Python 3.8 EOL approaching

[davidhewitt]

Let's discuss the upcoming end of life for Python 3.8. Are we ready to drop support for it in PyO3?

cc @alex - what's the status of 3.8 (and 3.7 still) in cryptography?

I think potentially even if we do not drop CPython 3.7 and 3.8, I would like to drop PyPy 3.7 and 3.8 in 0.23. PyPy has not supported either of those for a while and they are causing flakiness in our CI.

[alex]

cc: @reaperhulk

To be precise, the status is: 😭 😭 😭

We continue to see very high levels of 3.7 usage, overwhelmingly driven by Amazon Linux 2, which exits support next year.

Nevertheless, in our next release we're starting to emit a warning on 3.7, warning users that support will be dropped in the future. This is the first step to dropping it. (The next steps would be: Declaring a final release with 3.7 support which emits a definitive warning, and then the next release after that will drop support.)

As a result of that sadness, we haven't begun looking at 3.8 yet. From looking at https://pypistats.org/packages/cryptography, it looks like it's still 15% of our downloads, and thus we have a ways to go before we drop support. We could probably estimate when we think usage is likely to drop based on reviewing which Linux distributions ship with 3.8 and when those distributions go EOL.

The one good piece of news I can share is that we have no problems dropping older PyPys, we more or less only support versions of PyPy that have current support from them, which is to say we currently only test or produce wheels for PyPy 3.10.