-
-
Notifications
You must be signed in to change notification settings - Fork 33.2k
Description
Bug report
Bug description:
Overnight there were several new Python security releases. The Python 3.10-12 subset of those are fine, however, the Python 3.8.20 and 3.9.20 releases are missing the GPG signatures for the release. This is causing our release automation to fail, since it can't validate the releases.
ie: These files are missing:
https://www.python.org/ftp/python/3.8.20/Python-3.8.20.tgz.asc
https://www.python.org/ftp/python/3.9.20/Python-3.9.20.tgz.asc
For example:
+ curl --fail --retry 3 --retry-connrefused --connect-timeout 10 --max-time 60 -o python.tgz.asc https://www.python.org/ftp/python/3.8.20/Python-3.8.20.tgz.asc
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (22) The requested URL returned error: 404
(From https://github.com/heroku/heroku-buildpack-python/actions/runs/10750205053/job/29816134924#step:4:19)
Also note how on the python.org releases pages, the GPG column in the "Files" table doesn't have a value:
https://www.python.org/downloads/release/python-3820/
https://www.python.org/downloads/release/python-3920/
cc @ambv
CPython versions tested on:
3.8, 3.9
Operating systems tested on:
No response