Merge branch 'main' into bump-aiohttp-3.12.15

Author: sethmlarson

.github/workflows/build-release.yml

@@ -153,23 +153,16 @@ jobs:
       - name: "Install docs dependencies"
         run: |
           python -m pip install -r Doc/requirements.txt
-          sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends \
-            fonts-freefont-otf \
-            latexmk \
-            texinfo \
-            texlive-fonts-extra \
-            texlive-fonts-recommended \
-            texlive-latex-base \
-            texlive-latex-extra \
-            texlive-latex-recommended \
-            texlive-xetex \
-            xindy
 
       - name: "Build docs"
+        env:
+          SPHINXOPTS: "-j10"
         run: |
           cd Doc
-          SPHINXOPTS="-j10" make dist
+          make dist-epub
+          make dist-html
+          make dist-texinfo
+          make dist-text
 
       - name: "Upload the docs artifacts"
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

release.py

@@ -19,7 +19,7 @@
 import subprocess
 import sys
 import tempfile
-from collections.abc import Generator
+from collections.abc import Generator, Sequence
 from contextlib import contextmanager
 from dataclasses import dataclass
 from pathlib import Path
@@ -256,7 +256,7 @@ def error(*msgs: str) -> None:
 
 
 def run_cmd(
-    cmd: list[str] | str, silent: bool = False, shell: bool = False, **kwargs: Any
+    cmd: Sequence[str] | str, silent: bool = False, shell: bool = False, **kwargs: Any
 ) -> None:
     if shell:
         cmd = SPACE.join(cmd)
@@ -700,11 +700,17 @@ def build_docs() -> str:
         run_cmd([pip, "install", "-r", "Doc/requirements.txt"])
         sphinx_build = os.path.join(venv, "bin", "sphinx-build")
         blurb = os.path.join(venv, "bin", "blurb")
+        docs_env = {
+            **os.environ,
+            "BLURB": blurb,
+            "SPHINXBUILD": sphinx_build,
+            "SPHINXOPTS": "-j10",
+        }
         with pushd("Doc"):
-            run_cmd(
-                ["make", "dist", "SPHINXBUILD=" + sphinx_build, "BLURB=" + blurb],
-                env={**os.environ, "SPHINXOPTS": "-j10"},
-            )
+            run_cmd(("make", "dist-epub"), env=docs_env)
+            run_cmd(("make", "dist-html"), env=docs_env)
+            run_cmd(("make", "dist-texinfo"), env=docs_env)
+            run_cmd(("make", "dist-text"), env=docs_env)
             return os.path.abspath("dist")
 
 

run_release.py

@@ -604,8 +604,6 @@ def wait_for_build_release(db: ReleaseShelf) -> None:
                 docs_path / f"python-{release_tag}-docs.epub",
                 docs_path / f"python-{release_tag}-docs-html.tar.bz2",
                 docs_path / f"python-{release_tag}-docs-html.zip",
-                docs_path / f"python-{release_tag}-docs-pdf-a4.tar.bz2",
-                docs_path / f"python-{release_tag}-docs-pdf-a4.zip",
                 docs_path / f"python-{release_tag}-docs-texinfo.tar.bz2",
                 docs_path / f"python-{release_tag}-docs-texinfo.zip",
                 docs_path / f"python-{release_tag}-docs-text.tar.bz2",
@@ -1127,6 +1125,15 @@ def modify_the_docs_by_version_page(db: ReleaseShelf) -> None:
             )
 
 
+def announce_release(db: ReleaseShelf) -> None:
+    if not ask_question(
+        "Have you announced the release at https://discuss.python.org/c/core-dev/23 "
+        "and https://www.blogger.com?\n"
+        "Tip: use the 'release' tag and 'releases' label respectively."
+    ):
+        raise ReleaseException("The release has not been announced")
+
+
 def post_release_merge(db: ReleaseShelf) -> None:
     subprocess.check_call(
         ["git", "fetch", "--all"],
@@ -1450,6 +1457,7 @@ def _api_key(api_key: str) -> str:
         Task(purge_the_cdn, "Purge the CDN of python.org/downloads"),
         Task(modify_the_prereleases_page, "Modify the pre-release page"),
         Task(modify_the_docs_by_version_page, "Update docs by version page"),
+        Task(announce_release, "Announce the release"),
     ]
     automata = ReleaseDriver(
         git_repo=args.repo,

tests/README.rst

@@ -153,7 +153,7 @@ Documentation
 updated daily.
 
 It can also be downloaded in many formats for faster access.  The documentation
-is downloadable in HTML, PDF, and reStructuredText formats; the latter version
+is downloadable in HTML, EPUB, and reStructuredText formats; the latter version
 is primarily for documentation authors, translators, and people with special
 formatting requirements.
 

windows-release/azure-pipelines.yml

@@ -140,8 +140,14 @@ variables:
     SigningDescription: ${{ parameters.SigningDescription }}
   PublishARM64: ${{ parameters.DoARM64 }}
 # QUEUE TIME VARIABLES
-#  PyDotOrgUsername: ''
-#  PyDotOrgServer: ''
+#  OverrideNugetVersion: ''
+#  PyManagerIndexFilename: ''
+#  SkipNugetPublish: ''
+#  SkipPipTests: ''
+#  SkipPythonOrgPublish: ''
+#  SkipSBOM: ''
+#  SkipTests: ''
+#  SkipTkTests: ''
 
 trigger: none
 pr: none
@@ -193,61 +199,67 @@ stages:
       parameters:
         BuildToPackage: ${{ parameters.BuildToPackage }}
         DoFreethreaded: ${{ parameters.DoFreethreaded }}
+        SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
     - template: stage-layout-symbols.yml
       parameters:
         BuildToPackage: ${{ parameters.BuildToPackage }}
         DoFreethreaded: ${{ parameters.DoFreethreaded }}
+        SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
     - ${{ if eq(parameters.DoEmbed, 'true') }}:
       - template: stage-layout-embed.yml
         parameters:
           BuildToPackage: ${{ parameters.BuildToPackage }}
+          SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
     - ${{ if eq(parameters.DoNuget, 'true') }}:
       - template: stage-layout-nuget.yml
         parameters:
           BuildToPackage: ${{ parameters.BuildToPackage }}
           DoFreethreaded: ${{ parameters.DoFreethreaded }}
+          SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
     - ${{ if eq(parameters.DoMSIX, 'true') }}:
       - template: stage-layout-msix.yml
         parameters:
           BuildToPackage: ${{ parameters.BuildToPackage }}
+          SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
     - ${{ if eq(parameters.DoPyManager, 'true') }}:
       - template: stage-layout-pymanager.yml
         parameters:
           BuildToPackage: ${{ parameters.BuildToPackage }}
           DoFreethreaded: ${{ parameters.DoFreethreaded }}
           DoEmbed: ${{ parameters.DoEmbed }}
+          SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
 
   - stage: Pack
     dependsOn: Layout
     displayName: Pack
     jobs:
     #- ${{ if eq(parameters.DoEmbed, 'true') }}:
     #  - template: stage-pack-embed.yml
+    #    parameters:
+    #      SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
     - ${{ if eq(parameters.DoMSI, 'true') }}:
       - template: stage-msi.yml
         parameters:
           BuildToPackage: ${{ parameters.BuildToPackage }}
           DoARM64: ${{ parameters.DoARM64}}
           DoFreethreaded: ${{ parameters.DoFreethreaded }}
-          ${{ if and(parameters.SigningCertificate, ne(parameters.SigningCertificate, 'Unsigned')) }}:
-            SigningCertificate: ${{ parameters.SigningCertificate }}
+          SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
     - ${{ if eq(parameters.DoMSIX, 'true') }}:
       - template: stage-pack-msix.yml
         parameters:
-          ${{ if and(parameters.SigningCertificate, ne(parameters.SigningCertificate, 'Unsigned')) }}:
-            SigningCertificate: ${{ parameters.SigningCertificate }}
+          SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
     - ${{ if eq(parameters.DoNuget, 'true') }}:
       - template: stage-pack-nuget.yml
         parameters:
           ${{ if eq(parameters.SignNuget, 'true') }}:
-            ${{ if and(parameters.SigningCertificate, ne(parameters.SigningCertificate, 'Unsigned')) }}:
-              SigningCertificate: ${{ parameters.SigningCertificate }}
+            SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
           DoFreethreaded: ${{ parameters.DoFreethreaded }}
     - ${{ if eq(parameters.DoPyManager, 'true') }}:
       - template: stage-pack-pymanager.yml
         parameters:
           DoFreethreaded: ${{ parameters.DoFreethreaded }}
           DoEmbed: ${{ parameters.DoEmbed }}
+          SigningCertificate: ${{ iif(eq(parameters.SigningCertificate, 'Unsigned'), '', parameters.SigningCertificate) }}
 
   - stage: Test
     dependsOn: Pack

windows-release/msi-steps.yml

@@ -67,6 +67,10 @@ steps:
         Include: ''
         ExportCommand: SignCommand
         SigningCertificate: ${{ parameters.SigningCertificate }}
+        # WiX is struggling with WIF authentication and sign.exe right now,
+        # so we still rely on the client secret for legacy builds.
+        # We disable the service connection here to skip the login steps.
+        AzureServiceConnectionName: ''
 
     - powershell: |
         $cmd = $env:SignCommand -replace '"', '\"'
@@ -81,12 +85,12 @@ steps:
     displayName: 'Build launcher installer'
     env:
       Platform: x86
+      # Only need the variable here for msi.props to detect
+      SigningCertificate: ${{ parameters.SigningCertificate }}
       ${{ if parameters.SigningCertificate }}:
         AZURE_TENANT_ID: $(TrustedSigningTenantId)
         AZURE_CLIENT_ID: $(TrustedSigningClientId)
-        AZURE_CLIENT_SECRET: $(TrustedSigningSecret)
-        # Only need the variable here for msi.props to detect
-        SigningCertificate: ${{ parameters.SigningCertificate }}
+        AZURE_CLIENT_SECRET: $(TrustedSigningClientSecret)
 
   - ${{ each b in parameters.Bundles }}:
     - script: |
@@ -99,12 +103,12 @@ steps:
         PYTHONHOME: $(Build.SourcesDirectory)
         ${{ if b.TclTkArtifact }}:
           TclTkLibraryDir: $(Pipeline.Workspace)\${{ b.TclTkArtifact }}
+        # Only need the variable here for msi.props to detect
+        SigningCertificate: ${{ parameters.SigningCertificate }}
         ${{ if parameters.SigningCertificate }}:
           AZURE_TENANT_ID: $(TrustedSigningTenantId)
           AZURE_CLIENT_ID: $(TrustedSigningClientId)
-          AZURE_CLIENT_SECRET: $(TrustedSigningSecret)
-          # Only need the variable here for msi.props to detect
-          SigningCertificate: ${{ parameters.SigningCertificate }}
+          AZURE_CLIENT_SECRET: $(TrustedSigningClientSecret)
 
   - powershell: |
       del $env:ResponseFile -ErrorAction Continue

windows-release/sign-files.yml

@@ -7,10 +7,12 @@ parameters:
   SigningCertificate: ''
   ExportCommand: ''
   ContinueOnError: false
+  AzureServiceConnectionName: 'Python Signing'
 
 steps:
 - ${{ if parameters.SigningCertificate }}:
   - powershell: |
+      # Install sign tool
       dotnet tool install --global --prerelease sign
       $signtool = (gcm sign -EA SilentlyContinue).Source
       if (-not $signtool) {
@@ -32,6 +34,30 @@ steps:
     env:
       EXPORT_COMMAND: ${{ parameters.ExportCommand }}
 
+  - ${{ if parameters.AzureServiceConnectionName }}:
+    # We sign in once with the AzureCLI task, as it uses OIDC to obtain a
+    # temporary token. But the task also logs out, and so we save the token and
+    # use it to log in persistently (for the rest of the build).
+    - task: AzureCLI@2
+      displayName: 'Authenticate signing tools (1/2)'
+      inputs:
+        azureSubscription: ${{ parameters.AzureServiceConnectionName }}
+        scriptType: 'ps'
+        scriptLocation: 'inlineScript'
+        inlineScript: |
+          "##vso[task.setvariable variable=AZURE_CLIENT_ID;issecret=true]${env:servicePrincipalId}"
+          "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]${env:idToken}"
+          "##vso[task.setvariable variable=AZURE_TENANT_ID;issecret=true]${env:tenantId}"
+        addSpnToEnvironment: true
+
+    - powershell: >
+        az login --service-principal
+        -u $(AZURE_CLIENT_ID)
+        --tenant $(AZURE_TENANT_ID)
+        --allow-no-subscriptions
+        --federated-token $(AZURE_ID_TOKEN)
+      displayName: 'Authenticate signing tools (2/2)'
+
   - ${{ if parameters.Include }}:
     - powershell: |
         if ("${{ parameters.Exclude }}") {
@@ -58,9 +84,6 @@ steps:
       env:
         TRUSTED_SIGNING_CMD: $(__TrustedSigningCmd)
         TRUSTED_SIGNING_ARGS: $(__TrustedSigningArgs)
-        AZURE_TENANT_ID: $(TrustedSigningTenantId)
-        AZURE_CLIENT_ID: $(TrustedSigningClientId)
-        AZURE_CLIENT_SECRET: $(TrustedSigningSecret)
         ${{ if parameters.Filter }}:
           FILTER: ${{ parameters.Filter }}
 

windows-release/stage-layout-embed.yml

@@ -1,5 +1,6 @@
 parameters:
   BuildToPackage: current
+  SigningCertificate: ''
 
 jobs:
 - job: Make_Embed_Layout

windows-release/stage-layout-full.yml

@@ -1,6 +1,7 @@
 parameters:
   BuildToPackage: current
   DoFreethreaded: false
+  SigningCertificate: ''
 
 jobs:
 - job: Make_Layouts
@@ -131,10 +132,10 @@ jobs:
     displayName: 'Update TCL_LIBRARY'
     condition: and(succeeded(), variables['TclLibrary'])
 
-  - powershell: |
-      copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
-    displayName: 'Copy signed files into sources'
-    condition: and(succeeded(), variables['SigningCertificate'])
+  - ${{ if parameters.SigningCertificate }}:
+    - powershell: |
+        copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
+      displayName: 'Copy signed files into sources'
 
   - template: ./layout-command.yml
     parameters: