From cb554c7d4cb6223ddc5f81153edb68e9aad4f74d681e48fe7a9afd2191b95a14 Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Wed, 2 Jul 2025 11:27:27 +0000 Subject: [PATCH 1/4] Accepting request 1289841 from home:dgarcia:branches:devel:languages:python:Factory - Use one core to build doc. This will make sphinx doc build reproducible. bsc#1243155 OBS-URL: https://build.opensuse.org/request/show/1289841 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=108 --- python313.changes | 7 +++++++ python313.spec | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/python313.changes b/python313.changes index d098403..e9abecf 100644 --- a/python313.changes +++ b/python313.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Tue Jul 1 08:23:22 UTC 2025 - Daniel Garcia + +- Use one core to build doc. This will make sphinx doc build + reproducible. + bsc#1243155 + ------------------------------------------------------------------- Sat Jun 21 14:32:16 UTC 2025 - Marcus Meissner diff --git a/python313.spec b/python313.spec index 50abd0c..da469f5 100644 --- a/python313.spec +++ b/python313.spec @@ -562,7 +562,7 @@ TODAY_DATE=`date -r %{SOURCE0} "+%%B %%d, %%Y"` cd Doc sed -i "s/^today = .*/today = '$TODAY_DATE'/" conf.py -%make_build -j1 html +%make_build -j1 JOBS=1 html # Build also devhelp files sphinx-build -a -b devhelp . build/devhelp From b30cd19ff8956662c47409c846074eb9f39eac8a350863e8c4b638ece7169fee Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Wed, 2 Jul 2025 13:52:43 +0000 Subject: [PATCH 2/4] - Add bsc1243155-sphinx-non-determinism.patch (bsc#1243155) to generate ids for audit_events using docname (reproducible builds). OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=109 --- bsc1243155-sphinx-non-determinism.patch | 45 +++++++++++++++++++++++++ python313.changes | 7 ++++ python313.spec | 3 ++ 3 files changed, 55 insertions(+) create mode 100644 bsc1243155-sphinx-non-determinism.patch diff --git a/bsc1243155-sphinx-non-determinism.patch b/bsc1243155-sphinx-non-determinism.patch new file mode 100644 index 0000000..55259e9 --- /dev/null +++ b/bsc1243155-sphinx-non-determinism.patch @@ -0,0 +1,45 @@ +From 906a590df191f66f4f0c4a70e3edb6fd82c156ef Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Tue, 1 Jul 2025 12:13:28 +0200 +Subject: [PATCH] Doc: Generate ids for audit_events using docname + +This patch generates ids for audit_events using the docname so the id is +not global but depend on the source file. This make the doc build +reproducible with multiple cores because it doesn't which file is parsed +first, the id for audit_events will always be consistent independently +of what file is parsed first. + +https://github.com/python/cpython/issues/130979 +--- + Doc/tools/extensions/audit_events.py | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +Index: Python-3.13.5/Doc/tools/extensions/audit_events.py +=================================================================== +--- Python-3.13.5.orig/Doc/tools/extensions/audit_events.py 2025-07-02 15:51:58.388560540 +0200 ++++ Python-3.13.5/Doc/tools/extensions/audit_events.py 2025-07-02 15:51:58.411254070 +0200 +@@ -72,8 +72,13 @@ + logger.warning(msg) + return + +- def id_for(self, name) -> str: +- source_count = len(self.sources.get(name, set())) ++ def _source_count(self, name, docname) -> int: ++ """Count the event name in the same source""" ++ sources = self.sources.get(name, set()) ++ return len([s for s, t in sources if s == docname]) ++ ++ def id_for(self, name, docname) -> str: ++ source_count = self._source_count(name, docname) + name_clean = re.sub(r"\W", "_", name) + return f"audit_event_{name_clean}_{source_count}" + +@@ -148,7 +153,7 @@ + except (IndexError, TypeError): + target = None + if not target: +- target = self.env.audit_events.id_for(name) ++ target = self.env.audit_events.id_for(name, self.env.docname) + ids.append(target) + self.env.audit_events.add_event(name, args, (self.env.docname, target)) + diff --git a/python313.changes b/python313.changes index e9abecf..4fb3055 100644 --- a/python313.changes +++ b/python313.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Wed Jul 2 13:14:28 UTC 2025 - Matej Cepl + +- Add bsc1243155-sphinx-non-determinism.patch (bsc#1243155) to + generate ids for audit_events using docname (reproducible + builds). + ------------------------------------------------------------------- Tue Jul 1 08:23:22 UTC 2025 - Daniel Garcia diff --git a/python313.spec b/python313.spec index da469f5..78b8b3b 100644 --- a/python313.spec +++ b/python313.spec @@ -228,6 +228,9 @@ Patch41: doc-py38-to-py36.patch # PATCH-FIX-UPSTREAM gh126985-mv-pyvenv.cfg2getpath.patch mcepl@suse.com # Remove tests failing in test_sysconfig Patch42: gh126985-mv-pyvenv.cfg2getpath.patch +# PATCH-FIX-UPSTREAM bsc1243155-sphinx-non-determinism.patch bsc#1243155 mcepl@suse.com +# Doc: Generate ids for audit_events using docname +Patch43: bsc1243155-sphinx-non-determinism.patch BuildRequires: autoconf-archive BuildRequires: automake BuildRequires: fdupes From 5584dde572c47f4e48796c89852ab5cacfa59e748cb714338f74a31558be6029 Mon Sep 17 00:00:00 2001 From: Matej Cepl Date: Wed, 2 Jul 2025 14:51:36 +0000 Subject: [PATCH 3/4] - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705). OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=110 --- CVE-2025-6069-quad-complex-HTMLParser.patch | 247 ++++++++++++++++++++ python313.changes | 7 + python313.spec | 3 + 3 files changed, 257 insertions(+) create mode 100644 CVE-2025-6069-quad-complex-HTMLParser.patch diff --git a/CVE-2025-6069-quad-complex-HTMLParser.patch b/CVE-2025-6069-quad-complex-HTMLParser.patch new file mode 100644 index 0000000..3336e74 --- /dev/null +++ b/CVE-2025-6069-quad-complex-HTMLParser.patch @@ -0,0 +1,247 @@ +From 9043edabc7e2f0dd655146e0a4571e2a0b2906af Mon Sep 17 00:00:00 2001 +From: Serhiy Storchaka +Date: Fri, 13 Jun 2025 19:57:48 +0300 +Subject: [PATCH] gh-135462: Fix quadratic complexity in processing special + input in HTMLParser (GH-135464) + +End-of-file errors are now handled according to the HTML5 specs -- +comments and declarations are automatically closed, tags are ignored. +(cherry picked from commit 6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41) + +Co-authored-by: Serhiy Storchaka +--- + Lib/html/parser.py | 41 +++- + Lib/test/test_htmlparser.py | 97 +++++++--- + Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst | 4 + 3 files changed, 111 insertions(+), 31 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2025-06-13-15-55-22.gh-issue-135462.KBeJpc.rst + +Index: Python-3.13.5/Lib/html/parser.py +=================================================================== +--- Python-3.13.5.orig/Lib/html/parser.py 2025-06-11 17:36:57.000000000 +0200 ++++ Python-3.13.5/Lib/html/parser.py 2025-07-02 16:49:52.020175099 +0200 +@@ -27,6 +27,7 @@ + attr_charref = re.compile(r'&(#[0-9]+|#[xX][0-9a-fA-F]+|[a-zA-Z][a-zA-Z0-9]*)[;=]?') + + starttagopen = re.compile('<[a-zA-Z]') ++endtagopen = re.compile('') + commentclose = re.compile(r'--\s*>') + # Note: +@@ -195,7 +196,7 @@ + k = self.parse_pi(i) + elif startswith("', i + 1) +- if k < 0: +- k = rawdata.find('<', i + 1) +- if k < 0: +- k = i + 1 ++ if starttagopen.match(rawdata, i): # < + letter ++ pass ++ elif startswith("'), +- ('comment', '/img'), +- ('endtag', 'html<')]) ++ ('data', '\n')]) + + def test_starttag_junk_chars(self): ++ self._run_check("<", [('data', '<')]) ++ self._run_check("<>", [('data', '<>')]) ++ self._run_check("< >", [('data', '< >')]) ++ self._run_check("< ", [('data', '< ')]) + self._run_check("", []) ++ self._run_check("<$>", [('data', '<$>')]) + self._run_check("", [('comment', '$')]) + self._run_check("", [('endtag', 'a')]) ++ self._run_check("", [('starttag', 'a", [('endtag', 'a'", [('data', "'", []) ++ self._run_check("", [('starttag', 'a$b', [])]) + self._run_check("", [('startendtag', 'a$b', [])]) + self._run_check("", [('starttag', 'a$b', [])]) + self._run_check("", [('startendtag', 'a$b', [])]) ++ self._run_check("", [('endtag', 'a$b')]) + + def test_slashes_in_starttag(self): + self._run_check('', [('startendtag', 'a', [('foo', 'var')])]) +@@ -576,21 +583,50 @@ + for html, expected in data: + self._run_check(html, expected) + +- def test_EOF_in_comments_or_decls(self): ++ def test_eof_in_comments(self): + data = [ +- ('', [('comment', '-!>')]), ++ ('' + '' + '' +@@ -604,6 +640,7 @@ + '' # required '[' after CDATA + ) + expected = [ ++ ('comment', 'ELEMENT br EMPTY'), + ('comment', ' not really a comment '), + ('comment', ' not a comment either --'), + ('comment', ' -- close enough --'), +@@ -684,6 +721,26 @@ + ('endtag', 'a'), ('data', ' bar & baz')] + ) + ++ @support.requires_resource('cpu') ++ def test_eof_no_quadratic_complexity(self): ++ # Each of these examples used to take about an hour. ++ # Now they take a fraction of a second. ++ def check(source): ++ parser = html.parser.HTMLParser() ++ parser.feed(source) ++ parser.close() ++ n = 120_000 ++ check(" + +- Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst + case quadratic complexity when processing certain crafted + malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705). + ------------------------------------------------------------------- Wed Jul 2 13:14:28 UTC 2025 - Matej Cepl diff --git a/python313.spec b/python313.spec index 78b8b3b..867d1d0 100644 --- a/python313.spec +++ b/python313.spec @@ -231,6 +231,9 @@ Patch42: gh126985-mv-pyvenv.cfg2getpath.patch # PATCH-FIX-UPSTREAM bsc1243155-sphinx-non-determinism.patch bsc#1243155 mcepl@suse.com # Doc: Generate ids for audit_events using docname Patch43: bsc1243155-sphinx-non-determinism.patch +# PATCH-FIX-UPSTREAM CVE-2025-6069-quad-complex-HTMLParser.patch bsc#1244705 mcepl@suse.com +# avoid quadratic complexity when processing malformed inputs with HTMLParser +Patch44: CVE-2025-6069-quad-complex-HTMLParser.patch BuildRequires: autoconf-archive BuildRequires: automake BuildRequires: fdupes From 8fc89fce82b25ad801f63cf454e88b97af5dba6062c69d17ae8f3bb5e8777471 Mon Sep 17 00:00:00 2001 From: Daniel Garcia Date: Thu, 10 Jul 2025 10:18:09 +0000 Subject: [PATCH 4/4] - Fix gil/nogil package description, bsc#1246229 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python313?expand=0&rev=111 --- python313.changes | 5 +++++ python313.spec | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/python313.changes b/python313.changes index 4a4e5d4..060b1ac 100644 --- a/python313.changes +++ b/python313.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Thu Jul 10 09:33:26 UTC 2025 - Daniel Garcia + +- Fix gil/nogil package description, bsc#1246229 + ------------------------------------------------------------------- Wed Jul 2 14:47:20 UTC 2025 - Matej Cepl diff --git a/python313.spec b/python313.spec index 867d1d0..810f05e 100644 --- a/python313.spec +++ b/python313.spec @@ -327,7 +327,7 @@ Installing "python3" is sufficient for the vast majority of usecases. In addition, recommended packages provide UI toolkit support (python3-curses, python3-tk), legacy UNIX database bindings (python3-dbm), and the IDLE development environment (python3-idle). -%if %{with GIL} +%if %{without GIL} This package has been built with the Global Interpreter Lock removed. This feature is still considered to be experimental. This package is @@ -448,7 +448,7 @@ This package contains the interpreter core and most commonly used modules from the standard library. This is sufficient for many usecases, but it excludes components that depend on external libraries, most notably XML, database and UI toolkits support. -%if %{with GIL} +%if %{without GIL} This package has been built with the Global Interpreter Lock removed. This feature is still considered to be experimental. This package is