Dear Maintainer,

if I understood it correctly, the Python 3.10 and later should be compiled as
PIE (position independent executable). That is why there are the new packages
python3-nopie, python3.10-nopie, and 3.11-nopie.

But 3.11 is not a PIE. I checked arm64, amd64, armhf, armel, and i386
architectures.

$ file /usr/bin/python3.11
/usr/bin/python3.11: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV),
dynamically linked, interpreter /lib/ld-linux-aarch64.so.1,
BuildID[sha1]=8dad83d75a00e6b5e26095c79dee978a8d57ef7d, for GNU/Linux 3.7.0,
stripped

The same is true for Sid version python3.11-minimal (3.11.2-4). The hardening-
check is reporting the same.

On the contrary, python3.10-minimal (3.10.9-1) is correctly a PIE

$ file /usr/bin/python3.10
/usr/bin/python3.10: ELF 64-bit LSB pie executable, ARM aarch64, version 1
(SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1,
BuildID[sha1]=7d2767e751dbd5c9287dbe5cd8de9022faa9d042, for GNU/Linux 3.7.0,
stripped

Dear Maintainer,

PIE was enebaled for Python 3.10 by [Bug
#919134](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919134).

[b23d4ec0](https://salsa.debian.org/cpython-team/python3/-/commit/b23d4ec00357597127b8651a1f4f5e3eea388d72#8756c63497c8dc39f7773438edf53b220c773f67_84_83)
added it only for Ubuntu, so
[4faf96b5](https://salsa.debian.org/cpython-team/python3/-/commit/4faf96b52843e91c28c2e4cc2a5cbb8b88ff7ec3#8756c63497c8dc39f7773438edf53b220c773f67_88_83)
changed it to also support Debian and switched from

Then
[03a2c395](https://salsa.debian.org/cpython-team/python3/-/commit/03a2c395781b26ecb2c6ec09a54fa3569de8ac9c#8756c63497c8dc39f7773438edf53b220c773f67_86_85)
added a work-around for [pypa/pip#11183](https://github.com/pypa/pip/issues/11183) and disbaled PIE:

But `debian/rules` contains this:

No "bookworm" here, so `$(filter booworm,…)` is empty and the following
gets applied:
                                                          ^


Sadly the commit does not carry any extra information why PIE was
disabled, probably to make binary wheels compatible with Debian again?

Philipp

Dear submitter,

as the package python3.11 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1076098

The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

My guess is a copy&paste mistake.  This problem is still around, since
the 3.11.0~b4-2 release the python3.1X binaries are not PIE.  There are
also two related (and problematic) merge requests open, with could be
handled in the scope of this bug:
https://salsa.debian.org/cpython-team/python3/-/merge_requests/37
https://salsa.debian.org/cpython-team/python3/-/merge_requests/29

Dear Maintainers, please share your thoughts about this bug report and
the possible ways forward.