What the developer wrote
Authored by SomberNight
build: bump python versions in binaries
note: 3.12 is in security-only status,
so can't bump win/mac binaries without switching to 3.13
(as we don't compile our own cpython for those)
we should bump those to at least 3.13...
What changed, and why it matters
This commit updates the Python versions used to build Electrum's Android, Linux AppImage, and host Python components. It moves Android and host Python from 3.11.14 to 3.11.15, and the Linux AppImage from 3.12.11 to 3.12.13. It also switches Android builds to download Python from the official python.org source instead of GitHub auto-generated archives. The commit message notes that Python 3.12 is now in 'security-only' status and Windows/Mac binaries should ideally move to 3.13. This is a routine maintenance/security-hardening build change, not a fix for an active exploit.
Verify the new SHA-512 and tar.xz hashes against official python.org published values before merging or releasing. Plan to bump Windows and macOS binaries to Python 3.13 as noted by the commit author, since 3.12 is in security-only support. No immediate user action is required.
Security signals we found
Routine Python interpreter version bump in build scripts
Switch Android Python source from GitHub auto-generated archives to signed python.org releases
Commit message explicitly references Python 3.12 security-only maintenance status
No changes to application code, cryptography, networking, or wallet logic
Evidence from the diff
The diff bumps pinned Python interpreter versions in build recipes and updates corresponding SHA-512/Tar.xz hashes. Android hostpython3 and python3 recipes move to CPython 3.11.15 and change the download URL template to https://www.python.org/ftp/python/{version}/Python-{version}.tgz. The Linux AppImage build script moves to CPython 3.12.13 and updates the verify_hash value. No application code, wallet logic, or network protocol handling is changed. The change reduces exposure to known CPython security bugs in the bundled interpreter and improves supply-chain trust by using signed official Python.org tarballs for Android.
Changed components
contrib/android/p4a_recipes/hostpython3/__init__.pycontrib/android/p4a_recipes/python3/__init__.pycontrib/build-linux/appimage/make_appimage.shInspect captured patch +12 / −6
diff --git a/contrib/android/p4a_recipes/hostpython3/__init__.py b/contrib/android/p4a_recipes/hostpython3/__init__.py
index a4a63d7..2bce6e8 100644
--- a/contrib/android/p4a_recipes/hostpython3/__init__.py
+++ b/contrib/android/p4a_recipes/hostpython3/__init__.py
@@ -12,8 +12,11 @@ assert HostPython3Recipe.python_depends == []
class HostPython3RecipePinned(util.InheritedRecipeMixin, HostPython3Recipe):
# PYTHON_VERSION= # < line here so that I can grep the codebase and teleport here
- version = "3.11.14"
- sha512sum = "4642f6d59c76c6e5dbd827fdb28694376a9cc76e513146d092b49afb41513b3c9dff2339cfcebfb5b260f5cdc49a59a69906e284e5d478b2189d3374e9e24fd5"
+ version = "3.11.15"
+ sha512sum = "d4b4d9c51412dca47f0259ad351d4630d4d26fccbbe1457cc8e2168a7b2cbbd43113c1b5a64efe62d0e81f81c31c6f28109696e8633bc0943ad4cb9eb9340bbb"
+
+ # use official releases from python.org that have sigs, instead of auto-generated archives from github
+ url = 'https://www.python.org/ftp/python/{version}/Python-{version}.tgz'
# this property overrides the default hostpython dependencies for PyProjectRecipe recipies
pyproject_base_dependencies = [
diff --git a/contrib/android/p4a_recipes/python3/__init__.py b/contrib/android/p4a_recipes/python3/__init__.py
index 11cf395..e42f347 100644
--- a/contrib/android/p4a_recipes/python3/__init__.py
+++ b/contrib/android/p4a_recipes/python3/__init__.py
@@ -12,8 +12,11 @@ assert Python3Recipe.python_depends == []
class Python3RecipePinned(util.InheritedRecipeMixin, Python3Recipe):
# PYTHON_VERSION= # < line here so that I can grep the codebase and teleport here
- version = "3.11.14"
- sha512sum = "4642f6d59c76c6e5dbd827fdb28694376a9cc76e513146d092b49afb41513b3c9dff2339cfcebfb5b260f5cdc49a59a69906e284e5d478b2189d3374e9e24fd5"
+ version = "3.11.15"
+ sha512sum = "d4b4d9c51412dca47f0259ad351d4630d4d26fccbbe1457cc8e2168a7b2cbbd43113c1b5a64efe62d0e81f81c31c6f28109696e8633bc0943ad4cb9eb9340bbb"
+
+ # use official releases from python.org that have sigs, instead of auto-generated archives from github
+ url = 'https://www.python.org/ftp/python/{version}/Python-{version}.tgz'
recipe = Python3RecipePinned()
diff --git a/contrib/build-linux/appimage/make_appimage.sh b/contrib/build-linux/appimage/make_appimage.sh
index f10ef52..fa52409 100755
--- a/contrib/build-linux/appimage/make_appimage.sh
+++ b/contrib/build-linux/appimage/make_appimage.sh
@@ -20,7 +20,7 @@ git -C "$PROJECT_ROOT" rev-parse 2>/dev/null || fail "Building outside a git clo
export GCC_STRIP_BINARIES="1"
# pinned versions
-PYTHON_VERSION=3.12.11
+PYTHON_VERSION=3.12.13
PY_VER_MAJOR="3.12" # as it appears in fs paths
PKG2APPIMAGE_COMMIT="a9c85b7e61a3a883f4a35c41c5decb5af88b6b5d"
@@ -44,7 +44,7 @@ verify_hash "$CACHEDIR/appimagetool" "46fdd785094c7f6e545b61afcfb0f3d98d8eab243f
# appimagetool tags a new release (see https://github.com/AppImage/appimagetool/pull/47)
download_if_not_exist "$CACHEDIR/Python-$PYTHON_VERSION.tar.xz" "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tar.xz"
-verify_hash "$CACHEDIR/Python-$PYTHON_VERSION.tar.xz" "c30bb24b7f1e9a19b11b55a546434f74e739bb4c271a3e3a80ff4380d49f7adb"
+verify_hash "$CACHEDIR/Python-$PYTHON_VERSION.tar.xz" "c08bc65a81971c1dd5783182826503369466c7e67374d1646519adf05207b684"
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.