coverage for ports
+
+---------
+
+(cherry picked from commit d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a)
+
+Co-authored-by: Seth Michael Larson <seth@python.org>
+Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
+---
+ Lib/test/test_urlparse.py                                                |   37 +++++++++-
+ Lib/urllib/parse.py                                                      |   20 ++++-
+ Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst |    4 +
+ 3 files changed, 58 insertions(+), 3 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
+
+--- a/Lib/test/test_urlparse.py
+++ b/Lib/test/test_urlparse.py
+@@ -1224,16 +1224,51 @@ class UrlParseTestCase(unittest.TestCase
+         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af::2309::fae7:1234]/Path?Query')
+         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@[0439:23af:2309::fae7:1234:2342:438e:192.0.2.146]/Path?Query')
+         self.assertRaises(ValueError, urllib.parse.urlsplit, 'Scheme://user@]v6a.ip[/Path')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]/')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix/')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip]?')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip].suffix?')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]/')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix/')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]?')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix?')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:a1')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:a1')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:1a')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:1a')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[::1].suffix:/')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[::1]:?')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@prefix.[v6a.ip]')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://user@[v6a.ip].suffix')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://[v6a.ip')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip]')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip[')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://]v6a.ip')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix.[v6a.ip')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip].suffix')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip[suffix')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://prefix]v6a.ip')
+        self.assertRaises(ValueError, urllib.parse.urlsplit, 'scheme://v6a.ip[suffix')
+ 
+     def test_splitting_bracketed_hosts(self):
+-        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]/path?query')
+        p1 = urllib.parse.urlsplit('scheme://user@[v6a.ip]:1234/path?query')
+         self.assertEqual(p1.hostname, 'v6a.ip')
+         self.assertEqual(p1.username, 'user')
+         self.assertEqual(p1.path, '/path')
+        self.assertEqual(p1.port, 1234)
+         p2 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7%test]/path?query')
+         self.assertEqual(p2.hostname, '0439:23af:2309::fae7%test')
+         self.assertEqual(p2.username, 'user')
+         self.assertEqual(p2.path, '/path')
+        self.assertIs(p2.port, None)
+         p3 = urllib.parse.urlsplit('scheme://user@[0439:23af:2309::fae7:1234:192.0.2.146%test]/path?query')
+         self.assertEqual(p3.hostname, '0439:23af:2309::fae7:1234:192.0.2.146%test')
+         self.assertEqual(p3.username, 'user')
+--- a/Lib/urllib/parse.py
+++ b/Lib/urllib/parse.py
+@@ -436,6 +436,23 @@ def _checknetloc(netloc):
+             raise ValueError("netloc '" + netloc + "' contains invalid " +
+                              "characters under NFKC normalization")
+ 
+def _check_bracketed_netloc(netloc):
+    # Note that this function must mirror the splitting
+    # done in NetlocResultMixins._hostinfo().
+    hostname_and_port = netloc.rpartition('@')[2]
+    before_bracket, have_open_br, bracketed = hostname_and_port.partition('[')
+    if have_open_br:
+        # No data is allowed before a bracket.
+        if before_bracket:
+            raise ValueError("Invalid IPv6 URL")
+        hostname, _, port = bracketed.partition(']')
+        # No data is allowed after the bracket but before the port delimiter.
+        if port and not port.startswith(":"):
+            raise ValueError("Invalid IPv6 URL")
+    else:
+        hostname, _, port = hostname_and_port.partition(':')
+    _check_bracketed_host(hostname)
+
+ # Valid bracketed hosts are defined in
+ # https://www.rfc-editor.org/rfc/rfc3986#page-49 and https://url.spec.whatwg.org/
+ def _check_bracketed_host(hostname):
+@@ -496,8 +513,7 @@ def urlsplit(url, scheme='', allow_fragm
+                 (']' in netloc and '[' not in netloc)):
+             raise ValueError("Invalid IPv6 URL")
+         if '[' in netloc and ']' in netloc:
+-            bracketed_host = netloc.partition('[')[2].partition(']')[0]
+-            _check_bracketed_host(bracketed_host)
+            _check_bracketed_netloc(netloc)
+     if allow_fragments and '#' in url:
+         url, fragment = url.split('#', 1)
+     if '?' in url:
+--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2025-01-28-14-08-03.gh-issue-105704.EnhHxu.rst
+@@ -0,0 +1,4 @@
+When using :func:`urllib.parse.urlsplit` and :func:`urllib.parse.urlparse` host
+parsing would not reject domain names containing square brackets (``[`` and
+``]``). Square brackets are only valid for IPv6 and IPvFuture hosts according to
+`RFC 3986 Section 3.2.2 <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.2>`__.
@@ -0,0 +1,504 @@
+From 0c33e5baedf18ebcb04bc41dff7cfc614d5ea5fe Mon Sep 17 00:00:00 2001
+From: Serhiy Storchaka <storchaka@gmail.com>
+Date: Tue, 20 May 2025 15:46:57 +0300
+Subject: [PATCH] [3.11] gh-133767: Fix use-after-free in the unicode-escape
+ decoder with an error handler (GH-129648) (GH-133944)
+
+If the error handler is used, a new bytes object is created to set as
+the object attribute of UnicodeDecodeError, and that bytes object then
+replaces the original data. A pointer to the decoded data will became invalid
+after destroying that temporary bytes object. So we need other way to return
+the first invalid escape from _PyUnicode_DecodeUnicodeEscapeInternal().
+
+_PyBytes_DecodeEscape() does not have such issue, because it does not
+use the error handlers registry, but it should be changed for compatibility
+with _PyUnicode_DecodeUnicodeEscapeInternal().
+(cherry picked from commit 9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e)
+(cherry picked from commit 6279eb8c076d89d3739a6edb393e43c7929b429d)
+(cherry picked from commit a75953b347716fff694aa59a7c7c2489fa50d1f5)
+
+Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
+---
+ Include/cpython/bytesobject.h                                            |    4 
+ Include/cpython/unicodeobject.h                                          |   13 ++
+ Lib/test/test_codeccallbacks.py                                          |   39 ++++++
+ Lib/test/test_codecs.py                                                  |   52 ++++++--
+ Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst |    2 
+ Objects/bytesobject.c                                                    |   56 ++++++--
+ Objects/unicodeobject.c                                                  |   63 +++++++---
+ Parser/string_parser.c                                                   |   24 ++-
+ 8 files changed, 197 insertions(+), 56 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst
+
+--- a/Include/cpython/bytesobject.h
+++ b/Include/cpython/bytesobject.h
+@@ -25,6 +25,10 @@ PyAPI_FUNC(PyObject*) _PyBytes_FromHex(
+     int use_bytearray);
+ 
+ /* Helper for PyBytes_DecodeEscape that detects invalid escape chars. */
+PyAPI_FUNC(PyObject*) _PyBytes_DecodeEscape2(const char *, Py_ssize_t,
+                                             const char *,
+                                             int *, const char **);
+// Export for binary compatibility.
+ PyAPI_FUNC(PyObject *) _PyBytes_DecodeEscape(const char *, Py_ssize_t,
+                                              const char *, const char **);
+ 
+--- a/Include/cpython/unicodeobject.h
+++ b/Include/cpython/unicodeobject.h
+@@ -914,6 +914,19 @@ PyAPI_FUNC(PyObject*) _PyUnicode_DecodeU
+ );
+ /* Helper for PyUnicode_DecodeUnicodeEscape that detects invalid escape
+    chars. */
+PyAPI_FUNC(PyObject*) _PyUnicode_DecodeUnicodeEscapeInternal2(
+    const char *string,     /* Unicode-Escape encoded string */
+    Py_ssize_t length,      /* size of string */
+    const char *errors,     /* error handling */
+    Py_ssize_t *consumed,   /* bytes consumed */
+    int *first_invalid_escape_char, /* on return, if not -1, contain the first
+                                       invalid escaped char (<= 0xff) or invalid
+                                       octal escape (> 0xff) in string. */
+    const char **first_invalid_escape_ptr); /* on return, if not NULL, may
+                                        point to the first invalid escaped
+                                        char in string.
+                                        May be NULL if errors is not NULL. */
+// Export for binary compatibility.
+ PyAPI_FUNC(PyObject*) _PyUnicode_DecodeUnicodeEscapeInternal(
+         const char *string,     /* Unicode-Escape encoded string */
+         Py_ssize_t length,      /* size of string */
+--- a/Lib/test/test_codeccallbacks.py
+++ b/Lib/test/test_codeccallbacks.py
+@@ -1,6 +1,7 @@
+ import codecs
+ import html.entities
+ import itertools
+import re
+ import sys
+ import unicodedata
+ import unittest
+@@ -1124,7 +1125,7 @@ class CodecCallbackTest(unittest.TestCas
+             text = 'abc<def>ghi'*n
+             text.translate(charmap)
+ 
+-    def test_mutatingdecodehandler(self):
+    def test_mutating_decode_handler(self):
+         baddata = [
+             ("ascii", b"\xff"),
+             ("utf-7", b"++"),
+@@ -1159,6 +1160,42 @@ class CodecCallbackTest(unittest.TestCas
+         for (encoding, data) in baddata:
+             self.assertEqual(data.decode(encoding, "test.mutating"), "\u4242")
+ 
+    def test_mutating_decode_handler_unicode_escape(self):
+        decode = codecs.unicode_escape_decode
+        def mutating(exc):
+            if isinstance(exc, UnicodeDecodeError):
+                r = data.get(exc.object[:exc.end])
+                if r is not None:
+                    exc.object = r[0] + exc.object[exc.end:]
+                    return ('\u0404', r[1])
+            raise AssertionError("don't know how to handle %r" % exc)
+
+        codecs.register_error('test.mutating2', mutating)
+        data = {
+            br'\x0': (b'\\', 0),
+            br'\x3': (b'xxx\\', 3),
+            br'\x5': (b'x\\', 1),
+        }
+        def check(input, expected, msg):
+            with self.assertWarns(DeprecationWarning) as cm:
+                self.assertEqual(decode(input, 'test.mutating2'), (expected, len(input)))
+            self.assertIn(msg, str(cm.warning))
+
+        check(br'\x0n\z', '\u0404\n\\z', r"invalid escape sequence '\z'")
+        check(br'\x0n\501', '\u0404\n\u0141', r"invalid octal escape sequence '\501'")
+        check(br'\x0z', '\u0404\\z', r"invalid escape sequence '\z'")
+
+        check(br'\x3n\zr', '\u0404\n\\zr', r"invalid escape sequence '\z'")
+        check(br'\x3zr', '\u0404\\zr', r"invalid escape sequence '\z'")
+        check(br'\x3z5', '\u0404\\z5', r"invalid escape sequence '\z'")
+        check(memoryview(br'\x3z5x')[:-1], '\u0404\\z5', r"invalid escape sequence '\z'")
+        check(memoryview(br'\x3z5xy')[:-2], '\u0404\\z5', r"invalid escape sequence '\z'")
+
+        check(br'\x5n\z', '\u0404\n\\z', r"invalid escape sequence '\z'")
+        check(br'\x5n\501', '\u0404\n\u0141', r"invalid octal escape sequence '\501'")
+        check(br'\x5z', '\u0404\\z', r"invalid escape sequence '\z'")
+        check(memoryview(br'\x5zy')[:-1], '\u0404\\z', r"invalid escape sequence '\z'")
+
+     # issue32583
+     def test_crashing_decode_handler(self):
+         # better generating one more character to fill the extra space slot
+--- a/Lib/test/test_codecs.py
+++ b/Lib/test/test_codecs.py
+@@ -1198,23 +1198,39 @@ class EscapeDecodeTest(unittest.TestCase
+         check(br"[\1010]", b"[A0]")
+         check(br"[\x41]", b"[A]")
+         check(br"[\x410]", b"[A0]")
+
+    def test_warnings(self):
+        decode = codecs.escape_decode
+        check = coding_checker(self, decode)
+         for i in range(97, 123):
+             b = bytes([i])
+             if b not in b'abfnrtvx':
+-                with self.assertWarns(DeprecationWarning):
+                with self.assertWarnsRegex(DeprecationWarning,
+                        r"invalid escape sequence '\\%c'" % i):
+                     check(b"\\" + b, b"\\" + b)
+-            with self.assertWarns(DeprecationWarning):
+            with self.assertWarnsRegex(DeprecationWarning,
+                    r"invalid escape sequence '\\%c'" % (i-32)):
+                 check(b"\\" + b.upper(), b"\\" + b.upper())
+-        with self.assertWarns(DeprecationWarning):
+        with self.assertWarnsRegex(DeprecationWarning,
+                r"invalid escape sequence '\\8'"):
+             check(br"\8", b"\\8")
+         with self.assertWarns(DeprecationWarning):
+             check(br"\9", b"\\9")
+-        with self.assertWarns(DeprecationWarning):
+        with self.assertWarnsRegex(DeprecationWarning,
+                r"invalid escape sequence '\\\xfa'") as cm:
+             check(b"\\\xfa", b"\\\xfa")
+         for i in range(0o400, 0o1000):
+-            with self.assertWarns(DeprecationWarning):
+            with self.assertWarnsRegex(DeprecationWarning,
+                    r"invalid octal escape sequence '\\%o'" % i):
+                 check(rb'\%o' % i, bytes([i & 0o377]))
+ 
+        with self.assertWarnsRegex(DeprecationWarning,
+                r"invalid escape sequence '\\z'"):
+            self.assertEqual(decode(br'\x\z', 'ignore'), (b'\\z', 4))
+        with self.assertWarnsRegex(DeprecationWarning,
+                r"invalid octal escape sequence '\\501'"):
+            self.assertEqual(decode(br'\x\501', 'ignore'), (b'A', 6))
+
+     def test_errors(self):
+         decode = codecs.escape_decode
+         self.assertRaises(ValueError, decode, br"\x")
+@@ -2487,24 +2503,40 @@ class UnicodeEscapeTest(ReadTest, unitte
+         check(br"[\x410]", "[A0]")
+         check(br"\u20ac", "\u20ac")
+         check(br"\U0001d120", "\U0001d120")
+
+    def test_decode_warnings(self):
+        decode = codecs.unicode_escape_decode
+        check = coding_checker(self, decode)
+         for i in range(97, 123):
+             b = bytes([i])
+             if b not in b'abfnrtuvx':
+-                with self.assertWarns(DeprecationWarning):
+                with self.assertWarnsRegex(DeprecationWarning,
+                        r"invalid escape sequence '\\%c'" % i):
+                     check(b"\\" + b, "\\" + chr(i))
+             if b.upper() not in b'UN':
+-                with self.assertWarns(DeprecationWarning):
+                with self.assertWarnsRegex(DeprecationWarning,
+                        r"invalid escape sequence '\\%c'" % (i-32)):
+                     check(b"\\" + b.upper(), "\\" + chr(i-32))
+-        with self.assertWarns(DeprecationWarning):
+        with self.assertWarnsRegex(DeprecationWarning,
+                r"invalid escape sequence '\\8'"):
+             check(br"\8", "\\8")
+         with self.assertWarns(DeprecationWarning):
+             check(br"\9", "\\9")
+-        with self.assertWarns(DeprecationWarning):
+        with self.assertWarnsRegex(DeprecationWarning,
+                r"invalid escape sequence '\\\xfa'") as cm:
+             check(b"\\\xfa", "\\\xfa")
+         for i in range(0o400, 0o1000):
+-            with self.assertWarns(DeprecationWarning):
+            with self.assertWarnsRegex(DeprecationWarning,
+                    r"invalid octal escape sequence '\\%o'" % i):
+                 check(rb'\%o' % i, chr(i))
+ 
+        with self.assertWarnsRegex(DeprecationWarning,
+                r"invalid escape sequence '\\z'"):
+            self.assertEqual(decode(br'\x\z', 'ignore'), ('\\z', 4))
+        with self.assertWarnsRegex(DeprecationWarning,
+                r"invalid octal escape sequence '\\501'"):
+            self.assertEqual(decode(br'\x\501', 'ignore'), ('\u0141', 6))
+
+     def test_decode_errors(self):
+         decode = codecs.unicode_escape_decode
+         for c, d in (b'x', 2), (b'u', 4), (b'U', 4):
+--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst
+@@ -0,0 +1,2 @@
+Fix use-after-free in the "unicode-escape" decoder with a non-"strict" error
+handler.
+--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
+@@ -1057,10 +1057,11 @@ _PyBytes_FormatEx(const char *format, Py
+ }
+ 
+ /* Unescape a backslash-escaped string. */
+-PyObject *_PyBytes_DecodeEscape(const char *s,
+PyObject *_PyBytes_DecodeEscape2(const char *s,
+                                 Py_ssize_t len,
+                                 const char *errors,
+-                                const char **first_invalid_escape)
+                                int *first_invalid_escape_char,
+                                const char **first_invalid_escape_ptr)
+ {
+     int c;
+     char *p;
+@@ -1074,7 +1075,8 @@ PyObject *_PyBytes_DecodeEscape(const ch
+         return NULL;
+     writer.overallocate = 1;
+ 
+-    *first_invalid_escape = NULL;
+    *first_invalid_escape_char = -1;
+    *first_invalid_escape_ptr = NULL;
+ 
+     end = s + len;
+     while (s < end) {
+@@ -1112,9 +1114,10 @@ PyObject *_PyBytes_DecodeEscape(const ch
+                     c = (c<<3) + *s++ - '0';
+             }
+             if (c > 0377) {
+-                if (*first_invalid_escape == NULL) {
+-                    *first_invalid_escape = s-3; /* Back up 3 chars, since we've
+-                                                    already incremented s. */
+                if (*first_invalid_escape_char == -1) {
+                    *first_invalid_escape_char = c;
+                    /* Back up 3 chars, since we've already incremented s. */
+                    *first_invalid_escape_ptr = s - 3;
+                 }
+             }
+             *p++ = c;
+@@ -1155,9 +1158,10 @@ PyObject *_PyBytes_DecodeEscape(const ch
+             break;
+ 
+         default:
+-            if (*first_invalid_escape == NULL) {
+-                *first_invalid_escape = s-1; /* Back up one char, since we've
+-                                                already incremented s. */
+            if (*first_invalid_escape_char == -1) {
+                *first_invalid_escape_char = (unsigned char)s[-1];
+                /* Back up one char, since we've already incremented s. */
+                *first_invalid_escape_ptr = s - 1;
+             }
+             *p++ = '\\';
+             s--;
+@@ -1171,23 +1175,39 @@ PyObject *_PyBytes_DecodeEscape(const ch
+     return NULL;
+ }
+ 
+// Export for binary compatibility.
+PyObject *_PyBytes_DecodeEscape(const char *s,
+                                Py_ssize_t len,
+                                const char *errors,
+                                const char **first_invalid_escape)
+{
+    int first_invalid_escape_char;
+    return _PyBytes_DecodeEscape2(
+            s, len, errors,
+            &first_invalid_escape_char,
+            first_invalid_escape);
+}
+
+ PyObject *PyBytes_DecodeEscape(const char *s,
+                                 Py_ssize_t len,
+                                 const char *errors,
+                                 Py_ssize_t Py_UNUSED(unicode),
+                                 const char *Py_UNUSED(recode_encoding))
+ {
+-    const char* first_invalid_escape;
+-    PyObject *result = _PyBytes_DecodeEscape(s, len, errors,
+-                                             &first_invalid_escape);
+    int first_invalid_escape_char;
+    const char *first_invalid_escape_ptr;
+    PyObject *result = _PyBytes_DecodeEscape2(s, len, errors,
+                                             &first_invalid_escape_char,
+                                             &first_invalid_escape_ptr);
+     if (result == NULL)
+         return NULL;
+-    if (first_invalid_escape != NULL) {
+-        unsigned char c = *first_invalid_escape;
+-        if ('4' <= c && c <= '7') {
+    if (first_invalid_escape_char != -1) {
+        if (first_invalid_escape_char > 0xff) {
+            char buf[12] = "";
+            snprintf(buf, sizeof buf, "%o", first_invalid_escape_char);
+             if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
+-                                 "invalid octal escape sequence '\\%.3s'",
+-                                 first_invalid_escape) < 0)
+                                 "invalid octal escape sequence '\\%s'",
+                                 buf) < 0)
+             {
+                 Py_DECREF(result);
+                 return NULL;
+@@ -1196,7 +1216,7 @@ PyObject *PyBytes_DecodeEscape(const cha
+         else {
+             if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
+                                  "invalid escape sequence '\\%c'",
+-                                 c) < 0)
+                                 first_invalid_escape_char) < 0)
+             {
+                 Py_DECREF(result);
+                 return NULL;
+--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
+@@ -6301,20 +6301,23 @@ PyUnicode_AsUTF16String(PyObject *unicod
+ static _PyUnicode_Name_CAPI *ucnhash_capi = NULL;
+ 
+ PyObject *
+-_PyUnicode_DecodeUnicodeEscapeInternal(const char *s,
+_PyUnicode_DecodeUnicodeEscapeInternal2(const char *s,
+                                Py_ssize_t size,
+                                const char *errors,
+                                Py_ssize_t *consumed,
+-                               const char **first_invalid_escape)
+                               int *first_invalid_escape_char,
+                               const char **first_invalid_escape_ptr)
+ {
+     const char *starts = s;
+    const char *initial_starts = starts;
+     _PyUnicodeWriter writer;
+     const char *end;
+     PyObject *errorHandler = NULL;
+     PyObject *exc = NULL;
+ 
+     // so we can remember if we've seen an invalid escape char or not
+-    *first_invalid_escape = NULL;
+    *first_invalid_escape_char = -1;
+    *first_invalid_escape_ptr = NULL;
+ 
+     if (size == 0) {
+         if (consumed) {
+@@ -6402,9 +6405,12 @@ _PyUnicode_DecodeUnicodeEscapeInternal(c
+                 }
+             }
+             if (ch > 0377) {
+-                if (*first_invalid_escape == NULL) {
+-                    *first_invalid_escape = s-3; /* Back up 3 chars, since we've
+-                                                    already incremented s. */
+                if (*first_invalid_escape_char == -1) {
+                    *first_invalid_escape_char = ch;
+                    if (starts == initial_starts) {
+                        /* Back up 3 chars, since we've already incremented s. */
+                        *first_invalid_escape_ptr = s - 3;
+                    }
+                 }
+             }
+             WRITE_CHAR(ch);
+@@ -6503,9 +6509,12 @@ _PyUnicode_DecodeUnicodeEscapeInternal(c
+             goto error;
+ 
+         default:
+-            if (*first_invalid_escape == NULL) {
+-                *first_invalid_escape = s-1; /* Back up one char, since we've
+-                                                already incremented s. */
+            if (*first_invalid_escape_char == -1) {
+                *first_invalid_escape_char = c;
+                if (starts == initial_starts) {
+                    /* Back up one char, since we've already incremented s. */
+                    *first_invalid_escape_ptr = s - 1;
+                }
+             }
+             WRITE_ASCII_CHAR('\\');
+             WRITE_CHAR(c);
+@@ -6544,24 +6553,42 @@ _PyUnicode_DecodeUnicodeEscapeInternal(c
+     return NULL;
+ }
+ 
+// Export for binary compatibility.
+PyObject *
+_PyUnicode_DecodeUnicodeEscapeInternal(const char *s,
+                               Py_ssize_t size,
+                               const char *errors,
+                               Py_ssize_t *consumed,
+                               const char **first_invalid_escape)
+{
+    int first_invalid_escape_char;
+    return _PyUnicode_DecodeUnicodeEscapeInternal2(
+            s, size, errors, consumed,
+            &first_invalid_escape_char,
+            first_invalid_escape);
+}
+
+ PyObject *
+ _PyUnicode_DecodeUnicodeEscapeStateful(const char *s,
+                               Py_ssize_t size,
+                               const char *errors,
+                               Py_ssize_t *consumed)
+ {
+-    const char *first_invalid_escape;
+-    PyObject *result = _PyUnicode_DecodeUnicodeEscapeInternal(s, size, errors,
+    int first_invalid_escape_char;
+    const char *first_invalid_escape_ptr;
+    PyObject *result = _PyUnicode_DecodeUnicodeEscapeInternal2(s, size, errors,
+                                                       consumed,
+-                                                      &first_invalid_escape);
+                                                      &first_invalid_escape_char,
+                                                      &first_invalid_escape_ptr);
+     if (result == NULL)
+         return NULL;
+-    if (first_invalid_escape != NULL) {
+-        unsigned char c = *first_invalid_escape;
+-        if ('4' <= c && c <= '7') {
+    if (first_invalid_escape_char != -1) {
+        if (first_invalid_escape_char > 0xff) {
+            char buf[12] = "";
+            snprintf(buf, sizeof buf, "%o", first_invalid_escape_char);
+             if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
+-                                 "invalid octal escape sequence '\\%.3s'",
+-                                 first_invalid_escape) < 0)
+                                 "invalid octal escape sequence '\\%s'",
+                                 buf) < 0)
+             {
+                 Py_DECREF(result);
+                 return NULL;
+@@ -6570,7 +6597,7 @@ _PyUnicode_DecodeUnicodeEscapeStateful(c
+         else {
+             if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
+                                  "invalid escape sequence '\\%c'",
+-                                 c) < 0)
+                                 first_invalid_escape_char) < 0)
+             {
+                 Py_DECREF(result);
+                 return NULL;
+--- a/Parser/string_parser.c
+++ b/Parser/string_parser.c
+@@ -130,12 +130,15 @@ decode_unicode_with_escapes(Parser *pars
+     len = p - buf;
+     s = buf;
+ 
+-    const char *first_invalid_escape;
+-    v = _PyUnicode_DecodeUnicodeEscapeInternal(s, len, NULL, NULL, &first_invalid_escape);
+    int first_invalid_escape_char;
+    const char *first_invalid_escape_ptr;
+    v = _PyUnicode_DecodeUnicodeEscapeInternal2(s, (Py_ssize_t)len, NULL, NULL,
+                                                &first_invalid_escape_char,
+                                                &first_invalid_escape_ptr);
+ 
+-    if (v != NULL && first_invalid_escape != NULL) {
+-        if (warn_invalid_escape_sequence(parser, first_invalid_escape, t) < 0) {
+-            /* We have not decref u before because first_invalid_escape points
+    if (v != NULL && first_invalid_escape_ptr != NULL) {
+        if (warn_invalid_escape_sequence(parser, first_invalid_escape_ptr, t) < 0) {
+            /* We have not decref u before because first_invalid_escape_ptr points
+                inside u. */
+             Py_XDECREF(u);
+             Py_DECREF(v);
+@@ -149,14 +152,17 @@ decode_unicode_with_escapes(Parser *pars
+ static PyObject *
+ decode_bytes_with_escapes(Parser *p, const char *s, Py_ssize_t len, Token *t)
+ {
+-    const char *first_invalid_escape;
+-    PyObject *result = _PyBytes_DecodeEscape(s, len, NULL, &first_invalid_escape);
+    int first_invalid_escape_char;
+    const char *first_invalid_escape_ptr;
+    PyObject *result = _PyBytes_DecodeEscape2(s, len, NULL,
+                                              &first_invalid_escape_char,
+                                              &first_invalid_escape_ptr);
+     if (result == NULL) {
+         return NULL;
+     }
+ 
+-    if (first_invalid_escape != NULL) {
+-        if (warn_invalid_escape_sequence(p, first_invalid_escape, t) < 0) {
+    if (first_invalid_escape_ptr != NULL) {
+        if (warn_invalid_escape_sequence(p, first_invalid_escape_ptr, t) < 0) {
+             Py_DECREF(result);
+             return NULL;
+         }
@@ -0,0 +1,190 @@
+From 9043edabc7e2f0dd655146e0a4571e2a0b2906af Mon Sep 17 00:00:00 2001
+From: Serhiy Storchaka <storchaka@gmail.com>
+Date: Fri, 13 Jun 2025 19:57:48 +0300
+Subject: [PATCH] gh-135462: Fix quadratic complexity in processing special
+ input in HTMLParser (GH-135464)
+
+End-of-file errors are now handled according to the HTML5 specs --
+comments and declarations are automatically closed, tags are ignored.
+(cherry picked from commit 6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41)
+
+Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
+---
+ Lib/html/parser.py                                                       |   41 +++++---
+ Lib/test/test_htmlparser.py                                              |   51 +++++++---
+ Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst |    4 
+ 3 files changed, 74 insertions(+), 22 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst
+
+Index: Python-3.11.13/Lib/html/parser.py
+===================================================================
+--- Python-3.11.13.orig/Lib/html/parser.py	2025-07-02 18:12:07.084569398 +0200
+++ Python-3.11.13/Lib/html/parser.py	2025-07-02 18:12:12.582519793 +0200
+@@ -25,6 +25,7 @@
+ charref = re.compile('&#(?:[0-9]+|[xX][0-9a-fA-F]+)[^0-9a-fA-F]')
+ 
+ starttagopen = re.compile('<[a-zA-Z]')
+endtagopen = re.compile('</[a-zA-Z]')
+ piclose = re.compile('>')
+ commentclose = re.compile(r'--\s*>')
+ # Note:
+@@ -176,7 +177,7 @@
+                     k = self.parse_pi(i)
+                 elif startswith("<!", i):
+                     k = self.parse_html_declaration(i)
+-                elif (i + 1) < n:
+                elif (i + 1) < n or end:
+                     self.handle_data("<")
+                     k = i + 1
+                 else:
+@@ -184,17 +185,35 @@
+                 if k < 0:
+                     if not end:
+                         break
+-                    k = rawdata.find('>', i + 1)
+-                    if k < 0:
+-                        k = rawdata.find('<', i + 1)
+-                        if k < 0:
+-                            k = i + 1
+                    if starttagopen.match(rawdata, i):  # < + letter
+                        pass
+                    elif startswith("</", i):
+                        if i + 2 == n:
+                            self.handle_data("</")
+                        elif endtagopen.match(rawdata, i):  # </ + letter
+                            pass
+                        else:
+                            # bogus comment
+                            self.handle_comment(rawdata[i+2:])
+                    elif startswith("<!--", i):
+                        j = n
+                        for suffix in ("--!", "--", "-"):
+                            if rawdata.endswith(suffix, i+4):
+                                j -= len(suffix)
+                                break
+                        self.handle_comment(rawdata[i+4:j])
+                    elif startswith("<![CDATA[", i):
+                        self.unknown_decl(rawdata[i+3:])
+                    elif rawdata[i:i+9].lower() == '<!doctype':
+                        self.handle_decl(rawdata[i+2:])
+                    elif startswith("<!", i):
+                        # bogus comment
+                        self.handle_comment(rawdata[i+2:])
+                    elif startswith("<?", i):
+                        self.handle_pi(rawdata[i+2:])
+                     else:
+-                        k += 1
+-                    if self.convert_charrefs and not self.cdata_elem:
+-                        self.handle_data(unescape(rawdata[i:k]))
+-                    else:
+-                        self.handle_data(rawdata[i:k])
+                        raise AssertionError("we should not get here!")
+                    k = n
+                 i = self.updatepos(i, k)
+             elif startswith("&#", i):
+                 match = charref.match(rawdata, i)
+Index: Python-3.11.13/Lib/test/test_htmlparser.py
+===================================================================
+--- Python-3.11.13.orig/Lib/test/test_htmlparser.py	2025-07-02 18:12:08.523658593 +0200
+++ Python-3.11.13/Lib/test/test_htmlparser.py	2025-07-02 18:13:32.674943007 +0200
+@@ -4,6 +4,8 @@
+ import pprint
+ import unittest
+ 
+from test import support
+
+ 
+ class EventCollector(html.parser.HTMLParser):
+ 
+@@ -391,28 +393,34 @@
+                             ('data', '<'),
+                             ('starttag', 'bc<', [('a', None)]),
+                             ('endtag', 'html'),
+-                            ('data', '\n<img src="URL>'),
+-                            ('comment', '/img'),
+-                            ('endtag', 'html<')])
+                            ('data', '\n')])
+ 
+     def test_starttag_junk_chars(self):
+        self._run_check("<", [('data', '<')])
+        self._run_check("<>", [('data', '<>')])
+        self._run_check("< >", [('data', '< >')])
+        self._run_check("< ", [('data', '< ')])
+         self._run_check("</>", [])
+        self._run_check("<$>", [('data', '<$>')])
+         self._run_check("</$>", [('comment', '$')])
+         self._run_check("</", [('data', '</')])
+-        self._run_check("</a", [('data', '</a')])
+        self._run_check("</a", [])
+        self._run_check("</ a>", [('endtag', 'a')])
+        self._run_check("</ a", [('comment', ' a')])
+         self._run_check("<a<a>", [('starttag', 'a<a', [])])
+         self._run_check("</a<a>", [('endtag', 'a<a')])
+-        self._run_check("<!", [('data', '<!')])
+-        self._run_check("<a", [('data', '<a')])
+-        self._run_check("<a foo='bar'", [('data', "<a foo='bar'")])
+-        self._run_check("<a foo='bar", [('data', "<a foo='bar")])
+-        self._run_check("<a foo='>'", [('data', "<a foo='>'")])
+-        self._run_check("<a foo='>", [('data', "<a foo='>")])
+        self._run_check("<!", [('comment', '')])
+        self._run_check("<a", [])
+        self._run_check("<a foo='bar'", [])
+        self._run_check("<a foo='bar", [])
+        self._run_check("<a foo='>'", [])
+        self._run_check("<a foo='>", [])
+         self._run_check("<a$>", [('starttag', 'a$', [])])
+         self._run_check("<a$b>", [('starttag', 'a$b', [])])
+         self._run_check("<a$b/>", [('startendtag', 'a$b', [])])
+         self._run_check("<a$b  >", [('starttag', 'a$b', [])])
+         self._run_check("<a$b  />", [('startendtag', 'a$b', [])])
+        self._run_check("</a$b>", [('endtag', 'a$b')])
+ 
+     def test_slashes_in_starttag(self):
+         self._run_check('<a foo="var"/>', [('startendtag', 'a', [('foo', 'var')])])
+@@ -549,8 +557,9 @@
+             ('comment', ' -- close enough --'),
+             ('comment', ''),
+             ('comment', '<-- this was an empty comment'),
+-            ('comment', '!! another bogus comment !!!'),
+            ('comment', '!! another bogus comment !!!')
+         ]
+
+         self._run_check(html, expected)
+ 
+     def test_broken_condcoms(self):
+@@ -598,6 +607,26 @@
+              ('endtag', 'a'), ('data', ' bar & baz')]
+         )
+ 
+    @support.requires_resource('cpu')
+    def test_eof_no_quadratic_complexity(self):
+        # Each of these examples used to take about an hour.
+        # Now they take a fraction of a second.
+        def check(source):
+            parser = html.parser.HTMLParser()
+            parser.feed(source)
+            parser.close()
+        n = 120_000
+        check("<a " * n)
+        check("<a a=" * n)
+        check("</a " * 14 * n)
+        check("</a a=" * 11 * n)
+        check("<!--" * 4 * n)
+        check("<!" * 60 * n)
+        check("<?" * 19 * n)
+        check("</$" * 15 * n)
+        check("<![CDATA[" * 9 * n)
+        check("<!doctype" * 35 * n)
+
+ 
+ class AttributesTestCase(TestCaseBase):
+ 
+Index: Python-3.11.13/Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ Python-3.11.13/Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst	2025-07-02 18:12:12.583386736 +0200
+@@ -0,0 +1,4 @@
+Fix quadratic complexity in processing specially crafted input in
+:class:`html.parser.HTMLParser`. End-of-file errors are now handled according
+to the HTML5 specs -- comments and declarations are automatically closed,
+tags are ignored.
@@ -0,0 +1,212 @@
+From 28d130238bfb5604eef4b594d597f7b5ec951eba Mon Sep 17 00:00:00 2001
+From: Alexander Urieles <aeurielesn@users.noreply.github.com>
+Date: Mon, 28 Jul 2025 17:37:26 +0200
+Subject: [PATCH] gh-130577: tarfile now validates archives to ensure member
+ offsets are non-negative (GH-137027) (cherry picked from commit
+ 7040aa54f14676938970e10c5f74ea93cd56aa38)
+
+Co-authored-by: Alexander Urieles <aeurielesn@users.noreply.github.com>
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+---
+ Lib/tarfile.py                                                          |    3 
+ Lib/test/test_tarfile.py                                                |  156 ++++++++++
+ Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst |    3 
+ 3 files changed, 162 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+
+Index: Python-3.11.13/Lib/tarfile.py
+===================================================================
+--- Python-3.11.13.orig/Lib/tarfile.py	2025-08-01 22:17:38.141397067 +0200
+++ Python-3.11.13/Lib/tarfile.py	2025-08-01 22:17:42.375160009 +0200
+@@ -1613,6 +1613,9 @@
+         """Round up a byte count by BLOCKSIZE and return it,
+            e.g. _block(834) => 1024.
+         """
+        # Only non-negative offsets are allowed
+        if count < 0:
+            raise InvalidHeaderError("invalid offset")
+         blocks, remainder = divmod(count, BLOCKSIZE)
+         if remainder:
+             blocks += 1
+Index: Python-3.11.13/Lib/test/test_tarfile.py
+===================================================================
+--- Python-3.11.13.orig/Lib/test/test_tarfile.py	2025-08-01 22:17:39.582120870 +0200
+++ Python-3.11.13/Lib/test/test_tarfile.py	2025-08-01 22:17:42.375846065 +0200
+@@ -50,6 +50,7 @@
+ xzname = os.path.join(TEMPDIR, "testtar.tar.xz")
+ tmpname = os.path.join(TEMPDIR, "tmp.tar")
+ dotlessname = os.path.join(TEMPDIR, "testtar")
+SPACE = b" "
+ 
+ sha256_regtype = (
+     "e09e4bc8b3c9d9177e77256353b36c159f5f040531bbd4b024a8f9b9196c71ce"
+@@ -4386,6 +4387,161 @@
+         ar.extractall(self.testdir, filter='fully_trusted')
+ 
+ 
+class OffsetValidationTests(unittest.TestCase):
+    tarname = tmpname
+    invalid_posix_header = (
+        # name: 100 bytes
+        tarfile.NUL * tarfile.LENGTH_NAME
+        # mode, space, null terminator: 8 bytes
+        + b"000755" + SPACE + tarfile.NUL
+        # uid, space, null terminator: 8 bytes
+        + b"000001" + SPACE + tarfile.NUL
+        # gid, space, null terminator: 8 bytes
+        + b"000001" + SPACE + tarfile.NUL
+        # size, space: 12 bytes
+        + b"\xff" * 11 + SPACE
+        # mtime, space: 12 bytes
+        + tarfile.NUL * 11 + SPACE
+        # chksum: 8 bytes
+        + b"0011407" + tarfile.NUL
+        # type: 1 byte
+        + tarfile.REGTYPE
+        # linkname: 100 bytes
+        + tarfile.NUL * tarfile.LENGTH_LINK
+        # magic: 6 bytes, version: 2 bytes
+        + tarfile.POSIX_MAGIC
+        # uname: 32 bytes
+        + tarfile.NUL * 32
+        # gname: 32 bytes
+        + tarfile.NUL * 32
+        # devmajor, space, null terminator: 8 bytes
+        + tarfile.NUL * 6 + SPACE + tarfile.NUL
+        # devminor, space, null terminator: 8 bytes
+        + tarfile.NUL * 6 + SPACE + tarfile.NUL
+        # prefix: 155 bytes
+        + tarfile.NUL * tarfile.LENGTH_PREFIX
+        # padding: 12 bytes
+        + tarfile.NUL * 12
+    )
+    invalid_gnu_header = (
+        # name: 100 bytes
+        tarfile.NUL * tarfile.LENGTH_NAME
+        # mode, null terminator: 8 bytes
+        + b"0000755" + tarfile.NUL
+        # uid, null terminator: 8 bytes
+        + b"0000001" + tarfile.NUL
+        # gid, space, null terminator: 8 bytes
+        + b"0000001" + tarfile.NUL
+        # size, space: 12 bytes
+        + b"\xff" * 11 + SPACE
+        # mtime, space: 12 bytes
+        + tarfile.NUL * 11 + SPACE
+        # chksum: 8 bytes
+        + b"0011327" + tarfile.NUL
+        # type: 1 byte
+        + tarfile.REGTYPE
+        # linkname: 100 bytes
+        + tarfile.NUL * tarfile.LENGTH_LINK
+        # magic: 8 bytes
+        + tarfile.GNU_MAGIC
+        # uname: 32 bytes
+        + tarfile.NUL * 32
+        # gname: 32 bytes
+        + tarfile.NUL * 32
+        # devmajor, null terminator: 8 bytes
+        + tarfile.NUL * 8
+        # devminor, null terminator: 8 bytes
+        + tarfile.NUL * 8
+        # padding: 167 bytes
+        + tarfile.NUL * 167
+    )
+    invalid_v7_header = (
+        # name: 100 bytes
+        tarfile.NUL * tarfile.LENGTH_NAME
+        # mode, space, null terminator: 8 bytes
+        + b"000755" + SPACE + tarfile.NUL
+        # uid, space, null terminator: 8 bytes
+        + b"000001" + SPACE + tarfile.NUL
+        # gid, space, null terminator: 8 bytes
+        + b"000001" + SPACE + tarfile.NUL
+        # size, space: 12 bytes
+        + b"\xff" * 11 + SPACE
+        # mtime, space: 12 bytes
+        + tarfile.NUL * 11 + SPACE
+        # chksum: 8 bytes
+        + b"0010070" + tarfile.NUL
+        # type: 1 byte
+        + tarfile.REGTYPE
+        # linkname: 100 bytes
+        + tarfile.NUL * tarfile.LENGTH_LINK
+        # padding: 255 bytes
+        + tarfile.NUL * 255
+    )
+    valid_gnu_header = tarfile.TarInfo("filename").tobuf(tarfile.GNU_FORMAT)
+    data_block = b"\xff" * tarfile.BLOCKSIZE
+
+    def _write_buffer(self, buffer):
+        with open(self.tarname, "wb") as f:
+            f.write(buffer)
+
+    def _get_members(self, ignore_zeros=None):
+        with open(self.tarname, "rb") as f:
+            with tarfile.open(
+                mode="r", fileobj=f, ignore_zeros=ignore_zeros
+            ) as tar:
+                return tar.getmembers()
+
+    def _assert_raises_read_error_exception(self):
+        with self.assertRaisesRegex(
+            tarfile.ReadError, "file could not be opened successfully"
+        ):
+            self._get_members()
+
+    def test_invalid_offset_header_validations(self):
+        for tar_format, invalid_header in (
+            ("posix", self.invalid_posix_header),
+            ("gnu", self.invalid_gnu_header),
+            ("v7", self.invalid_v7_header),
+        ):
+            with self.subTest(format=tar_format):
+                self._write_buffer(invalid_header)
+                self._assert_raises_read_error_exception()
+
+    def test_early_stop_at_invalid_offset_header(self):
+        buffer = self.valid_gnu_header + self.invalid_gnu_header + self.valid_gnu_header
+        self._write_buffer(buffer)
+        members = self._get_members()
+        self.assertEqual(len(members), 1)
+        self.assertEqual(members[0].name, "filename")
+        self.assertEqual(members[0].offset, 0)
+
+    def test_ignore_invalid_archive(self):
+        # 3 invalid headers with their respective data
+        buffer = (self.invalid_gnu_header + self.data_block) * 3
+        self._write_buffer(buffer)
+        members = self._get_members(ignore_zeros=True)
+        self.assertEqual(len(members), 0)
+
+    def test_ignore_invalid_offset_headers(self):
+        for first_block, second_block, expected_offset in (
+            (
+                (self.valid_gnu_header),
+                (self.invalid_gnu_header + self.data_block),
+                0,
+            ),
+            (
+                (self.invalid_gnu_header + self.data_block),
+                (self.valid_gnu_header),
+                1024,
+            ),
+        ):
+            self._write_buffer(first_block + second_block)
+            members = self._get_members(ignore_zeros=True)
+            self.assertEqual(len(members), 1)
+            self.assertEqual(members[0].name, "filename")
+            self.assertEqual(members[0].offset, expected_offset)
+
+
+ def setUpModule():
+     os_helper.unlink(TEMPDIR)
+     os.makedirs(TEMPDIR)
+Index: Python-3.11.13/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ Python-3.11.13/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst	2025-08-01 22:17:42.376340965 +0200
+@@ -0,0 +1,3 @@
+:mod:`tarfile` now validates archives to ensure member offsets are
+non-negative.  (Contributed by Alexander Enrique Urieles Nieto in
+:gh:`130577`.)
@@ -0,0 +1,215 @@
+From 910f38d9768d39d4d31426743ae4081ed1ab66b6 Mon Sep 17 00:00:00 2001
+From: Michal Cyprian <m.cyprian@gmail.com>
+Date: Mon, 26 Jun 2017 16:32:56 +0200
+Subject: [PATCH] 00251: Change user install location
+
+Set values of prefix and exec_prefix in distutils install command
+to /usr/local if executable is /usr/bin/python* and RPM build
+is not detected to make pip and distutils install into separate location.
+
+Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+---
+ Lib/distutils/command/install.py |   15 +++++++++++++--
+ Lib/site.py                      |    9 ++++++++-
+ 2 files changed, 21 insertions(+), 3 deletions(-)
+
+Index: Python-3.11.8/Lib/distutils/command/install.py
+===================================================================
+--- Python-3.11.8.orig/Lib/distutils/command/install.py
+++ Python-3.11.8/Lib/distutils/command/install.py
+@@ -441,8 +441,19 @@ class install(Command):
+                     raise DistutilsOptionError(
+                           "must not supply exec-prefix without prefix")
+ 
+-                self.prefix = os.path.normpath(sys.prefix)
+-                self.exec_prefix = os.path.normpath(sys.exec_prefix)
+                # self.prefix is set to sys.prefix + /local/
+                # if neither RPM build nor virtual environment is
+                # detected to make pip and distutils install packages
+                # into the separate location.
+                if (not (hasattr(sys, 'real_prefix') or
+                    sys.prefix != sys.base_prefix) and
+                    'RPM_BUILD_ROOT' not in os.environ):
+                    addition = "/local"
+                else:
+                    addition = ""
+
+                self.prefix = os.path.normpath(sys.prefix) + addition
+                self.exec_prefix = os.path.normpath(sys.exec_prefix) + addition
+ 
+             else:
+                 if self.exec_prefix is None:
+Index: Python-3.11.8/Lib/site.py
+===================================================================
+--- Python-3.11.8.orig/Lib/site.py
+++ Python-3.11.8/Lib/site.py
+@@ -387,8 +387,15 @@ def getsitepackages(prefixes=None):
+     return sitepackages
+ 
+ def addsitepackages(known_paths, prefixes=None):
+-    """Add site-packages to sys.path"""
+    """Add site-packages to sys.path
+
+    '/usr/local' is included in PREFIXES if RPM build is not detected
+    to make packages installed into this location visible.
+
+    """
+     _trace("Processing global site-packages")
+    if ENABLE_USER_SITE and 'RPM_BUILD_ROOT' not in os.environ:
+        PREFIXES.insert(0, "/usr/local")
+     for sitedir in getsitepackages(prefixes):
+         if os.path.isdir(sitedir):
+             addsitedir(sitedir, known_paths)
+
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Mon, 15 Feb 2021 12:19:27 +0100
+Subject: [PATCH] 00251: Change user install location
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Set values of base and platbase in sysconfig from /usr
+to /usr/local when RPM build is not detected
+to make pip and similar tools install into separate location.
+
+Fedora Change: https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+Downstream only.
+
+We've tried to rework in Fedora 36/Python 3.10 to follow https://bugs.python.org/issue43976
+but we have identified serious problems with that approach,
+see https://bugzilla.redhat.com/2026979 or https://bugzilla.redhat.com/2097183
+
+pypa/distutils integration: https://github.com/pypa/distutils/pull/70
+
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+Co-authored-by: Miro Hrončok <miro@hroncok.cz>
+Co-authored-by: Michal Cyprian <m.cyprian@gmail.com>
+Co-authored-by: Lumír Balhar <frenzy.madness@gmail.com>
+---
+ Lib/site.py                |  9 ++++++-
+ Lib/sysconfig.py           | 49 +++++++++++++++++++++++++++++++++++++-
+ Lib/test/test_sysconfig.py | 17 +++++++++++--
+ 3 files changed, 71 insertions(+), 4 deletions(-)
+
+Index: Python-3.11.9/Lib/sysconfig.py
+===================================================================
+--- Python-3.11.9.orig/Lib/sysconfig.py
+++ Python-3.11.9/Lib/sysconfig.py
+@@ -103,6 +103,11 @@ if os.name == 'nt':
+ else:
+     _INSTALL_SCHEMES['venv'] = _INSTALL_SCHEMES['posix_venv']
+ 
+# For a brief period of time in the Fedora 36 life cycle,
+# this installation scheme existed and was documented in the release notes.
+# For backwards compatibility, we keep it here (at least on 3.10 and 3.11).
+_INSTALL_SCHEMES['rpm_prefix'] = _INSTALL_SCHEMES['posix_prefix']
+
+ 
+ # NOTE: site.py has copy of this function.
+ # Sync it when modify this function.
+@@ -162,6 +167,19 @@ if _HAS_USER_BASE:
+             },
+     }
+ 
+# This is used by distutils.command.install in the stdlib
+# as well as pypa/distutils (e.g. bundled in setuptools).
+# The self.prefix value is set to sys.prefix + /local/
+# if neither RPM build nor virtual environment is
+# detected to make distutils install packages
+# into the separate location.
+# https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+if (not (hasattr(sys, 'real_prefix') or
+    sys.prefix != sys.base_prefix) and
+    'RPM_BUILD_ROOT' not in os.environ):
+    _prefix_addition = '/local'
+
+
+ _SCHEME_KEYS = ('stdlib', 'platstdlib', 'purelib', 'platlib', 'include',
+                 'scripts', 'data')
+ 
+@@ -258,11 +276,40 @@ def _extend_dict(target_dict, other_dict
+         target_dict[key] = value
+ 
+ 
+_CONFIG_VARS_LOCAL = None
+
+
+def _config_vars_local():
+    # This function returns the config vars with prefixes amended to /usr/local
+    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+    global _CONFIG_VARS_LOCAL
+    if _CONFIG_VARS_LOCAL is None:
+        _CONFIG_VARS_LOCAL = dict(get_config_vars())
+        _CONFIG_VARS_LOCAL['base'] = '/usr/local'
+        _CONFIG_VARS_LOCAL['platbase'] = '/usr/local'
+    return _CONFIG_VARS_LOCAL
+
+
+ def _expand_vars(scheme, vars):
+     res = {}
+     if vars is None:
+         vars = {}
+-    _extend_dict(vars, get_config_vars())
+
+    # when we are not in a virtual environment or an RPM build
+    # we change '/usr' to '/usr/local'
+    # to avoid surprises, we explicitly check for the /usr/ prefix
+    # Python virtual environments have different prefixes
+    # we only do this for posix_prefix, not to mangle the venv scheme
+    # posix_prefix is used by sudo pip install
+    # we only change the defaults here, so explicit --prefix will take precedence
+    # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+    if (scheme == 'posix_prefix' and
+        _PREFIX == '/usr' and
+        'RPM_BUILD_ROOT' not in os.environ):
+            _extend_dict(vars, _config_vars_local())
+    else:
+        _extend_dict(vars, get_config_vars())
+
+     if os.name == 'nt':
+         # On Windows we want to substitute 'lib' for schemes rather
+         # than the native value (without modifying vars, in case it
+Index: Python-3.11.9/Lib/test/test_sysconfig.py
+===================================================================
+--- Python-3.11.9.orig/Lib/test/test_sysconfig.py
+++ Python-3.11.9/Lib/test/test_sysconfig.py
+@@ -111,8 +111,19 @@ class TestSysConfig(unittest.TestCase):
+         for scheme in _INSTALL_SCHEMES:
+             for name in _INSTALL_SCHEMES[scheme]:
+                 expected = _INSTALL_SCHEMES[scheme][name].format(**config_vars)
+                tested = get_path(name, scheme)
+                # https://fedoraproject.org/wiki/Changes/Making_sudo_pip_safe
+                if tested.startswith('/usr/local'):
+                    # /usr/local should only be used in posix_prefix
+                    self.assertEqual(scheme, 'posix_prefix')
+                    # Fedora CI runs tests for venv and virtualenv that check for other prefixes
+                    self.assertEqual(sys.prefix, '/usr')
+                    # When building the RPM of Python, %check runs this with RPM_BUILD_ROOT set
+                    # Fedora CI runs this with RPM_BUILD_ROOT unset
+                    self.assertNotIn('RPM_BUILD_ROOT', os.environ)
+                    tested = tested.replace('/usr/local', '/usr')
+                 self.assertEqual(
+-                    os.path.normpath(get_path(name, scheme)),
+                    os.path.normpath(tested),
+                     os.path.normpath(expected),
+                 )
+ 
+@@ -345,7 +356,7 @@ class TestSysConfig(unittest.TestCase):
+         self.assertTrue(os.path.isfile(config_h), config_h)
+ 
+     def test_get_scheme_names(self):
+-        wanted = ['nt', 'posix_home', 'posix_prefix', 'posix_venv', 'nt_venv', 'venv']
+        wanted = ['nt', 'posix_home', 'posix_prefix', 'posix_venv', 'nt_venv', 'venv', 'rpm_prefix']
+         if HAS_USER_BASE:
+             wanted.extend(['nt_user', 'osx_framework_user', 'posix_user'])
+         self.assertEqual(get_scheme_names(), tuple(sorted(wanted)))
+@@ -357,6 +368,8 @@ class TestSysConfig(unittest.TestCase):
+             cmd = "-c", "import sysconfig; print(sysconfig.get_platform())"
+             self.assertEqual(py.call_real(*cmd), py.call_link(*cmd))
+ 
+    @unittest.skipIf('RPM_BUILD_ROOT' not in os.environ,
+                     "Test doesn't expect Fedora's paths")
+     def test_user_similar(self):
+         # Issue #8759: make sure the posix scheme for the users
+         # is similar to the global posix_prefix one
@@ -0,0 +1,26 @@
+Notes for packagers of Python3
+==============================
+
+0. Faster build turnaround
+--------------------------
+
+By default, python builds with profile-guided optimization. This needs
+an additional run of the test suite and it is generally slow.
+PGO build takes around 50 minutes.
+
+For development, use "--without profileopt" option to disable PGO. This
+shortens the build time to ~5 minutes including test suite.
+
+1. import_failed.map
+----------------------
+
+This is a mechanism installed as part of python3-base, that places shim modules
+on python's path (through a generated zzzz-import-failed-hooks.pth file, so that
+it is imported as much at the end as makes sense; and an _import_failed subdir
+of /usr/lib/pythonX.Y). Then when the user tries to import a module that is part
+of a subpackage, the ImportError will contain a helpful message telling them
+which missing subpackage to install.
+
+This can sometimes cause problems on non-standard configurations, if the pth
+gets included too early (for instance if you are using a script to include all
+pths by hand in some strange order). Just something to look out for.
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEz9yiRbEEPPKl+Xhl/+h0BBaL2EcFAmbbrO0ACgkQ/+h0BBaL
+2Ec+YBAAnQJLKYPjj7Yr7xkFU655Sv86JxeRAdWjnIapbiIuWg3Up8Pd8FTRgHGf
+3XdTHw7b03lSjtzJwavzdnDklqAlBIGn9dVieljUIN7NYyNxoYOr/AiatimgSwv7
+dI5mfun5fLKV6ZcdNdQN5PJ3RZtF3I7VfkN2mlfZJHtxl1agdU/TfW2L+qJ7+JPY
+cayjq2xKTLRNXOf2iV29GRRovLiqA+Dx0+cAwsScwreHMp3U4k3GkeHVoR6fldV4
+bVAM8GRl3CYVFePiqAbamKP1BSys44JOINWbWyd94JxzEAwXWz//Es0h73AzeRfK
+ueORqzdoOGrVc74+HGlAHhqO1Gg7jMMmtkzCEuav+cGHYnMRMOngGR3q47aTJTVb
+5UdP0oD4OlADPFVa6q0LCqN/IFlebWMh9pXYw7Wpek63oNuZHTfNPq4S1AUM2HJm
+C3yzaOG9VAdYfLneJC4ldY4CVt1FKckfaXp5OAaMr71DI74e4CcEswlUupZJLZKV
+TJRjQD15bnXGhHDqU4w3RmzpCWMh2mf4m4VMYQyObl3TtlX+gVvzIhDS5+mXqutB
+F1pdXwaHHkTb2PLLxpwOGrnsp8XoW74tsylcYirQg8jSFMbgxfwgIjEIuRGXeDkT
+B4QzmQ4SxsbLiH7etV6Fznl1h569Z4DO9OOs4i0ZzIjdhPDQtAs=
+=TatG
+-----END PGP SIGNATURE-----
@@ -0,0 +1 @@
+{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICzDCCAlOgAwIBAgIUWcRolJPsPmtJKA6VkjHSj7PtjY8wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQxMjAzMTgxOTA1WhcNMjQxMjAzMTgyOTA1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEN+fBJCRZIAZiWPBdjyQVD+x5vgmjuuVct1HkPHIBMuEe7wI4mBG2BhJ3fHkpr97efIH6ELMmPV99edyAIZFXR6OCAXIwggFuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUkutZdHfCCSvGI87mjnBRwZB8ihYwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wIgYDVR0RAQH/BBgwFoEUcGFibG9nc2FsQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGTjb9QlwAABAMARzBFAiEA4ddSINhYM+p0+DGzRqnA8rVtJF9YgI+9znXiq9fqQNkCIEErcSnQmN8jjErhwWWtcTM5GgH4ka/uk5kdHTycwxj3MAoGCCqGSM49BAMDA2cAMGQCMFmkCEH2pCBpFeFiUi2uA4opcJP6vh/zqb+D0tbxqd+jwbBkuDxDqA9/Ao3UWop+twIwO9o71KAlYWPSPYMeZERM4R8zWlp9mVJPiK3tgOJJi40MNmxwtfsQeQtncqiQLBAH"}, "tlogEntries": [{"logIndex": "153122039", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1733249946", "inclusionPromise": {"signedEntryTimestamp": "MEUCIBL9zpVJtljIuZtAe8uptLfDmakmbAjy5ELp2q8WJTQ7AiEAv6lIpyJZycHwTS+JHYJFzMVv0SmA8yQ0eMneBivMhPY="}, "inclusionProof": {"logIndex": "31217777", "rootHash": "BMKHBPePzSbNqf2NyF/Ejuyy3troRGpNS41Dqe43nZ0=", "treeSize": "31217778", "hashes": ["lrr8dxmtgD09fnZTo1tMTY00HNKc2ZIpbZa1djDeTes=", "yFxGSg1RDbtZ/eNftnMdBJGNEZmmLyx2ZRDFtAIMHAk=", "GeqsQGnvgc+gcuaIC+vQ5b0RdTyBxBnYTpbeW2AeD+Q=", "dMTPeN/a9xCQQP+Hz7sddW0pPj8n54sfkhcf3XhjrMM=", "XjayhjKU3shP7q7lhmhKDv3Vpi4gJgAPCu0KlEzc9Qo=", "go1dmexQYS5etu69upRRX7IFvuA0rIcT9aYjMstmPIU=", "AYwr74Bm2w383UnS7DdbZUUAhusq28JoxKpWrQ7OvGQ=", "u+yWmGIR6sAH32wiSy22mz1Yf+jfPdBTjFbyRISuTZw=", "3eFC7Gp4fWecybDOAw9uUTrM1xB7YRYRAGsfYkiQbV8=", "1uKk2qjOliHMiTk906jrchP8mXWsRG8apaU1sa0lfh0=", "oOecFfN3YqDOkbijS/ej1WF5Da/Gt/AZNhbwE9uoOE8=", "4lUF0YOu9XkIDXKXA0wMSzd6VeDY3TZAgmoOeWmS2+Y=", "gf+9m552B3PnkWnO0o4KdVvjcT3WVHLrCbf1DoVYKFw="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n31217778\nBMKHBPePzSbNqf2NyF/Ejuyy3troRGpNS41Dqe43nZ0=\n\n\u2014 rekor.sigstore.dev wNI9ajBEAiA7ed0HqugBwVpmxDAR1VN35J91/+DeRdj09y5lFY+bRwIgYe07JnZlJvp3MfAMXX3i4XBsZoDRZoXtwfBaRj/8x8s=\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyYTk5MjBjN2EwY2QyMzZkZTMzNjQ0ZWQ5ODBhMTNjYmJjMjEwNThiZmRjNTI4ZmViYjYwODE1NzVlZDczYmUzIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJRU5KSGllaWs5WkVibW83a0p4ZUhWY2FvVDVYOUxyWG1zRTVxc1I5R1JpSEFpRUFtcHZyV21vUHF5YzRpQ09VYXVmY3dKTllMK1lPTWU0b0NOaWRLVGduT1FBPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZSRU5EUVd4UFowRjNTVUpCWjBsVlYyTlNiMnhLVUhOUWJYUktTMEUyVm10cVNGTnFOMUIwYWxrNGQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFJlRTFxUVhwTlZHZDRUMVJCTVZkb1kwNU5hbEY0VFdwQmVrMVVaM2xQVkVFeFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZPSzJaQ1NrTlNXa2xCV21sWFVFSmthbmxSVmtRcmVEVjJaMjFxZFhWV1kzUXhTR3NLVUVoSlFrMTFSV1UzZDBrMGJVSkhNa0pvU2pObVNHdHdjamszWldaSlNEWkZURTF0VUZZNU9XVmtlVUZKV2taWVVqWlBRMEZZU1hkblowWjFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZyZFhSYUNtUklaa05EVTNaSFNUZzNiV3B1UWxKM1drSTRhV2haZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsbldVUldVakJTUVZGSUwwSkNaM2RHYjBWVlkwZEdhV0pIT1c1ak1rWnpVVWhDTldSSGFIWmlhVFYyWTIxamQwdFJXVXRMZDFsQ1FrRkhSQXAyZWtGQ1FWRlJZbUZJVWpCalNFMDJUSGs1YUZreVRuWmtWelV3WTNrMWJtSXlPVzVpUjFWMVdUSTVkRTFEYzBkRGFYTkhRVkZSUW1jM09IZEJVV2RGQ2toUmQySmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5TVWRMUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJZDBVS1pXZENORUZJV1VFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIxUnFZamxSYkhkQlFRcENRVTFCVW5wQ1JrRnBSVUUwWkdSVFNVNW9XVTByY0RBclJFZDZVbkZ1UVRoeVZuUktSamxaWjBrck9YcHVXR2x4T1daeFVVNXJRMGxGUlhKalUyNVJDbTFPT0dwcVJYSm9kMWRYZEdOVVRUVkhaMGcwYTJFdmRXczFhMlJJVkhsamQzaHFNMDFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbU5CVFVkUlEwMUdiV3NLUTBWSU1uQkRRbkJHWlVacFZXa3lkVUUwYjNCalNsQTJkbWd2ZW5GaUswUXdkR0o0Y1dRcmFuZGlRbXQxUkhoRWNVRTVMMEZ2TTFWWGIzQXJkSGRKZHdwUE9XODNNVXRCYkZsWFVGTlFXVTFsV2tWU1RUUlNPSHBYYkhBNWJWWktVR2xMTTNSblQwcEthVFF3VFU1dGVIZDBabk5SWlZGMGJtTnhhVkZNUWtGSUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}]}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "Kpkgx6DNI23jNkTtmAoTy7whBYv9xSj+u2CBV17XO+M="}, "signature": "MEUCIENJHieik9ZEbmo7kJxeHVcaoT5X9LrXmsE5qsR9GRiHAiEAmpvrWmoPqyc4iCOUaufcwJNYL+YOMe4oCNidKTgnOQA="}}
@@ -0,0 +1 @@
+{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICzDCCAlOgAwIBAgIUdXXo3kfUuTRxhwfBaDz2hbLdc00wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNDA4MTUwMzI1WhcNMjUwNDA4MTUxMzI1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEChWB96w27HEQAug03xOuj5aVvdcEBkLaseC6PKbhc3lq1vL78o96RMSdWdBSmBQ4OrRHKvop8VRwn4SI6KPIN6OCAXIwggFuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUDQFNdUPu8lJprLgYTWMF//JnS0owHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wIgYDVR0RAQH/BBgwFoEUcGFibG9nc2FsQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGWFe1zcgAABAMARzBFAiAMLue9b86BfjeZl9ML7LekLskkUPTEhI2ciiZrYgaF/gIhAIt66OYOVpC39L+bRXJd1K+T39IGMxYcKoaDrMk0DX59MAoGCCqGSM49BAMDA2cAMGQCMEJ+IEScHRIlOwToBZxVVJjrSxOVvqRSfUO5hvYNkqhYz97LxxUFWpcB/DMiQJOUbwIwKJRh5d7c30z1XyE5zsjOZZmz37ah6aJtyuHLCn3QKJniWBMxIMy9lbXlRZWZgsf0"}, "tlogEntries": [{"logIndex": "193896942", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1744124605", "inclusionPromise": {"signedEntryTimestamp": "MEUCIQDBvc4N4pmeJKalSbAgT5X5MiHnHfiFJ3q/ifYIUDQORwIgNCMUBexEGM4B8VSSWkSDK8uZDGqzA7bgurZdWE0z/vc="}, "inclusionProof": {"logIndex": "71992680", "rootHash": "jow4GaqK8wgGK0YaQkHyINNk1eJRvrgCUSax5oC+bgc=", "treeSize": "71992683", "hashes": ["V5p0el9OkIku5PMpzeGtSeSQLNkd4d0DVh6qNlixrlk=", "CbJfH60w3vsS3xzOzbMZQaokwVM+6efm7OCLjQ5og/k=", "fJZsSVsDo+dpw5484/+8Rm3EH3JostySBfLMVDBUZOU=", "/C+wK2WU/SrXLMnuHDzeBP4K+Jlt/S0nAvzvcXJPp30=", "m6j5meZeKpBfFqNeI7qiCogWjT2IT5NZkgJYwot9sRo=", "V7VMIiqIq7yvzO+ic8vLqIJr3+iGA6whYAGN7YvWhsQ=", "2ap6N1WIsMWGC/Zrnzsx//K9223/3B9lLpJP87M+rXE=", "2kwW2rqY/EMS68q/rOjagVYsEMybFHgxIfbokSa8yKU=", "QReFEOB9XSZtDKsjRtA0fGnYGMYD2Z7qn50auG1YlWo=", "K26LG80DXyb+bC58c4Nw00WigG52v0PCsZGY3ExGsts=", "WEm5OgPzJpYROv+4CcrieexCYyQKrLUH3hbxmcQQ+DM=", "7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n71992683\njow4GaqK8wgGK0YaQkHyINNk1eJRvrgCUSax5oC+bgc=\n\n\u2014 rekor.sigstore.dev wNI9ajBGAiEA7u1b4P659JpwuXMf6lhvC1RhOj/ZH7CpYcAQbitQSwUCIQDJrflW8FGweaiB88lSuLfpfD/a6l6jWhUyOQB/mIJ9rA==\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI4NDlkYTg3YWY0ZGYxMzc3MTBjMTc5NmUyNzZhOTU1ZjdhODVjOWY5NzEwODEwNjdjOGY1NjVkMTVjMzUyYTA5In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRnMzQi9oTk9OMVY2TXFaUkxzRmNHNlU2Qjkza2FsL1VLZWsvYkRVb3o2MUFpQWZydmsrWXpjK0hHZGJYemRRQ203cjlKU2RNUCtuR1BOblVCZzFoSnAySVE9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZSRU5EUVd4UFowRjNTVUpCWjBsVlpGaFliek5yWmxWMVZGSjRhSGRtUW1GRWVqSm9Za3hrWXpBd2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDVFUVRSTlZGVjNUWHBKTVZkb1kwNU5hbFYzVGtSQk5FMVVWWGhOZWtreFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZEYUZkQ09UWjNNamRJUlZGQmRXY3dNM2hQZFdvMVlWWjJaR05GUW10TVlYTmxRellLVUV0aWFHTXpiSEV4ZGt3M09HODVObEpOVTJSWFpFSlRiVUpSTkU5eVVraExkbTl3T0ZaU2QyNDBVMGsyUzFCSlRqWlBRMEZZU1hkblowWjFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZFVVVaT0NtUlZVSFU0YkVwd2NreG5XVlJYVFVZdkwwcHVVekJ2ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsbldVUldVakJTUVZGSUwwSkNaM2RHYjBWVlkwZEdhV0pIT1c1ak1rWnpVVWhDTldSSGFIWmlhVFYyWTIxamQwdFJXVXRMZDFsQ1FrRkhSQXAyZWtGQ1FWRlJZbUZJVWpCalNFMDJUSGs1YUZreVRuWmtWelV3WTNrMWJtSXlPVzVpUjFWMVdUSTVkRTFEYzBkRGFYTkhRVkZSUW1jM09IZEJVV2RGQ2toUmQySmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5TVWRMUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJZDBVS1pXZENORUZJV1VFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIxZEdaVEY2WTJkQlFRcENRVTFCVW5wQ1JrRnBRVTFNZFdVNVlqZzJRbVpxWlZwc09VMU1OMHhsYTB4emEydFZVRlJGYUVreVkybHBXbkpaWjJGR0wyZEphRUZKZERZMlQxbFBDbFp3UXpNNVRDdGlVbGhLWkRGTEsxUXpPVWxIVFhoWlkwdHZZVVJ5VFdzd1JGZzFPVTFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbU5CVFVkUlEwMUZTaXNLU1VWVFkwaFNTV3hQZDFSdlFscDRWbFpLYW5KVGVFOVdkbkZTVTJaVlR6Vm9kbGxPYTNGb1dYbzVOMHg0ZUZWR1YzQmpRaTlFVFdsUlNrOVZZbmRKZHdwTFNsSm9OV1EzWXpNd2VqRlllVVUxZW5OcVQxcGFiWG96TjJGb05tRktkSGwxU0V4RGJqTlJTMHB1YVZkQ1RYaEpUWGs1YkdKWWJGSmFWMXBuYzJZd0NpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}], "timestampVerificationData": {}}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "hJ2oevTfE3cQwXluJ2qVX3qFyflxCBBnyPVl0Vw1Kgk="}, "signature": "MEQCIFs3B/hNON1V6MqZRLsFcG6U6B93kal/UKek/bDUoz61AiAfrvk+Yzc+HGdbXzdQCm7r9JSdMP+nGPNnUBg1hJp2IQ=="}}
@@ -0,0 +1 @@
+{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICzjCCAlSgAwIBAgIUfnOGm4U1QCsCXWiDvPy5Tgni2HUwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNjAzMTkyNzM1WhcNMjUwNjAzMTkzNzM1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpTsf/wrCdu4Domf4WOtO4CLkj51wmj4iesYv5N6DYhghPjqQFwGYI9gFc/WX6QMIWh5YHU2NGxrmM7KfbAYzz6OCAXMwggFvMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUkQ2/O4Fivj1bTq7NTQczm1RdtYAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wIgYDVR0RAQH/BBgwFoEUcGFibG9nc2FsQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGLBgorBgEEAdZ5AgQCBH0EewB5AHcA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGXN0NwGwAABAMASDBGAiEA6pD8PjS+5z2SQre/NS/wOdFSjVMsxvtfF6A1jg+1T3YCIQDC44S/Z3c0dNddM7EkE+A3j7Vft3hqRUoFkNe4U6g5qTAKBggqhkjOPQQDAwNoADBlAjA6lBI2r3KCZFc+2affpH3S3Xj3gMOKh8Lr5Z7TgkGp3Q6QsnExGmJJ0leXhqH6rQkCMQDfxk/6DyhbO7KTrIUfmrbZoa7dV75cresJS69Xk67XN57qsqY52DZj9o4fbUIw4ro="}, "tlogEntries": [{"logIndex": "228953871", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1748978856", "inclusionPromise": {"signedEntryTimestamp": "MEUCIQC9nXmfcRqyOL2Zmw1zI7+kulTbmDE3Yfzew81mXJGU4QIgF8Uhdg2uzttSA6erOuEchX68PCyJ0cVFHE0XJX2+ZfE="}, "inclusionProof": {"logIndex": "107049609", "rootHash": "Ilofw5POqC/C3zqfrdMQP1DyhNW+UfB9fHdjrbK6qaM=", "treeSize": "107049610", "hashes": ["AcD1iyjU7nuIPqAq29ynz7PEdq6zPXglj6e2tkH+/do=", "1BNDCN01B3dbUo/TfLaQgKIYTvPyrkcrHKd69GxuF2E=", "t59A0CV2pHM2S9AgZgcEA6FbXhgNZGo0jMRIXHiqsJ0=", "bCrkgWpJ8MBic+mIfCRsKi+5XAMqgM8Lc6G0LLfzZ7M=", "4iwdOrGkcqdN0qqZUx/gv8a8qpLMqVj8aXRVmhQ558c=", "mAX/zvx1jR0ujLtDApsQpHyxmoDGidClHMOn0BX1aQA=", "u5LKLBPTYgXZg0fBi6/8LuEeNy3EBAxJF0AkkB4Co6E=", "SPUVncwJRVX/n/RICCYqLpAzraqx7S0eMdXRr1RLRgg=", "uEJFtwcGQJMd9kjQhkXb7gl2WD3WMElCc15uDFvFGxs=", "VdOKzpQhJlpXgijzXANf/hNlje1G/N1kUuVnKNskkso=", "mta5fH/gFwxJ/0fT8yGpn3sFCY0G1RY555Iflm0LInM=", "7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n107049610\nIlofw5POqC/C3zqfrdMQP1DyhNW+UfB9fHdjrbK6qaM=\n\n\u2014 rekor.sigstore.dev wNI9ajBGAiEAjtzTnsnrGx0G3Dg99s89cPUh6EA+cxkicQ9j4qYU60wCIQCKcAL4kdakbq2JrBVgk7bRNf3FoJRrEI6SCjv16f7Crg==\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI4ZmI1ZjlmYmM3NjA5ZmE4MjJjYjMxNTQ5ODg0NTc1ZGI3ZmQ5NjU3Y2JmZmI4OTUxMGI1ZDc5NzU5NjNhODNhIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUM5Q1JZRjNSWGUzdDNxQlBJd2UrR3pMMTJCOXVLTjIrRFpWa2JjZW1FTS93SWdPMDFKaVhnbUJxZEN5RVhoM05JUEt5QlRBb2hpcjZHTkhZdXhiSUxKNDlRPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVd4VFowRjNTVUpCWjBsVlptNVBSMjAwVlRGUlEzTkRXRmRwUkhaUWVUVlVaMjVwTWtoVmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDVxUVhwTlZHdDVUbnBOTVZkb1kwNU5hbFYzVG1wQmVrMVVhM3BPZWsweFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZ3VkhObUwzZHlRMlIxTkVSdmJXWTBWMDkwVHpSRFRHdHFOVEYzYldvMGFXVnpXWFlLTlU0MlJGbG9aMmhRYW5GUlJuZEhXVWs1WjBaakwxZFlObEZOU1Zkb05WbElWVEpPUjNoeWJVMDNTMlppUVZsNmVqWlBRMEZZVFhkblowWjJUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZyVVRJdkNrODBSbWwyYWpGaVZIRTNUbFJSWTNwdE1WSmtkRmxCZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsbldVUldVakJTUVZGSUwwSkNaM2RHYjBWVlkwZEdhV0pIT1c1ak1rWnpVVWhDTldSSGFIWmlhVFYyWTIxamQwdFJXVXRMZDFsQ1FrRkhSQXAyZWtGQ1FWRlJZbUZJVWpCalNFMDJUSGs1YUZreVRuWmtWelV3WTNrMWJtSXlPVzVpUjFWMVdUSTVkRTFEYzBkRGFYTkhRVkZSUW1jM09IZEJVV2RGQ2toUmQySmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5TVWRNUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJTUVVS1pYZENOVUZJWTBFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIxaE9NRTUzUjNkQlFRcENRVTFCVTBSQ1IwRnBSVUUyY0VRNFVHcFRLelY2TWxOUmNtVXZUbE12ZDA5a1JsTnFWazF6ZUhaMFprWTJRVEZxWnlzeFZETlpRMGxSUkVNME5GTXZDbG96WXpCa1RtUmtUVGRGYTBVclFUTnFOMVptZEROb2NWSlZiMFpyVG1VMFZUWm5OWEZVUVV0Q1oyZHhhR3RxVDFCUlVVUkJkMDV2UVVSQ2JFRnFRVFlLYkVKSk1uSXpTME5hUm1Nck1tRm1abkJJTTFNeldHb3paMDFQUzJnNFRISTFXamRVWjJ0SGNETlJObEZ6YmtWNFIyMUtTakJzWlZob2NVZzJjbEZyUXdwTlVVUm1lR3N2TmtSNWFHSlBOMHRVY2tsVlptMXlZbHB2WVRka1ZqYzFZM0psYzBwVE5qbFlhelkzV0U0MU4zRnpjVmsxTWtSYWFqbHZOR1ppVlVsM0NqUnliejBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In19fX0="}], "timestampVerificationData": {}}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "j7X5+8dgn6giyzFUmIRXXbf9llfL/7iVELXXl1ljqDo="}, "signature": "MEUCIQC9CRYF3RXe3t3qBPIwe+GzL12B9uKN2+DZVkbcemEM/wIgO01JiXgmBqdCyEXh3NIPKyBTAohir6GNHYuxbILJ49Q="}}
@@ -0,0 +1,43 @@
+Python 3 in SUSE
+==============
+
+* Subpackages *
+
+Python 3 is split into several subpackages, based on external dependencies.
+The main package 'python3' has soft dependencies on all subpackages needed to
+assemble the standard library; however, these might not all be installed by default.
+
+If you attempt to import a module that is currently not installed, an ImportError is thrown,
+with instructions to install the missing subpackage. Installing the subpackage might result
+in installing libraries that the subpackage requires to function.
+
+
+* ensurepip *
+
+The 'ensurepip' module from Python 3 standard library (PEP 453) is supposed to deploy
+a bundled copy of the pip installer. This makes no sense in a managed distribution like SUSE.
+Instead, you need to install package 'python3-pip'. Usually this will be installed automatically
+with 'python3'.
+
+Using 'ensurepip' when pip is not installed will result in an ImportError with instructions
+to install 'python3-pip'.
+
+
+* Documentation *
+
+You can find documentation in seprarate packages: python3-doc and
+python3-doc-pdf. These contan following documents:
+
+    Tutorial, What's New in Python, Global Module Index, Library Reference,
+    Macintosh Module Reference, Installing Python Modules, Distributing Python
+    Modules, Language Reference, Extending and Embedding, Python/C API,
+    Documenting Python 
+
+The python3-doc package constains many text files from source tarball.
+
+
+* Interactive mode *
+
+Interactive mode is by default enhanced with of history and command completion.
+If you don't like these features, you can unset the PYTHONSTARTUP variable
+in your .profile or disable it system wide in /etc/profile.d/python.sh.
@@ -0,0 +1,29 @@
+Description: Add platform triplets for LoongArch.
+
+---
+ configure.ac |   14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/configure.ac
+++ b/configure.ac
+@@ -976,6 +976,20 @@ cat > conftest.c <<EOF
+         hppa-linux-gnu
+ # elif defined(__ia64__)
+         ia64-linux-gnu
+# elif defined(__loongarch__)
+#  if defined(__loongarch_lp64)
+#   if defined(__loongarch_soft_float)
+        loongarch64-linux-gnusf
+#   elif defined(__loongarch_single_float)
+        loongarch64-linux-gnuf32
+#   elif defined(__loongarch_double_float)
+        loongarch64-linux-gnu
+#   else
+#    error unknown platform triplet
+#   endif
+#  else
+#   error unknown platform triplet
+#  endif
+ # elif defined(__m68k__) && !defined(__mcoldfire__)
+         m68k-linux-gnu
+ # elif defined(__mips_hard_float) && defined(__mips_isa_rev) && (__mips_isa_rev >=6) && defined(_MIPSEL)
@@ -0,0 +1,3 @@
+python311-base
+python311
+libpython3_11-1_0
@@ -0,0 +1,173 @@
+From 5754521af1d51aa8e445cba07a093bbc0c88596d Mon Sep 17 00:00:00 2001
+From: Zackery Spytz <zspytz@gmail.com>
+Date: Mon, 16 Dec 2019 18:24:08 -0700
+Subject: [PATCH] bpo-31046: ensurepip does not honour the value of $(prefix)
+
+Co-Authored-By: Xavier de Gaye <xdegaye@gmail.com>
+---
+ Doc/library/ensurepip.rst                                       |    9 +++--
+ Lib/ensurepip/__init__.py                                       |   18 +++++++---
+ Lib/test/test_ensurepip.py                                      |   11 ++++++
+ Makefile.pre.in                                                 |    4 +-
+ Misc/NEWS.d/next/Build/2019-12-16-17-50-42.bpo-31046.XA-Qfr.rst |    1 
+ 5 files changed, 34 insertions(+), 9 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Build/2019-12-16-17-50-42.bpo-31046.XA-Qfr.rst
+
+Index: Python-3.11.8/Doc/library/ensurepip.rst
+===================================================================
+--- Python-3.11.8.orig/Doc/library/ensurepip.rst
+++ Python-3.11.8/Doc/library/ensurepip.rst
+@@ -59,7 +59,9 @@ is at least as recent as the one availab
+ By default, ``pip`` is installed into the current virtual environment
+ (if one is active) or into the system site packages (if there is no
+ active virtual environment). The installation location can be controlled
+-through two additional command line options:
+through some additional command line options:
+
+* ``--prefix <dir>``: Installs ``pip`` using the given directory prefix.
+ 
+ * :samp:`--root {dir}`: Installs ``pip`` relative to the given root directory
+   rather than the root of the currently active virtual environment (if any)
+@@ -92,7 +94,7 @@ Module API
+    Returns a string specifying the available version of pip that will be
+    installed when bootstrapping an environment.
+ 
+-.. function:: bootstrap(root=None, upgrade=False, user=False, \
+.. function:: bootstrap(root=None, prefix=None, upgrade=False, user=False, \
+                         altinstall=False, default_pip=False, \
+                         verbosity=0)
+ 
+@@ -102,6 +104,8 @@ Module API
+    If *root* is ``None``, then installation uses the default install location
+    for the current environment.
+ 
+   *prefix* specifies the directory prefix to use when installing.
+
+    *upgrade* indicates whether or not to upgrade an existing installation
+    of an earlier version of ``pip`` to the available version.
+ 
+@@ -122,6 +126,8 @@ Module API
+    *verbosity* controls the level of output to :data:`sys.stdout` from the
+    bootstrapping operation.
+ 
+   .. versionchanged:: 3.9 the *prefix* parameter was added.
+
+    .. audit-event:: ensurepip.bootstrap root ensurepip.bootstrap
+ 
+    .. note::
+Index: Python-3.11.8/Lib/ensurepip/__init__.py
+===================================================================
+--- Python-3.11.8.orig/Lib/ensurepip/__init__.py
+++ Python-3.11.8/Lib/ensurepip/__init__.py
+@@ -122,27 +122,27 @@ def _disable_pip_configuration_settings(
+     os.environ['PIP_CONFIG_FILE'] = os.devnull
+ 
+ 
+-def bootstrap(*, root=None, upgrade=False, user=False,
+def bootstrap(*, root=None, prefix=None, upgrade=False, user=False,
+               altinstall=False, default_pip=False,
+               verbosity=0):
+     """
+     Bootstrap pip into the current Python installation (or the given root
+-    directory).
+    and directory prefix).
+ 
+     Note that calling this function will alter both sys.path and os.environ.
+     """
+     # Discard the return value
+-    _bootstrap(root=root, upgrade=upgrade, user=user,
+    _bootstrap(root=root, prefix=prefix, upgrade=upgrade, user=user,
+                altinstall=altinstall, default_pip=default_pip,
+                verbosity=verbosity)
+ 
+ 
+-def _bootstrap(*, root=None, upgrade=False, user=False,
+def _bootstrap(*, root=None, prefix=None, upgrade=False, user=False,
+               altinstall=False, default_pip=False,
+               verbosity=0):
+     """
+     Bootstrap pip into the current Python installation (or the given root
+-    directory). Returns pip command status code.
+    and directory prefix). Returns pip command status code.
+ 
+     Note that calling this function will alter both sys.path and os.environ.
+     """
+@@ -192,6 +192,8 @@ def _bootstrap(*, root=None, upgrade=Fal
+         args = ["install", "--no-cache-dir", "--no-index", "--find-links", tmpdir]
+         if root:
+             args += ["--root", root]
+        if prefix:
+            args += ["--prefix", prefix]
+         if upgrade:
+             args += ["--upgrade"]
+         if user:
+@@ -267,6 +269,11 @@ def _main(argv=None):
+         help="Install everything relative to this alternate root directory.",
+     )
+     parser.add_argument(
+        "--prefix",
+        default=None,
+        help="Install everything using this prefix.",
+    )
+    parser.add_argument(
+         "--altinstall",
+         action="store_true",
+         default=False,
+@@ -285,6 +292,7 @@ def _main(argv=None):
+ 
+     return _bootstrap(
+         root=args.root,
+        prefix=args.prefix,
+         upgrade=args.upgrade,
+         user=args.user,
+         verbosity=args.verbosity,
+Index: Python-3.11.8/Lib/test/test_ensurepip.py
+===================================================================
+--- Python-3.11.8.orig/Lib/test/test_ensurepip.py
+++ Python-3.11.8/Lib/test/test_ensurepip.py
+@@ -112,6 +112,17 @@ class TestBootstrap(EnsurepipMixin, unit
+             unittest.mock.ANY,
+         )
+ 
+    def test_bootstrapping_with_prefix(self):
+        ensurepip.bootstrap(prefix="/foo/bar/")
+        self.run_pip.assert_called_once_with(
+            [
+                "install", "--no-cache-dir", "--no-index", "--find-links",
+                unittest.mock.ANY, "--prefix", "/foo/bar/",
+                "setuptools", "pip",
+            ],
+            unittest.mock.ANY,
+        )
+
+     def test_bootstrapping_with_user(self):
+         ensurepip.bootstrap(user=True)
+ 
+Index: Python-3.11.8/Makefile.pre.in
+===================================================================
+--- Python-3.11.8.orig/Makefile.pre.in
+++ Python-3.11.8/Makefile.pre.in
+@@ -1761,7 +1761,7 @@ install: @FRAMEWORKINSTALLFIRST@ commoni
+ 			install|*) ensurepip="" ;; \
+ 		esac; \
+ 		$(RUNSHARED) $(PYTHON_FOR_BUILD) -m ensurepip \
+-			$$ensurepip --root=$(DESTDIR)/ ; \
+			$$ensurepip --root=$(DESTDIR)/ --prefix=$(prefix) ; \
+ 	fi
+ 
+ altinstall: commoninstall
+@@ -1771,7 +1771,7 @@ altinstall: commoninstall
+ 			install|*) ensurepip="--altinstall" ;; \
+ 		esac; \
+ 		$(RUNSHARED) $(PYTHON_FOR_BUILD) -m ensurepip \
+-			$$ensurepip --root=$(DESTDIR)/ ; \
+			$$ensurepip --root=$(DESTDIR)/ --prefix=$(prefix) ; \
+ 	fi
+ 
+ commoninstall:  check-clean-src @FRAMEWORKALTINSTALLFIRST@ \
+Index: Python-3.11.8/Misc/NEWS.d/next/Build/2019-12-16-17-50-42.bpo-31046.XA-Qfr.rst
+===================================================================
+--- /dev/null
+++ Python-3.11.8/Misc/NEWS.d/next/Build/2019-12-16-17-50-42.bpo-31046.XA-Qfr.rst
+@@ -0,0 +1 @@
+A directory prefix can now be specified when using :mod:`ensurepip`.
@@ -0,0 +1,21 @@
+From a3052035485bd2836e40f5284657ca105382cbfd Mon Sep 17 00:00:00 2001
+From: sobolevn <mail@sobolevn.me>
+Date: Tue, 5 Mar 2024 20:24:16 +0300
+Subject: [PATCH] gh-116112: Fix `ResourceWarning` in
+ `test_asyncio.test_stream`
+
+Co-authored-by: @CendioOssman
+---
+ Lib/test/test_asyncio/test_streams.py |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Lib/test/test_asyncio/test_streams.py
+++ b/Lib/test/test_asyncio/test_streams.py
+@@ -1156,6 +1156,7 @@ os.close(fd)
+ 
+     def test_unhandled_cancel(self):
+         async def handle_echo(reader, writer):
+            writer.close()
+             asyncio.current_task().cancel()
+         messages = self._basetest_unhandled_exceptions(handle_echo)
+         self.assertEqual(messages, [])
@@ -0,0 +1,37 @@
+From ac2b8869724d7a57d9b5efbdce2f20423214e8bb Mon Sep 17 00:00:00 2001
+From: "Bernhard M. Wiedemann" <bwiedemann@suse.de>
+Date: Tue, 16 Jul 2024 21:39:33 +0200
+Subject: [PATCH] Allow to override build date with SOURCE_DATE_EPOCH
+
+to make builds reproducible.
+See https://reproducible-builds.org/ for why this is good
+and https://reproducible-builds.org/specs/source-date-epoch/
+for the definition of this variable.
+---
+ Doc/conf.py               |    3 ++-
+ Doc/library/functions.rst |    2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/Doc/conf.py
+++ b/Doc/conf.py
+@@ -316,7 +316,8 @@ html_context = {
+ }
+ 
+ # This 'Last updated on:' timestamp is inserted at the bottom of every page.
+-html_last_updated_fmt = time.strftime('%b %d, %Y (%H:%M UTC)', time.gmtime())
+html_time = int(os.environ.get('SOURCE_DATE_EPOCH', time.time()))
+html_last_updated_fmt = time.strftime('%b %d, %Y (%H:%M UTC)', time.gmtime(html_time))
+ 
+ # Path to find HTML templates.
+ templates_path = ['tools/templates']
+--- a/Doc/library/functions.rst
+++ b/Doc/library/functions.rst
+@@ -1356,7 +1356,7 @@ are always available.  They are listed h
+    (where :func:`open` is declared), :mod:`os`, :mod:`os.path`, :mod:`tempfile`,
+    and :mod:`shutil`.
+ 
+-   .. audit-event:: open file,mode,flags open
+   .. audit-event:: open path,mode,flags open
+ 
+    The ``mode`` and ``flags`` arguments may have been modified or inferred from
+    the original call.
@@ -0,0 +1,17 @@
+---
+ Lib/distutils/util.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: Python-3.11.8/Lib/distutils/util.py
+===================================================================
+--- Python-3.11.8.orig/Lib/distutils/util.py
+++ Python-3.11.8/Lib/distutils/util.py
+@@ -436,7 +436,7 @@ byte_compile(files, optimize=%r, force=%
+     else:
+         from py_compile import compile
+ 
+-        for file in py_files:
+        for file in sorted(py_files):
+             if file[-3:] != ".py":
+                 # This lets us be lazy and not filter filenames in
+                 # the "install_lib" command.
@@ -0,0 +1,12 @@
+[externally-managed]
+Error=To install Python packages system-wide, try 
+ zypper install __PYTHONPREFIX__-xyz, where xyz is the package
+ you are trying to install.
+
+ If you wish to install a non-rpm packaged Python package,
+ create a virtual environment using __PYTHON__ -m venv path/to/venv.
+ Then use path/to/venv/bin/python and path/to/venv/bin/pip.
+
+ If you wish to install a non-rpm packaged Python application,
+ it may be easiest to use `pipx install xyz`, which will manage a
+ virtual environment for you. Install pipx via `zypper install __PYTHONPREFIX__-pipx` .
@@ -0,0 +1,40 @@
+---
+ Doc/using/configure.rst |    3 ---
+ Misc/NEWS               |    2 +-
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+--- a/Doc/using/configure.rst
+++ b/Doc/using/configure.rst
+@@ -43,7 +43,6 @@ General Options
+ 
+    See :data:`sys.int_info.bits_per_digit <sys.int_info>`.
+ 
+-.. option:: --with-cxx-main
+ .. option:: --with-cxx-main=COMPILER
+ 
+    Compile the Python ``main()`` function and link Python executable with C++
+@@ -529,13 +528,11 @@ macOS Options
+ 
+ See ``Mac/README.rst``.
+ 
+-.. option:: --enable-universalsdk
+ .. option:: --enable-universalsdk=SDKDIR
+ 
+    Create a universal binary build. *SDKDIR* specifies which macOS SDK should
+    be used to perform the build (default is no).
+ 
+-.. option:: --enable-framework
+ .. option:: --enable-framework=INSTALLDIR
+ 
+    Create a Python.framework rather than a traditional Unix install. Optional
+--- a/Misc/NEWS
+++ b/Misc/NEWS
+@@ -9911,7 +9911,7 @@ C API
+ - bpo-40939: Removed documentation for the removed ``PyParser_*`` C API.
+ 
+ - bpo-43795: The list in :ref:`limited-api-list` now shows the public name
+-  :c:struct:`PyFrameObject` rather than ``_frame``. The non-existing entry
+  :c:type:`PyFrameObject` rather than ``_frame``. The non-existing entry
+   ``_node`` no longer appears in the list.
+ 
+ - bpo-44378: :c:func:`Py_IS_TYPE` no longer uses :c:func:`Py_TYPE` to avoid
@@ -0,0 +1,82 @@
+From 3d390148c05a7ea2d401c4633e7d4db75ebf97d9 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Thu, 7 Nov 2024 11:07:02 +0100
+Subject: [PATCH] gh-126500: test_ssl: Don't stop ThreadedEchoServer on OSError
+ in ConnectionHandler; rely on __exit__ (GH-126503)
+
+If `read()` in the ConnectionHandler thread raises `OSError` (except `ConnectionError`),
+the ConnectionHandler shuts down the entire ThreadedEchoServer,
+preventing further connections.
+It also does that for `EPROTOTYPE` in `wrap_conn`.
+
+As far as I can see, this is done to avoid the server thread getting stuck,
+forgotten, in its accept loop. However, since 2011 (5b95eb90a7167285b6544b50865227c584943c9a)
+the server is used as a context manager, and its `__exit__` does `stop()` and `join()`.
+(I'm not sure if we *always* used `with` since that commit, but currently we do.)
+
+Make sure that the context manager *is* used, and remove the `server.stop()`
+calls from ConnectionHandler.
+(cherry picked from commit c9cda1608edf7664c10f4f467e24591062c2fe62)
+
+Co-authored-by: Petr Viktorin <encukou@gmail.com>
+---
+ Lib/test/test_ssl.py |   17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+Index: Python-3.11.12/Lib/test/test_ssl.py
+===================================================================
+--- Python-3.11.12.orig/Lib/test/test_ssl.py	2025-04-19 19:55:02.157545844 +0200
+++ Python-3.11.12/Lib/test/test_ssl.py	2025-04-19 19:55:05.014552345 +0200
+@@ -2516,7 +2516,6 @@
+                 # See also http://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/
+                 if e.errno != errno.EPROTOTYPE and sys.platform != "darwin":
+                     self.running = False
+-                    self.server.stop()
+                     self.close()
+                 return False
+             else:
+@@ -2651,10 +2650,6 @@
+                     self.close()
+                     self.running = False
+
+-                    # normally, we'd just stop here, but for the test
+-                    # harness, we want to stop the server
+-                    self.server.stop()
+-
+     def __init__(self, certificate=None, ssl_version=None,
+                  certreqs=None, cacerts=None,
+                  chatty=True, connectionchatty=False, starttls_server=False,
+@@ -2688,21 +2683,33 @@
+         self.conn_errors = []
+         threading.Thread.__init__(self)
+         self.daemon = True
+        self._in_context = False
+
+     def __enter__(self):
+        if self._in_context:
+            raise ValueError('Re-entering ThreadedEchoServer context')
+        self._in_context = True
+         self.start(threading.Event())
+         self.flag.wait()
+         return self
+
+     def __exit__(self, *args):
+        assert self._in_context
+        self._in_context = False
+         self.stop()
+         self.join()
+
+     def start(self, flag=None):
+        if not self._in_context:
+            raise ValueError(
+                'ThreadedEchoServer must be used as a context manager')
+         self.flag = flag
+         threading.Thread.start(self)
+
+     def run(self):
+        if not self._in_context:
+            raise ValueError(
+                'ThreadedEchoServer must be used as a context manager')
+         self.sock.settimeout(1.0)
+         self.sock.listen(5)
+         self.active = True
@@ -0,0 +1,35 @@
+From 1b3f6523a5c83323cdc44031b33a1c062e5dc698 Mon Sep 17 00:00:00 2001
+From: Xi Ruoyao <xry111@xry111.site>
+Date: Fri, 7 Jun 2024 23:51:32 +0800
+Subject: [PATCH] gh-120226: Fix
+ test_sendfile_close_peer_in_the_middle_of_receiving on Linux >= 6.10
+ (GH-120227)
+
+The worst case is that the kernel buffers 17 pages with a page size of 64k.
+(cherry picked from commit a7584245661102a5768c643fbd7db8395fd3c90e)
+
+Co-authored-by: Xi Ruoyao <xry111@xry111.site>
+---
+ Lib/test/test_asyncio/test_sendfile.py |   11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/Lib/test/test_asyncio/test_sendfile.py
+++ b/Lib/test/test_asyncio/test_sendfile.py
+@@ -93,13 +93,10 @@ class MyProto(asyncio.Protocol):
+ 
+ class SendfileBase:
+ 
+-    # 256 KiB plus small unaligned to buffer chunk
+-    # Newer versions of Windows seems to have increased its internal
+-    # buffer and tries to send as much of the data as it can as it
+-    # has some form of buffering for this which is less than 256KiB
+-    # on newer server versions and Windows 11.
+-    # So DATA should be larger than 256 KiB to make this test reliable.
+-    DATA = b"x" * (1024 * 256 + 1)
+    # Linux >= 6.10 seems buffering up to 17 pages of data.
+    # So DATA should be large enough to make this test reliable even with a
+    # 64 KiB page configuration.
+    DATA = b"x" * (1024 * 17 * 64 + 1)
+     # Reduce socket buffer size to test on relative small data sets.
+     BUF_SIZE = 4 * 1024   # 4 KiB
+ 
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- Copyright 2017 Zbigniew Jędrzejewski-Szmek -->
+<application>
+  <id type="desktop">idle3.desktop</id>
+  <name>IDLE3</name>
+  <metadata_licence>CC0</metadata_licence>
+  <project_license>Python-2.0</project_license>
+  <summary>Python 3 Integrated Development and Learning Environment</summary>
+  <description>
+    <p>
+      IDLE is Python’s Integrated Development and Learning Environment.
+      The GUI is uniform between Windows, Unix, and Mac OS X.
+      IDLE provides an easy way to start writing, running, and debugging
+      Python code.
+    </p>
+    <p>
+      IDLE is written in pure Python, and uses the tkinter GUI toolkit.
+      It provides:
+    </p>
+    <ul>
+       <li>a Python shell window (interactive interpreter) with colorizing of code input, output, and error messages,</li>
+       <li>a multi-window text editor with multiple undo, Python colorizing, smart indent, call tips, auto completion, and other features,</li>
+       <li>search within any window, replace within editor windows, and search through multiple files (grep),</li>
+       <li>a debugger with persistent breakpoints, stepping, and viewing of global and local namespaces.</li>
+    </ul>
+  </description>
+  <url type="homepage">https://docs.python.org/3/library/idle.html</url>
+  <screenshots>
+    <screenshot type="default">http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-main-window.png</screenshot>
+    <screenshot>http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-class-browser.png</screenshot>
+    <screenshot>http://in.waw.pl/~zbyszek/fedora/idle3-appdata/idle3-code-viewer.png</screenshot>
+  </screenshots>
+  <update_contact>zbyszek@in.waw.pl</update_contact>
+</application>
@@ -0,0 +1,12 @@
+[Desktop Entry]
+Version=1.0
+Name=IDLE 3
+GenericName=Python 3 IDE
+Comment=Python 3 Integrated Development and Learning Environment
+Exec=idle3 %F
+TryExec=idle3
+Terminal=false
+Type=Application
+Icon=idle3
+Categories=Development;IDE;
+MimeType=text/x-python;
@@ -0,0 +1,7 @@
+python311-curses: curses _curses _curses_panel
+python311-dbm: dbm _dbm _gdbm
+python311-idle: idlelib
+python311-testsuite: test _ctypes_test _testbuffer _testcapi _testinternalcapi _testimportmultiple _testmultiphase xxlimited
+python311-tk: tkinter _tkinter
+python311-tools: turtledemo
+python311: sqlite3 readline _sqlite3 nis
@@ -0,0 +1,23 @@
+import sys, os
+from sysconfig import get_path
+
+failed_map_path = os.path.join(get_path('stdlib'), '_import_failed', 'import_failed.map')
+
+if __spec__:
+    failed_name = __spec__.name
+else:
+    failed_name = __name__
+
+with open(failed_map_path) as fd:
+    for line in fd:
+        package = line.split(':')[0]
+        imports = line.split(':')[1]
+        if failed_name in imports:
+            raise ImportError(f"""Module '{failed_name}' is not installed.
+Use:
+  sudo zypper install {package}
+to install it.""")
+
+raise ImportError(f"""Module '{failed_name}' is not installed.
+It is supposed to be part of python3 distribution, but missing from failed import map.
+Please file a bug on the SUSE Bugzilla.""")
@@ -0,0 +1,28 @@
+%have_python3   1
+
+# commented out legacy macro definitions
+#py3_prefix /usr
+#py3_incdir /usr/include/python3.5m
+#py3_ver 3.5
+
+# these should now be provided by macros.python_all
+#python3_sitearch /usr/lib64/python3.5/site-packages
+#python3_sitelib /usr/lib/python3.5/site-packages
+#python3_version 3.5
+
+# hard to say if anyone ever used these?
+#py3_soflags cpython-35m-x86_64-linux-gnu
+#py3_abiflags m
+%cpython3_soabi   %(python3 -c "import sysconfig; print(sysconfig.get_config_var('SOABI'))")
+%py3_soflags      %cpython3_soabi
+
+# compilation macros that might be in use somewhere
+%py3_compile(O) \
+find %1 -name '*.pyc' -exec rm -f {} ";"\
+python3 -c "import sys, os, compileall; br='%{buildroot}'; compileall.compile_dir(sys.argv[1], ddir=br and (sys.argv[1][len(os.path.abspath(br)):]+'/') or None)" %1\
+%{-O:\
+find %1 -name '*.pyo' -exec rm -f {} ";"\
+python3 -O -c "import sys, os, compileall; br='%{buildroot}'; compileall.compile_dir(sys.argv[1], ddir=br and (sys.argv[1][len(os.path.abspath(br)):]+'/') or None)" %1\
+}
+
+
@@ -0,0 +1,653 @@
+only in patch2:
+unchanged:
+---
+ Doc/library/turtle.rst |   82 -------------------------------------------------
+ 1 file changed, 82 deletions(-)
+
+--- a/Doc/library/turtle.rst
+++ b/Doc/library/turtle.rst
+@@ -440,7 +440,6 @@ Turtle motion
+    turtle is headed.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.position()
+       (0.00,0.00)
+@@ -467,7 +466,6 @@ Turtle motion
+       >>> turtle.goto(0, 0)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.position()
+       (0.00,0.00)
+@@ -486,13 +484,11 @@ Turtle motion
+    orientation depends on the turtle mode, see :func:`mode`.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :hide:
+ 
+       >>> turtle.setheading(22)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.heading()
+       22.0
+@@ -511,13 +507,11 @@ Turtle motion
+    orientation depends on the turtle mode, see :func:`mode`.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :hide:
+ 
+       >>> turtle.setheading(22)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.heading()
+       22.0
+@@ -540,13 +534,11 @@ Turtle motion
+    not change the turtle's orientation.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :hide:
+ 
+       >>> turtle.goto(0, 0)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> tp = turtle.pos()
+       >>> tp
+@@ -570,13 +562,11 @@ Turtle motion
+    unchanged.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :hide:
+ 
+       >>> turtle.goto(0, 240)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.position()
+       (0.00,240.00)
+@@ -592,13 +582,11 @@ Turtle motion
+    Set the turtle's second coordinate to *y*, leave first coordinate unchanged.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :hide:
+ 
+       >>> turtle.goto(0, 40)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.position()
+       (0.00,40.00)
+@@ -625,7 +613,6 @@ Turtle motion
+    =================== ====================
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.setheading(90)
+       >>> turtle.heading()
+@@ -638,14 +625,12 @@ Turtle motion
+    its start-orientation (which depends on the mode, see :func:`mode`).
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :hide:
+ 
+       >>> turtle.setheading(90)
+       >>> turtle.goto(0, -10)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.heading()
+       90.0
+@@ -677,7 +662,6 @@ Turtle motion
+    calculated automatically.  May be used to draw regular polygons.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.position()
+@@ -706,7 +690,6 @@ Turtle motion
+ 
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.dot()
+@@ -724,7 +707,6 @@ Turtle motion
+    it by calling ``clearstamp(stamp_id)``.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.color("blue")
+       >>> turtle.stamp()
+@@ -740,7 +722,6 @@ Turtle motion
+    Delete stamp with given *stampid*.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.position()
+       (150.00,-0.00)
+@@ -785,7 +766,6 @@ Turtle motion
+    undo actions is determined by the size of the undobuffer.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> for i in range(4):
+       ...     turtle.fd(50); turtle.lt(80)
+@@ -818,7 +798,6 @@ Turtle motion
+    turtle turn instantly.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.speed()
+       3
+@@ -839,7 +818,6 @@ Tell Turtle's state
+    Return the turtle's current location (x,y) (as a :class:`Vec2D` vector).
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.pos()
+       (440.00,-0.00)
+@@ -855,7 +833,6 @@ Tell Turtle's state
+    orientation which depends on the mode - "standard"/"world" or "logo".
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.goto(10, 10)
+       >>> turtle.towards(0,0)
+@@ -867,7 +844,6 @@ Tell Turtle's state
+    Return the turtle's x coordinate.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.left(50)
+@@ -883,7 +859,6 @@ Tell Turtle's state
+    Return the turtle's y coordinate.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.left(60)
+@@ -900,7 +875,6 @@ Tell Turtle's state
+    :func:`mode`).
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.left(67)
+@@ -917,7 +891,6 @@ Tell Turtle's state
+    other turtle, in turtle step units.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.distance(30,40)
+@@ -941,7 +914,6 @@ Settings for measurement
+    Default value is 360 degrees.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.left(90)
+@@ -964,7 +936,6 @@ Settings for measurement
+    ``degrees(2*math.pi)``.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.left(90)
+@@ -975,7 +946,6 @@ Settings for measurement
+       1.5707963267948966
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :hide:
+ 
+       >>> turtle.degrees(360)
+@@ -1011,7 +981,6 @@ Drawing state
+    thickness.  If no argument is given, the current pensize is returned.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.pensize()
+       1
+@@ -1043,7 +1012,6 @@ Drawing state
+    attributes in one statement.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :options: +NORMALIZE_WHITESPACE
+ 
+       >>> turtle.pen(fillcolor="black", pencolor="red", pensize=10)
+@@ -1066,7 +1034,6 @@ Drawing state
+    Return ``True`` if pen is down, ``False`` if it's up.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.penup()
+       >>> turtle.isdown()
+@@ -1107,7 +1074,6 @@ Color control
+    newly set pencolor.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> colormode()
+       1.0
+@@ -1156,7 +1122,6 @@ Color control
+    with the newly set fillcolor.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.fillcolor("violet")
+       >>> turtle.fillcolor()
+@@ -1195,7 +1160,6 @@ Color control
+    with the newly set colors.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.color("red", "green")
+       >>> turtle.color()
+@@ -1212,7 +1176,6 @@ Filling
+ ~~~~~~~
+ 
+ .. doctest::
+-   :skipif: _tkinter is None
+    :hide:
+ 
+    >>> turtle.home()
+@@ -1222,7 +1185,6 @@ Filling
+    Return fillstate (``True`` if filling, ``False`` else).
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.begin_fill()
+       >>> if turtle.filling():
+@@ -1247,7 +1209,6 @@ Filling
+    above may be either all yellow or have some white regions.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.color("black", "red")
+       >>> turtle.begin_fill()
+@@ -1264,7 +1225,6 @@ More drawing control
+    variables to the default values.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.goto(0,-22)
+       >>> turtle.left(100)
+@@ -1315,7 +1275,6 @@ Visibility
+    drawing observably.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.hideturtle()
+ 
+@@ -1326,7 +1285,6 @@ Visibility
+    Make the turtle visible.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.showturtle()
+ 
+@@ -1357,7 +1315,6 @@ Appearance
+    deal with shapes see Screen method :func:`register_shape`.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.shape()
+       'classic'
+@@ -1383,7 +1340,6 @@ Appearance
+    ``resizemode("user")`` is called by :func:`shapesize` when used with arguments.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.resizemode()
+       'noresize'
+@@ -1407,7 +1363,6 @@ Appearance
+    of the shape's outline.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.shapesize()
+       (1.0, 1.0, 1)
+@@ -1432,7 +1387,6 @@ Appearance
+    heading of the turtle are sheared.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.shape("circle")
+       >>> turtle.shapesize(5,2)
+@@ -1449,7 +1403,6 @@ Appearance
+    change the turtle's heading (direction of movement).
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.reset()
+       >>> turtle.shape("circle")
+@@ -1469,7 +1422,6 @@ Appearance
+    (direction of movement).
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.reset()
+       >>> turtle.shape("circle")
+@@ -1495,7 +1447,6 @@ Appearance
+    turtle (its direction of movement).
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.reset()
+       >>> turtle.shape("circle")
+@@ -1524,7 +1475,6 @@ Appearance
+    given matrix.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle = Turtle()
+       >>> turtle.shape("square")
+@@ -1540,7 +1490,6 @@ Appearance
+    can be used to define a new shape or components of a compound shape.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.shape("square")
+       >>> turtle.shapetransform(4, -1, 0, 2)
+@@ -1565,7 +1514,6 @@ Using events
+    procedural way:
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> def turn(x, y):
+       ...     left(180)
+@@ -1586,7 +1534,6 @@ Using events
+    ``None``, existing bindings are removed.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> class MyTurtle(Turtle):
+       ...     def glow(self,x,y):
+@@ -1614,7 +1561,6 @@ Using events
+    mouse-click event on that turtle.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.ondrag(turtle.goto)
+ 
+@@ -1642,7 +1588,6 @@ Special Turtle methods
+    Return the last recorded polygon.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.home()
+       >>> turtle.begin_poly()
+@@ -1662,7 +1607,6 @@ Special Turtle methods
+    turtle properties.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> mick = Turtle()
+       >>> joe = mick.clone()
+@@ -1675,7 +1619,6 @@ Special Turtle methods
+    return the "anonymous turtle":
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> pet = getturtle()
+       >>> pet.fd(50)
+@@ -1689,7 +1632,6 @@ Special Turtle methods
+    TurtleScreen methods can then be called for that object.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> ts = turtle.getscreen()
+       >>> ts
+@@ -1707,7 +1649,6 @@ Special Turtle methods
+    ``None``, the undobuffer is disabled.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> turtle.setundobuffer(42)
+ 
+@@ -1717,7 +1658,6 @@ Special Turtle methods
+    Return number of entries in the undobuffer.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> while undobufferentries():
+       ...     undo()
+@@ -1740,7 +1680,6 @@ below:
+    For example:
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> s = Shape("compound")
+       >>> poly1 = ((0,0),(10,-5),(0,10),(-10,-5))
+@@ -1751,7 +1690,6 @@ below:
+ 3. Now add the Shape to the Screen's shapelist and use it:
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> register_shape("myshape", s)
+       >>> shape("myshape")
+@@ -1771,7 +1709,6 @@ Most of the examples in this section ref
+ ``screen``.
+ 
+ .. doctest::
+-   :skipif: _tkinter is None
+    :hide:
+ 
+    >>> screen = Screen()
+@@ -1788,7 +1725,6 @@ Window control
+    Set or return background color of the TurtleScreen.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.bgcolor("orange")
+       >>> screen.bgcolor()
+@@ -1880,7 +1816,6 @@ Window control
+    distorted.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.reset()
+       >>> screen.setworldcoordinates(-50,-7.5,50,7.5)
+@@ -1891,7 +1826,6 @@ Window control
+       ...     left(45); fd(2)   # a regular octagon
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+       :hide:
+ 
+       >>> screen.reset()
+@@ -1913,7 +1847,6 @@ Animation control
+    Optional argument:
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.delay()
+       10
+@@ -1935,7 +1868,6 @@ Animation control
+    :func:`delay`).
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.tracer(8, 25)
+       >>> dist = 2
+@@ -1972,7 +1904,6 @@ Using screen events
+    must have the focus. (See method :func:`listen`.)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> def f():
+       ...     fd(50)
+@@ -1993,7 +1924,6 @@ Using screen events
+    must have focus. (See method :func:`listen`.)
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> def f():
+       ...     fd(50)
+@@ -2018,7 +1948,6 @@ Using screen events
+    named ``turtle``:
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.onclick(turtle.goto) # Subsequently clicking into the TurtleScreen will
+       >>>                             # make the turtle move to the clicked point.
+@@ -2038,7 +1967,6 @@ Using screen events
+    Install a timer that calls *fun* after *t* milliseconds.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> running = True
+       >>> def f():
+@@ -2120,7 +2048,6 @@ Settings and special methods
+    ============ ========================= ===================
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> mode("logo")   # resets turtle heading to north
+       >>> mode()
+@@ -2135,7 +2062,6 @@ Settings and special methods
+    values of color triples have to be in the range 0..*cmode*.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.colormode(1)
+       >>> turtle.pencolor(240, 160, 80)
+@@ -2156,7 +2082,6 @@ Settings and special methods
+    do with a Tkinter Canvas.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> cv = screen.getcanvas()
+       >>> cv
+@@ -2168,7 +2093,6 @@ Settings and special methods
+    Return a list of names of all currently available turtle shapes.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.getshapes()
+       ['arrow', 'blank', 'circle', ..., 'turtle']
+@@ -2192,7 +2116,6 @@ Settings and special methods
+        coordinates: Install the corresponding polygon shape.
+ 
+        .. doctest::
+-          :skipif: _tkinter is None
+ 
+           >>> screen.register_shape("triangle", ((5,-3), (0,5), (-5,-3)))
+ 
+@@ -2208,7 +2131,6 @@ Settings and special methods
+    Return the list of turtles on the screen.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> for turtle in screen.turtles():
+       ...     turtle.color("red")
+@@ -2270,7 +2192,6 @@ Methods specific to Screen, not inherite
+                   center window vertically
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.setup (width=200, height=200, startx=0, starty=0)
+       >>>              # sets window to 200x200 pixels, in upper left of screen
+@@ -2286,7 +2207,6 @@ Methods specific to Screen, not inherite
+    Set title of turtle window to *titlestring*.
+ 
+    .. doctest::
+-      :skipif: _tkinter is None
+ 
+       >>> screen.title("Welcome to the turtle zoo!")
+ 
+@@ -2357,7 +2277,6 @@ Public classes
+       Example:
+ 
+       .. doctest::
+-         :skipif: _tkinter is None
+ 
+          >>> poly = ((0,0),(10,-5),(0,10),(-10,-5))
+          >>> s = Shape("compound")
+@@ -2743,7 +2662,6 @@ Changes since Python 3.0
+ 
+ 
+ .. doctest::
+-   :skipif: _tkinter is None
+    :hide:
+ 
+    >>> for turtle in turtles():
@@ -0,0 +1,78 @@
+#!/bin/bash
+
+export LC_ALL=C
+
+master=python*.spec
+
+# create import_failed.map from package definitions
+pkgname=$(grep python_pkg_name $master |grep define |awk -F' ' '{print $3}')
+MAPFILE=import_failed.map
+function new_map_line () {
+    package=$1
+    package=$(echo $1 |sed -e "s:%{python_pkg_name}:$pkgname:")
+    modules=$2
+    if [ -z "$package" -o -z "$modules" ]; then
+        return
+    fi
+    if [[ "$package" =~ "-base" ]]; then
+        return
+    fi
+    echo "$package:$modules" >> $MAPFILE.tmp
+}
+
+for spec in *.spec; do
+    basename=${spec%.spec}
+    package=
+    modules=
+    while read line; do
+        case $line in
+            "%files -n "*)
+                new_map_line $package "$modules"
+                package=${line#"%files -n "}
+                modules=
+                ;;
+            "%files "*)
+                new_map_line $package "$modules"
+                package=$basename-${line#"%files "}
+                modules=
+                ;;
+            "%files")
+                new_map_line $package "$modules"
+                package=$basename
+                modules=
+                ;;
+            "%{sitedir}/config-"*)
+                # ignore
+                ;;
+            "%{sitedir}/"*)
+                word=${line#"%{sitedir}/"}
+                if ! echo $word | grep -q /; then
+                    modules="$modules $word"
+                fi
+                ;;
+            "%{dynlib "*"}")
+                word=${line#"%{dynlib "}
+                word=${word%"}"}
+                modules="$modules $word"
+                ;;
+        esac
+    done < $spec
+    new_map_line $package "$modules"
+done
+
+cat $MAPFILE.tmp |sort -u > $MAPFILE
+rm $MAPFILE.tmp
+
+# run test inclusion check
+tar xJf Python-*.xz 
+python3 skipped_tests.py
+
+# generate baselibs.conf
+VERSION=$(grep ^Version $master|awk -F':' '{print $2}' |sed -e 's/ //g')
+python_version=${VERSION:0:3}                   # 3.3
+python_version_abitag=${python_version//./}     # 33
+python_version_soname=${python_version//./_}    # 3_3
+echo "$pkgname-base" > baselibs.conf
+echo "$pkgname" >> baselibs.conf
+echo "libpython$python_version_soname-1_0" >> baselibs.conf
+
@@ -0,0 +1,27 @@
+---
+ Makefile.pre.in |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+Index: Python-3.11.8/Makefile.pre.in
+===================================================================
+--- Python-3.11.8.orig/Makefile.pre.in
+++ Python-3.11.8/Makefile.pre.in
+@@ -1240,11 +1240,18 @@ Modules/getbuildinfo.o: $(PARSER_OBJS) \
+ 		$(DTRACE_OBJS) \
+ 		$(srcdir)/Modules/getbuildinfo.c
+ 	$(CC) -c $(PY_CORE_CFLAGS) \
+	      -DDATE="\"`date -u -r Makefile.pre.in +"%b %d %Y"`\"" \
+	      -DTIME="\"`date -u -r Makefile.pre.in +"%T"`\"" \
+ 	      -DGITVERSION="\"`LC_ALL=C $(GITVERSION)`\"" \
+ 	      -DGITTAG="\"`LC_ALL=C $(GITTAG)`\"" \
+ 	      -DGITBRANCH="\"`LC_ALL=C $(GITBRANCH)`\"" \
+ 	      -o $@ $(srcdir)/Modules/getbuildinfo.c
+ 
+Python/getcompiler.o: $(srcdir)/Python/getcompiler.c Makefile
+	$(CC) -c $(PY_CORE_CFLAGS) \
+		-DCOMPILER='"[GCC]"' \
+		-o $@ $(srcdir)/Python/getcompiler.c
+
+ Modules/getpath.o: $(srcdir)/Modules/getpath.c Python/frozen_modules/getpath.h Makefile $(PYTHON_HEADERS)
+ 	$(CC) -c $(PY_CORE_CFLAGS) -DPYTHONPATH='"$(PYTHONPATH)"' \
+ 		-DPREFIX='"$(prefix)"' \
@@ -0,0 +1,13 @@
+Index: Python-3.11.8/Lib/site.py
+===================================================================
+--- Python-3.11.8.orig/Lib/site.py
+++ Python-3.11.8/Lib/site.py
+@@ -77,7 +77,7 @@ import io
+ import stat
+ 
+ # Prefixes for site-packages; add additional prefixes like /usr/local here
+-PREFIXES = [sys.prefix, sys.exec_prefix]
+PREFIXES = [sys.prefix, sys.exec_prefix, '/usr/local']
+ # Enable per user site-packages directory
+ # set it to False to disable the feature or True to force the feature
+ ENABLE_USER_SITE = None
@@ -0,0 +1,17 @@
+---
+ Lib/test/test_posix.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: Python-3.11.8/Lib/test/test_posix.py
+===================================================================
+--- Python-3.11.8.orig/Lib/test/test_posix.py
+++ Python-3.11.8/Lib/test/test_posix.py
+@@ -430,7 +430,7 @@ class PosixTester(unittest.TestCase):
+     def test_posix_fadvise(self):
+         fd = os.open(os_helper.TESTFN, os.O_RDONLY)
+         try:
+-            posix.posix_fadvise(fd, 0, 0, posix.POSIX_FADV_WILLNEED)
+            posix.posix_fadvise(fd, 0, 0, posix.POSIX_FADV_RANDOM)
+         finally:
+             os.close(fd)
+ 
@@ -0,0 +1,109 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFq+ToQBEADRYvIVtbK6owynD3j3nxwpW2KEk/p+aDvtXmc2SR2dBcZ8sFW2
+R5vEsG8d3/D3wgv5pcL3KfNNXQYUnXVbobrFUUWQYc79qIsE3MgiPf5NVOtwKPUR
+i5g9YJgKvpBxkQfqp3LYGm9ZBtwo3DVLA3yn7KsazCmAgTNFJYw7ku1XxgmIzY6K
+5J30DfbJiqDqj4f9GslCCCCH3qiPnuLG/HUyVLHMpbWlaiy9NI0GcaLxjJewHj9w
+W2D2lydkxe5JGo7egUkV3ILcuLVSVKA35SKY27dYqfuyqp9tAzaRbjDYjsYdHA6G
+BqrNrKBn/GwlFDPrVdcvN3ZSY2wMLTxWE3Axc/FweuHxFnou/80FwX7F3JD+oEQ6
+rofmcxOBCC7J98I7HZAhP9jBn88XIS2hztbLq8d6rZJZRtcz0k61VR0ddO+TrFmf
+9rMYCPgCckRtVxeFIVIabrN1IzKynLFeo040h8hSGswd6YKDOVwjJY6Oa6EmVefZ
+a8QSt4+M65RSzH6SEPY008F3nJUAK6MEkzTak+tFltZNrVWu8p2xd1j9nmxAwEhZ
+/lgbxLqzYgaUWmfyHeZ8yVA0MhHzdiAL8nVUEdG3KecIq0RWCJLGLWWIjd6KAJl1
+yAmhRYKK/sjPDsL3elHsFACfZbyx3o5GGQNlas1FYoPLWbaNGaJtgFTF2QARAQAB
+tCtQYWJsbyBHYWxpbmRvIFNhbGdhZG8gPHBhYmxvZ3NhbEBnbWFpbC5jb20+iQJO
+BBMBCgA4FiEEoDXIwZIZuoIezqhrZOYo+NaEaW0FAlq+ToQCGwMFCwkIBwMFFQoJ
+CAsFFgIDAQACHgECF4AACgkQZOYo+NaEaW2bmA/+PXIap2udLoUVOHxnsIBdqYwp
+sv1Aj5lfIJmNhmxPbHShwp1Jg+w4urxe+2Dj5ofKVlIo1i83bQkvnKJMDXDVuc/K
+P6zqhBJ3rT4Q3qx2mzX8bIfQoJ2JHuH4lkP+I7doDcHHRyeNASyk72VdQmU4twNw
+Ibn8nSNV6ThKHdoPYzVnO2rZUFcGIqH5HNsvR+B7cc1MBCHsgURYwSVhSePIFGlZ
+iasdBD6QQkDSe4QWi7AcJFWFElw4kbOKJWxAWsrEk+tMXJVGRjnmL289EmPCx/vx
+BqKy7Mse0yWCSRR3vB+O6TB1S5SgEyEgqlYsfGNv1qf/rfRD4KkyCbNU3LhY1Aim
+vJP4pDW+KFxTk2Ks8vrx8gOSd2aFqPeO/pFDrpsF7PD62XwsfoXu4xc5V0Giw7r1
+Nai0nax7kOrldNF8TbbtRjW0jmoC7wLIDujAkwDIOroZ0CXA3N4HVHdSbrHm/urX
+nyxJXupXAQNwGx64JCBcbF2fp3Kvu1VAXBEFnd01KaopthHcbG5pA50Kl2Vhe+98
+OdezUX42fHkQpQkB7HgtXfm6W1bw6YRBamrNvs1OoHBYmUjlECpe566IIu25Hc8s
+x3qA+6eca7iqizyLG+WyMT8ZIYTWGAS59jxwR4esqGczbbZPSAPHFwLbGv7Wr0Rd
+TPu5B0FcKpDkTd4IxQW5Ag0EWr5O2gEQAMjLe4CtbSfofmJrz5wfNkMVsZ81Gbqe
+MoYd3dtkJnQYERUj8flzBj3ucaxGJ+Cuf7ybh3naPopKvEI1q0vkcgCDqrEgXK//
+jKJbP28uPSMGhOG28q4PbamG55gy5FtM3ezzAxPWWKe9qBpV65GMmFy7eBQx2iJs
+yiDIOOQQ4kraS+cTqNFimEXAGLCOQRNLcwIZzwAAHoW7HEpNUfVwaBD9kMlbo1ND
+I60IKcNrNcmcmRxhJqfxjj8YBMwcKHO6GBE3AVpaE/+UO9zyr4TH+0YuQUgxKlPW
+Dkg5XlkDo0S1GyLY5e9ckIDIlkTdDa2pOkoE2yB5MQCEga3YiHrKUVTTWaxn9XVJ
+6x5ZjUF6bgSWGkrG5dUqSYoO1iDMuNVjtiujNyf/rvfj5cNxS7/lgxchhQKZHZXL
+WVqxlneeVJ6s0P4+ROVG9ga2Sve7aUJ6wXIewZwulBcV2sE/W/DgxHgLBi53CUQt
+vEzFzKvo48GnDqL5VYjA7l0HMYHd4GksCLi8E8U6Cgj+imXiM8voL7pHRZfs8mY8
+udR+UT4e1Scl2MYP2qBJ9/17B/X52B3s1EZdqI/r+hfOyqrhPs+dbAN0mtMPn68+
+nrvY1+nscvrSYEP6ZBlc9Hp2mgJdb6IcTvINXBEeLRjgc3pjViva443pkiFp9Axm
+ecOckMKP3uSlABEBAAGJBGwEGAEKACAWIQSgNcjBkhm6gh7OqGtk5ij41oRpbQUC
+Wr5O2gIbAgJACRBk5ij41oRpbcF0IAQZAQoAHRYhBM/cokWxBDzypfl4Zf/odAQW
+i9hHBQJavk7aAAoJEP/odAQWi9hHr7YP/RCLre1CmOoWYpAtoa1yVCeYMDV6eQgL
+B488/BEZHQE1zbrYy16XkhORob3JF/kUMjmJW7XaFF8FrWvRcdj/xaUGbOOEulKg
+v+8zWfswYQRiZ4/JlwER4vRLi6fTE89MVER6Fkj2ASD4D2cifY+EztD4flV3sq3s
+vIogGFaN9IvdrdeptOVGXs1RmAyoTsiS2mKQ6xsGh8B9ZAm55W8fBOGiSzLX21Xk
+Ofdw53BrFQxn3cu/JgIKpdeZxgukcvEAI62B6X+YL6Na4j0eqEGLzsNtU1+xeJlo
+WtVvmRwnRHGSxF6fzIZ3mk/p/aFiXAEq/xITCTY6tDv7x7pFE/RpdlJZyNJ+R5Y4
+SQiuDsylxNCa/4G5EB6q+7iVYtbEQ9MnZg2phowEE42tlj0rz8/rvDK3LH3xibot
+KHIodCWKlWByxH99u2PuHUQ0c1oCVBUE1KkruMpvI236DpU/dvdq4JLSg/fWrys/
+VIjqLZgsIE5g/KO9XqngWHkLcBLh4CNAmHJ8Iia+s+/rfgsejQWB5uJb6eYg2JjB
+4WP1EI0rULM6fdrCNB+MJ36wE2Lnb4bfT0phOMgjjH5/Ki7ZCbkxkOsBs4SRjiS+
+weCsmpAtMqodWY/Cnw9pWSA/qLSRD5/mKeb9SO6OZ/OPfAatwnGHsvZ2sAueC6rR
+04W5BfXZWrnJUXQP/id/EKE1Ksp5fKoxSCbkKTCig+Sf5Afwe36yFN+niZBqzn5b
+BgL/HIKaZM97oDHersPPANeEgS+JVlBf95iKIYnQbZP43FLVbvOuaINhBIVtFO54
+2Y7EYwl41kP7ILDElVy36KAmdQyBAfrjnZiRA70xShOxApLug1L0lxhR3YfmLwNi
+RJ0V6KnYDKf0pfdhO9VFyFFWUojX1usn2SmSsXNizsNtvRqHXzPnX0rbJzZ9+N4O
+9k1nxygYFG/2R/jGonVmTjRzcAHrAkNJETMWXMA7/8wRMDwluz8j+cCldey9x8Vk
+JwgLGnZSbQtVpcFAnm5r/36Gt+9wc1VWMyrUrVr6Z679aqAbG7PMaeR5h5ygMj1k
+VqRTYAUPSk1f8bZKRssQkQwEbp9dVIjm9SsR8VT7/tB+UuB85dABxgHfv3psJRT+
+tL8g9V7kSZqQfcLNGmvEVvr2Zl9NtxwXtsFM2OBprxCenwb+e9Ppm1LjfJG/NE72
+mAnOERfDaiLt4bqNo36Ei5sGCJ4Fx61phzNBXzkdRNM47i8J5UZRKFkE91c99BVM
+HKUaY61NRK24fR0zP98ftDU82YFw0VRFJpTeBrO5ivN1MlQxUPzUWxKxMxO+20wa
+UOXroEw11Tb4SRLGOla1pCl6lCUPJRy9IzadPDgTr/OTMkob/snt/XLdnV5/uQIN
+BFq+TvoBEAC8Oy1g6pPWBbrCMhIq7VWY2fjylJ1fwg5BPXkOKVK1dsGYO4QD7oW9
+L0aSqcFSNFGF9Cl0Ri4TFXZC3hnG4HeSXUWApuKdBLn21H3jba36Ay1oGcGfdm0v
+Zght4c6BlMVBpGCw2wIkJbUNEy6InMM+O8CCbbaH3iJkJ4141P7pODHignx5AmZI
+conMui4YOhC+IXQXynVEv1Juk7erB1Nh1RcRvsA4lb44HWx49lIwe85ejOmoZ0O3
+6f9NJRer6bV0+rHWmg4IV5Q9h/Gn4IhEDZxA0DZl1RQI7dMgaMbIFbXGq7Kgzstz
+EUnOoy29hXodxVmwIsMrAiQUYtwJ9hW+ESsw47+W2iPHVgviGWl7r/SgcgMYmf6m
+5kiTBtwU7BQPS9G3zwwP2Rm3AA/6g39Q+tQKjOwi1I8+GZsY2On44Zly7BreBNg5
+4gJgdAGcMOYU9etr050clH3UpTYcAEtX++ahtOKhJgLIPNcIAQNlnifqvU0VYpgw
+R4YpZ7hgg+AVDzC73PIM0lFI0XiDuqChbxE+K1jmLXWe5iJF0dzgVTwP+PmsifNZ
+Wg3+YxSsS+hDMPQ2xPiQN49gT4JJDHcDuyhHyCGYgyMiVJCsku9KrkubbfVRivyN
+ZF2Zfo3f+nbrRxsftz0yjAq8byCvb0V0XOpt4pJ/ddlug9ytRxALNwARAQABiQI2
+BBgBCgAgFiEEoDXIwZIZuoIezqhrZOYo+NaEaW0FAlq+TvoCGwwACgkQZOYo+NaE
+aW3urA//UQ/cKQ7HvWjcLphzQOZc+6m5YL0wxvZkSjemU7mqjZdpacteIvRAoers
+EqXHc208liIBtNfRzoreXdcXNzie65xXkrRnWoHVH/fTWy4lOnHr2CMXLeHjUgg/
+M6PYi8+sARm05YFB8nsYhlhx3IdLhcfeVVbJedQKO0yL3CK1okT30DUVq5Lq6X/K
+DC6AxuJR3D6UMSoT0WLaoX8qbhAp88qLynInfBVL18d97h916WPLTPeP0eHwhwND
+bYtKDCMDuKQ9XX5+QsNH0RmbxlX274LHrUMMvkLKxcfCBvP+iuqrBeIuoeVzXYJZ
+j7ZJtEH79bW44eecl/CY/STFYgSQ2XGTp2BI2q60wAmtKlNhwxY5ena0FgyFl6Tm
+5OBHW/Pwo+ndQJGfbrCyWkTgRay9c8er3gl3GQYIBH6X0kCiG7h/Epj0b5CHOPU5
+hCw0kEB8MB4poTIjeiY+Q01472/lQ68CL3DX158hR5d3XaPSIxAN+qFsfB1o316p
+yjxhfK1MD/IfrOgjlggPPnc/KmLkCzpgdwKcZwLCdZq9hYBvF1Zs34HbaVMYbWTK
+uxLowtXGU43vatCXXqmPOvl4/g4tZD6rysJDgOrHQnEHzT+Napn07s0BRC0IbbNn
+FynUrkr5KMSuRz7Hg7xMApENOrb0nqdHSUJ914ZpuMIS6RhJgGu5Ag0EWr5PIAEQ
+ALfh9vPD2B+miHDTMADI8aRZ7g9tnzynZYkk3+2sCiiusetsQQ+HIPJ/ASEJB7On
+ane9dyT/LTRhrK9qaxgVMimk2COXB/xyh7Mnw7nJgFU0aRSbtX0vbvQz2suSzrQ6
+9mPKzan28JGoClqB0bw1vwf3VjjxHV2dgD57CmqFPv7kAC/2a56dE+etzXattZAL
+2JWTpmfQ0ePRRadtBm0VahQhnU8x0+jvAVrEawqpVW83ozYFyW/0WInM2J7jHgQ
+16OosY4lj5L/DxpVxaArhRFoRfWPXfC37iE8Mou/I95isvPQIhp1wTo4jG0KM02B
+oIVbp/QRNBQ6WtpOzvJs1gqQiJJTfqbKJXQ3NDEY9crpVS83HJ+Zv99PNsyNkFjG
+QpU84U3ZhsI4ygjdY45mpZueqI1RVcRQdu8Hgvoo/78Q/Sir6gMGop3mVdVo2guI
+kFcJrXh0Xk3ech4aVqrmKx/mPXGwOAQU0DAul4RW3fKg1QxQE7Tlw3+95Ee/+q5j
+HARL0uDbCJpRO8Sl8NDEuL32n/2Ot6kQeCSHrU7KJRYAkTxkKvr8zNow7hFhHFPE
+SnHvTnskI6noh0VY6NwMhmLvhm0wKkRxZPzUNc3sgLvbK1NymIZ9aKCZamzhZrmG
+vnblEz/OSLwGUua465H3hM1vvBQiartj7+6ZqWIkSmBPABEBAAGJAjYEGAEKACAW
+IQSgNcjBkhm6gh7OqGtk5ij41oRpbQUCWr5PIAIbIAAKCRBk5ij41oRpbWmeEACG
+axtDC8UoNp9ORiYwEWLzZWDuugE+ah7DYYGD4Vs633FXVZW3SgM/bFtJ/0Lg8CF
+74jI4LMHyIjDzEjcoItwnhBLix+kUoJTvrY58GPydwekLuw1p4KXLqtRs4fsZbNQ
+YTknl4jYtRWoxO98x7tun7Gq2gqmJkIB2uj630fKz5cBk6p6oDFKjzyrHe+V7BiK
+3okQPaD4x7hq8OnTy7lOy92ZZAqztS4tNEb4DkYW1MpuwsJ7hbBZitc1siI+FVVb
+GjVVGZz6ssXoW67Tz8+VxdWJxNLXlv27eMcj4sme5S0th/YYNA5fRRv6zuzqZAru
+YNGLpYYU7JLvZJ+3lCwa5j5ycOGBF0GvsGs6gj6h+CHkjR/BgzAgWC+GgUgslt6q
+aH04rWtV6rVz+Y91LcrX5P6OM4anmXD3Gp3kl35AypXb4KyASF19+11RUziD4Z7q
+wQEWfbwOltNyZv2lD8s2jPr7P02axWRQUbZAEhxRmvOQev/FZPyCF6gqUo/HxRbQ
+y3bzmnipyHSv1DlXNfCFCHvN8kGyZnRWARqIKRg+j9ediJgOUqlLhg6KmrTVxd5v
+3Dfv52PW2UODDTM20s3cQGuX/UswzMRwPI/+P44iCMwEKdm7duM/5oisZT9Vhy7g
+P15MreFZLcZvUVgjqgy0u57cstyGK1Bo9e2sFcK2fA==
+=6Zb4
+-----END PGP PUBLIC KEY BLOCK-----
@@ -0,0 +1,4 @@
+addFilter("pem-certificate.*/usr/lib.*/python.*/test/*.pem")
+addFilter("devel-file-in-non-devel-package.*/usr/lib.*/python.*/tests/*.c")
+addFilter("devel-file-in-non-devel-package.*/usr/lib.*/python.*/test/*.cpp")
+addFilter("python-bytecode-inconsistent-mtime.*\.pyc")
@@ -0,0 +1,23 @@
+---
+ Lib/test/test_capi/test_misc.py |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/Lib/test/test_capi/test_misc.py
+++ b/Lib/test/test_capi/test_misc.py
+@@ -40,6 +40,8 @@ import _testinternalcapi
+ # Were we compiled --with-pydebug or with #define Py_DEBUG?
+ Py_DEBUG = hasattr(sys, 'gettotalrefcount')
+ 
+# Which version of the SLE distro we build on?
+SLE_VERSION = int(os.environ.get('SLE_VERSION', '0'), 10)
+ 
+ NULL = None
+ 
+@@ -1281,6 +1283,7 @@ class PyMemDebugTests(unittest.TestCase)
+     def test_pyobject_forbidden_bytes_is_freed(self):
+         self.check_pyobject_is_freed('check_pyobject_forbidden_bytes_is_freed')
+ 
+    @unittest.skipIf(0 < SLE_VERSION < 150300, 'Failing on Leap 15.*')
+     def test_pyobject_freed_is_freed(self):
+         self.check_pyobject_is_freed('check_pyobject_freed_is_freed')
+ 
@@ -0,0 +1,15 @@
+---
+ Lib/test/support/__init__.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Lib/test/support/__init__.py
+++ b/Lib/test/support/__init__.py
+@@ -384,7 +384,7 @@ def skip_if_buildbot(reason=None):
+     if not reason:
+         reason = 'not suitable for buildbots'
+     try:
+-        isbuildbot = getpass.getuser().lower() == 'buildbot'
+        isbuildbot = getpass.getuser().lower() in ['buildbot', 'abuild']
+     except (KeyError, EnvironmentError) as err:
+         warnings.warn(f'getpass.getuser() failed {err}.', RuntimeWarning)
+         isbuildbot = False
@@ -0,0 +1,69 @@
+#!/usr/bin/python3
+"""
+Simple regexp-based skipped test checker.
+It lists tests that are mentioned (presumably for exclusion)
+in BASE, and in MAIN (presumably for inclusion)
+and reports discrepancies.
+
+This will have a number of 
+"""
+
+MAIN = "python39.spec"
+
+import glob
+import re
+from os.path import basename
+
+alltests = set()
+qemu_exclusions = set()
+
+for item in glob.glob("Python-*/Lib/test/test_*"):
+    testname = basename(item)
+    if testname.endswith(".py"):
+        testname = testname[:-3]
+    alltests.add(testname)
+
+testre = re.compile(r'[\s"](test_\w+)\b')
+
+def find_tests_in_spec(specname):
+    global qemu_exclusions
+
+    found_tests = set()
+    with open(specname) as spec:
+        in_qemu = False
+        for line in spec:
+            line = line.strip()
+            if "#" in line:
+                line = line[:line.index("#")]
+            tests = set(testre.findall(line))
+            found_tests |= tests
+            if line == "%if 0%{?qemu_user_space_build} > 0":
+                in_qemu = True
+            if in_qemu:
+                if line == "%endif":
+                    in_qemu = False
+                qemu_exclusions |= tests
+    return found_tests
+
+excluded = find_tests_in_spec(MAIN)
+
+#print("--- excluded tests:", " ".join(sorted(excluded)))
+#print("--- included tests:", " ".join(sorted(included)))
+
+mentioned = excluded
+nonexistent = mentioned - alltests
+missing = excluded - qemu_exclusions
+
+print("--- the following tests are excluded for QEMU and not tested in python")
+print("--- (that probably means we don't need to worry about them)")
+for test in sorted(qemu_exclusions - excluded):
+    print(test)
+
+print("--- the following tests might be excluded in python:")
+for test in sorted(missing):
+    print(test)
+
+if nonexistent:
+    print("--- the following tests don't exist:")
+    for test in sorted(nonexistent):
+        print(test)
@@ -0,0 +1,18 @@
+---
+ Lib/test/test_subprocess.py |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+Index: Python-3.11.8/Lib/test/test_subprocess.py
+===================================================================
+--- Python-3.11.8.orig/Lib/test/test_subprocess.py
+++ Python-3.11.8/Lib/test/test_subprocess.py
+@@ -280,7 +280,8 @@ class ProcessTestCase(BaseTestCase):
+                      "time.sleep(3600)"],
+                     # Some heavily loaded buildbots (sparc Debian 3.x) require
+                     # this much time to start and print.
+-                    timeout=3)
+                    # OBS might require even more
+                    timeout=10)
+             self.fail("Expected TimeoutExpired.")
+         self.assertEqual(c.exception.output, b'BDFL')
+
				`@@ -0,0 +1 @@`
				{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICzDCCAlOgAwIBAgIUWcRolJPsPmtJKA6VkjHSj7PtjY8wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQxMjAzMTgxOTA1WhcNMjQxMjAzMTgyOTA1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEN+fBJCRZIAZiWPBdjyQVD+x5vgmjuuVct1HkPHIBMuEe7wI4mBG2BhJ3fHkpr97efIH6ELMmPV99edyAIZFXR6OCAXIwggFuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUkutZdHfCCSvGI87mjnBRwZB8ihYwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wIgYDVR0RAQH/BBgwFoEUcGFibG9nc2FsQHB5dGhvbi5vcmcwKQYKKwYBBAGDvzABAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGTjb9QlwAABAMARzBFAiEA4ddSINhYM+p0+DGzRqnA8rVtJF9YgI+9znXiq9fqQNkCIEErcSnQmN8jjErhwWWtcTM5GgH4ka/uk5kdHTycwxj3MAoGCCqGSM49BAMDA2cAMGQCMFmkCEH2pCBpFeFiUi2uA4opcJP6vh/zqb+D0tbxqd+jwbBkuDxDqA9/Ao3UWop+twIwO9o71KAlYWPSPYMeZERM4R8zWlp9mVJPiK3tgOJJi40MNmxwtfsQeQtncqiQLBAH"}, "tlogEntries": [{"logIndex": "153122039", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1733249946", "inclusionPromise": {"signedEntryTimestamp": "MEUCIBL9zpVJtljIuZtAe8uptLfDmakmbAjy5ELp2q8WJTQ7AiEAv6lIpyJZycHwTS+JHYJFzMVv0SmA8yQ0eMneBivMhPY="}, "inclusionProof": {"logIndex": "31217777", "rootHash": "BMKHBPePzSbNqf2NyF/Ejuyy3troRGpNS41Dqe43nZ0=", "treeSize": "31217778", "hashes": ["lrr8dxmtgD09fnZTo1tMTY00HNKc2ZIpbZa1djDeTes=", "yFxGSg1RDbtZ/eNftnMdBJGNEZmmLyx2ZRDFtAIMHAk=", "GeqsQGnvgc+gcuaIC+vQ5b0RdTyBxBnYTpbeW2AeD+Q=", "dMTPeN/a9xCQQP+Hz7sddW0pPj8n54sfkhcf3XhjrMM=", "XjayhjKU3shP7q7lhmhKDv3Vpi4gJgAPCu0KlEzc9Qo=", "go1dmexQYS5etu69upRRX7IFvuA0rIcT9aYjMstmPIU=", "AYwr74Bm2w383UnS7DdbZUUAhusq28JoxKpWrQ7OvGQ=", "u+yWmGIR6sAH32wiSy22mz1Yf+jfPdBTjFbyRISuTZw=", "3eFC7Gp4fWecybDOAw9uUTrM1xB7YRYRAGsfYkiQbV8=", "1uKk2qjOliHMiTk906jrchP8mXWsRG8apaU1sa0lfh0=", "oOecFfN3YqDOkbijS/ej1WF5Da/Gt/AZNhbwE9uoOE8=", "4lUF0YOu9XkIDXKXA0wMSzd6VeDY3TZAgmoOeWmS2+Y=", "gf+9m552B3PnkWnO0o4KdVvjcT3WVHLrCbf1DoVYKFw="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n31217778\nBMKHBPePzSbNqf2NyF/Ejuyy3troRGpNS41Dqe43nZ0=\n\n\u2014 rekor.sigstore.dev wNI9ajBEAiA7ed0HqugBwVpmxDAR1VN35J91/+DeRdj09y5lFY+bRwIgYe07JnZlJvp3MfAMXX3i4XBsZoDRZoXtwfBaRj/8x8s=\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyYTk5MjBjN2EwY2QyMzZkZTMzNjQ0ZWQ5ODBhMTNjYmJjMjEwNThiZmRjNTI4ZmViYjYwODE1NzVlZDczYmUzIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJRU5KSGllaWs5WkVibW83a0p4ZUhWY2FvVDVYOUxyWG1zRTVxc1I5R1JpSEFpRUFtcHZyV21vUHF5YzRpQ09VYXVmY3dKTllMK1lPTWU0b0NOaWRLVGduT1FBPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZSRU5EUVd4UFowRjNTVUpCWjBsVlYyTlNiMnhLVUhOUWJYUktTMEUyVm10cVNGTnFOMUIwYWxrNGQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFJlRTFxUVhwTlZHZDRUMVJCTVZkb1kwNU5hbEY0VFdwQmVrMVVaM2xQVkVFeFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZPSzJaQ1NrTlNXa2xCV21sWFVFSmthbmxSVmtRcmVEVjJaMjFxZFhWV1kzUXhTR3NLVUVoSlFrMTFSV1UzZDBrMGJVSkhNa0pvU2pObVNHdHdjamszWldaSlNEWkZURTF0VUZZNU9XVmtlVUZKV2taWVVqWlBRMEZZU1hkblowWjFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZyZFhSYUNtUklaa05EVTNaSFNUZzNiV3B1UWxKM1drSTRhV2haZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsbldVUldVakJTUVZGSUwwSkNaM2RHYjBWVlkwZEdhV0pIT1c1ak1rWnpVVWhDTldSSGFIWmlhVFYyWTIxamQwdFJXVXRMZDFsQ1FrRkhSQXAyZWtGQ1FWRlJZbUZJVWpCalNFMDJUSGs1YUZreVRuWmtWelV3WTNrMWJtSXlPVzVpUjFWMVdUSTVkRTFEYzBkRGFYTkhRVkZSUW1jM09IZEJVV2RGQ2toUmQySmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5TVWRMUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJZDBVS1pXZENORUZJV1VFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIxUnFZamxSYkhkQlFRcENRVTFCVW5wQ1JrRnBSVUUwWkdSVFNVNW9XVTByY0RBclJFZDZVbkZ1UVRoeVZuUktSamxaWjBrck9YcHVXR2x4T1daeFVVNXJRMGxGUlhKalUyNVJDbTFPT0dwcVJYSm9kMWRYZEdOVVRUVkhaMGcwYTJFdmRXczFhMlJJVkhsamQzaHFNMDFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbU5CVFVkUlEwMUdiV3NLUTBWSU1uQkRRbkJHWlVacFZXa3lkVUUwYjNCalNsQTJkbWd2ZW5GaUswUXdkR0o0Y1dRcmFuZGlRbXQxUkhoRWNVRTVMMEZ2TTFWWGIzQXJkSGRKZHdwUE9XODNNVXRCYkZsWFVGTlFXVTFsV2tWU1RUUlNPSHBYYkhBNWJWWktVR2xMTTNSblQwcEthVFF3VFU1dGVIZDBabk5SWlZGMGJtTnhhVkZNUWtGSUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}]}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "Kpkgx6DNI23jNkTtmAoTy7whBYv9xSj+u2CBV17XO+M="}, "signature": "MEUCIENJHieik9ZEbmo7kJxeHVcaoT5X9LrXmsE5qsR9GRiHAiEAmpvrWmoPqyc4iCOUaufcwJNYL+YOMe4oCNidKTgnOQA="}}