diff --git a/CVE-2025-8291-consistency-zip64.patch b/CVE-2025-8291-consistency-zip64.patch index 83d846e..4a76545 100644 --- a/CVE-2025-8291-consistency-zip64.patch +++ b/CVE-2025-8291-consistency-zip64.patch @@ -10,17 +10,17 @@ prepended to the ZIP file. Co-authored-by: Serhiy Storchaka --- - Lib/test/test_zipfile/test_core.py | 82 ++++++++++++++++++- - Lib/zipfile/__init__.py | 51 +++++++----- - ...-10-07-19-31-34.gh-issue-139700.vNHU1O.rst | 3 + + Lib/test/test_zipfile/test_core.py | 82 +++++++++- + Lib/zipfile/__init__.py | 51 +++--- + Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst | 3 3 files changed, 113 insertions(+), 23 deletions(-) create mode 100644 Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst -diff --git a/Lib/test/test_zipfile/test_core.py b/Lib/test/test_zipfile/test_core.py -index c033059a515db6..6acfefc74d6665 100644 ---- a/Lib/test/test_zipfile/test_core.py -+++ b/Lib/test/test_zipfile/test_core.py -@@ -898,6 +898,8 @@ def make_zip64_file( +Index: Python-3.14.0/Lib/test/test_zipfile/test_core.py +=================================================================== +--- Python-3.14.0.orig/Lib/test/test_zipfile/test_core.py 2025-11-12 01:03:54.947094045 +0100 ++++ Python-3.14.0/Lib/test/test_zipfile/test_core.py 2025-11-12 01:04:11.766432381 +0100 +@@ -898,6 +898,8 @@ self, file_size_64_set=False, file_size_extra=False, compress_size_64_set=False, compress_size_extra=False, header_offset_64_set=False, header_offset_extra=False, @@ -29,7 +29,7 @@ index c033059a515db6..6acfefc74d6665 100644 ): """Generate bytes sequence for a zip with (incomplete) zip64 data. -@@ -951,6 +953,12 @@ def make_zip64_file( +@@ -951,6 +953,12 @@ central_dir_size = struct.pack(' 2: inferred = concat + offset_cd -@@ -289,16 +286,15 @@ def _EndRecData64(fpin, offset, endrec): +@@ -289,16 +286,15 @@ """ Read the ZIP64 end-of-archive records and use that to update endrec """ @@ -221,7 +221,7 @@ index 2969f735e8abb9..ac2332e58468a2 100644 sig, diskno, reloff, disks = struct.unpack(structEndArchive64Locator, data) if sig != stringEndArchive64Locator: return endrec -@@ -306,16 +302,33 @@ def _EndRecData64(fpin, offset, endrec): +@@ -306,16 +302,33 @@ if diskno != 0 or disks > 1: raise BadZipFile("zipfiles that span multiple disks are not supported") @@ -260,7 +260,7 @@ index 2969f735e8abb9..ac2332e58468a2 100644 # Update the original endrec using data from the ZIP64 record endrec[_ECD_SIGNATURE] = sig -@@ -325,6 +338,7 @@ def _EndRecData64(fpin, offset, endrec): +@@ -325,6 +338,7 @@ endrec[_ECD_ENTRIES_TOTAL] = dircount2 endrec[_ECD_SIZE] = dirsize endrec[_ECD_OFFSET] = diroffset @@ -268,7 +268,7 @@ index 2969f735e8abb9..ac2332e58468a2 100644 return endrec -@@ -358,7 +372,7 @@ def _EndRecData(fpin): +@@ -358,7 +372,7 @@ endrec.append(filesize - sizeEndCentDir) # Try to read the "Zip64 end of central directory" structure @@ -277,7 +277,7 @@ index 2969f735e8abb9..ac2332e58468a2 100644 # Either this is not a ZIP file, or it is a ZIP file with an archive # comment. Search the end of the file for the "end of central directory" -@@ -382,8 +396,7 @@ def _EndRecData(fpin): +@@ -382,8 +396,7 @@ endrec.append(maxCommentStart + start) # Try to read the "Zip64 end of central directory" structure @@ -287,7 +287,7 @@ index 2969f735e8abb9..ac2332e58468a2 100644 # Unable to find a valid end of central directory structure return None -@@ -2142,7 +2155,7 @@ def _write_end_record(self): +@@ -2142,7 +2155,7 @@ " would require ZIP64 extensions") zip64endrec = struct.pack( structEndArchive64, stringEndArchive64, @@ -296,11 +296,10 @@ index 2969f735e8abb9..ac2332e58468a2 100644 centDirSize, centDirOffset) self.fp.write(zip64endrec) -diff --git a/Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst b/Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst -new file mode 100644 -index 00000000000000..a8e7a1f1878c6b ---- /dev/null -+++ b/Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst +Index: Python-3.14.0/Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ Python-3.14.0/Misc/NEWS.d/next/Security/2025-10-07-19-31-34.gh-issue-139700.vNHU1O.rst 2025-11-12 01:04:11.767493557 +0100 @@ -0,0 +1,3 @@ +Check consistency of the zip64 end of central directory record. Support +records with "zip64 extensible data" if there are no bytes prepended to the diff --git a/Python-3.14.0a5.tar.xz b/Python-3.14.0a5.tar.xz deleted file mode 100644 index acbcac8..0000000 --- a/Python-3.14.0a5.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:74e83f26de1e4fb9eef1b56492cff92508834bb71ac13f5c580438ce9f093682 -size 22859900 diff --git a/Python-3.14.0a5.tar.xz.sigstore b/Python-3.14.0a5.tar.xz.sigstore deleted file mode 100644 index 4fd7573..0000000 --- a/Python-3.14.0a5.tar.xz.sigstore +++ /dev/null @@ -1 +0,0 @@ -{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIICzTCCAlOgAwIBAgIUCBWax1Yv006eiUrTmVXnVEYP0acwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwMjEyMDc1NDE1WhcNMjUwMjEyMDgwNDE1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEVLFuPzDtOjejFwRdg4rACkVZkfQ10PXnoC8+U28wbs73RqyH7az/ArOWDhwvCruZCTOtm2QTWYCK30NDi/6q+KOCAXIwggFuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUc0Iet3OpFv7Oq6lKxwe/rg2yFgowHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wHQYDVR0RAQH/BBMwEYEPaHVnb0BweXRob24ub3JnMCwGCisGAQQBg78wAQEEHmh0dHBzOi8vZ2l0aHViLmNvbS9sb2dpbi9vYXV0aDAuBgorBgEEAYO/MAEIBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9sb2dpbi9vYXV0aDCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABlPkmxwAAAAQDAEYwRAIgFK4/2Od+BPgQZOqIOjCl7m37O9dFR6o8vvSxw3wLaKECICszaphh3ouecV37MD5cNSrC9OMoOvVUD1tL51NIygISMAoGCCqGSM49BAMDA2gAMGUCMQCNuzhin8H0+q2qxODgGrsKMpaSmK20VJxjmW+sEaEZzKROThaHevYwgFKOVFD1uj8CMBgy22e4sm2yW2tScetkOuYwgU3sSUycXRP9pKr9Gllfg9lOFlXC6/vnmvBuPRRjsA=="}, "tlogEntries": [{"logIndex": "170570053", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "hashedrekord", "version": "0.0.1"}, "integratedTime": "1739346856", "inclusionPromise": {"signedEntryTimestamp": "MEYCIQCGqYfCnbihbWn8mvWbiVe5x9xA/0Mvy2VRBnFm5E8ZZgIhAO6zmjkYA67Ttb7JKF5nn68KMvWi5MTzR+8o9xVq136S"}, "inclusionProof": {"logIndex": "48665791", "rootHash": "HzxfBCv2yi4J8G+S7TgoiMNBBo/wSkRjGDJfNOVUcTs=", "treeSize": "48665792", "hashes": ["b0yDjzNitZJIGTblWLhs4yUCBz6CKSng8isTxSgbsVE=", "dkJ2Yt1bEtBmpXpRN3vSmk+6+1j8GsOFEUA9iyueWhk=", "i1ABh9Dx8meNOBCr/HhTSupqNYK0LI+NnFjXmDfEgnY=", "MegLwopuwueYsc+JjT6t3LKiOJmtE0MguZsVB71COH0=", "FT+AWm/ITpPN+fIVrNXLPTjNvmfTVoGQfCV+uE6gZ8w=", "kRkMXhEDVcanV+ajODgw+9wD30fMQgV1vmvCfUV8ba0=", "6Z0kSTNv87FgCP6fBI6QTIRs0ABTmLD9tgAbSWRDRr0=", "p39Aj7k63Y8N82q5GXzhIzuZSex0HZN+9xq7U1Sxdp4=", "jhYil8zet/V88Ox8NV66V1iBkETlEJ2qH+SXo+kfMb0=", "Z/HAKVPPWMW9bRNxiWSaI+beB8FjcG/QYDqBuAZMTsY=", "cgbhJqDRiWT+2XKIQ9ch9WJ+6uwysr3Vn01jUW3nyv0=", "0NILEMXlPNU3cLx3pWSpe/u8BfMuXFyP+6HIsWDtkAU=", "3G1CfELRgkrpGc7BJBsecW/HvOojsTHpl40WsoH/3A0=", "Zse3BPkR/cJv62LvVuiDH+EpgIE5v3V3qXdG8HQFf1A=", "jU9+tgjTIKUYGeU7T7RjqyL+F+gFV9tCdwX2GZ1UtQs=", "vemyaMj0Na1LMjbB/9Dmkq8T+jAb3o+yCESgAayUABU="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n48665792\nHzxfBCv2yi4J8G+S7TgoiMNBBo/wSkRjGDJfNOVUcTs=\n\n\u2014 rekor.sigstore.dev wNI9ajBFAiEA3ZglJ4aYKUNaTJ96mujk5pcgWAj6iiwpmuUtpKIepGQCIGsrkTWsS2nFwjAv95ctdnJZK7cSvUMf+milS4alGlu9\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI3NGU4M2YyNmRlMWU0ZmI5ZWVmMWI1NjQ5MmNmZjkyNTA4ODM0YmI3MWFjMTNmNWM1ODA0MzhjZTlmMDkzNjgyIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJQVlIaGJLVVNTZldtMmNqV2hWYmhtUXdEUTdtR0lpcGdCVEpKaXFrdEtmdEFpRUE2VUszY3huRE5iZ0g1QnYzalBLanZzL2c5YjRrT1NNVTEvTUs2cmN1RklBPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVd4UFowRjNTVUpCWjBsVlEwSlhZWGd4V1hZd01EWmxhVlZ5VkcxV1dHNVdSVmxRTUdGamQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDFxUlhsTlJHTXhUa1JGTVZkb1kwNU5hbFYzVFdwRmVVMUVaM2RPUkVVeFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZXVEVaMVVIcEVkRTlxWldwR2QxSmtaelJ5UVVOclZscHJabEV4TUZCWWJtOURPQ3NLVlRJNGQySnpOek5TY1hsSU4yRjZMMEZ5VDFkRWFIZDJRM0oxV2tOVVQzUnRNbEZVVjFsRFN6TXdUa1JwTHpaeEswdFBRMEZZU1hkblowWjFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZqTUVsbENuUXpUM0JHZGpkUGNUWnNTM2gzWlM5eVp6SjVSbWR2ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBoUldVUldVakJTUVZGSUwwSkNUWGRGV1VWUVlVaFdibUl3UW5kbFdGSnZZakkwZFdJelNtNU5RM2RIUTJselIwRlJVVUpuTnpoM1FWRkZSUXBJYldnd1pFaENlazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemx6WWpKa2NHSnBPWFpaV0ZZd1lVUkJkVUpuYjNKQ1owVkZRVmxQTDAxQlJVbENRMEZOQ2todGFEQmtTRUo2VDJrNGRsb3liREJoU0ZacFRHMU9kbUpUT1hOaU1tUndZbWs1ZGxsWVZqQmhSRU5DYVZGWlMwdDNXVUpDUVVoWFpWRkpSVUZuVWpjS1FraHJRV1IzUWpGQlRqQTVUVWR5UjNoNFJYbFplR3RsU0Vwc2JrNTNTMmxUYkRZME0ycDVkQzgwWlV0amIwRjJTMlUyVDBGQlFVSnNVR3R0ZUhkQlFRcEJRVkZFUVVWWmQxSkJTV2RHU3pRdk1rOWtLMEpRWjFGYVQzRkpUMnBEYkRkdE16ZFBPV1JHVWpadk9IWjJVM2gzTTNkTVlVdEZRMGxEYzNwaGNHaG9Dak52ZFdWalZqTTNUVVExWTA1VGNrTTVUMDF2VDNaV1ZVUXhkRXcxTVU1SmVXZEpVMDFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbWRCVFVkVlEwMVJRMDRLZFhwb2FXNDRTREFyY1RKeGVFOUVaMGR5YzB0TmNHRlRiVXN5TUZaS2VHcHRWeXR6UldGRlducExVazlVYUdGSVpYWlpkMmRHUzA5V1JrUXhkV280UXdwTlFtZDVNakpsTkhOdE1ubFhNblJUWTJWMGEwOTFXWGRuVlROelUxVjVZMWhTVURsd1MzSTVSMnhzWm1jNWJFOUdiRmhETmk5MmJtMTJRblZRVWxKcUNuTkJQVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In19fX0="}]}, "messageSignature": {"messageDigest": {"algorithm": "SHA2_256", "digest": "dOg/Jt4eT7nu8bVkks/5JQiDS7cawT9cWAQ4zp8JNoI="}, "signature": "MEUCIAYHhbKUSSfWm2cjWhVbhmQwDQ7mGIipgBTJJiqktKftAiEA6UK3cxnDNbgH5Bv3jPKjvs/g9b4kOSMU1/MK6rcuFIA="}} diff --git a/fix-test-recursion-limit-15.6.patch b/fix-test-recursion-limit-15.6.patch index df002a4..27d05e0 100644 --- a/fix-test-recursion-limit-15.6.patch +++ b/fix-test-recursion-limit-15.6.patch @@ -2,10 +2,10 @@ Lib/test/test_compile.py | 5 +++++ 1 file changed, 5 insertions(+) -Index: Python-3.14.0b3/Lib/test/test_compile.py +Index: Python-3.14.0/Lib/test/test_compile.py =================================================================== ---- Python-3.14.0b3.orig/Lib/test/test_compile.py 2025-06-22 00:32:01.975698954 +0200 -+++ Python-3.14.0b3/Lib/test/test_compile.py 2025-06-22 00:32:07.740981155 +0200 +--- Python-3.14.0.orig/Lib/test/test_compile.py 2025-11-06 23:19:11.681015028 +0100 ++++ Python-3.14.0/Lib/test/test_compile.py 2025-11-06 23:22:47.971267371 +0100 @@ -24,6 +24,9 @@ from test.support.bytecode_helper import instructions_with_positions from test.support.os_helper import FakePath @@ -16,7 +16,7 @@ Index: Python-3.14.0b3/Lib/test/test_compile.py class TestSpecifics(unittest.TestCase): def compile_single(self, source): -@@ -121,6 +124,7 @@ class TestSpecifics(unittest.TestCase): +@@ -120,6 +123,7 @@ self.assertEqual(d['z'], 12) @unittest.skipIf(support.is_wasi, "exhausts limited stack on WASI") @@ -31,4 +31,4 @@ Index: Python-3.14.0b3/Lib/test/test_compile.py + @unittest.skipIf(IS_SLE_15_6 and IS_32bit, "fails on 15.6 i586") @support.skip_emscripten_stack_overflow() def test_compiler_recursion_limit(self): - # Expected limit is Py_C_RECURSION_LIMIT + # Compiler frames are small diff --git a/python-3.3.0b1-fix_date_time_compiler.patch b/python-3.3.0b1-fix_date_time_compiler.patch index 6f21f15..820adca 100644 --- a/python-3.3.0b1-fix_date_time_compiler.patch +++ b/python-3.3.0b1-fix_date_time_compiler.patch @@ -2,10 +2,10 @@ Makefile.pre.in | 5 +++++ 1 file changed, 5 insertions(+) -Index: Python-3.14.0rc1/Makefile.pre.in +Index: Python-3.14.0/Makefile.pre.in =================================================================== ---- Python-3.14.0rc1.orig/Makefile.pre.in 2025-07-22 18:42:44.000000000 +0200 -+++ Python-3.14.0rc1/Makefile.pre.in 2025-07-23 10:10:27.325708066 +0200 +--- Python-3.14.0.orig/Makefile.pre.in 2025-10-07 11:34:52.000000000 +0200 ++++ Python-3.14.0/Makefile.pre.in 2025-11-06 23:19:25.434995608 +0100 @@ -1910,6 +1910,11 @@ -DGITBRANCH="\"`LC_ALL=C $(GITBRANCH)`\"" \ -o $@ $(srcdir)/Modules/getbuildinfo.c diff --git a/python314.changes b/python314.changes index 981f9ca..5927033 100644 --- a/python314.changes +++ b/python314.changes @@ -8,6 +8,8 @@ Tue Nov 4 16:44:05 UTC 2025 - Matej Cepl a Rust one) then unpack it in production with another (e.g., the Python one) and get malicious content that the other parser did not see (CVE-2025-8291, bsc#1251305) +- Remove subprocess-raise-timeout.patch, which seems irrelevant + now. ------------------------------------------------------------------- Wed Oct 15 09:22:40 UTC 2025 - Daniel Garcia diff --git a/python314.spec b/python314.spec index e041f25..aef2583 100644 --- a/python314.spec +++ b/python314.spec @@ -203,8 +203,6 @@ Patch02: F00251-change-user-install-location.patch Patch03: python-3.3.0b1-localpath.patch # replace DATE, TIME and COMPILER by fixed definitions to aid reproducible builds Patch04: python-3.3.0b1-fix_date_time_compiler.patch -# Raise timeout value for test_subprocess -Patch06: subprocess-raise-timeout.patch # PATCH-FEATURE-UPSTREAM bpo-31046_ensurepip_honours_prefix.patch bpo#31046 mcepl@suse.com # ensurepip should honour the value of $(prefix) Patch07: bpo-31046_ensurepip_honours_prefix.patch diff --git a/subprocess-raise-timeout.patch b/subprocess-raise-timeout.patch deleted file mode 100644 index ae68b4a..0000000 --- a/subprocess-raise-timeout.patch +++ /dev/null @@ -1,18 +0,0 @@ ---- - Lib/test/test_subprocess.py | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - ---- a/Lib/test/test_subprocess.py -+++ b/Lib/test/test_subprocess.py -@@ -281,7 +281,8 @@ class ProcessTestCase(BaseTestCase): - "time.sleep(3600)"], - # Some heavily loaded buildbots (sparc Debian 3.x) require - # this much time to start and print. -- timeout=3) -+ # OBS might require even more -+ timeout=10) - self.fail("Expected TimeoutExpired.") - self.assertEqual(c.exception.output, b'BDFL') - - def test_timeout_exception(self): - try: