[jslobodzian]

Summary

Remediate bundled ensurepip trust and backport upstream CPython 3.12's runtime rejection of compromised eMudhra intermediate public keys.

Package: python3 3.12.15-1 -> 3.12.15-3, targeting fasttrack/3.0. The initial ensurepip remediation was -2; the SSL runtime backport is -3.

Changes

• Preserve the existing pip 25.0.1 ensurepip-wheel cleanup and RECORD regeneration. There is no bundled pip version upgrade.
• Add the Linux runtime portion of CPython 3.12 PR #160571, merged as a17d9ef549008133eadf20689b1f4787902efe5b, for CVE-2026-115557.
• Reject eight compromised intermediate public keys by SHA-256 of SubjectPublicKeyInfo, including cross-signed representations, when TLS certificate verification is enabled. Explicit CERT_NONE remains under the caller's control.
• Retain upstream's _ssl.c, denylist header, Linux Makefile dependency and security NEWS changes without source adaptation.
• Deliberately omit upstream test additions, certificate-generation changes, binary ZIP fixture and unused Windows project metadata. No ZIP is committed, no Source entry is added, and Source0/signatures are unchanged.
• Leave the existing %check section unchanged. Validate the omitted upstream regression separately, outside the RPM/GitHub payload.
• Synchronize the Python release in both architecture toolchain and pkggen manifests.

The runtime guard complements platform CA updates and bundled-data cleanup; it is not a replacement for either. It covers CPython _ssl, not independent native TLS stacks.

Validation

Source and packaging

• Existing cgi3.patch and ensurepip-helper patch apply before the new patch.
• The four retained upstream files match the merged upstream Git blobs exactly.
• Native Azure Linux 3 ARM64 GNU patch applies the complete patch stack with --batch --fuzz=0, without offsets.
• Native spec query resolves python3 3.12.15-3.azl3.
• Source declarations, source signatures and %check remain unchanged. No test/binary path appears in the new patch.

Native runtime validation

On Azure Linux 3.0 ARM64, rebuild the exact patched _ssl extension against the matching Python 3.12.15 ABI and OpenSSL 3.3.7 in a separate validation root:

• Execute upstream's omitted regression externally with its exact upstream fixture: it fails as expected on the previous extension and passes on the patched extension.
• All 14 published incident endpoints accept in the controlled pre-fix baseline with explicitly supplied test trust, then all 14 reject with verification code 28 (CERT_REJECTED) using the patched extension.
• Legitimate example.com SSL.com TLS verification succeeds.
• Explicit CERT_NONE behavior remains unchanged.
• Existing test_ssl, test_asyncio.test_ssl and test_asyncio.test_sslproto: 246 tests run, 27 skipped, all three test files pass.

This is native compiled-extension/runtime validation, not a new full candidate RPM build. The prior -2 installed ensurepip-wheel validation remains applicable to the unchanged helper; new complete AMD64/ARM64 package builds remain subject to PR CI.

Merge gates

• New full AMD64 and ARM64 PR builds passed.
• Required reviews satisfied.
• Toolchain/bootstrap publication coordination resolved.
• Ready to merge.

[Muhammad Falak R Wani (mfrw)]

Circular Dep Check is expected to fail whenever toolchain is bumped before the new RPM is published.

[Saul Paredes (Redent0r)]

nit: I think this could all go into a single 3.12.15-2 revision