Use Arfrever's patchset, bug 354877. Apply fix for CVS-2013-4238, bug 480856.

(Portage version: 2.2.0/cvs/Linux x86_64, signed Manifest commit with key 0BBEEA1FEA4843A4)

3 files changed, 603 insertions, 1 deletions

diff --git a/dev-lang/python/ChangeLog b/dev-lang/python/ChangeLog
index 2b3f2e8379c4..1b0dfe9ff640 100644
--- a/dev-lang/python/ChangeLog
+++ b/dev-lang/python/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for dev-lang/python
 # Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/ChangeLog,v 1.687 2013/08/06 13:11:48 ago Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/ChangeLog,v 1.688 2013/08/18 18:35:25 floppym Exp $
+
+*python-3.3.2-r2 (18 Aug 2013)
+
+  18 Aug 2013; Mike Gilbert <floppym@gentoo.org>
+  +files/CVE-2013-4073_py33.patch, +python-3.3.2-r2.ebuild:
+  Use Arfrever's patchset, bug 354877. Apply fix for CVS-2013-4238, bug 480856.
 
   06 Aug 2013; Agostino Sarubbo <ago@gentoo.org> python-2.7.5.ebuild:
   Stable for s390, wrt bug #475424
diff --git a/dev-lang/python/files/CVE-2013-4073_py33.patch b/dev-lang/python/files/CVE-2013-4073_py33.patch
new file mode 100644
index 000000000000..41db4d241b53
--- /dev/null
+++ b/dev-lang/python/files/CVE-2013-4073_py33.patch
@@ -0,0 +1,241 @@
+diff -r e0f86c3b3685 Lib/test/nullbytecert.pem
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ b/Lib/test/nullbytecert.pem	Sun Aug 11 18:17:23 2013 +0200
+@@ -0,0 +1,90 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 0 (0x0)
++    Signature Algorithm: sha1WithRSAEncryption
++        Issuer: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, OU=Python Core Development, CN=null.python.org\x00example.org/emailAddress=python-dev@python.org
++        Validity
++            Not Before: Aug  7 13:11:52 2013 GMT
++            Not After : Aug  7 13:12:52 2013 GMT
++        Subject: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, OU=Python Core Development, CN=null.python.org\x00example.org/emailAddress=python-dev@python.org
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                Public-Key: (2048 bit)
++                Modulus:
++                    00:b5:ea:ed:c9:fb:46:7d:6f:3b:76:80:dd:3a:f3:
++                    03:94:0b:a7:a6:db:ec:1d:df:ff:23:74:08:9d:97:
++                    16:3f:a3:a4:7b:3e:1b:0e:96:59:25:03:a7:26:e2:
++                    88:a9:cf:79:cd:f7:04:56:b0:ab:79:32:6e:59:c1:
++                    32:30:54:eb:58:a8:cb:91:f0:42:a5:64:27:cb:d4:
++                    56:31:88:52:ad:cf:bd:7f:f0:06:64:1f:cc:27:b8:
++                    a3:8b:8c:f3:d8:29:1f:25:0b:f5:46:06:1b:ca:02:
++                    45:ad:7b:76:0a:9c:bf:bb:b9:ae:0d:16:ab:60:75:
++                    ae:06:3e:9c:7c:31:dc:92:2f:29:1a:e0:4b:0c:91:
++                    90:6c:e9:37:c5:90:d7:2a:d7:97:15:a3:80:8f:5d:
++                    7b:49:8f:54:30:d4:97:2c:1c:5b:37:b5:ab:69:30:
++                    68:43:d3:33:78:4b:02:60:f5:3c:44:80:a1:8f:e7:
++                    f0:0f:d1:5e:87:9e:46:cf:62:fc:f9:bf:0c:65:12:
++                    f1:93:c8:35:79:3f:c8:ec:ec:47:f5:ef:be:44:d5:
++                    ae:82:1e:2d:9a:9f:98:5a:67:65:e1:74:70:7c:cb:
++                    d3:c2:ce:0e:45:49:27:dc:e3:2d:d4:fb:48:0e:2f:
++                    9e:77:b8:14:46:c0:c4:36:ca:02:ae:6a:91:8c:da:
++                    2f:85
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Basic Constraints: critical
++                CA:FALSE
++            X509v3 Subject Key Identifier:
++                88:5A:55:C0:52:FF:61:CD:52:A3:35:0F:EA:5A:9C:24:38:22:F7:5C
++            X509v3 Key Usage:
++                Digital Signature, Non Repudiation, Key Encipherment
++            X509v3 Subject Alternative Name:
++                *************************************************************
++                WARNING: The values for DNS, email and URI are WRONG. OpenSSL
++                         doesn't print the text after a NULL byte.
++                *************************************************************
++                DNS:altnull.python.org, email:null@python.org, URI:http://null.python.org, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1
++    Signature Algorithm: sha1WithRSAEncryption
++         ac:4f:45:ef:7d:49:a8:21:70:8e:88:59:3e:d4:36:42:70:f5:
++         a3:bd:8b:d7:a8:d0:58:f6:31:4a:b1:a4:a6:dd:6f:d9:e8:44:
++         3c:b6:0a:71:d6:7f:b1:08:61:9d:60:ce:75:cf:77:0c:d2:37:
++         86:02:8d:5e:5d:f9:0f:71:b4:16:a8:c1:3d:23:1c:f1:11:b3:
++         56:6e:ca:d0:8d:34:94:e6:87:2a:99:f2:ae:ae:cc:c2:e8:86:
++         de:08:a8:7f:c5:05:fa:6f:81:a7:82:e6:d0:53:9d:34:f4:ac:
++         3e:40:fe:89:57:7a:29:a4:91:7e:0b:c6:51:31:e5:10:2f:a4:
++         60:76:cd:95:51:1a:be:8b:a1:b0:fd:ad:52:bd:d7:1b:87:60:
++         d2:31:c7:17:c4:18:4f:2d:08:25:a3:a7:4f:b7:92:ca:e2:f5:
++         25:f1:54:75:81:9d:b3:3d:61:a2:f7:da:ed:e1:c6:6f:2c:60:
++         1f:d8:6f:c5:92:05:ab:c9:09:62:49:a9:14:ad:55:11:cc:d6:
++         4a:19:94:99:97:37:1d:81:5f:8b:cf:a3:a8:96:44:51:08:3d:
++         0b:05:65:12:eb:b6:70:80:88:48:72:4f:c6:c2:da:cf:cd:8e:
++         5b:ba:97:2f:60:b4:96:56:49:5e:3a:43:76:63:04:be:2a:f6:
++         c1:ca:a9:94
++-----BEGIN CERTIFICATE-----
++MIIE2DCCA8CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBxTELMAkGA1UEBhMCVVMx
++DzANBgNVBAgMBk9yZWdvbjESMBAGA1UEBwwJQmVhdmVydG9uMSMwIQYDVQQKDBpQ
++eXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEgMB4GA1UECwwXUHl0aG9uIENvcmUg
++RGV2ZWxvcG1lbnQxJDAiBgNVBAMMG251bGwucHl0aG9uLm9yZwBleGFtcGxlLm9y
++ZzEkMCIGCSqGSIb3DQEJARYVcHl0aG9uLWRldkBweXRob24ub3JnMB4XDTEzMDgw
++NzEzMTE1MloXDTEzMDgwNzEzMTI1MlowgcUxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI
++DAZPcmVnb24xEjAQBgNVBAcMCUJlYXZlcnRvbjEjMCEGA1UECgwaUHl0aG9uIFNv
++ZnR3YXJlIEZvdW5kYXRpb24xIDAeBgNVBAsMF1B5dGhvbiBDb3JlIERldmVsb3Bt
++ZW50MSQwIgYDVQQDDBtudWxsLnB5dGhvbi5vcmcAZXhhbXBsZS5vcmcxJDAiBgkq
++hkiG9w0BCQEWFXB5dGhvbi1kZXZAcHl0aG9uLm9yZzCCASIwDQYJKoZIhvcNAQEB
++BQADggEPADCCAQoCggEBALXq7cn7Rn1vO3aA3TrzA5QLp6bb7B3f/yN0CJ2XFj+j
++pHs+Gw6WWSUDpybiiKnPec33BFawq3kyblnBMjBU61ioy5HwQqVkJ8vUVjGIUq3P
++vX/wBmQfzCe4o4uM89gpHyUL9UYGG8oCRa17dgqcv7u5rg0Wq2B1rgY+nHwx3JIv
++KRrgSwyRkGzpN8WQ1yrXlxWjgI9de0mPVDDUlywcWze1q2kwaEPTM3hLAmD1PESA
++oY/n8A/RXoeeRs9i/Pm/DGUS8ZPINXk/yOzsR/XvvkTVroIeLZqfmFpnZeF0cHzL
++08LODkVJJ9zjLdT7SA4vnne4FEbAxDbKAq5qkYzaL4UCAwEAAaOB0DCBzTAMBgNV
++HRMBAf8EAjAAMB0GA1UdDgQWBBSIWlXAUv9hzVKjNQ/qWpwkOCL3XDALBgNVHQ8E
++BAMCBeAwgZAGA1UdEQSBiDCBhYIeYWx0bnVsbC5weXRob24ub3JnAGV4YW1wbGUu
++Y29tgSBudWxsQHB5dGhvbi5vcmcAdXNlckBleGFtcGxlLm9yZ4YpaHR0cDovL251
++bGwucHl0aG9uLm9yZwBodHRwOi8vZXhhbXBsZS5vcmeHBMAAAgGHECABDbgAAAAA
++AAAAAAAAAAEwDQYJKoZIhvcNAQEFBQADggEBAKxPRe99SaghcI6IWT7UNkJw9aO9
++i9eo0Fj2MUqxpKbdb9noRDy2CnHWf7EIYZ1gznXPdwzSN4YCjV5d+Q9xtBaowT0j
++HPERs1ZuytCNNJTmhyqZ8q6uzMLoht4IqH/FBfpvgaeC5tBTnTT0rD5A/olXeimk
++kX4LxlEx5RAvpGB2zZVRGr6LobD9rVK91xuHYNIxxxfEGE8tCCWjp0+3ksri9SXx
++VHWBnbM9YaL32u3hxm8sYB/Yb8WSBavJCWJJqRStVRHM1koZlJmXNx2BX4vPo6iW
++RFEIPQsFZRLrtnCAiEhyT8bC2s/Njlu6ly9gtJZWSV46Q3ZjBL4q9sHKqZQ=
++-----END CERTIFICATE-----
+diff -r e0f86c3b3685 Lib/test/test_ssl.py
+--- a/Lib/test/test_ssl.py	Sun Aug 11 13:04:50 2013 +0300
++++ b/Lib/test/test_ssl.py	Sun Aug 11 18:17:23 2013 +0200
+@@ -55,6 +55,7 @@
+ WRONGCERT = data_file("XXXnonexisting.pem")
+ BADKEY = data_file("badkey.pem")
+ NOKIACERT = data_file("nokia.pem")
++NULLBYTECERT = data_file("nullbytecert.pem")
+ 
+ DHFILE = data_file("dh512.pem")
+ BYTES_DHFILE = os.fsencode(DHFILE)
+@@ -162,6 +163,27 @@
+                           ('DNS', 'projects.forum.nokia.com'))
+                         )
+ 
++    def test_parse_cert_CVE_2013_4073(self):
++        p = ssl._ssl._test_decode_cert(NULLBYTECERT)
++        if support.verbose:
++            sys.stdout.write("\n" + pprint.pformat(p) + "\n")
++        subject = ((('countryName', 'US'),),
++                   (('stateOrProvinceName', 'Oregon'),),
++                   (('localityName', 'Beaverton'),),
++                   (('organizationName', 'Python Software Foundation'),),
++                   (('organizationalUnitName', 'Python Core Development'),),
++                   (('commonName', 'null.python.org\x00example.org'),),
++                   (('emailAddress', 'python-dev@python.org'),))
++        self.assertEqual(p['subject'], subject)
++        self.assertEqual(p['issuer'], subject)
++        self.assertEqual(p['subjectAltName'],
++                         (('DNS', 'altnull.python.org\x00example.com'),
++                         ('email', 'null@python.org\x00user@example.org'),
++                         ('URI', 'http://null.python.org\x00http://example.org'),
++                         ('IP Address', '192.0.2.1'),
++                         ('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
++                        )
++
+     def test_DER_to_PEM(self):
+         with open(SVN_PYTHON_ORG_ROOT_CERT, 'r') as f:
+             pem = f.read()
+@@ -294,6 +316,13 @@
+         fail(cert, 'foo.a.com')
+         fail(cert, 'bar.foo.com')
+ 
++        # NULL bytes are bad, CVE-2013-4073
++        cert = {'subject': ((('commonName',
++                              'null.python.org\x00example.org'),),)}
++        ok(cert, 'null.python.org\x00example.org') # or raise an error?
++        fail(cert, 'example.org')
++        fail(cert, 'null.python.org')
++
+         # Slightly fake real-world example
+         cert = {'notAfter': 'Jun 26 21:41:46 2011 GMT',
+                 'subject': ((('commonName', 'linuxfrz.org'),),),
+diff -r e0f86c3b3685 Modules/_ssl.c
+--- a/Modules/_ssl.c	Sun Aug 11 13:04:50 2013 +0300
++++ b/Modules/_ssl.c	Sun Aug 11 18:17:23 2013 +0200
+@@ -771,12 +771,14 @@
+                            ext->value->length));
+ 
+         for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {
+-
+             /* get a rendering of each name in the set of names */
++            int gntype;
++            ASN1_STRING *as = NULL;
+ 
+             name = sk_GENERAL_NAME_value(names, j);
+-            if (name->type == GEN_DIRNAME) {
+-
++            gntype = name-> type;
++            switch (gntype) {
++            case GEN_DIRNAME:
+                 /* we special-case DirName as a tuple of
+                    tuples of attributes */
+ 
+@@ -798,11 +800,62 @@
+                     goto fail;
+                 }
+                 PyTuple_SET_ITEM(t, 1, v);
++                break;
+ 
+-            } else {
++            case GEN_EMAIL:
++            case GEN_DNS:
++            case GEN_URI:
++                /* GENERAL_NAME_print() doesn't handle NUL bytes in ASN1_string
++                   correctly. */
++                t = PyTuple_New(2);
++                if (t == NULL)
++                    goto fail;
++                switch (gntype) {
++                case GEN_EMAIL:
++                    v = PyUnicode_FromString("email");
++                    as = name->d.rfc822Name;
++                    break;
++                case GEN_DNS:
++                    v = PyUnicode_FromString("DNS");
++                    as = name->d.dNSName;
++                    break;
++                case GEN_URI:
++                    v = PyUnicode_FromString("URI");
++                    as = name->d.uniformResourceIdentifier;
++                    break;
++                }
++                if (v == NULL) {
++                    Py_DECREF(t);
++                    goto fail;
++                }
++                PyTuple_SET_ITEM(t, 0, v);
++                v = PyUnicode_FromStringAndSize((char *)ASN1_STRING_data(as),
++                                                ASN1_STRING_length(as));
++                if (v == NULL) {
++                    Py_DECREF(t);
++                    goto fail;
++                }
++                PyTuple_SET_ITEM(t, 1, v);
++                break;
+ 
++            default:
+                 /* for everything else, we use the OpenSSL print form */
+-
++                switch (gntype) {
++                    /* check for new general name type */
++                    case GEN_OTHERNAME:
++                    case GEN_X400:
++                    case GEN_EDIPARTY:
++                    case GEN_IPADD:
++                    case GEN_RID:
++                        break;
++                    default:
++                        if (PyErr_WarnFormat(PyExc_RuntimeWarning, 1,
++                                             "Unknown general name type %d",
++                                             gntype) == -1) {
++                            goto fail;
++                        }
++                        break;
++                }
+                 (void) BIO_reset(biobuf);
+                 GENERAL_NAME_print(biobuf, name);
+                 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
+@@ -829,6 +882,7 @@
+                     goto fail;
+                 }
+                 PyTuple_SET_ITEM(t, 1, v);
++                break;
+             }
+ 
+             /* and add that rendering to the list */
diff --git a/dev-lang/python/python-3.3.2-r2.ebuild b/dev-lang/python/python-3.3.2-r2.ebuild
new file mode 100644
index 000000000000..6a594dc8f0ff
--- /dev/null
+++ b/dev-lang/python/python-3.3.2-r2.ebuild
@@ -0,0 +1,355 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/python-3.3.2-r2.ebuild,v 1.1 2013/08/18 18:35:25 floppym Exp $
+
+EAPI="3"
+WANT_AUTOMAKE="none"
+WANT_LIBTOOL="none"
+
+inherit autotools eutils flag-o-matic multilib pax-utils python-utils-r1 toolchain-funcs multiprocessing
+
+MY_P="Python-${PV}"
+PATCHSET_REVISION="2"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="http://www.python.org/"
+SRC_URI="http://www.python.org/ftp/python/${PV}/${MY_P}.tar.xz
+	mirror://gentoo/python-gentoo-patches-${PV}-${PATCHSET_REVISION}.tar.xz"
+
+LICENSE="PSF-2"
+SLOT="3.3"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd"
+IUSE="build doc elibc_uclibc examples gdbm hardened ipv6 +ncurses +readline sqlite +ssl +threads tk wininst +xml"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="app-arch/bzip2
+	>=sys-libs/zlib-1.1.3
+	virtual/libffi
+	virtual/libintl
+	!build? (
+		gdbm? ( sys-libs/gdbm[berkdb] )
+		ncurses? (
+			>=sys-libs/ncurses-5.2
+			readline? ( >=sys-libs/readline-4.1 )
+		)
+		sqlite? ( >=dev-db/sqlite-3.3.8:3[extensions] )
+		ssl? ( dev-libs/openssl )
+		tk? (
+			>=dev-lang/tk-8.0
+			dev-tcltk/blt
+		)
+		xml? ( >=dev-libs/expat-2.1 )
+	)
+	!!<sys-apps/sandbox-2.6-r1"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+	>=sys-devel/autoconf-2.65
+	!sys-devel/gcc[libffi]"
+RDEPEND+=" !build? ( app-misc/mime-types )
+	doc? ( dev-python/python-docs:${SLOT} )"
+PDEPEND="app-admin/eselect-python
+	app-admin/python-updater"
+
+S="${WORKDIR}/${MY_P}"
+
+src_prepare() {
+	# Ensure that internal copies of expat, libffi and zlib are not used.
+	rm -fr Modules/expat
+	rm -fr Modules/_ctypes/libffi*
+	rm -fr Modules/zlib
+
+	EPATCH_SUFFIX="patch" epatch "${WORKDIR}/${PV}-${PATCHSET_REVISION}"
+
+	epatch "${FILESDIR}/python-3.3-CVE-2013-2099.patch"
+	epatch "${FILESDIR}/CVE-2013-4073_py33.patch"
+
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" \
+		Lib/distutils/command/install.py \
+		Lib/distutils/sysconfig.py \
+		Lib/site.py \
+		Lib/sysconfig.py \
+		Lib/test/test_site.py \
+		Makefile.pre.in \
+		Modules/Setup.dist \
+		Modules/getpath.c \
+		setup.py || die "sed failed to replace @@GENTOO_LIBDIR@@"
+
+	# Disable ABI flags.
+	sed -e "s/ABIFLAGS=\"\${ABIFLAGS}.*\"/:/" -i configure.ac || die "sed failed"
+
+	epatch_user
+
+	eautoconf
+	eautoheader
+}
+
+src_configure() {
+	if use build; then
+		# Disable extraneous modules with extra dependencies.
+		export PYTHON_DISABLE_MODULES="gdbm _curses _curses_panel readline _sqlite3 _tkinter _elementtree pyexpat"
+		export PYTHON_DISABLE_SSL="1"
+	else
+		local disable
+		use gdbm     || disable+=" gdbm"
+		use ncurses  || disable+=" _curses _curses_panel"
+		use readline || disable+=" readline"
+		use sqlite   || disable+=" _sqlite3"
+		use ssl      || export PYTHON_DISABLE_SSL="1"
+		use tk       || disable+=" _tkinter"
+		use xml      || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat.
+		export PYTHON_DISABLE_MODULES="${disable}"
+
+		if ! use xml; then
+			ewarn "You have configured Python without XML support."
+			ewarn "This is NOT a recommended configuration as you"
+			ewarn "may face problems parsing any XML documents."
+		fi
+	fi
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	if [[ "$(gcc-major-version)" -ge 4 ]]; then
+		append-flags -fwrapv
+	fi
+
+	filter-flags -malign-double
+
+	[[ "${ARCH}" == "alpha" ]] && append-flags -fPIC
+
+	# https://bugs.gentoo.org/show_bug.cgi?id=50309
+	if is-flagq -O3; then
+		is-flagq -fstack-protector-all && replace-flags -O3 -O2
+		use hardened && replace-flags -O3 -O2
+	fi
+
+	# Run the configure scripts in parallel.
+	multijob_init
+
+	mkdir -p "${WORKDIR}"/{${CBUILD},${CHOST}}
+
+	if tc-is-cross-compiler; then
+		(
+		multijob_child_init
+		cd "${WORKDIR}"/${CBUILD} >/dev/null
+		OPT="-O1" CFLAGS="" CPPFLAGS="" LDFLAGS="" CC="" \
+		"${S}"/configure \
+			--{build,host}=${CBUILD} \
+			|| die "cross-configure failed"
+		) &
+		multijob_post_fork
+
+		# The configure script assumes it's buggy when cross-compiling.
+		export ac_cv_buggy_getaddrinfo=no
+		export ac_cv_have_long_long_format=yes
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	tc-export CXX
+	# The configure script fails to use pkg-config correctly.
+	# http://bugs.python.org/issue15506
+	export ac_cv_path_PKG_CONFIG=$(tc-getPKG_CONFIG)
+
+	# Set LDFLAGS so we link modules with -lpython3.2 correctly.
+	# Needed on FreeBSD unless Python 3.2 is already installed.
+	# Please query BSD team before removing this!
+	append-ldflags "-L."
+
+	local dbmliborder
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	cd "${WORKDIR}"/${CHOST}
+	ECONF_SOURCE=${S} OPT="" \
+	econf \
+		--with-fpectl \
+		--enable-shared \
+		$(use_enable ipv6) \
+		$(use_with threads) \
+		--infodir='${prefix}/share/info' \
+		--mandir='${prefix}/share/man' \
+		--with-computed-gotos \
+		--with-dbmliborder="${dbmliborder}" \
+		--with-libc="" \
+		--enable-loadable-sqlite-extensions \
+		--with-system-expat \
+		--with-system-ffi
+
+	if tc-is-cross-compiler; then
+		# Modify the Makefile.pre so we don't regen for the host/ one.
+		# We need to link the host python programs into $PWD and run
+		# them from here because the distutils sysconfig module will
+		# parse Makefile/etc... from argv[0], and we need it to pick
+		# up the target settings, not the host ones.
+		sed -i \
+			-e '1iHOSTPYTHONPATH = ./hostpythonpath:' \
+			-e '/^HOSTPYTHON/s:=.*:= ./hostpython:' \
+			-e '/^HOSTPGEN/s:=.*:= ./Parser/hostpgen:' \
+			Makefile{.pre,} || die "sed failed"
+	fi
+
+	multijob_finish
+}
+
+src_compile() {
+	if tc-is-cross-compiler; then
+		cd "${WORKDIR}"/${CBUILD}
+		# Disable as many modules as possible -- but we need a few to install.
+		PYTHON_DISABLE_MODULES=$(
+			sed -n "/Extension('/{s:^.*Extension('::;s:'.*::;p}" "${S}"/setup.py | \
+				egrep -v '(unicodedata|time|cStringIO|_struct|binascii)'
+		) \
+		PTHON_DISABLE_SSL="1" \
+		SYSROOT= \
+		emake || die "cross-make failed"
+		# See comment in src_configure about these.
+		ln python ../${CHOST}/hostpython || die
+		ln Parser/pgen ../${CHOST}/Parser/hostpgen || die
+		ln -s ../${CBUILD}/build/lib.*/ ../${CHOST}/hostpythonpath || die
+	fi
+
+	cd "${WORKDIR}"/${CHOST}
+	emake CPPFLAGS="" CFLAGS="" LDFLAGS="" || die "emake failed"
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax_kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	cd "${WORKDIR}"/${CHOST}
+
+	# Skip failing tests.
+	local skipped_tests="gdb"
+
+	for test in ${skipped_tests}; do
+		mv "${S}"/Lib/test/test_${test}.py "${T}"
+	done
+
+	# Rerun failed tests in verbose mode (regrtest -w).
+	PYTHONDONTWRITEBYTECODE="" emake test EXTRATESTOPTS="-w" CPPFLAGS="" CFLAGS="" LDFLAGS="" < /dev/tty
+	local result="$?"
+
+	for test in ${skipped_tests}; do
+		mv "${T}/test_${test}.py" "${S}"/Lib/test
+	done
+
+	elog "The following tests have been skipped:"
+	for test in ${skipped_tests}; do
+		elog "test_${test}.py"
+	done
+
+	elog "If you would like to run them, you may:"
+	elog "cd '${EPREFIX}/usr/$(get_libdir)/python${SLOT}/test'"
+	elog "and run the tests separately."
+
+	if [[ "${result}" -ne 0 ]]; then
+		die "emake test failed"
+	fi
+}
+
+src_install() {
+	local libdir=${ED}/usr/$(get_libdir)/python${SLOT}
+
+	cd "${WORKDIR}"/${CHOST}
+	emake DESTDIR="${D}" altinstall || die "emake altinstall failed"
+
+	sed \
+		-e "s/\(CONFIGURE_LDFLAGS=\).*/\1/" \
+		-e "s/\(PY_LDFLAGS=\).*/\1/" \
+		-i "${libdir}/config-${SLOT}/Makefile" || die "sed failed"
+
+	# Backwards compat with Gentoo divergence.
+	dosym python${SLOT}-config /usr/bin/python-config-${SLOT} || die
+
+	# Fix collisions between different slots of Python.
+	rm -f "${ED}usr/$(get_libdir)/libpython3.so"
+
+	if use build; then
+		rm -fr "${ED}usr/bin/idle${SLOT}" "${libdir}/"{idlelib,sqlite3,test,tkinter}
+	else
+		use elibc_uclibc && rm -fr "${libdir}/test"
+		use sqlite || rm -fr "${libdir}/"{sqlite3,test/test_sqlite*}
+		use tk || rm -fr "${ED}usr/bin/idle${SLOT}" "${libdir}/"{idlelib,tkinter,test/test_tk*}
+	fi
+
+	use threads || rm -fr "${libdir}/multiprocessing"
+	use wininst || rm -f "${libdir}/distutils/command/"wininst-*.exe
+
+	dodoc "${S}"/Misc/{ACKS,HISTORY,NEWS} || die "dodoc failed"
+
+	if use examples; then
+		insinto /usr/share/doc/${PF}/examples
+		find "${S}"/Tools -name __pycache__ -print0 | xargs -0 rm -fr
+		doins -r "${S}"/Tools || die "doins failed"
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' | \
+		emake --no-print-directory -s -f - 2>/dev/null)
+	newins "${S}"/Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${SLOT} || die "newconfd failed"
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${SLOT} || die "newinitd failed"
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${SLOT/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${SLOT}:" \
+		-i "${ED}etc/conf.d/pydoc-${SLOT}" "${ED}etc/init.d/pydoc-${SLOT}" || die "sed failed"
+
+	# for python-exec
+	python_export python${SLOT} EPYTHON PYTHON PYTHON_SITEDIR
+
+	# if not using a cross-compiler, use the fresh binary
+	if ! tc-is-cross-compiler; then
+		local PYTHON=./python \
+			LD_LIBRARY_PATH=${LD_LIBRARY_PATH+${LD_LIBRARY_PATH}:}.
+		export LD_LIBRARY_PATH
+	fi
+
+	echo "EPYTHON='${EPYTHON}'" > epython.py
+	python_domodule epython.py
+}
+
+pkg_preinst() {
+	if has_version "<${CATEGORY}/${PN}-${SLOT}" && ! has_version ">=${CATEGORY}/${PN}-${SLOT}_alpha"; then
+		python_updater_warning="1"
+	fi
+}
+
+eselect_python_update() {
+	if [[ -z "$(eselect python show)" || ! -f "${EROOT}usr/bin/$(eselect python show)" ]]; then
+		eselect python update
+	fi
+
+	if [[ -z "$(eselect python show --python${PV%%.*})" || ! -f "${EROOT}usr/bin/$(eselect python show --python${PV%%.*})" ]]; then
+		eselect python update --python${PV%%.*}
+	fi
+}
+
+pkg_postinst() {
+	eselect_python_update
+
+	if [[ "${python_updater_warning}" == "1" ]]; then
+		ewarn "You have just upgraded from an older version of Python."
+		ewarn "You should switch active version of Python ${PV%%.*} and run"
+		ewarn "'python-updater [options]' to rebuild Python modules."
+	fi
+}
+
+pkg_postrm() {
+	eselect_python_update
+}