Drop support for Python < 2.7.9

Older versions of Python 2.7 (prior to 2.7.9) don’t have the capability to have a good TLS configuration, and thus it would be great to drop support for them. We’re not currently at the point that we can do that, but I wanted to open this issue to both track that we should do that at some point, and also take notes about the current state and how to query in the future.

Results:

Python Version	Download Count	Percent
>=2.7.9	268456729	53%
<2.7.9	155669164	31%
3.5	35605564	7%
3.4	23114420	5%
2.6	13023950	3%
3.6	11948118	2%
3.3	1278506	0.3%
3.7	231670	0.05%

The results can be queried with:

SELECT
  CASE
    WHEN REGEXP_MATCH(details.python, r"2\.7\.(9|\d\d)") THEN '>=2.7.9'
    WHEN REGEXP_MATCH(details.python, r"2\.7\.") THEN '<2.7.9'
    ELSE REGEXP_EXTRACT(details.python, r"^([^\.]+\.[^\.]+)")
  END AS python_version,
  COUNT(*) AS download_count,
FROM
  TABLE_DATE_RANGE( [the-psf:pypi.downloads], DATE_ADD(CURRENT_TIMESTAMP(), -31, "day"), DATE_ADD(CURRENT_TIMESTAMP(), -1, "day") )
WHERE
  details.installer.name = 'pip'
GROUP BY
  python_version,
ORDER BY
  download_count DESC
LIMIT
  100

[hugovk]

For some reason GitHub gives me a 500 error on #7362, so I can’t see the close reason.

Anyway, do you think this should be swept into the general Python 2.7.* removals after pip 20.3 is released in October 2020?

https://github.com/pypa/pip/issues/6148#issuecomment-616213532

If so, close this?

[dstufft]

@nicktimko I think the biggest thing is just simply reducing the surface area of support we have. Generally we decide this on an X.Y basis, because that draws the cleanest lines around major changes. However, due to 2.7’s age, 2.7.9 is a bit of a special case in that it introduced a backported ssl module from Python 3.

This work would effectively allow us to better take advantage on the capabilities of that back ported SSL module, for instance we can use the configuration settings so that pip itself will not function with older versions of TLS, we can possibly start relying on the platform trust stores in more situations, etc.

But really the biggest thing is narrowing the supported configurations.

To @pradyunsg I think sub 5% is a perfectly fine point to drop support for older versions of 2.7.