compileall used the ctime of bytecode and source to determine if the bytecode

should be recreated. This created a timing hole. Fixed by just doing what
import does; check the mtime and magic number.

1 files changed, 4 insertions, 0 deletions

diff --git a/Misc/NEWS b/Misc/NEWS
index 9003037..cc71e83 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -152,6 +152,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #5128: Make compileall properly inspect bytecode to determine if needs
+  to be recreated. This avoids a timing hole thanks to the old reliance on the
+  ctime of the files involved.
+
 - Issue #5122: Synchronize tk load failure check to prevent a potential
   deadlock.