Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

Allow any release manager to build any release stream

未關閉
  • 哪裡不對？
#111 0 則留言 1 個 reaction 已指派 0 人 在 GitHub 檢視

還沒有人認領這個 Issue。

評估

難度
5/5
預估耗時
一週以上
新手友好度
25/100
Issue 類型
功能
描述清晰度
需要釐清
活躍度
停滯
技術堆疊
azure, github-actions, python
領域
ci-cd, release, security

研究方向

審查發布流程，涵蓋文件和時程、GPG 與 Sigstore 身分，以及 Windows、macOS、原始碼和文件建置。將擬議的自動化工作與 release-tools issue 108 進行比較；當各方就摩擦點、目標身分模型以及未來發布流程的轉換計畫達成共識時，此 issue 即完成。

由索引模型根據 Issue 內容生成。

描述

Python security releases usually require all Python release managers to be available due to each release stream being assigned to a specific release manager. This happens in multiple locations:

  • Documentation and schedule
  • GPG identities for artifacts
  • Sigstore identity of all artifacts
  • Windows and macOS artifacts built and signed by Experts

This makes security releases especially difficult to coordinate.

There's already history for release managers "filling in" for one another and fixing up things after the release is out (for example, 3.10.14 being done originally by @ambv and then resigned by @pablogsal later).

Making the release process not depend on specific release managers means releases are less of a burden on RMs while also setting solid long-term expectations for release artifact users.

Where are the friction points?

Where in the current process are the friction points around any release manager making a release?

Human identities
  • Human identities for signing (Sigstore and GPG).
  • Identities of all release managers need to be trusted due to it not being known which release manager would be signing the artifacts ahead of time.
  • Difficult to automate without injecting directly into the build process. Somewhat trivializes the "human" identity.
  • Sigstore doesn't offer an ergonomic solution to verify a human-identity signature against a list of trusted identities.
  • For GPG, it seems that most folks import all trusted keys before verifying but some folks are pinning the identity of the release manager per release stream (ref, ref)

If this changes, documentation and user expectations will need to change. Would require a gradual phase-out and an announcement.

Builds are not all automated
  • Windows is completely automated in Azure Pipelines, uses Steve's GPG key regardless of who kicks off the build.
  • Source and docs builds are partially automated, plan is to automate further to be similar to Windows.
  • macOS builds aren't automated yet, uses Ned's GPG key. Likely will use GitHub Actions for automation?

This doesn't require any user-facing documentation changes or announcements.

Potential changes

Here are a list of proposed changes towards solving the above problems. Not all of these changes need to be accepted to achieve the above outcome.

  • Continue offering Sigstore and GPG human identities for existing Python release streams.
  • Move towards Sigstore being the recommended integrity mechanism for CPython artifacts in GitHub Actions. Moving away from human identities to machine/workflow identities for Sigstore solves the human identity problems.
  • Decide a cut-off point (3.14?) to stop offering human identity Sigstore identities.
  • Deprecate GPG signatures for future releases? Shared GPG key for release manager team? Open to other suggestions.

Further automating GitHub Actions builds is captured in https://github.com/python/release-tools/issues/108

主要語言
Python
星號
61
分支
48
平均合併
3 小時 1 分鐘
30 天內合併 PR
5

環境準備

這個專案沒有提供開發容器、Dockerfile 或貢獻指南，環境需要你自己搭建：先看它的 README，通用步驟見我們的新手貢獻指南。

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

python/release-tools 的其他 Issue

查看 python/release-tools 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。