Make minimum Python version 3.9 again

Author: facutuesca

.github/workflows/tests.yml

@@ -11,6 +11,8 @@ jobs:
     strategy:
       matrix:
         python:
+          - "3.9"
+          - "3.10"
           - "3.11"
           - "3.12"
           - "3.13"

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- The minimum Python version required has been brought back to `3.9`
+  ([#64](https://github.com/trailofbits/pypi-attestations/pull/64)).
+
 ### Fixed
 
 - `python -m pypi_attestations verify` now handles inputs like `dist/*`

pyproject.toml

@@ -16,7 +16,7 @@ dependencies = [
     "sigstore~=3.3",
     "sigstore-protobuf-specs",
 ]
-requires-python = ">=3.11"
+requires-python = ">=3.9"
 
 [tool.setuptools.dynamic]
 version = { attr = "pypi_attestations.__version__" }
@@ -56,6 +56,7 @@ omit = ["src/pypi_attestations/_cli.py", "src/pypi_attestations/__main__.py"]
 mypy_path = "src"
 packages = "pypi_attestations"
 plugins = ["pydantic.mypy"]
+python_version = "3.9"
 allow_redefinition = true
 check_untyped_defs = true
 disallow_incomplete_defs = true
@@ -74,7 +75,7 @@ warn_unused_ignores = true
 
 [tool.ruff]
 line-length = 100
-target-version = "py311"
+target-version = "py39"
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "W", "UP", "ANN", "D", "COM", "ISC", "TCH", "SLF"]
@@ -83,6 +84,9 @@ select = ["E", "F", "I", "W", "UP", "ANN", "D", "COM", "ISC", "TCH", "SLF"]
 # COM812 and ISC001 can cause conflicts when using ruff as a formatter.
 # See https://docs.astral.sh/ruff/formatter/#conflicting-lint-rules.
 ignore = ["ANN101", "ANN102", "D203", "D213", "COM812", "ISC001"]
+# Needed since Pydantic relies on runtime type annotations, and we target Python versions
+# < 3.10. See https://docs.astral.sh/ruff/rules/non-pep604-annotation/#why-is-this-bad
+pyupgrade.keep-runtime-typing = true
 
 [tool.ruff.lint.per-file-ignores]
 

src/pypi_attestations/_impl.py

@@ -7,7 +7,7 @@
 
 import base64
 from enum import Enum
-from typing import TYPE_CHECKING, Annotated, Any, Literal, NewType
+from typing import TYPE_CHECKING, Annotated, Any, Literal, NewType, Optional, Union
 
 import sigstore.errors
 from annotated_types import MinLen  # noqa: TCH002
@@ -183,7 +183,7 @@ def verify(
         verifier: Verifier,
         policy: VerificationPolicy,
         dist: Distribution,
-    ) -> tuple[str, dict[str, Any] | None]:
+    ) -> tuple[str, Optional[dict[str, Any]]]:
         """Verify against an existing Python distribution.
 
         On failure, raises an appropriate subclass of `AttestationError`.
@@ -362,7 +362,7 @@ class _PublisherBase(BaseModel):
     model_config = ConfigDict(alias_generator=to_snake)
 
     kind: str
-    claims: dict[str, Any] | None = None
+    claims: Optional[dict[str, Any]] = None
 
 
 class GitHubPublisher(_PublisherBase):
@@ -382,7 +382,7 @@ class GitHubPublisher(_PublisherBase):
     action.
     """
 
-    environment: str | None = None
+    environment: Optional[str] = None
     """
     The optional name GitHub Actions environment that the publishing
     action was performed from.
@@ -401,13 +401,13 @@ class GitLabPublisher(_PublisherBase):
     `bar` owned by group `foo` and subgroup `baz`.
     """
 
-    environment: str | None = None
+    environment: Optional[str] = None
     """
     The optional environment that the publishing action was performed from.
     """
 
 
-Publisher = Annotated[GitHubPublisher | GitLabPublisher, Field(discriminator="kind")]
+Publisher = Annotated[Union[GitHubPublisher, GitLabPublisher], Field(discriminator="kind")]
 
 
 class AttestationBundle(BaseModel):

test/test_impl.py

@@ -546,7 +546,8 @@ class TestBase64Bytes:
     def test_decoding(self) -> None:
         # This raises when using our custom type. When using Pydantic's Base64Bytes,
         # this succeeds
-        with pytest.raises(ValueError, match="Only base64 data is allowed"):
+        # The exception message is different in Python 3.9 vs >=3.10
+        with pytest.raises(ValueError, match="Non-base64 digit found|Only base64 data is allowed"):
             DummyModel(base64_bytes=b"a\n\naaa")
 
     def test_encoding(self) -> None: