PEP 101 – Doing Python Releases 101 | peps.python.org Following system colour scheme Selected dark colour scheme Selected light colour scheme

Python Enhancement Proposals

• Python »
• PEP Index »
• PEP 101

Toggle light / dark / auto colour theme PEP 101 – Doing Python Releases 101

PEP 101 – Doing Python Releases 101

Author: Barry Warsaw <barry at python.org>, Guido van Rossum <guido at python.org> Status: Active Type: Informational Created: 22-Aug-2001 Post-History:

Replaces: 102 Table of Contents

• Abstract
• Things You’ll Need
• Types of Releases
• How To Make A Release
• What Next?
• Moving to End-of-life
• Windows Notes
• Copyright

Abstract

Making a Python release is a thrilling and crazy process. You’ve heard the expression “herding cats”? Imagine trying to also saddle those purring little creatures up, and ride them into town, with some of their buddies firmly attached to your bare back, anchored by newly sharpened claws. At least they’re cute, you remind yourself.

Actually, no, that’s a slight exaggeration 😉 The Python release process has steadily improved over the years and now, with the help of our amazing community, is really not too difficult. This PEP attempts to collect, in one place, all the steps needed to make a Python release. Most of the steps are now automated or guided by automation, so manually following this list is no longer necessary.

Things You’ll Need

As a release manager there are a lot of resources you’ll need to access. Here’s a hopefully-complete list.

• A GPG key.

  Python releases before 3.14 are digitally signed with GPG; for these you’ll need a key, which hopefully will be on the “web of trust” with at least one of the other release managers.

  Note

  GPG instructions in this PEP can be ignored for Python 3.14 and later. See PEP 761 for details.

• A bunch of software:
  • A checkout of the python/release-tools repo. It contains a requirements.txt file that you need to install dependencies from first. Afterwards, you can fire up scripts in the repo, covered later in this PEP.
  • blurb, the Misc/NEWS management tool. You can pip install it.
• Access to servers where you will upload files:
  • downloads.nyc1.psf.io, the server that hosts download files; and
  • docs.nyc1.psf.io, the server that hosts the documentation.
• Administrator access to python/cpython and membership of the Release Managers team.
• An administrator account on www.python.org, including an “API key”.
• Write access to the python/peps repository.

  If you’re reading this, you probably already have this–the first task of any release manager is to draft the release schedule. But in case you just signed up… sucker! I mean, uh, congratulations!

• A subscription to the super secret release manager mailing list, which may or may not be called python-cabal. Bug Barry about this.
• A @python.org email address that you will use to sign your releases with. Ask postmaster@ for an address; you can either get a full account, or a redirecting alias + SMTP credentials to send email from this address that looks legit to major email providers.
• Be added to the Python Security Response Team.

Types of Releases

There are several types of releases you will need to make. These include:

• alpha
• begin beta, also known as beta 1, also known as new branch
• beta 2+
• release candidate 1
• release candidate 2+
• final
• new branch
• begin bugfix mode
• begin security-only mode
• end-of-life

Some of these release types actually involve more than one release branch. In particular, a new branch is that point in the release cycle when a new feature release cycle begins. Under the current organization of the CPython Git repository, the main branch is always the target for new features. At some point in the release cycle of the next feature release, a new branch release is made which creates a new separate branch for stabilization and later maintenance of the current in-progress feature release (3.n.0) and the main branch is modified to build a new version (which will eventually be released as 3.n+1.0). While the new branch release step could occur at one of several points in the release cycle, current practice is for it to occur at feature code cutoff for the release which is scheduled for the first beta release.

In the descriptions that follow, steps specific to release types are labeled accordingly, for now, new branch and final.

How To Make A Release

Here are the steps taken to make a Python release. Some steps are more fuzzy than others because there’s little that can be automated (e.g. writing the NEWS entries). Where a step is usually performed by An Expert, the role of that expert is given. Otherwise, assume the step is done by the Release Manager (RM), the designated person performing the release. The roles and their current experts are:

• RM = Release Manager
  • Savannah Ostrowski <savannah@python.org> (US)
  • Hugo van Kemenade <hugo@python.org> (FI)
  • Thomas Wouters <thomas@python.org> (NL)
  • Pablo Galindo Salgado <pablogsal@python.org> (UK)
• WE = Windows - Steve Dower <steve.dower@python.org>
• ME = Mac - Ned Deily <nad@python.org> (US)

We use the following conventions in the examples below. Where a release number is given, it is of the form 3.X.YaN, e.g. 3.13.0a3 for Python 3.13.0 alpha 3, where “a” == alpha, “b” == beta, “rc” == release candidate.

Release tags are named v3.X.YaN. The branch name for minor release maintenance branches is 3.X.

As much as possible, the release is automated and guided by the run_release.py script, which is available in a separate repository: python/release-tools. This helps by automating many of the following steps, and guides you to perform some manual steps.

• Log into Discord and join the Python Core Devs server. Ask another RM for an invite.

  You probably need to coordinate with other people around the world. This communication channel is where we’ve arranged to meet.

• Check to see if there are any showstopper bugs.

  Go to https://github.com/python/cpython/issues and look for any open bugs that can block this release. You’re looking at two relevant labels:

  release-blockerStops the release dead in its tracks. You may not make any release with any open release blocker bugs. deferred-blockerDoesn’t block this release, but it will block a future release. You may not make a final or candidate release with any open deferred blocker bugs.

  Review the release blockers and either resolve them, bump them down to deferred, or stop the release and ask for community assistance. If you’re making a final or candidate release, do the same with any open deferred.

• Check the stable buildbots.

  Go to https://buildbot.python.org/all/#/release_status

  Look at the buildbots for the release you’re making. Ignore any that are offline (or inform the community so they can be restarted). If what remains are (mostly) green buildbots, you’re good to go. If you have non-offline red buildbots, you may want to hold up the release until they are fixed. Review the problems and use your judgement, taking into account whether you are making an alpha, beta, or final release.

• Make a release clone.

  On a fork of the CPython repository on GitHub, create a release branch within it (called the “release clone” from now on). You can use the same GitHub fork you use for CPython development. Using the standard setup recommended in the Python Developer’s Guide, your fork would be referred to as origin and the standard CPython repo as upstream. You will use the branch on your fork to do the release engineering work, including tagging the release, and you will use it to share with the other experts for making the binaries.

  For a final or release candidate 2+ release, if you are going to cherry-pick a subset of changes for the next rc or final from all those merged since the last rc, you should create a release engineering branch starting from the most recent release candidate tag, i.e. v3.8.0rc1. You will then cherry-pick changes from the standard release branch as necessary into the release engineering branch and then proceed as usual. If you are going to take all of the changes since the previous rc, you can proceed as normal.

• Make sure the current branch of your release clone is the branch you want to release from (git status).
• Run blurb release <version> specifying the version number (e.g. blurb release 3.4.7rc1). This merges all the recent news blurbs into a single file marked with this release’s version number.
• Regenerate Lib/pydoc-topics.py.

  While still in the Doc directory, run:

  make pydoc-topics cp build/pydoc-topics/topics.py ../Lib/pydoc_data/topics.py
• Commit your changes to pydoc_topics.py (and any fixes you made in the docs).
• Consider running autoconf using the currently accepted standard version in case configure or other Autoconf-generated files were last committed with a newer or older version and may contain spurious or harmful differences. Currently, Autoconf 2.71 is our de facto standard. if there are differences, commit them.
• Make sure the SOURCE_URI in Doc/tools/extensions/pyspecific.py points to the right branch in the Git repository (main or 3.X). For a new branch release, change the branch in the file from main to the new release branch you are about to create (3.X).
• Bump version numbers via the release script:
  .../release-tools/release.py --bump 3.X.YaN

  Reminder: X, Y, and N should be integers. a should be one of a, b, or rc (e.g. 3.4.3rc1). For final releases omit the aN (3.4.3). For the first release of a new version Y should be 0 (3.6.0).

  This automates updating various release numbers, but you will have to modify a few files manually. If your $EDITOR environment variable is set up correctly, release.py will pop up editor windows with the files you need to edit.

  Review the blurb-generated Misc/NEWS file and edit as necessary.

• Make sure all changes have been committed. (release.py --bump doesn’t check in its changes for you.)
• For a final major release, edit the first paragraph of Doc/whatsnew/3.X.rst to include the actual release date; e.g. “Python 2.5 was released on August 1, 2003.” There’s no need to edit this for alpha or beta releases.
• Do a git status in this directory.

  You should not see any files, i.e., you better not have any uncommitted changes in your working directory.

• Tag the release for 3.X.YaN:
  .../release-tools/release.py --tag 3.X.YaN

  This executes a git tag command with the -s option so that the release tag in the repo is signed with your GPG key. When prompted choose the private key you use for signing release tarballs etc.

• For begin security-only mode and end-of-life releases, review the two files and update the versions accordingly in all active branches.
• Push your commits to the remote release branch in your GitHub fork:
  # Do a dry run first. git push --dry-run --tags origin # Make sure you are pushing to your GitHub fork, # *not* to the main python/cpython repo! git push --tags origin
• In python/release-tools, go to the build-release workflow, select “Run workflow”, and enter the details of the tag you just created. This will perform the following steps:
  • Create the source gzip and xz tarballs.
  • Create the documentation tar and zip files.
  • Check the source tarball to make sure a completely clean, virgin build passes the regression test.
  • Build and test the binaries for platforms which don’t require an expert.

  The resulting artifacts will be attached to the summary page of the GitHub workflow. Once the source tarball is available, download and unpack it to make sure things look reasonable, there are no stray .pyc files, etc.

  If the tests pass, then you can feel good that the tarball is fine. If some of the tests fail, or anything else about the freshly unpacked directory looks weird, you better stop now and figure out what the problem is.

• Notify the experts that they can start building binaries.

• The WE generates and publishes the Windows files using the Azure Pipelines build scripts in .azure-pipelines/windows-release/, currently set up at https://dev.azure.com/Python/cpython/_build?definitionId=21.

  The build process runs in multiple stages, with each stage’s output being available as a downloadable artifact. The stages are:

  • Compile all variants of binaries (32-bit, 64-bit, debug/release), including running profile-guided optimization.
  • Codesign all the binaries with the PSF’s certificate.
  • Create packages for python.org, nuget.org, the embeddable distro and the Windows Store.
  • Perform basic verification of the installers.
  • Upload packages to python.org and nuget.org, purge download caches and run a test download.

  After the uploads are complete, the WE copies the generated hashes from the build logs and emails them to the RM. The Windows Store packages are uploaded manually to https://partner.microsoft.com/dashboard/home by the WE.

• The ME builds Mac installer packages and uploads them to downloads.nyc1.psf.io together with GPG signature files.
• scp or rsync all the files built by the build-release workflow to your home directory on downloads.nyc1.psf.io, along with any signatures, SBOMs, etc.

  While you’re waiting for the files to finish uploading, you can continue on with the remaining tasks. You can also ask folks on Discord and/or discuss.python.org to download the files as they finish uploading so that they can test them on their platforms as well.

• Now you need to go to downloads.nyc1.psf.io and move all the files in place over there. Our policy is that every Python version gets its own directory, but each directory contains all releases of that version.
  • On downloads.nyc1.psf.io, cd /srv/www.python.org/ftp/python/3.X.Y creating it if necessary. Make sure it is owned by group downloads and group-writable.
  • Take the files you uploaded to your home directory above, and move them into the release directory. The Win/Mac binaries are usually put there by the experts themselves.

    Make sure they are world readable. They should also be group writable, and group-owned by downloads.

  • Use gpg --verify to make sure they got uploaded intact.
  • If this is a final or rc release: Move the doc zips and tarballs to /srv/www.python.org/ftp/python/doc/3.X.Y[rcA], creating the directory if necessary, and adapt the “current” symlink in .../doc to point to that directory. Note though that if you’re releasing a maintenance release for an older version, don’t change the current link.
  • If this is a final or rc release (even a maintenance release), also unpack the HTML docs to /srv/docs.python.org/release/3.X.Y[rcA] on docs.nyc1.psf.io. Make sure the files are in group docs and are group-writeable.
  • Note both the documentation and downloads are behind a caching CDN. If you change archives after downloading them through the website, you’ll need to purge the stale data in the CDN like this:
    curl -X PURGE https://www.python.org/ftp/python/3.12.0/Python-3.12.0.tar.xz

    You should always purge the cache of the directory listing as people use that to browse the release files:

    curl -X PURGE https://www.python.org/ftp/python/3.12.0/
• For the extra paranoid, do a completely clean test of the release. This includes downloading the tarball from www.python.org.

  Make sure the md5 checksums match. Then unpack the tarball, and do a clean make test:

  make distclean ./configure make test

  To ensure that the regression test suite passes. If not, you screwed up somewhere!

If green, it’s time to merge the release engineering branch back into the main repo.

• In order to push your changes to GitHub, you’ll have to temporarily disable branch protection for administrators. Go to the Settings | Branches page:

  https://github.com/python/cpython/settings/branches

  “Edit” the settings for the branch you’re releasing on. This will load the settings page for that branch. Uncheck the “Include administrators” box and press the “Save changes” button at the bottom.

• Merge your release clone into the main development repo:
  # Pristine copy of the upstream repo branch git clone git@github.com:python/cpython.git merge cd merge # Checkout the correct branch: # 1. For feature pre-releases up to and including a # **new branch** release, i.e. alphas and first beta # do a checkout of the main branch git checkout main # 2. Else, for all other releases, checkout the # appropriate release branch. git checkout 3.X # Fetch the newly created and signed tag from your clone repo git fetch --tags git@github.com:your-github-id/cpython.git v3.X.YaN # Merge the temporary release engineering branch back into git merge --no-squash v3.X.YaN git commit -m 'Merge release engineering branch'
• If this is a new branch release, i.e. first beta, now create the new release branch:
  git checkout -b 3.X

  Do any steps needed to setup the new release branch, including:

  • In README.rst, change all references from main to the new branch, in particular, GitHub repo URLs.
• For all releases, do the guided post-release steps with the release script:
  .../release-tools/release.py --done 3.X.YaN
• For a final or release candidate 2+ release, you may need to do some post-merge cleanup. Check the top-level README.rst and include/patchlevel.h files to ensure they now reflect the desired post-release values for on-going development. The patchlevel should be the release tag with a +dev. Also, if you cherry-picked changes from the standard release branch into the release engineering branch for this release, you will now need to manually remove each blurb entry from the Misc/NEWS.d/next directory that was cherry-picked into the release you are working on since that blurb entry is now captured in the merged x.y.z.rst file for the new release. Otherwise, the blurb entry will appear twice in the changelog.html file, once under Python next and again under x.y.z.
• Review and commit these changes:
  git commit -m 'Post release updates'
• If this is a new branch release (e.g. the first beta), update the main branch to start development for the following feature release. When finished, the main branch will now build Python X.Y+1.
  • First, set main up to be the next release, i.e. X.Y+1.a0:
    git checkout main .../release-tools/release.py --bump 3.9.0a0
  • Edit all version references in README.rst
  • Edit Doc/tutorial/interpreter.rst (two references to ‘[Pp]ython3x’, one to ‘Python 3.x’, also make the date in the banner consistent).
  • Edit Doc/tutorial/stdlib.rst and Doc/tutorial/stdlib2.rst, which have each one reference to ‘[Pp]ython3x’.
  • Add a new whatsnew/3.x.rst file (with the comment near the top and the toplevel sections copied from the previous file) and add it to the toctree in whatsnew/index.rst. But beware that the initial whatsnew/3.x.rst checkin from previous releases may be incorrect due to the initial midstream change to blurb that propagates from release to release! Help break the cycle: if necessary make the following change:
    -For full details, see the :source:`Misc/NEWS` file. +For full details, see the :ref:`changelog <changelog>`.
  • Update the version number in configure.ac and re-run autoconf.
  • Make sure the SOURCE_URI in Doc/tools/extensions/pyspecific.py points to main.
  • Update the version numbers for the Windows builds which have references to python38:
    ls PC/pyconfig.h.in PCbuild/rt.bat | xargs sed -i 's/python3\(\.\?\)[0-9]\+/python3\19/g'
  • Edit the bug.yml and crash.yml issue templates in .github/ISSUE_TEMPLATE/ to add the new branch to the “versions” dropdown.
  • Commit these changes to the main branch:
    git status git add ... git commit -m 'Bump to 3.9.0a0'
• Do another git status in this directory.

  You should not see any files, i.e., you better not have any uncommitted changes in your working directory.

• Commit and push to the main repo:
  # Do a dry run first. # For feature pre-releases prior to a **new branch** release, # i.e. a feature alpha release: git push --dry-run --tags git@github.com:python/cpython.git main # If it looks OK, take the plunge. There's no going back! git push --tags git@github.com:python/cpython.git main # For a **new branch** release, i.e. first beta: git push --dry-run --tags git@github.com:python/cpython.git 3.X git push --dry-run --tags git@github.com:python/cpython.git main # If it looks OK, take the plunge. There's no going back! git push --tags git@github.com:python/cpython.git 3.X git push --tags git@github.com:python/cpython.git main # For all other releases: git push --dry-run --tags git@github.com:python/cpython.git 3.X # If it looks OK, take the plunge. There's no going back! git push --tags git@github.com:python/cpython.git 3.X
• If this is a new branch release, add a Branch protection rule for the newly created branch (3.X). Look at the values for the previous release branch (3.X-1) and use them as a template. https://github.com/python/cpython/settings/branches

  Also, add 3.x and needs backport to 3.X labels to the GitHub repo. https://github.com/python/cpython/labels

• You can now re-enable enforcement of branch settings against administrators on GitHub. Go back to the Settings | Branch page:

  https://github.com/python/cpython/settings/branches

  “Edit” the settings for the branch you’re releasing on. Re-check the “Include administrators” box and press the “Save changes” button at the bottom.

Now it’s time to twiddle the website. Almost none of this is automated, sorry.

To do these steps, you must have the permission to edit the website. If you don’t have that, ask someone on pydotorg@python.org for the proper permissions.

• Log in to https://www.python.org/admin
• Create a new “release” for the release. Currently “Releases” are sorted under “Downloads”.

  The easiest thing is probably to copy fields from an existing Python release “page”, editing as you go.

  You can use Markdown or reStructured Text to describe your release. The former is less verbose, while the latter has nifty integration for things like referencing PEPs.

  Leave the “Release page” field on the form empty.

• “Save” the release.
• Populate the release with the downloadable files.

  Your friend and mine, Georg Brandl, made a lovely tool called add_to_pydotorg.py. You can find it in the python/release-tools repo (next to release.py). You run the tool on downloads.nyc1.psf.io, like this:

  AUTH_INFO=<username>:<python.org-api-key> python add_to_pydotorg.py <version>

  This walks the correct download directory for <version>, looks for files marked with <version>, and populates the “Release Files” for the correct “release” on the web site with these files. Note that clears the “Release Files” for the relevant version each time it’s run. You may run it from any directory you like, and you can run it as many times as you like if the files happen to change. Keep a copy in your home directory on dl-files and keep it fresh.

  If new types of files are added to the release, someone will need to update add_to_pydotorg.py so it recognizes these new files. (It’s best to update add_to_pydotorg.py when file types are removed, too.)

  The script will also sign any remaining files that were not signed with Sigstore until this point. Again, if this happens, do use your @python.org address for this process. More info: https://www.python.org/downloads/metadata/sigstore/

• In case the CDN already cached a version of the Downloads page without the files present, you can invalidate the cache using:
  curl -X PURGE https://www.python.org/downloads/release/python-XXX/
• Write the announcement on discuss.python.org. This is the fuzzy bit because not much can be automated. You can use an earlier announcement as a template, but edit it for content!
• Also post the announcement to the Python Insider blog. To add a new entry, go to python/python-insider-blog.
• Update release PEPs (e.g. 719) with the release dates.
• Update the labels on https://github.com/python/cpython/issues:
  • Flip all the deferred-blocker issues back to release-blocker for the next release.
  • Review open issues, as this might find lurking showstopper bugs, besides reminding people to fix the easy ones they forgot about.
• You can delete the remote release clone branch from your repo clone.
• If this is a new branch release, you will need to ensure various pieces of the development infrastructure are updated for the new branch. These include:
  • Update the issue tracker for the new branch: add the new version to the versions list.
  • Update python-releases.toml to reflect the new branches and versions.
  • Create a PR to update the supported releases table on the downloads page (see python/pythondotorg#1302).
  • Ensure buildbots are defined for the new branch (contact Łukasz or Zach Ware).
  • Ensure the various GitHub bots are updated, as needed, for the new branch. In particular, make sure backporting to the new branch works (contact the core-workflow team).
  • Review the most recent commit history for the main and new release branches to identify and backport any merges that might have been made to the main branch during the release engineering phase and that should be in the release branch.
  • Verify that CI is working for new PRs for the main and new release branches and that the release branch is properly protected (no direct pushes, etc).
  • Verify that the online docs are building properly (this may take up to 24 hours for a complete build on the website).

What Next?

• Verify! Pretend you’re a user: download the files from www.python.org, and make Python from it. This step is too easy to overlook, and on several occasions we’ve had useless release files. Once a general server problem caused mysterious corruption of all files; once the source tarball got built incorrectly; more than once the file upload process on SF truncated files; and so on.
• Rejoice. Drink. Be Merry. Write a PEP like this one. Or be like unto Guido and take A Vacation.

You’ve just made a Python release!

Moving to End-of-life

Under current policy, a release branch normally reaches end-of-life status five years after its initial release. The policy is discussed in more detail in the Python Developer’s Guide. When end-of-life is reached, there are a number of tasks that need to be performed either directly by you as release manager or by ensuring someone else does them. Some of those tasks include:

• Optionally making a final release to publish any remaining unreleased changes.
• Freeze the state of the release branch by creating a tag of its current HEAD and then deleting the branch from the CPython repo. The current HEAD should be at or beyond the final security release for the branch:
  git fetch upstream git tag --sign -m 'Final head of the former 3.3 branch' 3.3 upstream/3.3 git push upstream refs/tags/3.3
• If all looks good, delete the branch. This may require the assistance of someone with repo administrator privileges:
  git push upstream --delete 3.3 # or perform from GitHub Settings page
• In python-releases.toml, set the branch status to end-of-life.
• Update or remove references to the branch in the developer’s guide.
• Retire the release from the issue tracker. Tasks include:
  • update issues from this version to the next supported version
  • remove version label from list of versions
  • remove the needs backport to label for the retired version
  • review and dispose of open issues marked for this branch
• Run a final build of the online docs to add the end-of-life banner
• Announce the branch retirement in the usual places:
  • discuss.python.org
  • Python Insider blog
• Enjoy your retirement and bask in the glow of a job well done!

Windows Notes

Windows has a MSI installer, various flavors of Windows have “special limitations”, and the Windows installer also packs precompiled “foreign” binaries (Tcl/Tk, expat, etc).

The installer is tested as part of the Azure Pipeline. In the past, those steps were performed manually. We’re keeping this for posterity.

Concurrent with uploading the installer, the WE installs Python from it twice: once into the default directory suggested by the installer, and later into a directory with embedded spaces in its name. For each installation, the WE runs the full regression suite from a DOS box, and both with and without -0. For maintenance release, the WE also tests whether upgrade installations succeed.

The WE also tries every shortcut created under Start -> Menu -> the Python group. When trying IDLE this way, you need to verify that Help -> Python Documentation works. When trying pydoc this way (the “Module Docs” Start menu entry), make sure the “Start Browser” button works, and make sure you can search for a random module (like “random” <wink>) and then that the “go to selected” button works.

It’s amazing how much can go wrong here – and even more amazing how often last-second checkins break one of these things. If you’re “the Windows geek”, keep in mind that you’re likely the only person routinely testing on Windows, and that Windows is simply a mess.

Repeat the testing for each target architecture. Try both an Admin and a plain User (not Power User) account.

Copyright

This document has been placed in the public domain.

Contents

• Abstract
• Things You’ll Need
• Types of Releases
• How To Make A Release
• What Next?
• Moving to End-of-life
• Windows Notes
• Copyright

Page Source (GitHub)

Source: https://github.com/python/peps/blob/main/peps/pep-0101.rst

Last modified: 2026-05-27 15:23:08 UTC