Decide on Python version

Description of issue or feature request: Decide which Python versions we want to support in TUF 1.0.0.

Arguments for > 3.5:

• Python 2.7 has EOLed.
• Allows us to use type hints.
• Users who need lower versions can still use the current implementation, which we will continue to support for a while
• 3.5 isn’t widely supported, see e.g. pyca/cryptography dropping support for it

Current behavior:

• TUF generally supports 2.7 and >= 3.5 (see setup.py and tests)
• The new simple metadata API requires >= 3.6 (see https://github.com/theupdateframework/tuf/pull/1112)

Expected behavior: TBD

[ofek]

Temporary means a while 😅

We’re one user, please do what you wish and do not block on us. We will be fine.

[joshuagl]

Datadog still needs temporary support for Python 2 at least, IIRC cc @ofek @FlorianVeaux

Can you help quantify “temporary support”? We don’t really have the engineering resources on the project to support multiple versions of the codebase. Back-porting security fixes won’t be very straightforward if we rearchitect the internals as has been proposed.

I’d rather avoid Python2.7 entirely, but it may be possible to get the Python 3.x features we want on a 2.7 supporting codebase by using additional dependencies. i.e. typing is available for Python 2.7. Of course, the danger there is that we don’t know how long our dependencies will continue to support an EOL version of Python.