Merge branch 'main' into llvm-version

Author: danigm

.github/workflows/jit.yml

@@ -134,6 +134,34 @@ jobs:
           make all --jobs 4
           ./python -m test --multiprocess 0 --timeout 4500 --verbose2 --verbose3
 
+  jit-with-disabled-gil:
+    name: Free-Threaded (Debug)
+    needs: interpreter
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        llvm:
+          - 19
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Build with JIT enabled and GIL disabled
+        run: |
+          sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh ${{ matrix.llvm }}
+          export PATH="$(llvm-config-${{ matrix.llvm }} --bindir):$PATH"
+          ./configure --enable-experimental-jit --with-pydebug --disable-gil
+          make all --jobs 4
+      - name: Run tests
+        run: |
+          ./python -m test --multiprocess 0 --timeout 4500 --verbose2 --verbose3
+        continue-on-error: true
+
   no-opt-jit:
     name: JIT without optimizations (Debug)
     needs: interpreter
@@ -160,31 +188,3 @@ jobs:
       - name: Run tests without optimizations
         run: |
           PYTHON_UOPS_OPTIMIZE=0 ./python -m test --multiprocess 0 --timeout 4500 --verbose2 --verbose3
-
-  # XXX: GH-133171
-  # jit-with-disabled-gil:
-  #   name: Free-Threaded (Debug)
-  #   needs: interpreter
-  #   runs-on: ubuntu-24.04
-  #   timeout-minutes: 90
-  #   strategy:
-  #     fail-fast: false
-  #     matrix:
-  #       llvm:
-  #         - 19
-  #   steps:
-  #     - uses: actions/checkout@v4
-  #       with:
-  #         persist-credentials: false
-  #     - uses: actions/setup-python@v5
-  #       with:
-  #         python-version: '3.11'
-  #     - name: Build with JIT enabled and GIL disabled
-  #       run: |
-  #         sudo bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)" ./llvm.sh ${{ matrix.llvm }}
-  #         export PATH="$(llvm-config-${{ matrix.llvm }} --bindir):$PATH"
-  #         ./configure --enable-experimental-jit --with-pydebug --disable-gil
-  #         make all --jobs 4
-  #     - name: Run tests
-  #       run: |
-  #         ./python -m test --multiprocess 0 --timeout 4500 --verbose2 --verbose3

Apple/__main__.py

@@ -316,7 +316,7 @@ def unpack_deps(
     for name_ver in [
         "BZip2-1.0.8-2",
         "libFFI-3.4.7-2",
-        "OpenSSL-3.0.16-2",
+        "OpenSSL-3.0.17-1",
         "XZ-5.6.4-2",
         "mpdecimal-4.0.0-2",
         "zstd-1.5.7-1",
@@ -577,6 +577,7 @@ def create_xcframework(platform: str) -> str:
 
     # Extract the package version from the merged framework
     version = package_version(package_path / "Python.xcframework")
+    version_tag = ".".join(version.split(".")[:2])
 
     # On non-macOS platforms, each framework in XCframework only contains the
     # headers, libPython, plus an Info.plist. Other resources like the standard
@@ -647,6 +648,23 @@ def create_xcframework(platform: str) -> str:
                 slice_framework / f"Headers/pyconfig-{arch}.h",
             )
 
+            # Apple identifies certain libraries as "security risks"; if you
+            # statically link those libraries into a Framework, you become
+            # responsible for providing a privacy manifest for that framework.
+            xcprivacy_file = {
+                "OpenSSL": subdir(host_triple) / "prefix/share/OpenSSL.xcprivacy"
+            }
+            print(f"   - {multiarch} xcprivacy files")
+            for module, lib in [
+                ("_hashlib", "OpenSSL"),
+                ("_ssl", "OpenSSL"),
+            ]:
+                shutil.copy(
+                    xcprivacy_file[lib],
+                    slice_path
+                    / f"lib-{arch}/python{version_tag}/lib-dynload/{module}.xcprivacy",
+                )
+
     print(" - build tools")
     shutil.copytree(
         PYTHON_DIR / "Apple/testbed/Python.xcframework/build",

Apple/testbed/Python.xcframework/build/utils.sh

@@ -67,6 +67,9 @@ install_dylib () {
 
     # The name of the extension file
     EXT=$(basename "$FULL_EXT")
+    # The name and location of the module
+    MODULE_PATH=$(dirname "$FULL_EXT")
+    MODULE_NAME=$(echo $EXT | cut -d "." -f 1)
     # The location of the extension file, relative to the bundle
     RELATIVE_EXT=${FULL_EXT#$CODESIGNING_FOLDER_PATH/}
     # The path to the extension file, relative to the install base
@@ -94,6 +97,16 @@ install_dylib () {
     # Create a back reference to the .so file location in the framework
     echo "${RELATIVE_EXT%.so}.fwork" > "$CODESIGNING_FOLDER_PATH/$FRAMEWORK_FOLDER/$FULL_MODULE_NAME.origin"
 
+    # If the framework provides an xcprivacy file, install it.
+    if [ -e "$MODULE_PATH/$MODULE_NAME.xcprivacy" ]; then
+        echo "Installing XCPrivacy file for $FRAMEWORK_FOLDER/$FULL_MODULE_NAME"
+        XCPRIVACY_FILE="$CODESIGNING_FOLDER_PATH/$FRAMEWORK_FOLDER/PrivacyInfo.xcprivacy"
+        if [ -e "$XCPRIVACY_FILE" ]; then
+          rm -rf "$XCPRIVACY_FILE"
+        fi
+        mv "$MODULE_PATH/$MODULE_NAME.xcprivacy" "$XCPRIVACY_FILE"
+    fi
+
     echo "Signing framework as $EXPANDED_CODE_SIGN_IDENTITY_NAME ($EXPANDED_CODE_SIGN_IDENTITY)..."
     /usr/bin/codesign --force --sign "$EXPANDED_CODE_SIGN_IDENTITY" ${OTHER_CODE_SIGN_FLAGS:-} -o runtime --timestamp=none --preserve-metadata=identifier,entitlements,flags --generate-entitlement-der "$CODESIGNING_FOLDER_PATH/$FRAMEWORK_FOLDER"
 }

Doc/c-api/init.rst

@@ -1382,6 +1382,9 @@ All of the following functions must be called after :c:func:`Py_Initialize`.
    This is not a replacement for :c:func:`PyModule_GetState()`, which
    extensions should use to store interpreter-specific state information.
 
+   The returned dictionary is borrowed from the interpreter and is valid until
+   interpreter shutdown.
+
    .. versionadded:: 3.8
 
 

Doc/c-api/weakref.rst

@@ -64,30 +64,6 @@ as much as it can.
    .. versionadded:: 3.13
 
 
-.. c:function:: PyObject* PyWeakref_GetObject(PyObject *ref)
-
-   Return a :term:`borrowed reference` to the referenced object from a weak
-   reference, *ref*.  If the referent is no longer live, returns ``Py_None``.
-
-   .. note::
-
-      This function returns a :term:`borrowed reference` to the referenced object.
-      This means that you should always call :c:func:`Py_INCREF` on the object
-      except when it cannot be destroyed before the last usage of the borrowed
-      reference.
-
-   .. deprecated-removed:: 3.13 3.15
-      Use :c:func:`PyWeakref_GetRef` instead.
-
-
-.. c:function:: PyObject* PyWeakref_GET_OBJECT(PyObject *ref)
-
-   Similar to :c:func:`PyWeakref_GetObject`, but does no error checking.
-
-   .. deprecated-removed:: 3.13 3.15
-      Use :c:func:`PyWeakref_GetRef` instead.
-
-
 .. c:function:: int PyWeakref_IsDead(PyObject *ref)
 
    Test if the weak reference *ref* is dead. Returns 1 if the reference is

Doc/data/refcounts.dat

@@ -1141,6 +1141,9 @@ PyInterpreterState_Clear:PyInterpreterState*:interp::
 PyInterpreterState_Delete:void:::
 PyInterpreterState_Delete:PyInterpreterState*:interp::
 
+PyInterpreterState_GetDict:PyObject*::0:
+PyInterpreterState_GetDict:PyInterpreterState*:interp::
+
 PyInterpreterState_GetID:int64_t:::
 PyInterpreterState_GetID:PyInterpreterState*:interp::
 
@@ -2947,12 +2950,6 @@ PyWeakref_CheckProxy:PyObject*:ob:0:
 PyWeakref_CheckRef:int:::
 PyWeakref_CheckRef:PyObject*:ob:0:
 
-PyWeakref_GET_OBJECT:PyObject*::0:
-PyWeakref_GET_OBJECT:PyObject*:ref:0:
-
-PyWeakref_GetObject:PyObject*::0:
-PyWeakref_GetObject:PyObject*:ref:0:
-
 PyWeakref_GetRef:int:::
 PyWeakref_GetRef:PyObject*:ref:0:
 PyWeakref_GetRef:PyObject**:pobj:+1:

Doc/data/stable_abi.dat

@@ -3,7 +3,7 @@ Pending removal in Python 3.15
 
 * The :c:func:`!PyImport_ImportModuleNoBlock`:
   Use :c:func:`PyImport_ImportModule` instead.
-* :c:func:`PyWeakref_GetObject` and :c:func:`PyWeakref_GET_OBJECT`:
+* :c:func:`!PyWeakref_GetObject` and :c:func:`!PyWeakref_GET_OBJECT`:
   Use :c:func:`PyWeakref_GetRef` instead. The `pythoncapi-compat project
   <https://github.com/python/pythoncapi-compat/>`__ can be used to get
   :c:func:`PyWeakref_GetRef` on Python 3.12 and older.

Doc/deprecations/c-api-pending-removal-in-3.15.rst

@@ -9,6 +9,8 @@ Deprecations
 
 .. include:: pending-removal-in-3.19.rst
 
+.. include:: pending-removal-in-3.20.rst
+
 .. include:: pending-removal-in-future.rst
 
 C API deprecations

Doc/deprecations/index.rst

@@ -0,0 +1,23 @@
+Pending removal in Python 3.20
+------------------------------
+
+* The ``__version__`` attribute has been deprecated in these standard library
+  modules and will be removed in Python 3.20.
+  Use :py:data:`sys.version_info` instead.
+
+  - :mod:`argparse`
+  - :mod:`csv`
+  - :mod:`!ctypes.macholib`
+  - :mod:`ipaddress`
+  - :mod:`json`
+  - :mod:`logging` (``__date__`` also deprecated)
+  - :mod:`optparse`
+  - :mod:`pickle`
+  - :mod:`platform`
+  - :mod:`re`
+  - :mod:`socketserver`
+  - :mod:`tabnanny`
+  - :mod:`tkinter.font`
+  - :mod:`tkinter.ttk`
+
+  (Contributed by Hugo van Kemenade in :gh:`76007`.)