Bump minimum required Python to 3.10

.github/workflows/_test.yml

@@ -10,14 +10,14 @@ jobs:
       fail-fast: false
       matrix:
         # Run tests once on each supported Python
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         os: [ubuntu-latest]
         toxenv: [py]
         include:
-          # Run macOS tests on 3.9 (current OS X python) and latest,
+          # Run macOS tests on 3.10 (current OS X python) and latest,
           # Run Windows and "special" tests on latest Python version only
           # Run linter on oldest supported Python
-          - python-version: "3.9"
+          - python-version: "3.10"
             os: macos-latest
             toxenv: py
           - python-version: "3.13"
@@ -35,7 +35,7 @@ jobs:
           - python-version: "3.13"
             os: ubuntu-latest
             toxenv: py-test-gpg-fails
-          - python-version: "3.9"
+          - python-version: "3.10"
             os: ubuntu-latest
             toxenv: lint
 

pyproject.toml

@@ -26,16 +26,16 @@ classifiers = [
     "Operating System :: MacOS :: MacOS X",
     "Operating System :: Microsoft :: Windows",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Programming Language :: Python :: Implementation :: CPython",
     "Topic :: Security",
     "Topic :: Software Development",
 ]
-requires-python = "~=3.8"
+requires-python = "~=3.10"
 dynamic = ["version"]
 
 [project.urls]

securesystemslib/formats.py

@@ -20,7 +20,7 @@
 
 """
 
-from typing import Callable, Optional, Union
+from collections.abc import Callable
 
 from securesystemslib import exceptions
 
@@ -52,7 +52,7 @@ def _canonical_string_encoder(string: str) -> str:
 
 
 def _encode_canonical(
-    object: Union[bool, None, str, int, tuple, list, dict], output_function: Callable
+    object: bool | None | str | int | tuple | list | dict, output_function: Callable
 ) -> None:
     # Helper for encode_canonical.  Older versions of json.encoder don't
     # even let us replace the separators.
@@ -94,9 +94,9 @@ def _encode_canonical(
 
 
 def encode_canonical(
-    object: Union[bool, None, str, int, tuple, list, dict],
-    output_function: Optional[Callable] = None,
-) -> Union[str, None]:
+    object: bool | None | str | int | tuple | list | dict,
+    output_function: Callable | None = None,
+) -> str | None:
     """
     <Purpose>
       Encoding an object so that it is always has the same string format
@@ -150,7 +150,7 @@ def encode_canonical(
       A string representing the 'object' encoded in canonical JSON form.
     """
 
-    result: Union[None, list] = None
+    result: None | list = None
     # If 'output_function' is unset, treat it as
     # appending to a list.
     if output_function is None:

securesystemslib/signer/_crypto_signer.py

@@ -3,7 +3,6 @@
 import logging
 import os
 from dataclasses import astuple, dataclass
-from typing import Optional, Union
 from urllib import parse
 
 from securesystemslib.exceptions import UnsupportedLibraryError
@@ -116,7 +115,7 @@ class CryptoSigner(Signer):
     def __init__(
         self,
         private_key: "PrivateKeyTypes",
-        public_key: Optional[SSlibKey] = None,
+        public_key: SSlibKey | None = None,
     ):
         if CRYPTO_IMPORT_ERROR:
             raise UnsupportedLibraryError(CRYPTO_IMPORT_ERROR)
@@ -125,7 +124,7 @@ def __init__(
             public_key = SSlibKey.from_crypto(private_key.public_key())
 
         self._private_key: PrivateKeyTypes
-        self._sign_args: Union[_RSASignArgs, _ECDSASignArgs, _NoSignArgs]
+        self._sign_args: _RSASignArgs | _ECDSASignArgs | _NoSignArgs
 
         if public_key.keytype == "rsa" and public_key.scheme in [
             "rsassa-pss-sha224",
@@ -195,7 +194,7 @@ def from_priv_key_uri(
         cls,
         priv_key_uri: str,
         public_key: Key,
-        secrets_handler: Optional[SecretsHandler] = None,
+        secrets_handler: SecretsHandler | None = None,
     ) -> "CryptoSigner":
         """Constructor for Signer to call
 
@@ -248,7 +247,7 @@ def from_priv_key_uri(
 
     @staticmethod
     def generate_ed25519(
-        keyid: Optional[str] = None,
+        keyid: str | None = None,
     ) -> "CryptoSigner":
         """Generate new key pair as "ed25519" signer.
 
@@ -270,8 +269,8 @@ def generate_ed25519(
 
     @staticmethod
     def generate_rsa(
-        keyid: Optional[str] = None,
-        scheme: Optional[str] = "rsassa-pss-sha256",
+        keyid: str | None = None,
+        scheme: str | None = "rsassa-pss-sha256",
         size: int = 3072,
     ) -> "CryptoSigner":
         """Generate new key pair as rsa signer.
@@ -299,7 +298,7 @@ def generate_rsa(
 
     @staticmethod
     def generate_ecdsa(
-        keyid: Optional[str] = None,
+        keyid: str | None = None,
     ) -> "CryptoSigner":
         """Generate new key pair as "ecdsa-sha2-nistp256" signer.
 

securesystemslib/signer/_signer.py

@@ -4,7 +4,7 @@
 
 import logging
 from abc import ABCMeta, abstractmethod
-from typing import Callable
+from collections.abc import Callable
 
 from securesystemslib.signer._key import Key
 from securesystemslib.signer._signature import Signature

tests/test_signer.py

@@ -7,7 +7,7 @@
 import unittest
 from contextlib import suppress
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any
 
 from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
 from cryptography.hazmat.primitives.serialization import (
@@ -760,7 +760,7 @@ def from_priv_key_uri(
                 cls,
                 priv_key_uri: str,
                 public_key: Key,
-                secrets_handler: Optional[SecretsHandler] = None,
+                secrets_handler: SecretsHandler | None = None,
             ) -> "CustomSigner":
                 return cls(key)