From 63923428fe8aafb2d51d38d61f271ff331bc6391 Mon Sep 17 00:00:00 2001
From: Petr Bokoc <pbokoc@redhat.com>
Date: Nov 13 2022 09:31:07 +0000
Subject: 746 and 842 - Python changes


---

diff --git a/modules/release-notes/pages/developers/Development_Python.adoc b/modules/release-notes/pages/developers/Development_Python.adoc
index 9a2ac8c..e9f5a21 100644
--- a/modules/release-notes/pages/developers/Development_Python.adoc
+++ b/modules/release-notes/pages/developers/Development_Python.adoc
@@ -3,3 +3,40 @@ include::{partialsdir}/entities.adoc[]
 
 [[sect-python]]
 = Python
+
+== Python 3.11
+
+Fedora 37 provides the Python stack in version 3.11, up from version 3.10 in the previous release. Notable changes include:
+
+* Exception Groups and `except*`
+* Enhanced error locations in tracebacks
+* Support for parsing TOML in the standard library
+* A massive speed improvement compared to Python 3.10
+
+Typing features:
+
+* Variadic generics
+* Marking individual `TypedDict` items as required or potentially-missing
+* Self type
+* Arbitrary literal string type
+* Dataclass transforms
+
+For a full list of changes, see the link:https://docs.python.org/3.11/whatsnew/3.11.html[What's New In Python 3.11] upstream document. Also see link:https://docs.python.org/3.11/whatsnew/3.11.html#porting-to-python-3-11[Porting to Python 3.11] if you have Python programs running on an older version.
+
+[[default-shebangs]]
+== Add -P to default shebangs
+
+All Python 3 shebang RPM macros in Fedora 37 have been changed to contain one more flag: `-P`. Previously, they contained `-s`, now they contain `-sP`. The `-P` flag was introduced in Python 3.11.
+
+The new flag stops Python from prepending a potentially unsafe path to `sys.path`. This causes Python programs in `/usr/bin` to be less fragile towards random files present in the same directory, making debugging certain types of issues easier and enhancing security.
+
+The following RPM macros are affected by this change:
+
+* `%{py3_shbang_opts}`
+* `%{py3_shbang_opts_nodash}`
+* `%{py3_shebang_flags}`
+* `%{py_shbang_opts}`
+* `%{py_shbang_opts_nodash}`
+* `%{py_shebang_flags}`
+
+For a detailed explanation of what this change means, a list of affected packages, and information on how to opt out of this change (or explicitly opt in) if needed, see the link:https://fedoraproject.org/wiki/Changes/PythonSafePath#Detailed_Description[Fedora Wiki].
diff --git a/modules/release-notes/pages/sysadmin/Distribution.adoc b/modules/release-notes/pages/sysadmin/Distribution.adoc
index 3f30e0f..ca71d04 100644
--- a/modules/release-notes/pages/sysadmin/Distribution.adoc
+++ b/modules/release-notes/pages/sysadmin/Distribution.adoc
@@ -33,3 +33,7 @@ The server documentation link:https://docs.fedoraproject.org/en-US/fedora-server
 == boot.iso now uses GRUB2 on BIOS systems
 
 See xref:sysadmin/Installation.adoc#boot-iso-grub2[Distribution].
+
+== Python3 packages are now built with -P
+
+See xref:developers/Development_Python.adoc#default-shebangs[Python].
diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc
index 21709f6..b2512de 100644
--- a/modules/release-notes/pages/sysadmin/Security.adoc
+++ b/modules/release-notes/pages/sysadmin/Security.adoc
@@ -12,3 +12,7 @@ The ability for an IoT or Edge device to be plugged in and automatically onboard
 With this update, Fedora IoT provides the FIDO Device Onboarding software stack for Zero Touch Onboarding.
 
 The aim is to demonstrate the use of the leading edge open industry protocols for onboarding IoT and Edge devices.
+
+== Python3 packages are now built with -P
+
+See xref:developers/Development_Python.adoc#default-shebangs[Python].