Sync upstream tag 20260320

Schamper · web-flow · commit 64b2193c3afe · 2026-03-25T10:31:48.000+01:00
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
@@ -72,7 +72,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # v7.5.0
         with:
           enable-cache: false
 
@@ -151,7 +151,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # v7.5.0
         with:
           enable-cache: false
 
@@ -226,7 +226,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # v7.5.0
         with:
           enable-cache: false
 
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
@@ -64,7 +64,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # v7.5.0
         with:
           enable-cache: false
 
@@ -131,7 +131,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # v7.5.0
         with:
           enable-cache: false
 
diff --git a/.github/workflows/publish-versions.yml b/.github/workflows/publish-versions.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: "Install uv"
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # v7.5.0
 
       - name: "Download SHA256SUMS"
         env:
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -64,7 +64,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # v7.5.0
         with:
           enable-cache: false
 
@@ -137,7 +137,7 @@ jobs:
           packages: autoconf automake libtool
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # v7.5.0
         with:
           enable-cache: false
 
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -30,6 +30,7 @@ rayon = "1.11.0"
 reqwest = { version = "0.12.24", features = ["rustls-tls-webpki-roots", "stream"] }
 reqwest-middleware = "0.4.2"
 reqwest-retry = "0.7.0"
+rustls = { version = "0.23" , default-features = false, features = ["aws_lc_rs"] }
 scroll = "0.13.0"
 semver = "1.0.27"
 serde = { version = "1.0.228", features = ["derive"] }
diff --git a/cpython-unix/Makefile b/cpython-unix/Makefile
@@ -171,9 +171,6 @@ $(OUTDIR)/mpdecimal-$(MPDECIMAL_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEP
 $(OUTDIR)/ncurses-$(NCURSES_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-ncurses.sh
 	$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) ncurses
 
-$(OUTDIR)/openssl-1.1-$(OPENSSL_1.1_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-1.1.sh
-	$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-1.1
-
 $(OUTDIR)/openssl-3.5-$(OPENSSL_3.5_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-3.5.sh
 	$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-3.5
 
diff --git a/cpython-unix/build-cpython.sh b/cpython-unix/build-cpython.sh
@@ -306,6 +306,11 @@ if [ "${PYTHON_MAJMIN_VERSION}" = 3.12 ] || [ "${PYTHON_MAJMIN_VERSION}" = 3.13
     patch -p1 -i "${ROOT}/patch-test-embed-prevent-segfault.patch"
 fi
 
+# RHEL 8 (supported until 2029) and below, including Fedora 33 and below, do not
+# ship an /etc/ssl/cert.pem or a hashed /etc/ssl/cert/ directory. Patch to look at
+# /etc/pki/tls/cert.pem instead, if that file exists and /etc/ssl/cert.pem does not.
+patch -p1 -i ${ROOT}/patch-cpython-redhat-cert-file.patch
+
 # Cherry-pick an upstream change in Python 3.15 to build _asyncio as
 # static (which we do anyway in our own fashion) and more importantly to
 # take this into account when finding the AsyncioDebug section.
@@ -1096,6 +1101,8 @@ replace_in_all("-I%s/deps/include/ncursesw" % tools_path, "")
 replace_in_all("-I%s/deps/include/uuid" % tools_path, "")
 replace_in_all("-I%s/deps/include" % tools_path, "")
 replace_in_all("-L%s/deps/lib" % tools_path, "")
+# See https://github.com/python/cpython/issues/145810#issuecomment-4068139183
+replace_in_all("-LModules/_hacl", "")
 
 EOF
 
diff --git a/cpython-unix/build-openssl-1.1.sh b/cpython-unix/build-openssl-1.1.sh
diff --git a/cpython-unix/build.py b/cpython-unix/build.py
@@ -1172,7 +1172,6 @@ def main():
             "m4",
             "mpdecimal",
             "ncurses",
-            "openssl-1.1",
             "openssl-3.5",
             "patchelf",
             "sqlite",
diff --git a/cpython-unix/patch-cpython-redhat-cert-file.patch b/cpython-unix/patch-cpython-redhat-cert-file.patch
@@ -0,0 +1,30 @@
+diff --git a/Lib/ssl.py b/Lib/ssl.py
+index 42ebb8ed384..c15c0ec940f 100644
+--- a/Lib/ssl.py
++++ b/Lib/ssl.py
+@@ -423,6 +423,8 @@ class SSLContext(_SSLContext):
+     """An SSLContext holds various SSL-related configuration options and
+     data, such as certificates and possibly a private key."""
+     _windows_cert_stores = ("CA", "ROOT")
++    _FALLBACK_CERT_FILE = "/etc/pki/tls/cert.pem"  # RHEL 8 and below, Fedora 33 and below
++    _FALLBACK_CERT_DIR = "/etc/pki/tls/certs"  # RHEL 8 and below, Fedora 33 and below
+ 
+     sslsocket_class = None  # SSLSocket is assigned later.
+     sslobject_class = None  # SSLObject is assigned later.
+@@ -531,6 +533,16 @@ def load_default_certs(self, purpose=Purpose.SERVER_AUTH):
+         if sys.platform == "win32":
+             for storename in self._windows_cert_stores:
+                 self._load_windows_store_certs(storename, purpose)
++        elif sys.platform == "linux":
++            _def_paths = _ssl.get_default_verify_paths()
++            if (_def_paths[0] not in os.environ and
++                not os.path.isfile(_def_paths[1]) and
++                os.path.isfile(self._FALLBACK_CERT_FILE)):
++                self.load_verify_locations(cafile=self._FALLBACK_CERT_FILE)
++            if (_def_paths[2] not in os.environ and
++                not os.path.isdir(_def_paths[3]) and
++                os.path.isdir(self._FALLBACK_CERT_DIR)):
++                self.load_verify_locations(capath=self._FALLBACK_CERT_DIR)
+         self.set_default_verify_paths()
+ 
+     if hasattr(_SSLContext, 'minimum_version'):
diff --git a/cpython-unix/patch-jit-llvm-version-3.13.patch b/cpython-unix/patch-jit-llvm-version-3.13.patch
@@ -6,7 +6,7 @@ diff --git a/Tools/jit/_llvm.py b/Tools/jit/_llvm.py
  import typing
  
 -_LLVM_VERSION = 18
-+_LLVM_VERSION = 21
++_LLVM_VERSION = 22
  _LLVM_VERSION_PATTERN = re.compile(rf"version\s+{_LLVM_VERSION}\.\d+\.\d+\S*\s+")
  
  _P = typing.ParamSpec("_P")
diff --git a/cpython-unix/patch-jit-llvm-version-3.14.patch b/cpython-unix/patch-jit-llvm-version-3.14.patch
@@ -6,7 +6,7 @@ diff --git a/Tools/jit/_llvm.py b/Tools/jit/_llvm.py
  import typing
  
 -_LLVM_VERSION = 19
-+_LLVM_VERSION = 21
++_LLVM_VERSION = 22
  _LLVM_VERSION_PATTERN = re.compile(rf"version\s+{_LLVM_VERSION}\.\d+\.\d+\S*\s+")
  
  _P = typing.ParamSpec("_P")
diff --git a/cpython-unix/targets.yml b/cpython-unix/targets.yml
@@ -131,6 +131,9 @@ aarch64-unknown-linux-gnu:
   target_cxx: clang++
   target_cflags:
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
     # Needed to prevent BOLT from crashing.
     - '-fdebug-default-version=4'
   needs:
@@ -567,6 +570,9 @@ x86_64-unknown-linux-gnu:
   target_cxx: clang++
   target_cflags:
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
     # Needed to prevent BOLT from crashing.
     - '-fdebug-default-version=4'
   needs:
@@ -614,6 +620,9 @@ x86_64_v2-unknown-linux-gnu:
   target_cflags:
     - '-march=x86-64-v2'
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
     # Needed to prevent BOLT from crashing.
     - '-fdebug-default-version=4'
   needs:
@@ -661,6 +670,9 @@ x86_64_v3-unknown-linux-gnu:
   target_cflags:
     - '-march=x86-64-v3'
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
     # Needed to prevent BOLT from crashing.
     - '-fdebug-default-version=4'
   needs:
@@ -708,6 +720,9 @@ x86_64_v4-unknown-linux-gnu:
   target_cflags:
     - '-march=x86-64-v4'
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
     # Needed to prevent BOLT from crashing.
     - '-fdebug-default-version=4'
   needs:
@@ -754,6 +769,9 @@ x86_64-unknown-linux-musl:
   target_cxx: clang++  # TODO: Explore a musl-clang++ shim?
   target_cflags:
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
   needs:
     - autoconf
     - bdb
@@ -799,6 +817,9 @@ x86_64_v2-unknown-linux-musl:
   target_cflags:
     - '-march=x86-64-v2'
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
   needs:
     - autoconf
     - bdb
@@ -844,6 +865,9 @@ x86_64_v3-unknown-linux-musl:
   target_cflags:
     - '-march=x86-64-v3'
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
   needs:
     - autoconf
     - bdb
@@ -889,6 +913,9 @@ x86_64_v4-unknown-linux-musl:
   target_cflags:
     - '-march=x86-64-v4'
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
   needs:
     - autoconf
     - bdb
@@ -937,6 +964,9 @@ aarch64-unknown-linux-musl:
   target_cxx: clang++
   target_cflags:
     - '-fvisibility=hidden'
+    # Enable frame pointers
+    - '-fno-omit-frame-pointer'
+    - '-mno-omit-leaf-frame-pointer'
   needs:
     - autoconf
     - bdb
diff --git a/pythonbuild/downloads.py b/pythonbuild/downloads.py
@@ -177,32 +177,32 @@
         "license_file": "LICENSE.libxcb.txt",
     },
     # Remember to update LLVM_URL in src/release.rs whenever upgrading.
-    "llvm-21-aarch64-linux": {
-        "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-gnu_only-aarch64-unknown-linux-gnu.tar.zst",
-        "size": 230693810,
-        "sha256": "2933d04136d102d7b82e6a712c5a2d45430045a17689033713e7daab931f111f",
-        "version": "21.1.4+20251029",
+    "llvm-aarch64-linux": {
+        "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20260312/llvm-22.1.1+20260312-gnu_only-aarch64-unknown-linux-gnu.tar.zst",
+        "size": 237665010,
+        "sha256": "0f7ef68a9d6239336aa073366edd5377a47192c32d40c96ff72b416a15259999",
+        "version": "22.1.1+20260312",
     },
     # Remember to update LLVM_URL in src/release.rs whenever upgrading.
-    "llvm-21-x86_64-linux": {
-        "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-gnu_only-x86_64-unknown-linux-gnu.tar.zst",
-        "size": 273582186,
-        "sha256": "4d33971109cab386c1721f7af80b8559f7e678164a0fed443909a84347c666f4",
-        "version": "21.1.4+20251029",
+    "llvm-x86_64-linux": {
+        "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20260312/llvm-22.1.1+20260312-gnu_only-x86_64-unknown-linux-gnu.tar.zst",
+        "size": 281108139,
+        "sha256": "2a2f2e51bb9c621c6b00a42d8349f27edcb3aacaa750040000ac95a0298e97c1",
+        "version": "22.1.1+20260312",
     },
     # Remember to update LLVM_URL in src/release.rs whenever upgrading.
     "llvm-aarch64-macos": {
-        "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-aarch64-apple-darwin.tar.zst",
-        "size": 155537884,
-        "sha256": "4a17d032ea9c2bd86203f5195df57fe621b0cc5163b858bb4208584fa41e8fc4",
-        "version": "21.1.4+20251029",
+        "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20260312/llvm-22.1.1+20260312-aarch64-apple-darwin.tar.zst",
+        "size": 159781503,
+        "sha256": "04df05eed3dde711a5962f031f3075e3d46bad92eb0520bc4c2814ac0210c56f",
+        "version": "22.1.1+20260312",
     },
     # Remember to update LLVM_URL in src/release.rs whenever upgrading.
     "llvm-x86_64-macos": {
-        "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20251029/llvm-21.1.4+20251029-x86_64-apple-darwin.tar.zst",
-        "size": 163122945,
-        "sha256": "a245a0a8bf529d8dc57ea48b930313b1325f5540bf42ddb8704ce525926cde46",
-        "version": "21.1.4+20251029",
+        "url": "https://github.com/indygreg/toolchain-tools/releases/download/toolchain-bootstrap%2F20260312/llvm-22.1.1+20260312-x86_64-apple-darwin.tar.zst",
+        "size": 167381561,
+        "sha256": "aef8508bef17a2d40b07ff955917ff7f36c1a609116ee8c052e12307ec748314",
+        "version": "22.1.1+20260312",
     },
     "m4": {
         # Mirrored from https://ftp.gnu.org/gnu/m4/m4-1.4.19.tar.xz
@@ -294,10 +294,10 @@
         "license_file": "LICENSE.readline.txt",
     },
     "setuptools": {
-        "url": "https://files.pythonhosted.org/packages/a3/dc/17031897dae0efacfea57dfd3a82fdd2a2aeb58e0ff71b77b87e44edc772/setuptools-80.9.0-py3-none-any.whl",
-        "size": 1201486,
-        "sha256": "062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922",
-        "version": "80.9.0",
+        "url": "https://files.pythonhosted.org/packages/9d/76/f789f7a86709c6b087c5a2f52f911838cad707cc613162401badc665acfe/setuptools-82.0.1-py3-none-any.whl",
+        "size": 1006223,
+        "sha256": "a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb",
+        "version": "82.0.1",
     },
     # Remember to update verify_distribution.py when version changed.
     "sqlite": {
diff --git a/pythonbuild/utils.py b/pythonbuild/utils.py
@@ -545,9 +545,9 @@ def sort_key(v):
 
 def clang_toolchain(host_platform: str, target_triple: str) -> str:
     if host_platform == "linux_x86_64":
-        return "llvm-21-x86_64-linux"
+        return "llvm-x86_64-linux"
     elif host_platform == "linux_aarch64":
-        return "llvm-21-aarch64-linux"
+        return "llvm-aarch64-linux"
     elif host_platform == "macos_arm64":
         return "llvm-aarch64-macos"
     elif host_platform == "macos_x86_64":
diff --git a/src/github.rs b/src/github.rs
diff --git a/src/main.rs b/src/main.rs
diff --git a/src/release.rs b/src/release.rs
