-
Notifications
You must be signed in to change notification settings - Fork 509
Description
Installing the Python feature using "version": "latest" fails on downloading the .asc signature. There is no more .asc signature.
13.22 (*) Building Python latest from source...
13.60 VERSION=3.14.0
13.60 Downloading Python-3.14.0.tgz...
23.29 (*) Keyserver hkp://keyserver.pgp.com is not reachable.
23.44 (*) Downloading GPG key...
24.95 Downloading Python-3.14.0.tgz.asc...
25.01 gpg: no valid OpenPGP data found.
25.01 gpg: the signature could not be verified.
25.01 Please remember that the signature file (.sig or .asc)
25.01 should be the first file given on the command line.
25.01 ERROR: Feature "Python" (ghcr.io/devcontainers/features/python) failed to install! Look at the documentation at https://github.com/devcontainers/features/tree/main/src/python for help troubleshooting this error.
I need to install a specific version of Python because of #1403
The relevant info from the release notes is at https://docs.python.org/3.14/whatsnew/3.14.html#whatsnew314-no-more-pgp
Discontinuation of PGP signatures
PGP (Pretty Good Privacy) signatures will not be provided for releases of Python 3.14 or future versions. To verify CPython artifacts, users must use Sigstore verification materials. Releases have been signed using Sigstore since Python 3.11.
This change in release process was specified in PEP 761.
The new sigstore signatures are available for Python 3.11 and newer, so signature verification should have version detection for 3.11 and later or 3.14 and later for the new method, while still using the pgp method for older releases.