Drop CPython 3.6 & 3.7 - MERGE AFTER 2025-05-06

README.rst

@@ -268,12 +268,12 @@ Image content
 
 All supported images currently contain:
 
-- CPython 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.13t and PyPy 3.7, 3.8, 3.9, 3.10 installed in
+- CPython 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.13t and PyPy 3.8, 3.9, 3.10 installed in
   ``/opt/python/<python tag>-<abi tag>``. The directories are named
   after the PEP 425 tags for each environment --
-  e.g. ``/opt/python/cp37-cp37m`` contains a CPython 3.7 build, and
+  e.g. ``/opt/python/cp313-cp313`` contains a CPython 3.13 build, and
   can be used to produce wheels named like
-  ``<pkg>-<version>-cp37-cp37m-<arch>.whl``.
+  ``<pkg>-<version>-cp313-cp313-<arch>.whl``.
 
 - Development packages for all the libraries that PEP 571/599 list. One should not assume the presence of any other development package.
 

docker/Dockerfile

@@ -109,28 +109,18 @@ RUN export MPDECIMAL_ROOT=mpdecimal-4.0.0 && \
 
 FROM --platform=${BUILDPLATFORM} ghcr.io/sigstore/cosign/cosign:v2.4.2 AS cosign-bin
 
-FROM build_base AS build_cpython_system_ssl
+FROM build_base AS build_cpython
 COPY --from=build_tcl_tk /manylinux-buildfs /
 COPY --from=build_mpdecimal /manylinux-buildfs /
 COPY --from=build_sqlite3 /manylinux-buildfs /
-COPY build_scripts/build-cpython.sh /build_scripts/
 RUN if command -v apk >/dev/null 2>&1; then ldconfig /; else ldconfig; fi
-COPY --from=cosign-bin /ko-app/cosign /usr/local/bin/cosign
-
-FROM build_cpython_system_ssl AS build_cpython
 COPY build_scripts/build-openssl.sh /build_scripts/
 RUN export OPENSSL_ROOT=openssl-3.0.16 && \
     export OPENSSL_HASH=57e03c50feab5d31b152af2b764f10379aecd8ee92f16c985983ce4a99f7ef86 && \
     export OPENSSL_DOWNLOAD_URL=https://github.com/openssl/openssl/releases/download/${OPENSSL_ROOT} && \
     manylinux-entrypoint /build_scripts/build-openssl.sh
-
-
-FROM build_cpython_system_ssl AS build_cpython36
-COPY build_scripts/cpython-pubkeys.txt /build_scripts/cpython-pubkeys.txt
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh "" "" 3.6.15
-
-FROM build_cpython_system_ssl AS build_cpython37
-RUN manylinux-entrypoint /build_scripts/build-cpython.sh [email protected] https://github.com/login/oauth 3.7.17
+COPY --from=cosign-bin /ko-app/cosign /usr/local/bin/cosign
+COPY build_scripts/build-cpython.sh /build_scripts/
 
 FROM build_cpython AS build_cpython38
 RUN manylinux-entrypoint /build_scripts/build-cpython.sh [email protected] https://github.com/login/oauth 3.8.20
@@ -160,9 +150,7 @@ COPY --from=build_mpdecimal /manylinux-rootfs /
 COPY --from=build_sqlite3 /manylinux-rootfs /
 COPY --from=build_git /manylinux-rootfs /
 COPY build_scripts /opt/_internal/build_scripts/
-RUN --mount=type=bind,target=/build_cpython36,from=build_cpython36 \
-    --mount=type=bind,target=/build_cpython37,from=build_cpython37 \
-    --mount=type=bind,target=/build_cpython38,from=build_cpython38 \
+RUN --mount=type=bind,target=/build_cpython38,from=build_cpython38 \
     --mount=type=bind,target=/build_cpython39,from=build_cpython39 \
     --mount=type=bind,target=/build_cpython310,from=build_cpython310 \
     --mount=type=bind,target=/build_cpython311,from=build_cpython311 \

docker/build_scripts/build-cpython.sh

@@ -28,14 +28,8 @@ function pyver_dist_dir {
 
 CPYTHON_DIST_DIR=$(pyver_dist_dir "${CPYTHON_VERSION}")
 fetch_source "Python-${CPYTHON_VERSION}.tar.xz" "${CPYTHON_DOWNLOAD_URL}/${CPYTHON_DIST_DIR}"
-if [ "${CERT_IDENTITY}" == "" ]; then
-	fetch_source "Python-${CPYTHON_VERSION}.tar.xz.asc" "${CPYTHON_DOWNLOAD_URL}/${CPYTHON_DIST_DIR}"
-	gpg --import "${MY_DIR}/cpython-pubkeys.txt"
-	gpg --verify "Python-${CPYTHON_VERSION}.tar.xz.asc"
-else
-	fetch_source "Python-${CPYTHON_VERSION}.tar.xz.sigstore" "${CPYTHON_DOWNLOAD_URL}/${CPYTHON_DIST_DIR}"
-	cosign  verify-blob "Python-${CPYTHON_VERSION}.tar.xz" --bundle "Python-${CPYTHON_VERSION}.tar.xz.sigstore" --certificate-identity="${CERT_IDENTITY}" --certificate-oidc-issuer="${CERT_OIDC_ISSUER}"
-fi
+fetch_source "Python-${CPYTHON_VERSION}.tar.xz.sigstore" "${CPYTHON_DOWNLOAD_URL}/${CPYTHON_DIST_DIR}"
+cosign  verify-blob "Python-${CPYTHON_VERSION}.tar.xz" --bundle "Python-${CPYTHON_VERSION}.tar.xz.sigstore" --certificate-identity="${CERT_IDENTITY}" --certificate-oidc-issuer="${CERT_OIDC_ISSUER}"
 
 tar -xJf "Python-${CPYTHON_VERSION}.tar.xz"
 pushd "Python-${CPYTHON_VERSION}"
@@ -49,11 +43,6 @@ if [ "${4:-}" == "nogil" ]; then
 	CONFIGURE_ARGS+=(--disable-gil)
 fi
 
-if [ "${CPYTHON_VERSION}" == "3.6.15" ]; then
-	# https://github.com/python/cpython/issues/89863
-	# gcc-12+ uses these 2 flags in -O2 but they were only enabled in -O3 with gcc-11
-	CFLAGS_EXTRA="${CFLAGS_EXTRA} -fno-tree-loop-vectorize -fno-tree-slp-vectorize"
-fi
 if [ "${AUDITWHEEL_POLICY}" == "manylinux2014" ] ; then
 	# Python 3.11+
 	export TCLTK_LIBS="-ltk8.6 -ltcl8.6"
@@ -68,7 +57,7 @@ fi
 SQLITE_PREFIX=$(find /opt/_internal -maxdepth 1 -name 'sqlite*')
 if [ "${SQLITE_PREFIX}" != "" ]; then
 	case "${CPYTHON_VERSION}" in
-		3.6.*|3.7.*|3.8.*|3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,--enable-new-dtags,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
+		3.8.*|3.9.*|3.10.*) sed -i "s|/usr/local/include/sqlite3|/opt/_internal/sqlite3/include|g ; s|sqlite_extra_link_args = ()|sqlite_extra_link_args = ('-Wl,--enable-new-dtags,-rpath=/opt/_internal/sqlite3/lib',)|g" setup.py;;
 		*) ;;
 	esac
 fi
@@ -97,7 +86,7 @@ fi
 make > /dev/null
 make install > /dev/null
 popd
-rm -rf "Python-${CPYTHON_VERSION}" "Python-${CPYTHON_VERSION}.tar.xz" "Python-${CPYTHON_VERSION}.tar.xz.sigstore"  "Python-${CPYTHON_VERSION}.tar.xz.asc"
+rm -rf "Python-${CPYTHON_VERSION}" "Python-${CPYTHON_VERSION}.tar.xz" "Python-${CPYTHON_VERSION}.tar.xz.sigstore"
 
 if [ "${OPENSSL_PREFIX}" != "" ]; then
 	rm -rf "${OPENSSL_PREFIX:?}/bin" "${OPENSSL_PREFIX}/include" "${OPENSSL_PREFIX}/lib/pkgconfig" "${OPENSSL_PREFIX}/lib/*.so"