Skip to content

Conversation

@krnowak
Copy link
Member

@krnowak krnowak commented Jan 7, 2026

CI: http://localhost:8080/job/container/job/sdk/2465/cldsv/

Bumping python to 3.12 - Gentoo is slowly moving away from 3.11 as some packages bumped their PYTHON_COMPAT beyond 3.11. Not bumping to 3.13 though, as sec-policy/selinux-base is still at 3.12 at most.

This required updating PYTHON_COMPAT in overlay packages, so I did it by updating them to 3.11 - 3.14 range.

I also added a transitional SDK profile that is only used for stage1 build of the SDK to ease the bump.

Needed to patch the boto package further to make it work with python3.12 (mostly some SyntaxWarnings about invalid escapes that could be fixed with using raw strings, and replaced imp with importlib).

  • Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)
  • Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.

Try to do it with in a kinda-sorta proper Gentoo way - with
PYTHON_TARGETS and PYTHON_SINGLE_TARGET variables in
make.defaults. Still need to disable all other versions of python,
otherwise our settings gets merged with settings from base Gentoo
profiles, which currently enable python 3.13. And we also need to keep
masking the other python versions, because emerge still for some
reason wants to install python 3.13 or 3.14 for some packages, despite
the settings in PYTHON_TARGETS.

We are not bumping to 3.13, because sec-policy/selinux-base
PYTHON_COMPAT is still on at most 3.12.

Note that this change still allows python 3.11 in PYTHON_TARGETS for a
transition period. Otherwise the SDK builds do not go past stage1. We
only restrict generic images to 3.12 only, otherwise we would end up
with two python version installed in sysext images.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
We only allow one version of Python in the SDK and generic images, but
this creates a friction during the SDK build where the seed still has
an old version of Python and the stage1 is supposed to have the new
one, and thus we end up with slot conflicts for python packages - I
don't really understand what is going on (there are python packages in
the seed image that are built for old Python and emerge wants to
install the same packages in the seed but built for the new Python and
it can't work its way around it.)

Allowing both versions of Python to coexist in stage1 seems to be
moving things forward. Stage3 image (stage2 is skipped) will contain
only the new version of Python.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
@krnowak krnowak marked this pull request as ready for review January 19, 2026 11:24
@krnowak krnowak requested a review from a team as a code owner January 19, 2026 11:24
@krnowak krnowak added the main label Jan 19, 2026
@krnowak krnowak moved this to ✅ Testing / in Review in Flatcar tactical, release planning, and roadmap Jan 19, 2026
@krnowak
Copy link
Member Author

krnowak commented Jan 19, 2026

CI passed on all platforms except qemu_uefi_secure (which seems to be generally borked).

Copy link
Contributor

@chewi chewi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well done on getting there in the end. I'd have looked more closely at SELinux, but I guess we can bump again soon. It's not clear why perfinion hasn't bumped it already. Gentoo #952707.

Comment on lines +14 to +15
PYTHON_SINGLE_TARGET="-pypy3_11 -python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
PYTHON_TARGETS="-pypy3_11 -python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not this? It implies -python* python3_12.

Suggested change
PYTHON_SINGLE_TARGET="-pypy3_11 -python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
PYTHON_TARGETS="-pypy3_11 -python3_11 python3_12 -python3_13 -python3_14 -python3_13t -python3_14t"
PYTHON_SINGLE_TARGET="python3_12"
PYTHON_TARGETS="python3_12"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Testing / in Review

Development

Successfully merging this pull request may close these issues.

3 participants