bump(dev-lang/python): Pull in 2.7.5 ebuild from upstream Gentoo.

sdk_container/src/third_party/coreos-overlay/dev-lang/python/files/CVE-2013-4238_py27.patch

@@ -0,0 +1,247 @@
+diff -r 9ddc63c039ba Lib/test/nullbytecert.pem
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ b/Lib/test/nullbytecert.pem	Sun Aug 11 18:13:17 2013 +0200
+@@ -0,0 +1,90 @@
++Certificate:
++    Data:
++        Version: 3 (0x2)
++        Serial Number: 0 (0x0)
++    Signature Algorithm: sha1WithRSAEncryption
++        Issuer: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, OU=Python Core Development, CN=null.python.org\x00example.org/emailAddress=python-dev@python.org
++        Validity
++            Not Before: Aug  7 13:11:52 2013 GMT
++            Not After : Aug  7 13:12:52 2013 GMT
++        Subject: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, OU=Python Core Development, CN=null.python.org\x00example.org/emailAddress=python-dev@python.org
++        Subject Public Key Info:
++            Public Key Algorithm: rsaEncryption
++                Public-Key: (2048 bit)
++                Modulus:
++                    00:b5:ea:ed:c9:fb:46:7d:6f:3b:76:80:dd:3a:f3:
++                    03:94:0b:a7:a6:db:ec:1d:df:ff:23:74:08:9d:97:
++                    16:3f:a3:a4:7b:3e:1b:0e:96:59:25:03:a7:26:e2:
++                    88:a9:cf:79:cd:f7:04:56:b0:ab:79:32:6e:59:c1:
++                    32:30:54:eb:58:a8:cb:91:f0:42:a5:64:27:cb:d4:
++                    56:31:88:52:ad:cf:bd:7f:f0:06:64:1f:cc:27:b8:
++                    a3:8b:8c:f3:d8:29:1f:25:0b:f5:46:06:1b:ca:02:
++                    45:ad:7b:76:0a:9c:bf:bb:b9:ae:0d:16:ab:60:75:
++                    ae:06:3e:9c:7c:31:dc:92:2f:29:1a:e0:4b:0c:91:
++                    90:6c:e9:37:c5:90:d7:2a:d7:97:15:a3:80:8f:5d:
++                    7b:49:8f:54:30:d4:97:2c:1c:5b:37:b5:ab:69:30:
++                    68:43:d3:33:78:4b:02:60:f5:3c:44:80:a1:8f:e7:
++                    f0:0f:d1:5e:87:9e:46:cf:62:fc:f9:bf:0c:65:12:
++                    f1:93:c8:35:79:3f:c8:ec:ec:47:f5:ef:be:44:d5:
++                    ae:82:1e:2d:9a:9f:98:5a:67:65:e1:74:70:7c:cb:
++                    d3:c2:ce:0e:45:49:27:dc:e3:2d:d4:fb:48:0e:2f:
++                    9e:77:b8:14:46:c0:c4:36:ca:02:ae:6a:91:8c:da:
++                    2f:85
++                Exponent: 65537 (0x10001)
++        X509v3 extensions:
++            X509v3 Basic Constraints: critical
++                CA:FALSE
++            X509v3 Subject Key Identifier:
++                88:5A:55:C0:52:FF:61:CD:52:A3:35:0F:EA:5A:9C:24:38:22:F7:5C
++            X509v3 Key Usage:
++                Digital Signature, Non Repudiation, Key Encipherment
++            X509v3 Subject Alternative Name:
++                *************************************************************
++                WARNING: The values for DNS, email and URI are WRONG. OpenSSL
++                         doesn't print the text after a NULL byte.
++                *************************************************************
++                DNS:altnull.python.org, email:null@python.org, URI:http://null.python.org, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1
++    Signature Algorithm: sha1WithRSAEncryption
++         ac:4f:45:ef:7d:49:a8:21:70:8e:88:59:3e:d4:36:42:70:f5:
++         a3:bd:8b:d7:a8:d0:58:f6:31:4a:b1:a4:a6:dd:6f:d9:e8:44:
++         3c:b6:0a:71:d6:7f:b1:08:61:9d:60:ce:75:cf:77:0c:d2:37:
++         86:02:8d:5e:5d:f9:0f:71:b4:16:a8:c1:3d:23:1c:f1:11:b3:
++         56:6e:ca:d0:8d:34:94:e6:87:2a:99:f2:ae:ae:cc:c2:e8:86:
++         de:08:a8:7f:c5:05:fa:6f:81:a7:82:e6:d0:53:9d:34:f4:ac:
++         3e:40:fe:89:57:7a:29:a4:91:7e:0b:c6:51:31:e5:10:2f:a4:
++         60:76:cd:95:51:1a:be:8b:a1:b0:fd:ad:52:bd:d7:1b:87:60:
++         d2:31:c7:17:c4:18:4f:2d:08:25:a3:a7:4f:b7:92:ca:e2:f5:
++         25:f1:54:75:81:9d:b3:3d:61:a2:f7:da:ed:e1:c6:6f:2c:60:
++         1f:d8:6f:c5:92:05:ab:c9:09:62:49:a9:14:ad:55:11:cc:d6:
++         4a:19:94:99:97:37:1d:81:5f:8b:cf:a3:a8:96:44:51:08:3d:
++         0b:05:65:12:eb:b6:70:80:88:48:72:4f:c6:c2:da:cf:cd:8e:
++         5b:ba:97:2f:60:b4:96:56:49:5e:3a:43:76:63:04:be:2a:f6:
++         c1:ca:a9:94
++-----BEGIN CERTIFICATE-----
++MIIE2DCCA8CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBxTELMAkGA1UEBhMCVVMx
++DzANBgNVBAgMBk9yZWdvbjESMBAGA1UEBwwJQmVhdmVydG9uMSMwIQYDVQQKDBpQ
++eXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEgMB4GA1UECwwXUHl0aG9uIENvcmUg
++RGV2ZWxvcG1lbnQxJDAiBgNVBAMMG251bGwucHl0aG9uLm9yZwBleGFtcGxlLm9y
++ZzEkMCIGCSqGSIb3DQEJARYVcHl0aG9uLWRldkBweXRob24ub3JnMB4XDTEzMDgw
++NzEzMTE1MloXDTEzMDgwNzEzMTI1MlowgcUxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI
++DAZPcmVnb24xEjAQBgNVBAcMCUJlYXZlcnRvbjEjMCEGA1UECgwaUHl0aG9uIFNv
++ZnR3YXJlIEZvdW5kYXRpb24xIDAeBgNVBAsMF1B5dGhvbiBDb3JlIERldmVsb3Bt
++ZW50MSQwIgYDVQQDDBtudWxsLnB5dGhvbi5vcmcAZXhhbXBsZS5vcmcxJDAiBgkq
++hkiG9w0BCQEWFXB5dGhvbi1kZXZAcHl0aG9uLm9yZzCCASIwDQYJKoZIhvcNAQEB
++BQADggEPADCCAQoCggEBALXq7cn7Rn1vO3aA3TrzA5QLp6bb7B3f/yN0CJ2XFj+j
++pHs+Gw6WWSUDpybiiKnPec33BFawq3kyblnBMjBU61ioy5HwQqVkJ8vUVjGIUq3P
++vX/wBmQfzCe4o4uM89gpHyUL9UYGG8oCRa17dgqcv7u5rg0Wq2B1rgY+nHwx3JIv
++KRrgSwyRkGzpN8WQ1yrXlxWjgI9de0mPVDDUlywcWze1q2kwaEPTM3hLAmD1PESA
++oY/n8A/RXoeeRs9i/Pm/DGUS8ZPINXk/yOzsR/XvvkTVroIeLZqfmFpnZeF0cHzL
++08LODkVJJ9zjLdT7SA4vnne4FEbAxDbKAq5qkYzaL4UCAwEAAaOB0DCBzTAMBgNV
++HRMBAf8EAjAAMB0GA1UdDgQWBBSIWlXAUv9hzVKjNQ/qWpwkOCL3XDALBgNVHQ8E
++BAMCBeAwgZAGA1UdEQSBiDCBhYIeYWx0bnVsbC5weXRob24ub3JnAGV4YW1wbGUu
++Y29tgSBudWxsQHB5dGhvbi5vcmcAdXNlckBleGFtcGxlLm9yZ4YpaHR0cDovL251
++bGwucHl0aG9uLm9yZwBodHRwOi8vZXhhbXBsZS5vcmeHBMAAAgGHECABDbgAAAAA
++AAAAAAAAAAEwDQYJKoZIhvcNAQEFBQADggEBAKxPRe99SaghcI6IWT7UNkJw9aO9
++i9eo0Fj2MUqxpKbdb9noRDy2CnHWf7EIYZ1gznXPdwzSN4YCjV5d+Q9xtBaowT0j
++HPERs1ZuytCNNJTmhyqZ8q6uzMLoht4IqH/FBfpvgaeC5tBTnTT0rD5A/olXeimk
++kX4LxlEx5RAvpGB2zZVRGr6LobD9rVK91xuHYNIxxxfEGE8tCCWjp0+3ksri9SXx
++VHWBnbM9YaL32u3hxm8sYB/Yb8WSBavJCWJJqRStVRHM1koZlJmXNx2BX4vPo6iW
++RFEIPQsFZRLrtnCAiEhyT8bC2s/Njlu6ly9gtJZWSV46Q3ZjBL4q9sHKqZQ=
++-----END CERTIFICATE-----
+diff -r 9ddc63c039ba Lib/test/test_ssl.py
+--- a/Lib/test/test_ssl.py	Sun Aug 11 13:04:50 2013 +0300
++++ b/Lib/test/test_ssl.py	Sun Aug 11 18:13:17 2013 +0200
+@@ -25,6 +25,7 @@
+ HOST = test_support.HOST
+ CERTFILE = None
+ SVN_PYTHON_ORG_ROOT_CERT = None
++NULLBYTECERT = None
+ 
+ def handle_error(prefix):
+     exc_format = ' '.join(traceback.format_exception(*sys.exc_info()))
+@@ -123,6 +124,27 @@
+                           ('DNS', 'projects.forum.nokia.com'))
+                         )
+ 
++    def test_parse_cert_CVE_2013_4073(self):
++        p = ssl._ssl._test_decode_cert(NULLBYTECERT)
++        if test_support.verbose:
++            sys.stdout.write("\n" + pprint.pformat(p) + "\n")
++        subject = ((('countryName', 'US'),),
++                   (('stateOrProvinceName', 'Oregon'),),
++                   (('localityName', 'Beaverton'),),
++                   (('organizationName', 'Python Software Foundation'),),
++                   (('organizationalUnitName', 'Python Core Development'),),
++                   (('commonName', 'null.python.org\x00example.org'),),
++                   (('emailAddress', 'python-dev@python.org'),))
++        self.assertEqual(p['subject'], subject)
++        self.assertEqual(p['issuer'], subject)
++        self.assertEqual(p['subjectAltName'],
++                         (('DNS', 'altnull.python.org\x00example.com'),
++                         ('email', 'null@python.org\x00user@example.org'),
++                         ('URI', 'http://null.python.org\x00http://example.org'),
++                         ('IP Address', '192.0.2.1'),
++                         ('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
++                        )
++
+     def test_DER_to_PEM(self):
+         with open(SVN_PYTHON_ORG_ROOT_CERT, 'r') as f:
+             pem = f.read()
+@@ -1360,7 +1382,7 @@
+ 
+ 
+ def test_main(verbose=False):
+-    global CERTFILE, SVN_PYTHON_ORG_ROOT_CERT, NOKIACERT
++    global CERTFILE, SVN_PYTHON_ORG_ROOT_CERT, NOKIACERT, NULLBYTECERT
+     CERTFILE = os.path.join(os.path.dirname(__file__) or os.curdir,
+                             "keycert.pem")
+     SVN_PYTHON_ORG_ROOT_CERT = os.path.join(
+@@ -1368,10 +1390,13 @@
+         "https_svn_python_org_root.pem")
+     NOKIACERT = os.path.join(os.path.dirname(__file__) or os.curdir,
+                              "nokia.pem")
++    NULLBYTECERT = os.path.join(os.path.dirname(__file__) or os.curdir,
++                                "nullbytecert.pem")
+ 
+     if (not os.path.exists(CERTFILE) or
+         not os.path.exists(SVN_PYTHON_ORG_ROOT_CERT) or
+-        not os.path.exists(NOKIACERT)):
++        not os.path.exists(NOKIACERT) or
++        not os.path.exists(NULLBYTECERT)):
+         raise test_support.TestFailed("Can't read certificate files!")
+ 
+     tests = [BasicTests, BasicSocketTests]
+diff -r 9ddc63c039ba Modules/_ssl.c
+--- a/Modules/_ssl.c	Sun Aug 11 13:04:50 2013 +0300
++++ b/Modules/_ssl.c	Sun Aug 11 18:13:17 2013 +0200
+@@ -741,8 +741,13 @@
+ 
+             /* get a rendering of each name in the set of names */
+ 
++            int gntype;
++            ASN1_STRING *as = NULL;
++
+             name = sk_GENERAL_NAME_value(names, j);
+-            if (name->type == GEN_DIRNAME) {
++            gntype = name-> type;
++            switch (gntype) {
++            case GEN_DIRNAME:
+ 
+                 /* we special-case DirName as a tuple of tuples of attributes */
+ 
+@@ -764,11 +769,61 @@
+                     goto fail;
+                 }
+                 PyTuple_SET_ITEM(t, 1, v);
++                break;
+ 
+-            } else {
++            case GEN_EMAIL:
++            case GEN_DNS:
++            case GEN_URI:
++                /* GENERAL_NAME_print() doesn't handle NUL bytes in ASN1_string
++                   correctly. */
++                t = PyTuple_New(2);
++                if (t == NULL)
++                    goto fail;
++                switch (gntype) {
++                case GEN_EMAIL:
++                    v = PyUnicode_FromString("email");
++                    as = name->d.rfc822Name;
++                    break;
++                case GEN_DNS:
++                    v = PyUnicode_FromString("DNS");
++                    as = name->d.dNSName;
++                    break;
++                case GEN_URI:
++                    v = PyUnicode_FromString("URI");
++                    as = name->d.uniformResourceIdentifier;
++                    break;
++                }
++                if (v == NULL) {
++                    Py_DECREF(t);
++                    goto fail;
++                }
++                PyTuple_SET_ITEM(t, 0, v);
++                v = PyString_FromStringAndSize((char *)ASN1_STRING_data(as),
++                                               ASN1_STRING_length(as));
++                if (v == NULL) {
++                    Py_DECREF(t);
++                    goto fail;
++                }
++                PyTuple_SET_ITEM(t, 1, v);
++                break;
+ 
++            default:
+                 /* for everything else, we use the OpenSSL print form */
+-
++                switch (gntype) {
++                    /* check for new general name type */
++                    case GEN_OTHERNAME:
++                    case GEN_X400:
++                    case GEN_EDIPARTY:
++                    case GEN_IPADD:
++                    case GEN_RID:
++                        break;
++                    default:
++                        if (PyErr_Warn(PyExc_RuntimeWarning,
++				       "Unknown general name type") == -1) {
++                            goto fail;
++                        }
++                        break;
++                }
+                 (void) BIO_reset(biobuf);
+                 GENERAL_NAME_print(biobuf, name);
+                 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
+@@ -794,6 +849,7 @@
+                     goto fail;
+                 }
+                 PyTuple_SET_ITEM(t, 1, v);
++		break;
+             }
+ 
+             /* and add that rendering to the list */

sdk_container/src/third_party/coreos-overlay/dev-lang/python/files/python-2.7.5-library-path.patch

@@ -0,0 +1,25 @@
+# HG changeset patch
+# User Ned Deily <nad@acm.org>
+# Date 1368666045 25200
+# Node ID cd577c3288860b0deb459443ca5c489dc0f99ef6
+# Parent  149340b3004acfcb68e5ed36b1e96b7463c756c7
+Issue #17990: Only modify include and library search paths when cross-compiling.
+
+diff --git a/setup.py b/setup.py
+--- a/setup.py
++++ b/setup.py
+@@ -437,9 +437,11 @@ class PyBuildExt(build_ext):
+ 
+     def detect_modules(self):
+         # Ensure that /usr/local is always used
+-        add_dir_to_list(self.compiler.library_dirs, '/usr/local/lib')
+-        add_dir_to_list(self.compiler.include_dirs, '/usr/local/include')
+-        self.add_gcc_paths()
++        if not cross_compiling:
++            add_dir_to_list(self.compiler.library_dirs, '/usr/local/lib')
++            add_dir_to_list(self.compiler.include_dirs, '/usr/local/include')
++        if cross_compiling:
++            self.add_gcc_paths()
+         self.add_multiarch_paths()
+ 
+         # Add paths specified in the environment variables LDFLAGS and

sdk_container/src/third_party/coreos-overlay/dev-lang/python/files/python-2.7.5-re_unsigned_ptrdiff.patch

@@ -0,0 +1,23 @@
+https://bugs.gentoo.org/show_bug.cgi?id=476426
+http://bugs.python.org/issue17998
+diff -r d91da96a55bf Modules/_sre.c
+--- a/Modules/_sre.c	Thu May 16 22:47:47 2013 +0100
++++ b/Modules/_sre.c	Fri May 17 21:02:48 2013 +0300
+@@ -1028,7 +1028,7 @@
+             TRACE(("|%p|%p|REPEAT_ONE %d %d\n", ctx->pattern, ctx->ptr,
+                    ctx->pattern[1], ctx->pattern[2]));
+ 
+-            if (ctx->pattern[1] > end - ctx->ptr)
++            if ((Py_ssize_t) ctx->pattern[1] > end - ctx->ptr)
+                 RETURN_FAILURE; /* cannot match */
+ 
+             state->ptr = ctx->ptr;
+@@ -1111,7 +1111,7 @@
+             TRACE(("|%p|%p|MIN_REPEAT_ONE %d %d\n", ctx->pattern, ctx->ptr,
+                    ctx->pattern[1], ctx->pattern[2]));
+ 
+-            if (ctx->pattern[1] > end - ctx->ptr)
++            if ((Py_ssize_t) ctx->pattern[1] > end - ctx->ptr)
+                 RETURN_FAILURE; /* cannot match */
+ 
+             state->ptr = ctx->ptr;

sdk_container/src/third_party/coreos-overlay/dev-lang/python/python-2.7.5-r2.ebuild

@@ -0,0 +1,394 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/python-2.7.5-r2.ebuild,v 1.13 2013/08/28 15:59:25 floppym Exp $
+
+EAPI="4"
+WANT_AUTOMAKE="none"
+WANT_LIBTOOL="none"
+
+inherit autotools eutils flag-o-matic multilib pax-utils python-utils-r1 toolchain-funcs multiprocessing
+
+MY_P="Python-${PV}"
+PATCHSET_REVISION="0"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="http://www.python.org/"
+SRC_URI="http://www.python.org/ftp/python/${PV}/${MY_P}.tar.xz
+	mirror://gentoo/python-gentoo-patches-${PV}-${PATCHSET_REVISION}.tar.xz"
+
+LICENSE="PSF-2"
+SLOT="2.7"
+KEYWORDS="alpha amd64 arm hppa ia64 ~m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd"
+IUSE="-berkdb build doc elibc_uclibc examples gdbm hardened ipv6 +ncurses +readline sqlite +ssl +threads tk +wide-unicode wininst +xml"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="app-arch/bzip2
+	>=sys-libs/zlib-1.1.3
+	virtual/libffi
+	virtual/libintl
+	!build? (
+		berkdb? ( || (
+			sys-libs/db:5.3
+			sys-libs/db:5.2
+			sys-libs/db:5.1
+			sys-libs/db:5.0
+			sys-libs/db:4.8
+			sys-libs/db:4.7
+			sys-libs/db:4.6
+			sys-libs/db:4.5
+			sys-libs/db:4.4
+			sys-libs/db:4.3
+			sys-libs/db:4.2
+		) )
+		gdbm? ( sys-libs/gdbm[berkdb] )
+		ncurses? (
+			>=sys-libs/ncurses-5.2
+			readline? ( >=sys-libs/readline-4.1 )
+		)
+		sqlite? ( >=dev-db/sqlite-3.3.8:3 )
+		ssl? ( dev-libs/openssl )
+		tk? (
+			>=dev-lang/tk-8.0
+			dev-tcltk/blt
+		)
+		xml? ( >=dev-libs/expat-2.1 )
+	)
+	!!<sys-apps/portage-2.1.9"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+	>=sys-devel/autoconf-2.65
+	!sys-devel/gcc[libffi]"
+RDEPEND+=" !build? ( app-misc/mime-types )
+	doc? ( dev-python/python-docs:${SLOT} )"
+PDEPEND="app-admin/eselect-python
+	app-admin/python-updater"
+
+S="${WORKDIR}/${MY_P}"
+
+pkg_setup() {
+	if use berkdb; then
+		ewarn "'bsddb' module is out-of-date and no longer maintained inside"
+		ewarn "dev-lang/python. 'bsddb' and 'dbhash' modules have been additionally"
+		ewarn "removed in Python 3. A maintained alternative of 'bsddb3' module"
+		ewarn "is provided by dev-python/bsddb3."
+	else
+		if has_version "=${CATEGORY}/${PN}-${PV%%.*}*[berkdb]"; then
+			ewarn "You are migrating from =${CATEGORY}/${PN}-${PV%%.*}*[berkdb]"
+			ewarn "to =${CATEGORY}/${PN}-${PV%%.*}*[-berkdb]."
+			ewarn "You might need to migrate your databases."
+		fi
+	fi
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat, libffi and zlib are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+	rm -r Modules/zlib || die
+
+	local excluded_patches
+	if ! tc-is-cross-compiler; then
+		excluded_patches="*_all_crosscompile.patch"
+	fi
+
+	EPATCH_EXCLUDE="${excluded_patches}" EPATCH_SUFFIX="patch" \
+		epatch "${WORKDIR}/${PV}-${PATCHSET_REVISION}"
+
+	epatch "${FILESDIR}/${P}-library-path.patch" #474882
+	epatch "${FILESDIR}/${P}-re_unsigned_ptrdiff.patch" #476426
+	epatch "${FILESDIR}/CVE-2013-4238_py27.patch"
+
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" \
+		Lib/distutils/command/install.py \
+		Lib/distutils/sysconfig.py \
+		Lib/site.py \
+		Lib/sysconfig.py \
+		Lib/test/test_site.py \
+		Makefile.pre.in \
+		Modules/Setup.dist \
+		Modules/getpath.c \
+		setup.py || die "sed failed to replace @@GENTOO_LIBDIR@@"
+
+	epatch_user
+
+	eautoconf
+	eautoheader
+}
+
+src_configure() {
+	if use build; then
+		# Disable extraneous modules with extra dependencies.
+		export PYTHON_DISABLE_MODULES="dbm _bsddb gdbm _curses _curses_panel readline _sqlite3 _tkinter _elementtree pyexpat"
+		export PYTHON_DISABLE_SSL="1"
+	else
+		# dbm module can be linked against berkdb or gdbm.
+		# Defaults to gdbm when both are enabled, #204343.
+		local disable
+		use berkdb   || use gdbm || disable+=" dbm"
+		use berkdb   || disable+=" _bsddb"
+		use gdbm     || disable+=" gdbm"
+		use ncurses  || disable+=" _curses _curses_panel"
+		use readline || disable+=" readline"
+		use sqlite   || disable+=" _sqlite3"
+		use ssl      || export PYTHON_DISABLE_SSL="1"
+		use tk       || disable+=" _tkinter"
+		use xml      || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat.
+		export PYTHON_DISABLE_MODULES="${disable}"
+
+		if ! use xml; then
+			ewarn "You have configured Python without XML support."
+			ewarn "This is NOT a recommended configuration as you"
+			ewarn "may face problems parsing any XML documents."
+		fi
+	fi
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	if [[ "$(gcc-major-version)" -ge 4 ]]; then
+		append-flags -fwrapv
+	fi
+
+	filter-flags -malign-double
+
+	[[ "${ARCH}" == "alpha" ]] && append-flags -fPIC
+
+	# https://bugs.gentoo.org/show_bug.cgi?id=50309
+	if is-flagq -O3; then
+		is-flagq -fstack-protector-all && replace-flags -O3 -O2
+		use hardened && replace-flags -O3 -O2
+	fi
+
+	# Run the configure scripts in parallel.
+	multijob_init
+
+	mkdir -p "${WORKDIR}"/{${CBUILD},${CHOST}}
+
+	if tc-is-cross-compiler; then
+		(
+		multijob_child_init
+		cd "${WORKDIR}"/${CBUILD} >/dev/null
+		OPT="-O1" CFLAGS="" CPPFLAGS="" LDFLAGS="" CC="" \
+		"${S}"/configure \
+			--{build,host}=${CBUILD} \
+			|| die "cross-configure failed"
+		) &
+		multijob_post_fork
+
+		# The configure script assumes it's buggy when cross-compiling.
+		export ac_cv_buggy_getaddrinfo=no
+		export ac_cv_have_long_long_format=yes
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python2.X/config/Makefile.
+	tc-export CXX
+	# The configure script fails to use pkg-config correctly.
+	# http://bugs.python.org/issue15506
+	export ac_cv_path_PKG_CONFIG=$(tc-getPKG_CONFIG)
+
+	# Set LDFLAGS so we link modules with -lpython2.7 correctly.
+	# Needed on FreeBSD unless Python 2.7 is already installed.
+	# Please query BSD team before removing this!
+	append-ldflags "-L."
+
+	local dbmliborder
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+	if use berkdb; then
+		dbmliborder+="${dbmliborder:+:}bdb"
+	fi
+
+	cd "${WORKDIR}"/${CHOST}
+	ECONF_SOURCE="${S}" OPT="" \
+	econf \
+		--with-fpectl \
+		--enable-shared \
+		$(use_enable ipv6) \
+		$(use_with threads) \
+		$(use wide-unicode && echo "--enable-unicode=ucs4" || echo "--enable-unicode=ucs2") \
+		--infodir='${prefix}/share/info' \
+		--mandir='${prefix}/share/man' \
+		--with-dbmliborder="${dbmliborder}" \
+		--with-libc="" \
+		--enable-loadable-sqlite-extensions \
+		--with-system-expat \
+		--with-system-ffi
+
+	if tc-is-cross-compiler; then
+		# Modify the Makefile.pre so we don't regen for the host/ one.
+		# We need to link the host python programs into $PWD and run
+		# them from here because the distutils sysconfig module will
+		# parse Makefile/etc... from argv[0], and we need it to pick
+		# up the target settings, not the host ones.
+		sed -i \
+			-e '1iHOSTPYTHONPATH = ./hostpythonpath:' \
+			-e '/^HOSTPYTHON/s:=.*:= ./hostpython:' \
+			-e '/^HOSTPGEN/s:=.*:= ./Parser/hostpgen:' \
+			Makefile{.pre,} || die "sed failed"
+	fi
+
+	multijob_finish
+}
+
+src_compile() {
+	if tc-is-cross-compiler; then
+		cd "${WORKDIR}"/${CBUILD}
+		# Disable as many modules as possible -- but we need a few to install.
+		PYTHON_DISABLE_MODULES=$(
+			sed -n "/Extension('/{s:^.*Extension('::;s:'.*::;p}" "${S}"/setup.py | \
+				egrep -v '(unicodedata|time|cStringIO|_struct|binascii)'
+		) \
+		PTHON_DISABLE_SSL="1" \
+		SYSROOT= \
+		emake
+		# See comment in src_configure about these.
+		ln python ../${CHOST}/hostpython || die
+		ln Parser/pgen ../${CHOST}/Parser/hostpgen || die
+		ln -s ../${CBUILD}/build/lib.*/ ../${CHOST}/hostpythonpath || die
+	fi
+
+	cd "${WORKDIR}"/${CHOST}
+	default
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax_kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	cd "${WORKDIR}"/${CHOST}
+
+	# Skip failing tests.
+	local skipped_tests="distutils gdb"
+
+	for test in ${skipped_tests}; do
+		mv "${S}"/Lib/test/test_${test}.py "${T}"
+	done
+
+	# Rerun failed tests in verbose mode (regrtest -w).
+	emake test EXTRATESTOPTS="-w" < /dev/tty
+	local result="$?"
+
+	for test in ${skipped_tests}; do
+		mv "${T}/test_${test}.py" "${S}"/Lib/test
+	done
+
+	elog "The following tests have been skipped:"
+	for test in ${skipped_tests}; do
+		elog "test_${test}.py"
+	done
+
+	elog "If you would like to run them, you may:"
+	elog "cd '${EPREFIX}/usr/$(get_libdir)/python${SLOT}/test'"
+	elog "and run the tests separately."
+
+	if [[ "${result}" -ne 0 ]]; then
+		die "emake test failed"
+	fi
+}
+
+src_install() {
+	local libdir=${ED}/usr/$(get_libdir)/python${SLOT}
+
+	cd "${WORKDIR}"/${CHOST}
+	emake DESTDIR="${D}" altinstall
+
+	sed -e "s/\(LDFLAGS=\).*/\1/" -i "${libdir}/config/Makefile" || die "sed failed"
+
+	# Backwards compat with Gentoo divergence.
+	dosym python${SLOT}-config /usr/bin/python-config-${SLOT}
+
+	# Fix collisions between different slots of Python.
+	mv "${ED}usr/bin/2to3" "${ED}usr/bin/2to3-${SLOT}"
+	mv "${ED}usr/bin/pydoc" "${ED}usr/bin/pydoc${SLOT}"
+	mv "${ED}usr/bin/idle" "${ED}usr/bin/idle${SLOT}"
+	rm -f "${ED}usr/bin/smtpd.py"
+
+	if use build; then
+		rm -fr "${ED}usr/bin/idle${SLOT}" "${libdir}/"{bsddb,dbhash.py,idlelib,lib-tk,sqlite3,test}
+	else
+		use berkdb || rm -r "${libdir}/"{bsddb,dbhash.py,test/test_bsddb*} || die
+		use sqlite || rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+		use tk || rm -r "${ED}usr/bin/idle${SLOT}" "${libdir}/"{idlelib,lib-tk} || die
+		use elibc_uclibc && rm -fr "${libdir}/"{bsddb/test,test}
+	fi
+
+	use threads || rm -r "${libdir}/multiprocessing" || die
+	use wininst || rm -r "${libdir}/distutils/command/"wininst-*.exe || die
+
+	dodoc "${S}"/Misc/{ACKS,HISTORY,NEWS} || die "dodoc failed"
+
+	if use examples; then
+		insinto /usr/share/doc/${PF}/examples
+		doins -r "${S}"/Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' | \
+		emake --no-print-directory -s -f - 2>/dev/null)
+	newins "${S}"/Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${SLOT}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${SLOT}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${SLOT/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${SLOT}:" \
+		-i "${ED}etc/conf.d/pydoc-${SLOT}" "${ED}etc/init.d/pydoc-${SLOT}" || die "sed failed"
+
+	# for python-exec
+	python_export python${SLOT} EPYTHON PYTHON PYTHON_SITEDIR
+
+	# if not using a cross-compiler, use the fresh binary
+	if ! tc-is-cross-compiler; then
+		local PYTHON=./python \
+			LD_LIBRARY_PATH=${LD_LIBRARY_PATH+${LD_LIBRARY_PATH}:}.
+		export LD_LIBRARY_PATH
+	fi
+
+	echo "EPYTHON='${EPYTHON}'" > epython.py
+	python_domodule epython.py
+}
+
+pkg_preinst() {
+	if has_version "<${CATEGORY}/${PN}-${SLOT}" && ! has_version "${CATEGORY}/${PN}:2.7"; then
+		python_updater_warning="1"
+	fi
+}
+
+eselect_python_update() {
+	if [[ -z "$(eselect python show)" || ! -f "${EROOT}usr/bin/$(eselect python show)" ]]; then
+		eselect python update
+	fi
+
+	if [[ -z "$(eselect python show --python${PV%%.*})" || ! -f "${EROOT}usr/bin/$(eselect python show --python${PV%%.*})" ]]; then
+		eselect python update --python${PV%%.*}
+	fi
+}
+
+pkg_postinst() {
+	eselect_python_update
+
+	if [[ "${python_updater_warning}" == "1" ]]; then
+		ewarn "You have just upgraded from an older version of Python."
+		ewarn "You should switch active version of Python ${PV%%.*} and run"
+		ewarn "'python-updater [options]' to rebuild Python modules."
+	fi
+}
+
+pkg_postrm() {
+	eselect_python_update
+}