Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python310 for openSUSE:Factory checked in at 2026-08-15 22:40:48 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python310 (Old) and /work/SRC/openSUSE:Factory/.python310.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python310" Sat Aug 15 22:40:48 2026 rev:80 rq:1371250 version:3.10.20 Changes: -------- --- /work/SRC/openSUSE:Factory/python310/python310.changes 2026-08-01 18:37:23.048466060 +0200 +++ /work/SRC/openSUSE:Factory/.python310.new.1258/python310.changes 2026-08-15 22:41:14.115872859 +0200 @@ -1,0 +2,7 @@ +Sat Aug 8 15:14:27 UTC 2026 - Matej Cepl <[email protected]> + +- noCVE: CVE-2026-6019 fix does not handle non-ascii chars correctly + (bsc#1263083) (internal SUSE bug so far, no CVE yet) + bsc1263083-http-cookies-atob-utf8.patch + +------------------------------------------------------------------- @@ -124,8 +130,0 @@ - -------------------------------------------------------------------- -Wed Apr 8 16:12:36 CEST 2026 - Matej Cepl <[email protected]> - -- Rewrite structure of Python interpreter packages. - `python3*` symbols should be now provided by real python3 - packages and its subpackages instead of the virtual provides - (bsc#1258364). New: ---- bsc1263083-http-cookies-atob-utf8.patch ----------(New B)---------- New: (bsc#1263083) (internal SUSE bug so far, no CVE yet) bsc1263083-http-cookies-atob-utf8.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python310.spec ++++++ --- /var/tmp/diff_new_pack.o3hAxQ/_old 2026-08-15 22:41:15.758930695 +0200 +++ /var/tmp/diff_new_pack.o3hAxQ/_new 2026-08-15 22:41:15.759930730 +0200 @@ -276,6 +276,9 @@ # PATCH-FIX-UPSTREAM CVE-2026-3276-On2-unicodedata-normalize.patch bsc#1267581 [email protected] # gh-149079: Fix O(n^2) canonical ordering in unicodedata.normalize() Patch62: CVE-2026-3276-On2-unicodedata-normalize.patch +# PATCH-FIX-UPSTREAM bsc1263083-http-cookies-atob-utf8.patch bsc#1263083 [email protected] +# Use decodeURIComponent() for UTF-8 support in js_output() +Patch63: bsc1263083-http-cookies-atob-utf8.patch ### END OF PATCHES BuildRequires: autoconf-archive BuildRequires: automake @@ -293,9 +296,8 @@ BuildRequires: pkgconfig(uuid) BuildRequires: pkgconfig(zlib) #!BuildIgnore: gdk-pixbuf-loader-rsvg -%if 0%{?suse_version} >= 1550 && %{without base} -# Skip for the base flavor: rpm-build-python requires python3-base, which -# creates an unresolvable dependency loop when building python3xx-base itself. +%if 0%{?suse_version} >= 1550 +# The provider for python(abi) is in rpm-build-python BuildRequires: rpm-build-python %endif %if 0%{?suse_version} >= 1500 && 0%{?suse_version} < 1599 @@ -334,6 +336,11 @@ Recommends: %{python_pkg_name}-dbm Recommends: %{python_pkg_name}-pip %obsolete_python_versioned +%if %{primary_interpreter} +Provides: python3 = %{python_version} +Provides: python3-readline +Provides: python3-sqlite3 +%endif %endif %description @@ -354,6 +361,9 @@ Summary: TkInter, a Python Tk Interface Requires: %{python_pkg_name} = %{version} %obsolete_python_versioned tk +%if %{primary_interpreter} +Provides: python3-tk = %{version} +%endif %description -n %{python_pkg_name}-tk Python interface to Tk. Tk is the GUI toolkit that comes with Tcl. @@ -362,6 +372,9 @@ Summary: Python Interface to the (N)Curses Library Requires: %{python_pkg_name} = %{version} %obsolete_python_versioned curses +%if %{primary_interpreter} +Provides: python3-curses +%endif %description -n %{python_pkg_name}-curses An easy to use interface to the (n)curses CUI library. CUI stands for @@ -371,6 +384,9 @@ Summary: Python Interface to the GDBM Library Requires: %{python_pkg_name} = %{version} %obsolete_python_versioned dbm +%if %{primary_interpreter} +Provides: python3-dbm +%endif %description -n %{python_pkg_name}-dbm An easy to use interface for Unix DBM databases, and more specifically, @@ -381,6 +397,9 @@ Requires: %{python_pkg_name} = %{version} Requires: %{python_pkg_name}-tk %obsolete_python_versioned idle +%if %{primary_interpreter} +Provides: python3-idle = %{version} +%endif %description -n %{python_pkg_name}-idle IDLE is a Tkinter based integrated development environment for Python. @@ -392,6 +411,9 @@ Summary: Package Documentation for Python 3 Enhances: %{python_pkg_name} = %{python_version} %obsolete_python_versioned doc +%if %{primary_interpreter} +Provides: python3-doc = %{version} +%endif %description -n %{python_pkg_name}-doc Tutorial, Global Module Index, Language Reference, Library Reference, @@ -401,6 +423,9 @@ %package -n %{python_pkg_name}-doc-devhelp Summary: Additional Package Documentation for Python 3 in devhelp format %obsolete_python_versioned doc-devhelp +%if %{primary_interpreter} +Provides: python3-doc-devhelp = %{version} +%endif %description -n %{python_pkg_name}-doc-devhelp Tutorial, Global Module Index, Language Reference, Library Reference, @@ -425,10 +450,16 @@ %obsolete_python_versioned typing # python3-xml was merged into python3, now moved into -base Provides: %{python_pkg_name}-xml = %{version} -# Explicitly provided because rpm-build-python (which auto-generates this) -# cannot be installed in the base flavor build root due to a bootstrap cycle: -# rpm-build-python -> python3-base -> (this package) -Provides: python(abi) = %{python_version} +%if %{primary_interpreter} +Provides: python3-asyncio = %{version} +Obsoletes: python3-asyncio < %{version} +Provides: python3-base = %{version} +Obsoletes: python3-base < %{version} +Provides: python3-typing = %{version} +Obsoletes: python3-typing < %{version} +Provides: python3-xml = %{version} +Obsoletes: python3-xml < %{version} +%endif %description -n %{python_pkg_name}-base Python is an interpreted, object-oriented programming language, and is @@ -447,6 +478,13 @@ Provides: %{python_pkg_name}-2to3 = %{version} Provides: %{python_pkg_name}-demo = %{version} %obsolete_python_versioned tools +%if %{primary_interpreter} +Provides: python3-2to3 = %{version} +Provides: python3-demo = %{version} +Provides: python3-tools = %{version} +Obsoletes: python3-2to3 < %{version} +Obsoletes: python3-demo < %{version} +%endif %description -n %{python_pkg_name}-tools A number of scripts that are useful for building, testing or extending Python, @@ -456,6 +494,9 @@ Summary: Include Files and Libraries Mandatory for Building Python Modules Requires: %{python_pkg_name}-base = %{version} %obsolete_python_versioned devel +%if %{primary_interpreter} +Provides: python3-devel = %{version} +%endif %description -n %{python_pkg_name}-devel The Python programming language's interpreter can be extended with @@ -473,6 +514,9 @@ Requires: %{python_pkg_name} = %{version} Requires: %{python_pkg_name}-tk = %{version} %obsolete_python_versioned testsuite +%if %{primary_interpreter} +Provides: python3-testsuite = %{version} +%endif %description -n %{python_pkg_name}-testsuite Unit tests that are useful for verifying integrity and functionality @@ -502,7 +546,11 @@ %if ! 0%{?sle_version} || 0%{?sle_version} >= 160000 %patch -p1 -P 21 %endif -%autopatch -p1 -m 22 +%autopatch -p1 -m 22 -M 55 +%if ! 0%{?sle_version} || 0%{?sle_version} >= 160000 +%patch -p1 -P 56 +%endif +%autopatch -p1 -m 57 # drop Autoconf version requirement sed -i 's/^AC_PREREQ/dnl AC_PREREQ/' configure.ac @@ -763,12 +811,20 @@ done rm -fv %{buildroot}%{dynlib nis} +# overwrite the copied binary with a link +ln -sf python%{python_version} %{buildroot}%{_bindir}/python3 + +# decide to ship python3 or just python3.X +%if !%{primary_interpreter} +# base rm %{buildroot}%{_bindir}/python3 rm %{buildroot}%{_bindir}/pydoc3 rm %{buildroot}%{_mandir}/man1/python3.1 +# devel rm %{buildroot}%{_bindir}/python3-config rm %{buildroot}%{_libdir}/libpython3.so rm %{buildroot}%{_libdir}/pkgconfig/{python3,python3-embed}.pc +%endif # link shared library instead of static library that tools expect ln -s ../../libpython%{python_abi}.so %{buildroot}%{_libdir}/python%{python_version}/config-%{python_abi}-%{archname}-%{_os}%{?_gnu}%{?armsuffix}/libpython%{python_abi}.so @@ -801,13 +857,7 @@ find "$PDOCS" -name "*.bat" -delete # put gdb helper script into place -%define gdb_help_script libpython%{python_abi}.so.%{so_major}.%{so_minor}-gdb.py -install -m 755 -D Tools/gdb/libpython.py \ - %{buildroot}%{_datadir}/gdb/auto-load/%{_libdir}/%{gdb_help_script} -# don't use %python310_fix_shebang_path to avoid circular dependency via -# python-rpm-macros -sed -i "1s@#\!.*python[^ ]*@#\!%{_bindir}/python%{python_version}@" \ - %{buildroot}%{_datadir}/gdb/auto-load/%{_libdir}/%{gdb_help_script} +install -m 755 -D Tools/gdb/libpython.py %{buildroot}%{_datadir}/gdb/auto-load/%{_libdir}/libpython%{python_abi}.so.%{so_major}.%{so_minor}-gdb.py # install devel files to /config #cp Makefile Makefile.pre.in Makefile.pre $RPM_BUILD_ROOT%{sitedir}/config-%{python_abi}/ @@ -919,10 +969,16 @@ %files -n %{python_pkg_name}-devel %{_libdir}/libpython%{python_abi}.so +%if %{primary_interpreter} +%{_libdir}/libpython3.so +%endif %{_libdir}/pkgconfig/* %{_includedir}/python%{python_abi} %{sitedir}/config-%{python_abi}-* %{_bindir}/python%{python_abi}-config +%if %{primary_interpreter} +%{_bindir}/python3-config +%endif # Own these directories to not depend on gdb %dir %{_datadir}/gdb %dir %{_datadir}/gdb/auto-load @@ -952,6 +1008,9 @@ %doc %{_docdir}/%{name}/README.rst %license LICENSE %doc %{_docdir}/%{name}/README.SUSE +%if %{primary_interpreter} +%{_mandir}/man1/python3.1%{?ext_man} +%endif %{_mandir}/man1/python%{python_version}.1%{?ext_man} # license text, not a doc because the code can use it at run-time %{sitedir}/LICENSE.txt @@ -1056,6 +1115,11 @@ # import-failed hooks %{sitedir}/_import_failed %{sitedir}/site-packages/zzzz-import-failed-hooks.pth +# symlinks +%if %{primary_interpreter} +%{_bindir}/python3 +%{_bindir}/pydoc3 +%endif # executables %attr(755, root, root) %{_bindir}/pydoc%{python_version} # %%attr(755, root, root) %%{_bindir}/python%%{python_abi} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.o3hAxQ/_old 2026-08-15 22:41:16.005939390 +0200 +++ /var/tmp/diff_new_pack.o3hAxQ/_new 2026-08-15 22:41:16.012939636 +0200 @@ -1,6 +1,6 @@ -mtime: 1785511873 -commit: 44151aa6dc4ed3d66728b146b9ab9c31e458b54ff070faedce2fd7334b4ac33c +mtime: 1786728920 +commit: f4ef5d553b299d780dd0dbeddfea1f33698484d2c6b16a97bdcfe29c9a9565c3 url: https://src.opensuse.org/python-interpreters/python310 -revision: 44151aa6dc4ed3d66728b146b9ab9c31e458b54ff070faedce2fd7334b4ac33c +revision: f4ef5d553b299d780dd0dbeddfea1f33698484d2c6b16a97bdcfe29c9a9565c3 projectscmsync: https://src.opensuse.org/python-interpreters/_ObsPrj ++++++ bsc1263083-http-cookies-atob-utf8.patch ++++++ >From 1d0cf3110288191db3bf07228456a24ddf6d344f Mon Sep 17 00:00:00 2001 From: Seth Larson <[email protected]> Date: Thu, 14 May 2026 16:10:39 -0500 Subject: [PATCH 1/2] [3.13] gh-149144: Use decodeURIComponent() for UTF-8 support in js_output() (GH-149157) (cherry picked from commit 461b1d96313de02992d284c1782be9aff24586c9) --- Lib/http/cookies.py | 6 +++--- Lib/test/test_http_cookies.py | 27 ++++++++++++++------------- 2 files changed, 17 insertions(+), 16 deletions(-) Index: Python-3.10.20/Lib/http/cookies.py =================================================================== --- Python-3.10.20.orig/Lib/http/cookies.py 2026-08-08 22:23:49.421969974 +0200 +++ Python-3.10.20/Lib/http/cookies.py 2026-08-08 22:23:52.713872963 +0200 @@ -389,18 +389,18 @@ return '<%s: %s>' % (self.__class__.__name__, self.OutputString()) def js_output(self, attrs=None): - import base64 + import urllib.parse # Print javascript output_string = self.OutputString(attrs) if _has_control_character(output_string): raise CookieError("Control characters are not allowed in cookies") # Base64-encode value to avoid template # injection in cookie values. - output_encoded = base64.b64encode(output_string.encode('utf-8')).decode("ascii") + output_encoded = urllib.parse.quote(output_string, safe='', encoding='utf-8') return """ <script type="text/javascript"> <!-- begin hiding - document.cookie = atob(\"%s\"); + document.cookie = decodeURIComponent(\"%s\"); // end hiding --> </script> """ % (output_encoded,) Index: Python-3.10.20/Lib/test/test_http_cookies.py =================================================================== --- Python-3.10.20.orig/Lib/test/test_http_cookies.py 2026-08-08 22:23:49.422301900 +0200 +++ Python-3.10.20/Lib/test/test_http_cookies.py 2026-08-08 22:23:52.714277175 +0200 @@ -1,5 +1,5 @@ # Simple test suite for http/cookies.py -import base64 +import urllib.parse import copy from test.support import run_unittest, run_doctest import unittest @@ -106,19 +106,19 @@ self.assertEqual(C.output(['path']), 'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme') - cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme; Version=1').decode('ascii') + cookie_encoded = urllib.parse.quote('Customer="WILE_E_COYOTE"; Path=/acme; Version=1', safe='', encoding='utf-8') self.assertEqual(C.js_output(), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{cookie_encoded}"); + document.cookie = decodeURIComponent("{cookie_encoded}"); // end hiding --> </script> """) - cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme').decode('ascii') + cookie_encoded = urllib.parse.quote('Customer="WILE_E_COYOTE"; Path=/acme', safe='', encoding='utf-8') self.assertEqual(C.js_output(['path']), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{cookie_encoded}"); + document.cookie = decodeURIComponent("{cookie_encoded}"); // end hiding --> </script> """) @@ -215,19 +215,19 @@ self.assertEqual(C.output(['path']), 'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme') - expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1').decode('ascii') + expected_encoded_cookie = urllib.parse.quote('Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1', safe='', encoding='utf-8') self.assertEqual(C.js_output(), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{expected_encoded_cookie}"); + document.cookie = decodeURIComponent("{expected_encoded_cookie}"); // end hiding --> </script> """) - expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme').decode('ascii') + expected_encoded_cookie = urllib.parse.quote('Customer=\"WILE_E_COYOTE\"; Path=/acme', safe='', encoding='utf-8') self.assertEqual(C.js_output(['path']), fr""" <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("{expected_encoded_cookie}"); + document.cookie = decodeURIComponent("{expected_encoded_cookie}"); // end hiding --> </script> """) @@ -318,13 +318,14 @@ self.assertEqual( M.output(), "Set-Cookie: %s=%s; Path=/foo" % (i, "%s_coded_val" % i)) - expected_encoded_cookie = base64.b64encode( - ("%s=%s; Path=/foo" % (i, "%s_coded_val" % i)).encode("ascii") - ).decode('ascii') + expected_encoded_cookie = urllib.parse.quote( + "%s=%s; Path=/foo" % (i, "%s_coded_val" % i), + safe='', encoding='utf-8', + ) expected_js_output = """ <script type="text/javascript"> <!-- begin hiding - document.cookie = atob("%s"); + document.cookie = decodeURIComponent("%s"); // end hiding --> </script> """ % (expected_encoded_cookie,) ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-14 19:35:20.000000000 +0200 @@ -0,0 +1,7 @@ +.osc +*.obscpio +*.osc +_build.* +.pbuild +*.rej +python310*-build/
