=============================
SECTION I - Verifying fileset
=============================
 
There are Two methods to verify the integrity of fileset:
1. Checksum verification
2. Signature verification
 
1. Checksum verification
------------------------
 
Checksum verification can be done by using tool such as openssl:
Example: openssl dgst <-sha256 or -sha512> python-3.11.15.1.tar.Z
 
The correct checksum values are:
SHA2-256(python-3.11.15.1.tar.Z)=
1c8bf8003e57165d2b46f2ba2eea35c03f5095dc95dbb49882e700d5f4edb1e0

SHA2-512(python-3.11.15.1.tar.Z)=
f08361d4d8b09c92e3b478a90c6f699dfa05f1b045ba2b6d0b9faa28aa9a7a0e1339c58c75f8346b17f15a4802d6b99b0804ba932b6207517cd7a13ec7a86b06

2. Signature verification
-------------------------
 
Integrity of the fileset can be verified by using the signature(.sig) file along with the public key.
 
2.1 Availability of public key
------------------------------
The public key is available for download from:
https://aix.software.ibm.com/aix/efixes/security/systems_p_os_aix_security_pubkey.txt
 
Alternatively, starting with AIX 7.2 TL5 SP3 and VIOS 3.1.3.10, the same public key is
available as part of bos.rte.security fileset at the location:
/etc/security/certificates/AIX_PSIRT_pubkey.txt
 
The checksum of the public key can be verified by running the command:
$ openssl dgst -sha256 /etc/security/certificates/AIX_PSIRT_pubkey.txt
The correct checksum value:
SHA256(/etc/security/certificates/AIX_PSIRT_pubkey.txt)=
98d1efb466c6946618b5111117a68b0cfe39b27e8718672896754faa81288d76
 
2.2 Verifying fileset by using public key
-----------------------------------------
Once the public key is obtained, the fileset can be verified by running the command:
$ openssl dgst -sha256 -verify [public key path] -signature [file.sig signature path] [file path]
 
Example:
openssl dgst -sha256 -verify /etc/security/certificates/AIX_PSIRT_pubkey.txt -signature python-3.11.15.1.tar.Z.sig python-3.11.15.1.tar.Z
 
If anything other than 'Verified OK' is returned, contact IBM Support for assistance.
 
Additional Notes:
----------------
1. Similarly, The signature for Readme file can also be verified by running the command:
openssl dgst -sha256 -verify /etc/security/certificates/AIX_PSIRT_pubkey.txt -signature Readme-3.11.15.1.txt.sig Readme-3.11.15.1.txt
 
2. These steps are also captured at : https://www.ibm.com/support/pages/node/6985269


=========================================================================
SECTION II - INFORMATION ABOUT python3.11.base and python3.11.test FILESETS
=========================================================================

These Python filesets are installable from AIX 7.3 TL1 SP4 onwards

PYTHON VERSION AND SUPPORTED MODULES
====================================
Current version of python3.11.base is 3.11.15.1. This version provides
python 3.11.15 and it is now the default python3.

As it is the default python3 now, there is no need to run the script
"/usr/opt/python3/bin/mk_python3.11_default" to make python3.11 as 
the default python3. Incase if there are any symlinks broken because
of the older python3.9 fileset, then one can run the script and make 
all the default symlinks point to python3.11 files.

Unlike python3.9.base, it doesn't have bundled pip and setuptools with it.
So there is no ensurepip module as well. Creation of virtual environment 
should use "--without-pip" option (python3.11 -m venv <dir> --without-pip).
pip can be installed by getting pip .whl file from pypi site and executing
"python3.11 <pip-x.x-py3-none-any.whl>/pip install <pip-x.x-py3-none-any.whl>"

This python3.11 version is built using OpenXL compiler 17.1.2 with LTO
& PGO optimizations enabled. So building Python C/C++ extension modules
require OpenXL compiler 17.1.2.

It is also built with below opensource packages to enable standard
modules in python. The modules are statically linked against these
libraries.

bzip2    - 1.0.8
expat    - 2.8.2
gdbm     - 1.18.1
gettext  - 0.21
libffi   - 3.3
readline - 8.0
sqlite   - 3.50.4
xz       - 5.8.3
zlib     - 1.3.2

For all the available modules, run "/usr/opt/python3/bin/pydoc3.11"


PACKAGING
=========
Python is built with "/usr/opt/python3" as the prefix (--prefix in the
configure stage), so all files are packaged into "/usr/opt/python3" 
directory.

Symbolic links are created for the binaries from "/usr/opt/python3/bin" 
to "/usr/bin".

Python man page is also available at "/usr/share/man/man1" which 
is a symbolic link from "/usr/opt/python3/share/man/man1".

python3.11.test is an optional fileset which contains regression tests for
python.


Change History
==============
A brief summary of changes done for python3.11.base & python3.11.test filesets

3.11.15.1
=========
     - Fix CVE-2026-4224, CVE-2026-6100 and CVE-2026-2297
     - Update expat to 2.8.2 to fix multiple CVEs

3.11.15.0
=========
     - Update python to 3.11.15 to address CVE-2025-12084
     - Update expat to 2.7.5 to address CVE-2026-32776,CVE-2026-32777,CVE-2026-32778
     - Update zlib to 1.3.2 and xz to 5.8.3

3.11.14.2
=========
     - Update post install script to check for symlinks

3.11.14.1
=========
     - Update expat to version 2.7.4

3.11.14.0
=========
     - Update to version 3.11.14
     - Update expat to 2.7.3 and sqlite3 to 3.50.4

3.11.13.1
=========
     - Make python3.11 as the default python3

3.11.13.0
=========
     - Update to version 3.11.13
     - Update sqlite to 3.49.1 version

3.11.10.1
=========
     - Update expat to 2.7.1 to fix CVE-2024-8176

3.11.10.0
=========
     - Update to version 3.11.10
     - Update expat to 2.6.4

3.11.9.0
========
     - Update to version 3.11.9

3.11.8.0
========
     - Python version 3.11.8 built with OpenXL compiler 17.1.2 with LTO & PGO optimizations
