lang/python313: fix CVE-2026-12345 (tempfile.TemporaryDirectory race) - #1654

Reviewer's Guide

Backports the CVE-2026-12345 fix by making TemporaryDirectory cleanup resistant to symlink races through descriptor-relative traversal and cleanup, while preserving existing shutil.rmtree callback compatibility; PORTREVISION 1 publishes the fix for both Python package variants.

Sequence diagram for race-resistant TemporaryDirectory cleanup

sequenceDiagram
    participant TD as TemporaryDirectory
    participant SH as shutil.rmtree
    participant FS as Filesystem

    TD->>SH: _rmtree(name, dir_fd=dir_fd)
    SH->>FS: Open and traverse directory entries
    FS-->>SH: direntry and parent dir_fd
    SH->>TD: onexc(func, path, exc, direntry, dir_fd)
    TD->>FS: _resetperms_at(base, dir_fd, fullpath)
    TD->>FS: os.unlink(base, dir_fd=dir_fd)
    alt Entry is a directory
        FS-->>TD: IsADirectoryError
        TD->>TD: _rmtree(base, dir_fd=dir_fd, fullname=fullpath)
    else Entry is removed
        FS-->>TD: Success
    end

File-Level Changes

Claude finished @laffer1's task in 32s —— View job

Review of PR #1654 (lang/python313 CVE backport)

Verdict: looks good. Approve-worthy, with a few non-blocking notes. I could not build or run tests here, so this is a read-through only.

What I checked

• PORTREVISION= 1 is placed correctly, after DISTVERSION.
• python313t sets MASTERDIR to ../python313 and includes its Makefile. It picks up both the patches and the bump.
• Makefile.version has PYTHON_DISTVERSION=3.13.11, which matches the PR description.
• Patch names follow the patch-Lib_shutil.py and patch-Lib_tempfile.py convention.
• The hunk line offsets are consistent in both patches. In tempfile.py they run +1, then +54, then +73, and the hunk headers match. The shutil.py hunks also chain correctly.
• The shutil.py logic holds together. The internal _onexc_kwargs=True call passes direntry and dir_fd. A user-supplied onexc is wrapped so it still gets the 3-argument form. The onerror delegate and the ignore_errors handlers accept **kwargs. _rmtree_unsafe still calls onexc with 3 positional arguments, which the new tempfile handler accepts because its extras default to None.

Notes (non-blocking)

1. Unverifiable CVE ID. I can't confirm CVE-2026-12345 or the cited upstream PRs ([3.13] gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory (GH-157580) python/cpython#158429 and #157580) from here. Please confirm them, and keep the reference in the commit message.
2. Public signature change. shutil.rmtree gains a _onexc_kwargs keyword argument, which is visible in inspect.signature. This matches the upstream design as described, so it is fine. It is one more reason to drop the patch when 3.13.12 ships.
3. Reminder in Makefile.version. Its comment says to remove PORTREVISION on a version bump. Add a note or a follow-up so the patches are also removed at 3.13.12. This is especially worth doing because the upstream backport was still open and may change.
4. Untested platforms. python313t was not built separately. It shares the sources and patches, so the risk is low. A bmake patch run there would confirm that both patches apply cleanly.
5. onexc fallback paths. The _resetperms_at fallbacks (O_NOFOLLOW open, then lstat+chmod by name) are only exercised on platforms without chmod(dir_fd=, follow_symlinks=False). Check whether MidnightBSD takes the first branch. It probably does, because it is FreeBSD-13-based.

There are no license, plist, security or architecture-compatibility concerns. The change touches no arch-specific code.