Skip to content

Python 3.8.20 and 3.9.20 releases missing GPG signatures #123807

@edmorley

Description

@edmorley

Bug report

Bug description:

Overnight there were several new Python security releases. The Python 3.10-12 subset of those are fine, however, the Python 3.8.20 and 3.9.20 releases are missing the GPG signatures for the release. This is causing our release automation to fail, since it can't validate the releases.

ie: These files are missing:
https://www.python.org/ftp/python/3.8.20/Python-3.8.20.tgz.asc
https://www.python.org/ftp/python/3.9.20/Python-3.9.20.tgz.asc

For example:

+ curl --fail --retry 3 --retry-connrefused --connect-timeout 10 --max-time 60 -o python.tgz.asc https://www.python.org/ftp/python/3.8.20/Python-3.8.20.tgz.asc
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (22) The requested URL returned error: 404

(From https://github.com/heroku/heroku-buildpack-python/actions/runs/10750205053/job/29816134924#step:4:19)

Also note how on the python.org releases pages, the GPG column in the "Files" table doesn't have a value:
https://www.python.org/downloads/release/python-3820/
https://www.python.org/downloads/release/python-3920/

cc @ambv

CPython versions tested on:

3.8, 3.9

Operating systems tested on:

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.8 (EOL)end of life3.9only security fixestype-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions