Drop support for Python 3.10 (EOL)

.github/workflows/integration.yml

@@ -36,7 +36,7 @@ jobs:
       fail-fast: false # Don't cancel other jobs if one fails
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        python-version: ['3.11', '3.12', '3.13', '3.14']
     permissions:
       contents: read
     steps:

.github/workflows/unit_tests.yml

@@ -32,7 +32,7 @@ jobs:
       fail-fast: false # Don't cancel other jobs if one fails
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        python-version: ['3.11', '3.12', '3.13', '3.14']
     permissions:
       contents: read
     steps:

CHANGELOG.md

@@ -30,6 +30,7 @@ All versions prior to 1.0.0 are untracked.
 
 ### Removed
 - Removed Python 3.9 support due to it reaching EOL 2025-10-31 (https://devguide.python.org/versions/)
+- Removed Python 3.10 support due to it reaching EOL in October 2026 (https://devguide.python.org/versions/) ([#602](https://github.com/sigstore/model-transparency/issues/602))
 
 ## [1.1.1] - 2025-10-10
 

pyproject.toml

@@ -15,7 +15,6 @@ authors = [
 classifiers = [
   "Programming Language :: Python :: 3 :: Only",
   "Programming Language :: Python :: 3",
-  "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
@@ -37,7 +36,7 @@ dependencies = [
   "sigstore-models>=0.0.5",
   "typing_extensions",
 ]
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 keywords = [
   "machine learning",
   "artificial intelligence",
@@ -88,7 +87,7 @@ features = [
 ]
 
 [[tool.hatch.envs.hatch-test.matrix]]
-python = ["3.10", "3.11", "3.12", "3.13", "3.14"]
+python = ["3.11", "3.12", "3.13", "3.14"]
 
 [tool.hatch.envs.bench]
 description = """Custom environment for running benchmarks.
@@ -104,7 +103,7 @@ extra-dependencies = [
 ]
 
 [[tool.hatch.envs.bench.matrix]]
-python = ["3.10", "3.11", "3.12", "3.13", "3.14"]
+python = ["3.11", "3.12", "3.13", "3.14"]
 
 [tool.hatch.envs.bench.scripts]
 generate = "python benchmarks/generate.py {args}"

src/model_signing/_signing/sign_certificate.py

@@ -65,7 +65,7 @@ def __init__(
             signing_certificate_path.read_bytes()
         )
 
-        now = datetime.datetime.now(datetime.timezone.utc)
+        now = datetime.datetime.now(datetime.UTC)
         if now > self._signing_certificate.not_valid_after_utc:
             raise ValueError(
                 "Signing certificate has expired "

src/model_signing/_signing/sign_sigstore.py

@@ -15,8 +15,7 @@
 """Sigstore based signature, signers and verifiers."""
 
 import pathlib
-import sys
-from typing import cast
+from typing import Self, cast
 
 from google.protobuf import json_format
 from sigstore import dsse as sigstore_dsse
@@ -29,11 +28,6 @@
 from model_signing._signing import signing
 
 
-if sys.version_info >= (3, 11):
-    from typing import Self
-else:
-    from typing_extensions import Self
-
 _DEFAULT_CLIENT_ID = "sigstore"
 _DEFAULT_CLIENT_SECRET = ""
 

src/model_signing/_signing/sign_sigstore_pb.py

@@ -24,21 +24,14 @@
 import abc
 import json
 import pathlib
-import sys
-from typing import cast
+from typing import Self, cast
 
 from sigstore_models.bundle import v1 as bundle_pb
 from typing_extensions import override
 
 from model_signing._signing import signing
 
 
-if sys.version_info >= (3, 11):
-    from typing import Self
-else:
-    from typing_extensions import Self
-
-
 # The media type to use when creating the protobuf based Sigstore bundle
 _BUNDLE_MEDIA_TYPE: str = "application/vnd.dev.sigstore.bundle.v0.3+json"
 

src/model_signing/_signing/signing.py

@@ -39,8 +39,7 @@
 import abc
 import json
 import pathlib
-import sys
-from typing import Any
+from typing import Any, Self
 
 from in_toto_attestation.v1 import statement
 
@@ -49,12 +48,6 @@
 from model_signing._hashing import memory
 
 
-if sys.version_info >= (3, 11):
-    from typing import Self
-else:
-    from typing_extensions import Self
-
-
 # The expected in-toto payload type for the signature.
 _IN_TOTO_JSON_PAYLOAD_TYPE: str = "application/vnd.in-toto+json"
 

src/model_signing/hashing.py

@@ -50,8 +50,7 @@
 from collections.abc import Callable, Iterable
 import os
 import pathlib
-import sys
-from typing import Literal
+from typing import Literal, Self, TypeAlias
 
 import blake3
 
@@ -63,20 +62,9 @@
 from model_signing._serialization import file_shard
 
 
-if sys.version_info >= (3, 11):
-    from typing import Self
-else:
-    from typing_extensions import Self
-
-
-# `TypeAlias` only exists from Python 3.10
-# `TypeAlias` is deprecated in Python 3.12 in favor of `type`
-from typing import TypeAlias
-
-
 # Type alias to support `os.PathLike`, `str` and `bytes` objects in the API
-# When Python 3.12 is the minimum supported version we can use `type`
-# When Python 3.11 is the minimum supported version we can use `|`
+# `TypeAlias` is deprecated in Python 3.12 in favor of `type`, which we can use
+# once Python 3.12 is the minimum supported version
 PathLike: TypeAlias = str | bytes | os.PathLike
 
 

src/model_signing/manifest.py

@@ -42,20 +42,13 @@
 from collections.abc import Iterable, Iterator
 import dataclasses
 import pathlib
-import sys
-from typing import Any, Final
+from typing import Any, Final, Self
 
 from typing_extensions import override
 
 from model_signing._hashing import hashing
 
 
-if sys.version_info >= (3, 11):
-    from typing import Self
-else:
-    from typing_extensions import Self
-
-
 @dataclasses.dataclass(frozen=True, order=True)
 class _ResourceDescriptor:
     """A description of any content from any `Manifest`.

src/model_signing/signing.py

@@ -44,7 +44,7 @@
 
 from collections.abc import Iterable
 import pathlib
-import sys
+from typing import Self
 
 from model_signing import hashing
 from model_signing._signing import sign_certificate as certificate
@@ -53,12 +53,6 @@
 from model_signing._signing import signing
 
 
-if sys.version_info >= (3, 11):
-    from typing import Self
-else:
-    from typing_extensions import Self
-
-
 def sign(model_path: hashing.PathLike, signature_path: hashing.PathLike):
     """Signs a model using the default configuration.
 

src/model_signing/verifying.py

@@ -40,7 +40,7 @@
 from collections.abc import Iterable
 import copy
 import pathlib
-import sys
+from typing import Self
 
 from model_signing import hashing
 from model_signing import manifest
@@ -50,12 +50,6 @@
 from model_signing._signing import sign_sigstore_pb as sigstore_pb
 
 
-if sys.version_info >= (3, 11):
-    from typing import Self
-else:
-    from typing_extensions import Self
-
-
 class Config:
     """Configuration to use when verifying models against signatures.
 

tests/_signing/sigstore_test.py

@@ -16,7 +16,7 @@
 
 import json
 import pathlib
-import sys
+from typing import Self
 from unittest import mock
 
 import pytest
@@ -28,12 +28,6 @@
 from model_signing._signing import signing
 
 
-if sys.version_info >= (3, 11):
-    from typing import Self
-else:
-    from typing_extensions import Self
-
-
 class MockedSigstoreBundle:
     """Mocked sigstore bundle that just records the signed payload."""