Add new ssh key argument and don't check magic number in old versions

Author: pablogsal

release.py

@@ -60,6 +60,9 @@ def get(self, key: Literal["auth_info"], default: str | None = None) -> str: ...
     @overload
     def get(self, key: Literal["ssh_user"], default: str | None = None) -> str: ...
 
+    @overload
+    def get(self, key: Literal["ssh_key"], default: str | None = None) -> str | None: ...
+
     @overload
     def get(self, key: Literal["sign_gpg"], default: bool | None = None) -> bool: ...
 
@@ -84,6 +87,9 @@ def __getitem__(self, key: Literal["auth_info"]) -> str: ...
     @overload
     def __getitem__(self, key: Literal["ssh_user"]) -> str: ...
 
+    @overload
+    def __getitem__(self, key: Literal["ssh_key"]) -> str | None: ...
+
     @overload
     def __getitem__(self, key: Literal["sign_gpg"]) -> bool: ...
 
@@ -110,6 +116,9 @@ def __setitem__(self, key: Literal["auth_info"], value: str) -> None: ...
     @overload
     def __setitem__(self, key: Literal["ssh_user"], value: str) -> None: ...
 
+    @overload
+    def __setitem__(self, key: Literal["ssh_key"], value: str | None) -> None: ...
+
     @overload
     def __setitem__(self, key: Literal["sign_gpg"], value: bool) -> None: ...
 

run_release.py

@@ -193,6 +193,7 @@ def __init__(
         api_key: str,
         ssh_user: str,
         sign_gpg: bool,
+        ssh_key: str | None = None,
         first_state: Task | None = None,
     ) -> None:
         self.tasks = tasks
@@ -215,6 +216,8 @@ def __init__(
             self.db["auth_info"] = api_key
         if not self.db.get("ssh_user"):
             self.db["ssh_user"] = ssh_user
+        if not self.db.get("ssh_key"):
+            self.db["ssh_key"] = ssh_key
         if not self.db.get("sign_gpg"):
             self.db["sign_gpg"] = sign_gpg
 
@@ -227,6 +230,7 @@ def __init__(
         print(f"- Normalized release tag: {release_tag.normalized()}")
         print(f"- Git repo: {self.db['git_repo']}")
         print(f"- SSH username: {self.db['ssh_user']}")
+        print(f"- SSH key: {self.db['ssh_key'] or 'Default'}")
         print(f"- python.org API key: {self.db['auth_info']}")
         print(f"- Sign with GPG: {self.db['sign_gpg']}")
         print()
@@ -313,17 +317,17 @@ def check_ssh_connection(db: ReleaseShelf) -> None:
     client = paramiko.SSHClient()
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.WarningPolicy)
-    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"])
+    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"], key_filename=db["ssh_key"])
     client.exec_command("pwd")
-    client.connect(DOCS_SERVER, port=22, username=db["ssh_user"])
+    client.connect(DOCS_SERVER, port=22, username=db["ssh_user"], key_filename=db["ssh_key"])
     client.exec_command("pwd")
 
 
 def check_sigstore_client(db: ReleaseShelf) -> None:
     client = paramiko.SSHClient()
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.WarningPolicy)
-    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"])
+    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"], key_filename=db["ssh_key"])
     _, stdout, _ = client.exec_command("python3 -m sigstore --version")
     sigstore_version = stdout.read(1000).decode()
     sigstore_vermatch = re.match("^sigstore ([0-9.]+)", sigstore_version)
@@ -398,6 +402,9 @@ def check_cpython_repo_is_clean(db: ReleaseShelf) -> None:
 
 def check_magic_number(db: ReleaseShelf) -> None:
     release_tag = db["release"]
+    if release_tag.major == 3 and release_tag.minor <= 13:
+        return
+
     if release_tag.is_final or release_tag.is_release_candidate:
 
         def out(msg: str) -> None:
@@ -623,7 +630,7 @@ def sign_source_artifacts(db: ReleaseShelf) -> None:
 
         subprocess.check_call(
             [
-                "python3",
+                sys.executable,
                 "-m",
                 "sigstore",
                 "sign",
@@ -692,7 +699,7 @@ def upload_files_to_server(db: ReleaseShelf, server: str) -> None:
     client = paramiko.SSHClient()
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.WarningPolicy)
-    client.connect(server, port=22, username=db["ssh_user"])
+    client.connect(server, port=22, username=db["ssh_user"], key_filename=db["ssh_key"])
     transport = client.get_transport()
     assert transport is not None, f"SSH transport to {server} is None"
 
@@ -737,7 +744,7 @@ def place_files_in_download_folder(db: ReleaseShelf) -> None:
     client = paramiko.SSHClient()
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.WarningPolicy)
-    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"])
+    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"], key_filename=db["ssh_key"])
     transport = client.get_transport()
     assert transport is not None, f"SSH transport to {DOWNLOADS_SERVER} is None"
 
@@ -788,7 +795,7 @@ def unpack_docs_in_the_docs_server(db: ReleaseShelf) -> None:
     client = paramiko.SSHClient()
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.WarningPolicy)
-    client.connect(DOCS_SERVER, port=22, username=db["ssh_user"])
+    client.connect(DOCS_SERVER, port=22, username=db["ssh_user"], key_filename=db["ssh_key"])
     transport = client.get_transport()
     assert transport is not None, f"SSH transport to {DOCS_SERVER} is None"
 
@@ -905,7 +912,7 @@ def wait_until_all_files_are_in_folder(db: ReleaseShelf) -> None:
     client = paramiko.SSHClient()
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.WarningPolicy)
-    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"])
+    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"], key_filename=db["ssh_key"])
     ftp_client = client.open_sftp()
 
     destination = f"/srv/www.python.org/ftp/python/{db['release'].normalized()}"
@@ -943,7 +950,7 @@ def run_add_to_python_dot_org(db: ReleaseShelf) -> None:
     client = paramiko.SSHClient()
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.WarningPolicy)
-    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"])
+    client.connect(DOWNLOADS_SERVER, port=22, username=db["ssh_user"], key_filename=db["ssh_key"])
     transport = client.get_transport()
     assert transport is not None, f"SSH transport to {DOWNLOADS_SERVER} is None"
 
@@ -1259,6 +1266,13 @@ def _api_key(api_key: str) -> str:
         help="Username to be used when authenticating via ssh",
         type=str,
     )
+    parser.add_argument(
+        "--ssh-key",
+        dest="ssh_key",
+        default=None,
+        help="Path to the SSH key file to use for authentication",
+        type=str,
+    )
     args = parser.parse_args()
 
     auth_key = args.auth_key or os.getenv("AUTH_INFO")
@@ -1353,6 +1367,7 @@ def _api_key(api_key: str) -> str:
         api_key=auth_key,
         ssh_user=args.ssh_user,
         sign_gpg=not no_gpg,
+        ssh_key=args.ssh_key,
         tasks=tasks,
     )
     automata.run()