Drop CPython 3.6 & 3.7 - MERGE AFTER 2025-05-06

README.rst

@@ -268,12 +268,12 @@ Image content
 
 All supported images currently contain:
 
-- CPython 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.13t and PyPy 3.7, 3.8, 3.9, 3.10 installed in
+- CPython 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.13t and PyPy 3.8, 3.9, 3.10 installed in
   ``/opt/python/<python tag>-<abi tag>``. The directories are named
   after the PEP 425 tags for each environment --
-  e.g. ``/opt/python/cp37-cp37m`` contains a CPython 3.7 build, and
+  e.g. ``/opt/python/cp313-cp313`` contains a CPython 3.13 build, and
   can be used to produce wheels named like
-  ``<pkg>-<version>-cp37-cp37m-<arch>.whl``.
+  ``<pkg>-<version>-cp313-cp313-<arch>.whl``.
 
 - Development packages for all the libraries that PEP 571/599 list. One should not assume the presence of any other development package.
 

docker/Dockerfile

@@ -109,28 +109,18 @@ RUN export MPDECIMAL_ROOT=mpdecimal-4.0.0 && \
 
 FROM --platform=${BUILDPLATFORM} ghcr.io/sigstore/cosign/cosign:v2.4.2 AS cosign-bin
 
-FROM build_base AS build_cpython_system_ssl
+FROM build_base AS build_cpython
 COPY --from=build_tcl_tk /manylinux-buildfs /
 COPY --from=build_mpdecimal /manylinux-buildfs /
 COPY --from=build_sqlite3 /manylinux-buildfs /
-COPY build_scripts/build-cpython.sh /build_scripts/
 RUN if command -v apk >/dev/null 2>&1; then ldconfig /; else ldconfig; fi
-COPY --from=cosign-bin /ko-app/cosign /usr/local/bin/cosign
-
-FROM build_cpython_system_ssl AS build_cpython
 COPY build_scripts/build-openssl.sh /build_scripts/
 RUN export OPENSSL_ROOT=openssl-3.0.16 && \
     export OPENSSL_HASH=57e03c50feab5d31b152af2b764f10379aecd8ee92f16c985983ce4a99f7ef86 && \
     export OPENSSL_DOWNLOAD_URL=https://github.com/openssl/openssl/releases/download/${OPENSSL_ROOT} && \
     manylinux-entrypoint /build_scripts/build-openssl.sh
-
-
-FROM build_cpython_system_ssl AS build_cpython36
-COPY build_scripts/cpython-pubkeys.txt /build_scripts/cpython-pubkeys.txt
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh "" "" 3.6.15
-
-FROM build_cpython_system_ssl AS build_cpython37
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh [email protected] https://github.com/login/oauth 3.7.17
+COPY --from=cosign-bin /ko-app/cosign /usr/local/bin/cosign
+COPY build_scripts/build-cpython.sh /build_scripts/
 
 FROM build_cpython AS build_cpython38
 RUN manylinux-entrypoint /build_scripts/build-cpython.sh [email protected] https://github.com/login/oauth 3.8.20
@@ -160,9 +150,7 @@ COPY --from=build_mpdecimal /manylinux-rootfs /
 COPY --from=build_sqlite3 /manylinux-rootfs /
 COPY --from=build_git /manylinux-rootfs /
 COPY build_scripts /opt/_internal/build_scripts/
-RUN --mount=type=bind,target=/build_cpython36,from=build_cpython36 \
-    --mount=type=bind,target=/build_cpython37,from=build_cpython37 \
-    --mount=type=bind,target=/build_cpython38,from=build_cpython38 \
+RUN --mount=type=bind,target=/build_cpython38,from=build_cpython38 \
     --mount=type=bind,target=/build_cpython39,from=build_cpython39 \
     --mount=type=bind,target=/build_cpython310,from=build_cpython310 \
     --mount=type=bind,target=/build_cpython311,from=build_cpython311 \

docker/build_scripts/build-cpython.sh

@@ -28,14 +28,8 @@ function pyver_dist_dir {
 
 CPYTHON_DIST_DIR=$(pyver_dist_dir "${CPYTHON_VERSION}")
 fetch_source "Python-${CPYTHON_VERSION}.tar.xz" "${CPYTHON_DOWNLOAD_URL}/${CPYTHON_DIST_DIR}"
-if [ "${CERT_IDENTITY}" == "" ]; then
-	fetch_source "Python-${CPYTHON_VERSION}.tar.xz.asc" "${CPYTHON_DOWNLOAD_URL}/${CPYTHON_DIST_DIR}"
-	gpg --import "${MY_DIR}/cpython-pubkeys.txt"
-	gpg --verify "Python-${CPYTHON_VERSION}.tar.xz.asc"
-else
-	fetch_source "Python-${CPYTHON_VERSION}.tar.xz.sigstore" "${CPYTHON_DOWNLOAD_URL}/${CPYTHON_DIST_DIR}"
-	cosign  verify-blob "Python-${CPYTHON_VERSION}.tar.xz" --bundle "Python-${CPYTHON_VERSION}.tar.xz.sigstore" --certificate-identity="${CERT_IDENTITY}" --certificate-oidc-issuer="${CERT_OIDC_ISSUER}"
-fi
+fetch_source "Python-${CPYTHON_VERSION}.tar.xz.sigstore" "${CPYTHON_DOWNLOAD_URL}/${CPYTHON_DIST_DIR}"
+cosign  verify-blob "Python-${CPYTHON_VERSION}.tar.xz" --bundle "Python-${CPYTHON_VERSION}.tar.xz.sigstore" --certificate-identity="${CERT_IDENTITY}" --certificate-oidc-issuer="${CERT_OIDC_ISSUER}"
 
 tar -xJf "Python-${CPYTHON_VERSION}.tar.xz"
 pushd "Python-${CPYTHON_VERSION}"
@@ -49,11 +43,6 @@ if [ "${4:-}" == "nogil" ]; then
 	CONFIGURE_ARGS+=(--disable-gil)
 fi
 
-if [ "${CPYTHON_VERSION}" == "3.6.15" ]; then
-	# https://github.com/python/cpython/issues/89863
-	# gcc-12+ uses these 2 flags in -O2 but they were only enabled in -O3 with gcc-11
-	CFLAGS_EXTRA="${CFLAGS_EXTRA} -fno-tree-loop-vectorize -fno-tree-slp-vectorize"
-fi
 if [ "${AUDITWHEEL_POLICY}" == "manylinux2014" ] ; then
 	# Python 3.11+
 	export TCLTK_LIBS="-ltk8.6 -ltcl8.6"
@@ -68,7 +57,7 @@ fi
 SQLITE_PREFIX=$(find /opt/_internal -maxdepth 1 -name 'sqlite*')
 if [ "${SQLITE_PREFIX}" != "" ]; then
 	case "${CPYTHON_VERSION}" in
-		3.6.*|3.7.*|3.8.*|3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,--enable-new-dtags,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
+		3.8.*|3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,--enable-new-dtags,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
 		*) ;;
 	esac
 fi
@@ -97,7 +86,7 @@ fi
 make > /dev/null
 make install > /dev/null
 popd
-rm -rf "Python-${CPYTHON_VERSION}" "Python-${CPYTHON_VERSION}.tar.xz" "Python-${CPYTHON_VERSION}.tar.xz.sigstore"  "Python-${CPYTHON_VERSION}.tar.xz.asc"
+rm -rf "Python-${CPYTHON_VERSION}" "Python-${CPYTHON_VERSION}.tar.xz" "Python-${CPYTHON_VERSION}.tar.xz.sigstore"
 
 if [ "${OPENSSL_PREFIX}" != "" ]; then
 	rm -rf "${OPENSSL_PREFIX:?}/bin" "${OPENSSL_PREFIX}/include" "${OPENSSL_PREFIX}/lib/pkgconfig" "${OPENSSL_PREFIX}/lib/*.so"

docker/build_scripts/python_versions.json

@@ -11,23 +11,6 @@
       "sha256": "2a80800a76ee6b737d6458ba9ab30ce386dfdd5b2b2bec3ee6bc51fd8e51e7c2"
     }
   },
-  "pp37-pypy37_pp73": {
-    "x86_64": {
-      "version": "7.3.9",
-      "download_url": "https://downloads.python.org/pypy/pypy3.7-v7.3.9-linux64.tar.bz2",
-      "sha256": "c58195124d807ecc527499ee19bc511ed753f4f2e418203ca51bc7e3b124d5d1"
-    },
-    "aarch64": {
-      "version": "7.3.9",
-      "download_url": "https://downloads.python.org/pypy/pypy3.7-v7.3.9-aarch64.tar.bz2",
-      "sha256": "dfc62f2c453fb851d10a1879c6e75c31ffebbf2a44d181bb06fcac4750d023fc"
-    },
-    "i686": {
-      "version": "7.3.9",
-      "download_url": "https://downloads.python.org/pypy/pypy3.7-v7.3.9-linux32.tar.bz2",
-      "sha256": "3398cece0167b81baa219c9cd54a549443d8c0a6b553ec8ec13236281e0d86cd"
-    }
-  },
   "pp38-pypy38_pp73": {
     "x86_64": {
       "version": "7.3.11",

noxfile.py

@@ -19,7 +19,7 @@ def update_python_dependencies(session):
     # regenerate the constraints files
     env["UV_CUSTOM_COMPILE_COMMAND"] = f"nox -s {session.name}"
 
-    for python_minor in range(7, 14):
+    for python_minor in range(8, 14):
         python_version = f"3.{python_minor}"
         session.run(
             "uv",

tests/forty-two/setup.py

@@ -3,6 +3,6 @@
 setup(
     name="forty_two",
     version="0.1.0",
-    python_requires=">=3.6",
+    python_requires=">=3.8",
     ext_modules=[Extension("forty_two", sources=["forty-two.c"])],
 )

tests/run_tests.sh

@@ -7,18 +7,18 @@ set -exuo pipefail
 MY_DIR=$(dirname "${BASH_SOURCE[0]}")
 
 if [ "${AUDITWHEEL_POLICY:0:10}" == "musllinux_" ]; then
-	EXPECTED_PYTHON_COUNT=9
-	EXPECTED_PYTHON_COUNT_ALL=9
+	EXPECTED_PYTHON_COUNT=7
+	EXPECTED_PYTHON_COUNT_ALL=7
 else
 	if [ "${AUDITWHEEL_ARCH}" == "x86_64" ] || [ "${AUDITWHEEL_ARCH}" == "aarch64" ]; then
-		EXPECTED_PYTHON_COUNT=11
-		EXPECTED_PYTHON_COUNT_ALL=15
+		EXPECTED_PYTHON_COUNT=9
+		EXPECTED_PYTHON_COUNT_ALL=12
 	elif [ "${AUDITWHEEL_ARCH}" == "i686" ]; then
-		EXPECTED_PYTHON_COUNT=11
-		EXPECTED_PYTHON_COUNT_ALL=14
-	else
 		EXPECTED_PYTHON_COUNT=9
-		EXPECTED_PYTHON_COUNT_ALL=9
+		EXPECTED_PYTHON_COUNT_ALL=11
+	else
+		EXPECTED_PYTHON_COUNT=7
+		EXPECTED_PYTHON_COUNT_ALL=7
 	fi
 fi
 
@@ -97,7 +97,7 @@ for PYTHON in /opt/python/*/bin/python; do
 		echo "invalid answer, expecting 42"
 		exit 1
 	fi
-	if [ "${PYVERS}" != "3.6" ] && [ "${PYVERS}" != "3.7" ] && [ "${IMPLEMENTATION}" != "graalpy" ] && [ "${AUDITWHEEL_POLICY:0:9}_${AUDITWHEEL_ARCH}" != "musllinux_ppc64le" ] && [ "${AUDITWHEEL_POLICY:0:9}_${AUDITWHEEL_ARCH}" != "musllinux_s390x" ] && [ "${AUDITWHEEL_ARCH}" != "riscv64" ]; then
+	if [ "${IMPLEMENTATION}" != "graalpy" ] && [ "${AUDITWHEEL_POLICY:0:9}_${AUDITWHEEL_ARCH}" != "musllinux_ppc64le" ] && [ "${AUDITWHEEL_POLICY:0:9}_${AUDITWHEEL_ARCH}" != "musllinux_s390x" ] && [ "${AUDITWHEEL_ARCH}" != "riscv64" ]; then
 		# no uv on musllinux ppc64le / s390x
 		UV_PYTHON=/tmp/uv-test-${IMPLEMENTATION}${PYVERS}/bin/python
 		uv venv --python "${PYTHON}" "/tmp/uv-test-${IMPLEMENTATION}${PYVERS}"