v3.1.0 fails on windows

[TLCFEM]

See:

https://github.com/TLCFEM/suanPan/actions/runs/18810757760/job/53671556828

Run sigstore/gh-action-sigstore-python@v3.1.0
  with:
    inputs: build/dist/bin/*.exe
    staging: false
    verify: false
    upload-signing-artifacts: false
    release-signing-artifacts: true
    internal-be-careful-debug: false
  env:
    SP_TIME: 251026
    ARTIFACT: suanPan-win-gcc-debug-openblas-251026.zip
Run # NOTE: Sourced, not executed as a script.
Collecting annotated-types==0.7.0
  Downloading annotated_types-0.7.0-py3-none-any.whl (13 kB)
Collecting certifi==2025.10.5
  Downloading certifi-2025.10.5-py3-none-any.whl (163 kB)
     -------------------------------------- 163.3/163.3 KB 4.9 MB/s eta 0:00:00
Collecting cffi==2.0.0
  Downloading cffi-2.0.0-cp39-cp39-win_amd64.whl (182 kB)
     ------------------------------------- 182.8/182.8 KB 10.8 MB/s eta 0:00:00
Collecting charset-normalizer==3.4.4
  Downloading charset_normalizer-3.4.4-cp39-cp39-win_amd64.whl (107 kB)
     ---------------------------------------- 107.2/107.2 KB ? eta 0:00:00
Collecting cryptography==46.0.3
  Downloading cryptography-46.0.3-cp38-abi3-win_amd64.whl (3.5 MB)
     ---------------------------------------- 3.5/3.5 MB 56.3 MB/s eta 0:00:00
ERROR: Could not find a version that satisfies the requirement dnspython==2.8.0 (from versions: 1.11.0, 1.11.1, 1.12.0, 1.13.0, 1.14.0, 1.15.0, 1.16.0, 2.0.0rc1, 2.0.0rc2, 2.0.0, 2.1.0rc1, 2.1.0, 2.2.0rc1, 2.2.0, 2.2.1, 2.3.0rc1, 2.3.0, 2.4.0rc1, 2.4.0, 2.4.1, 2.4.2, 2.5.0rc1, 2.5.0, 2.6.0rc1, 2.6.0, 2.6.1, 2.7.0rc1, 2.7.0)
ERROR: No matching distribution found for dnspython==2.8.0
WARNING: You are using pip version 22.0.4; however, version 25.3 is available.
You should consider upgrading via the 'D:\a\_actions\sigstore\gh-action-sigstore-python\v3.1.0\.action-env\Scripts\python.exe -m pip install --upgrade pip' command.

[woodruffw]

Thanks for reporting. Hmm, I don't really understand how this happened: dnspython has a universal wheel for 2.8.0:

https://pypi.org/project/dnspython/#files

[woodruffw]

Details: https://pypi.org/project/dnspython/#dnspython-2.8.0-py3-none-any.whl

[TLCFEM]

Maybe because the python shipped with windows-2022 is python 3.9.

https://github.com/actions/runner-images/blob/main/images/windows/Windows2022-Readme.md#language-and-runtime

[TLCFEM]

And dns-python==2.8.0 needs >3.10

[woodruffw]

Ah yeah, that would do it. Per your comment in #236, we should definitely be testing against a matrix of supported Python versions here.

(However, we'll probably also want to drop 3.9 given that it's almost EOL and our dependencies are beginning to move beyond it. I'll also need to update our setup check:

gh-action-sigstore-python/setup/setup.bash

Line 48 in 27dac9c

[[ "${maj_vers}" == "3" && "${min_vers}" -ge 9 ]] || die "Bad Python version: ${vers}"

)

[TLCFEM]

My two cents:

If python runtime is not bundled within this action, then it is probably better to be compatible with github runner images, it could be a hassle if downstreams users need to additionally setup a dedicated python environment to sign files.

If python runtime is bundled, it is probably more convenient to pack the script into a standalone binary with tools like pyinstaller, with which, there is no need to 1) test all os python version combinations and 2) pin dependencies.

[woodruffw]

I agree about runner compatibility, but the problem is that the runners themselves aren't always in sync with the Python version lifetimes: once Python 3.9 goes EOL our dependencies will begin breaking in ways that upstreams won't be willing to fix. Plus sigstore-python itself usually drops Python versions shortly after EOL, as a matter of policy.

(You're 100% right about including the runtime, though, IMO we should do that either via uv or setup-python. I'll look into that this week.)