Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add 3.14-rc variants #981

Merged
merged 1 commit into from
Oct 16, 2024
Merged

Add 3.14-rc variants #981

merged 1 commit into from
Oct 16, 2024

Conversation

sspans-sbp
Copy link
Contributor

Python 3.14 is still in development. This release, 3.14.0a1 is the first of seven planned alpha releases.

https://www.python.org/downloads/release/python-3140a1/

@sspans-sbp
Copy link
Contributor Author

sspans-sbp commented Oct 16, 2024

It seems sigstore is de recommended way to validate more recent Python releases.
GPG signatures are not available for 3.14....

cosign verify-blob Python-3.14.0a1.tar.xz --bundle Python-3.14.0a1.tar.xz.sigstore  --certificate-identity hugo@python.org --certificate-oidc-issuer https://github.com/login/oauth  --new-bundle-format=true
Verified OK

@jnoordsij
Copy link
Contributor

https://peps.python.org/pep-0761/ seems to confirm that Python is indeed moving from PGP to Sigstore. For >= 3.11 this seems to be in place, so a full migration would not be possible yet; so probably this would require distinguishing versions and implementing two different ways to verify artefacts.

@yosifkit
Copy link
Member

#977 (comment)

So, I think we'll have to just remove the gpg verification for 3.14 and above and solely rely on the sha256 check (#978) until there is a secure/verifiable way (like an apt package in Debian) to get a sigstore client to check the sigstore signature.

@tianon
Copy link
Member

tianon commented Oct 16, 2024

Updated with an appropriate conditional to remove the PGP logic for 3.14+ 👀

@yosifkit yosifkit merged commit ed7351e into docker-library:master Oct 16, 2024
44 checks passed
docker-library-bot added a commit to docker-library-bot/official-images that referenced this pull request Oct 16, 2024
Changes:

- docker-library/python@ed7351e: Merge pull request docker-library/python#981 from sspans-sbp/add-3.14
- docker-library/python@f599a55: Add 3.14-rc variants
- docker-library/python@fe21c86: Merge pull request docker-library/python#978 from infosiftr/sha256
- docker-library/python@37a7bfd: Add SHA256 verification
- docker-library/python@7666104: Merge pull request docker-library/python#974 from edmorley/patch-1
- docker-library/python@f56fa00: Remove deadcode in versions.sh
docker-library-bot added a commit to docker-library-bot/official-images that referenced this pull request Oct 18, 2024
Changes:

- docker-library/python@57abe0e: Merge pull request docker-library/python#980 from RobertDeRose/bugfix/dont-skip-optimization
- docker-library/python@37a6827: Do not set PROFILE_TASK environment variable
- docker-library/python@3540d68: Merge pull request docker-library/python#982 from infosiftr/jq-IN
- docker-library/python@cab4df8: Use jq's `IN()` instead of `index()`
- docker-library/python@ed7351e: Merge pull request docker-library/python#981 from sspans-sbp/add-3.14
- docker-library/python@f599a55: Add 3.14-rc variants
- docker-library/python@fe21c86: Merge pull request docker-library/python#978 from infosiftr/sha256
- docker-library/python@37a7bfd: Add SHA256 verification
- docker-library/python@7666104: Merge pull request docker-library/python#974 from edmorley/patch-1
- docker-library/python@f56fa00: Remove deadcode in versions.sh
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants