From dbf2524524f2b6f0ec9952e2825a8842231c1788 Mon Sep 17 00:00:00 2001
From: Jens Vagelpohl <jens@plyp.com>
Date: Wed, 29 May 2024 12:23:33 +0200
Subject: [PATCH 1/4] - remove support for Python 3.7 and add support for
 Python 3.13

---
 .github/workflows/tests.yml | 73 ++++++++++++++++++++++++-------------
 .manylinux-install.sh       | 13 +++++--
 .meta.toml                  |  4 +-
 CHANGES.rst                 |  4 ++
 setup.py                    |  4 +-
 tox.ini                     |  4 +-
 6 files changed, 67 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9d3a3ca..2f5e435 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -97,21 +97,16 @@ jobs:
       matrix:
         python-version:
           - "pypy-3.10"
-          - "3.7"
           - "3.8"
           - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
+          - "3.13"
         os: [ubuntu-latest, macos-latest, windows-latest]
         exclude:
-          - os: macos-latest
-            python-version: "3.7"
           - os: macos-latest
             python-version: "pypy-3.10"
-        include:
-          - python-version: "3.7"
-            os: macos-12
 
     steps:
       - name: checkout
@@ -120,6 +115,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -156,17 +152,22 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-pip-
 
+      - name: Install Build Dependencies (3.13)
+        if: matrix.python-version == '3.13'
+        run: |
+          pip install -U pip
+          pip install -U "setuptools<69" wheel twine
       - name: Install Build Dependencies
+        if: matrix.python-version != '3.13'
         run: |
           pip install -U pip
           pip install -U "setuptools<69" wheel twine
           pip install -U zope.proxy
 
-      - name: Build zope.security (macOS x86_64, Python 3.8+)
+      - name: Build zope.security (macOS x86_64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         env:
           MACOSX_DEPLOYMENT_TARGET: 10.9
           _PYTHON_HOST_PLATFORM: macosx-10.9-x86_64
@@ -176,11 +177,10 @@ jobs:
           # output (pip install uses a random temporary directory, making this difficult).
           python setup.py build_ext -i
           python setup.py bdist_wheel
-      - name: Build zope.security (macOS arm64, Python 3.8+)
+      - name: Build zope.security (macOS arm64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         env:
           MACOSX_DEPLOYMENT_TARGET: 11.0
           _PYTHON_HOST_PLATFORM: macosx-11.0-arm64
@@ -194,14 +194,21 @@ jobs:
         if: >
           !startsWith(runner.os, 'Mac')
           || startsWith(matrix.python-version, 'pypy')
-          || matrix.python-version == '3.7'
         run: |
           # Next, build the wheel *in place*. This helps ccache, and also lets us cache the configure
           # output (pip install uses a random temporary directory, making this difficult).
           python setup.py build_ext -i
           python setup.py bdist_wheel
 
+      - name: Install zope.security and dependencies (3.13)
+        if: matrix.python-version == '3.13'
+        run: |
+          # Install to collect dependencies into the (pip) cache.
+          # Use "--pre" here because dependencies with support for this future
+          # Python release may only be available as pre-releases
+          pip install --pre .[test]
       - name: Install zope.security and dependencies
+        if: matrix.python-version != '3.13'
         run: |
           # Install to collect dependencies into the (pip) cache.
           pip install .[test]
@@ -215,19 +222,18 @@ jobs:
           startsWith(runner.os, 'Mac')
         uses: actions/upload-artifact@v4
         with:
-          name: zope.security-${{ runner.os }}-${{ matrix.python-version }}.whl
+          # The x86_64 wheel is uploaded with a different name just so it can be
+          # manually downloaded when desired. The wheel itself *cannot* be tested
+          # on the GHA runner, which uses arm64 architecture.
+          name: zope.security-${{ runner.os }}-${{ matrix.python-version }}-x86_64.whl
           path: dist/*x86_64.whl
       - name: Upload zope.security wheel (macOS arm64)
         if: >
           startsWith(runner.os, 'Mac')
-          && !(startsWith(matrix.python-version, 'pypy')
-               || matrix.python-version == '3.7')
+          && !startsWith(matrix.python-version, 'pypy')
         uses: actions/upload-artifact@v4
         with:
-          # The arm64 wheel is uploaded with a different name just so it can be
-          # manually downloaded when desired. The wheel itself *cannot* be tested
-          # on the GHA runner, which uses x86_64 architecture.
-          name: zope.security-${{ runner.os }}-${{ matrix.python-version }}-arm64.whl
+          name: zope.security-${{ runner.os }}-${{ matrix.python-version }}.whl
           path: dist/*arm64.whl
       - name: Upload zope.security wheel (all other platforms)
         if: >
@@ -245,6 +251,7 @@ jobs:
           && startsWith(github.ref, 'refs/tags')
           && !startsWith(runner.os, 'Linux')
           && !startsWith(matrix.python-version, 'pypy')
+          && !startsWith(matrix.python-version, '3.13')
         env:
           TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
         run: |
@@ -258,21 +265,16 @@ jobs:
       matrix:
         python-version:
           - "pypy-3.10"
-          - "3.7"
           - "3.8"
           - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
+          - "3.13"
         os: [ubuntu-latest, macos-latest, windows-latest]
         exclude:
-          - os: macos-latest
-            python-version: "3.7"
           - os: macos-latest
             python-version: "pypy-3.10"
-        include:
-          - python-version: "3.7"
-            os: macos-12
 
     steps:
       - name: checkout
@@ -281,6 +283,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -322,7 +325,22 @@ jobs:
         with:
           name: zope.security-${{ runner.os }}-${{ matrix.python-version }}.whl
           path: dist/
+      - name: Install zope.security 3.13 ${{ matrix.python-version }}
+        if: matrix.python-version == '3.13'
+        run: |
+          pip install -U wheel "setuptools<69"
+          # coverage might have a wheel on PyPI for a future python version which is
+          # not ABI compatible with the current one, so build it from sdist:
+          pip install -U --no-binary :all: coverage
+          # Unzip into src/ so that testrunner can find the .so files
+          # when we ask it to load tests from that directory. This
+          # might also save some build time?
+          unzip -n dist/zope.security-*whl -d src
+          # Use "--pre" here because dependencies with support for this future
+          # Python release may only be available as pre-releases
+          pip install --pre -U -e .[test]
       - name: Install zope.security
+        if: matrix.python-version != '3.13'
         run: |
           pip install -U wheel "setuptools<69"
           pip install -U coverage
@@ -377,6 +395,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -445,6 +464,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
@@ -512,6 +532,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
       ###
       # Caching.
       # This actually *restores* a cache and schedules a cleanup action
diff --git a/.manylinux-install.sh b/.manylinux-install.sh
index d818c24..46cd34d 100755
--- a/.manylinux-install.sh
+++ b/.manylinux-install.sh
@@ -28,7 +28,7 @@ yum -y install libffi-devel
 
 tox_env_map() {
     case $1 in
-        *"cp37"*) echo 'py37';;
+        *"cp313"*) echo 'py313';;
         *"cp38"*) echo 'py38';;
         *"cp39"*) echo 'py39';;
         *"cp310"*) echo 'py310';;
@@ -41,14 +41,19 @@ tox_env_map() {
 # Compile wheels
 for PYBIN in /opt/python/*/bin; do
     if \
+       [[ "${PYBIN}" == *"cp313/"* ]] || \
        [[ "${PYBIN}" == *"cp311/"* ]] || \
        [[ "${PYBIN}" == *"cp312/"* ]] || \
-       [[ "${PYBIN}" == *"cp37/"* ]] || \
        [[ "${PYBIN}" == *"cp38/"* ]] || \
        [[ "${PYBIN}" == *"cp39/"* ]] || \
        [[ "${PYBIN}" == *"cp310/"* ]] ; then
-        "${PYBIN}/pip" install -e /io/
-        "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+        if [[ "${PYBIN}" == *"cp313/"* ]] ; then
+            "${PYBIN}/pip" install --pre -e /io/
+            "${PYBIN}/pip" wheel /io/ --pre -w wheelhouse/
+        else
+            "${PYBIN}/pip" install -e /io/
+            "${PYBIN}/pip" wheel /io/ -w wheelhouse/
+        fi
         if [ `uname -m` == 'aarch64' ]; then
           cd /io/
           ${PYBIN}/pip install tox
diff --git a/.meta.toml b/.meta.toml
index 36b881c..9e65eed 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -2,13 +2,13 @@
 # https://github.com/zopefoundation/meta/tree/master/config/c-code
 [meta]
 template = "c-code"
-commit-id = "1c0f31f5"
+commit-id = "9f78efd3"
 
 [python]
 with-appveyor = true
 with-windows = true
 with-pypy = true
-with-future-python = false
+with-future-python = true
 with-docs = true
 with-sphinx-doctests = true
 with-macos = false
diff --git a/CHANGES.rst b/CHANGES.rst
index ccb30ab..f13a7c1 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -5,6 +5,10 @@
 6.3 (unreleased)
 ----------------
 
+- Add preliminary support for Python 3.13 as of 3.13b1.
+
+- Drop support for Python 3.7.
+
 - Build windows wheels on GHA.
 
 
diff --git a/setup.py b/setup.py
index 7bfbe17..60bb894 100644
--- a/setup.py
+++ b/setup.py
@@ -121,12 +121,12 @@ def read(*rnames):
           'License :: OSI Approved :: Zope Public License',
           'Programming Language :: Python',
           'Programming Language :: Python :: 3',
-          'Programming Language :: Python :: 3.7',
           'Programming Language :: Python :: 3.8',
           'Programming Language :: Python :: 3.9',
           'Programming Language :: Python :: 3.10',
           'Programming Language :: Python :: 3.11',
           'Programming Language :: Python :: 3.12',
+          'Programming Language :: Python :: 3.13',
           'Programming Language :: Python :: Implementation :: CPython',
           'Programming Language :: Python :: Implementation :: PyPy',
           'Natural Language :: English',
@@ -149,7 +149,7 @@ def read(*rnames):
           'build_ext': optional_build_ext,
       },
       ext_modules=ext_modules,
-      python_requires='>=3.7',
+      python_requires='>=3.8',
       install_requires=[
           'setuptools',
           'zope.component',
diff --git a/tox.ini b/tox.ini
index efbe3c6..5c38db7 100644
--- a/tox.ini
+++ b/tox.ini
@@ -4,12 +4,12 @@
 minversion = 4.0
 envlist =
     lint
-    py37,py37-pure
     py38,py38-pure
     py39,py39-pure
     py310,py310-pure
     py311,py311-pure
     py312,py312-pure
+    py313,py313-pure
     pypy3
     docs
     coverage
@@ -17,9 +17,11 @@ envlist =
 
 [testenv]
 usedevelop = true
+pip_pre = py313: true
 deps =
     setuptools < 69
     py37: urllib3 < 2
+    Sphinx
 setenv =
     pure: PURE_PYTHON=1
     !pure-!pypy3: PURE_PYTHON=0

From 1e0df6f3f0944fc8dd5ac0968dda778046263f1d Mon Sep 17 00:00:00 2001
From: Jens Vagelpohl <jens@plyp.com>
Date: Wed, 29 May 2024 12:30:38 +0200
Subject: [PATCH 2/4] - fix cffi issue

---
 .meta.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.meta.toml b/.meta.toml
index 9e65eed..2174a33 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -63,3 +63,6 @@ additional-config = [
 additional-build-dependencies = [
     "zope.proxy",
     ]
+
+[c-code]
+require-cffi = true

From ae4ea6c24b81fc44d4a3ad51c1dbaf47beada87d Mon Sep 17 00:00:00 2001
From: Jens Vagelpohl <jens@plyp.com>
Date: Wed, 29 May 2024 12:36:20 +0200
Subject: [PATCH 3/4] - actually apply cffi fix

---
 .github/workflows/tests.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2f5e435..4f41853 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -157,11 +157,14 @@ jobs:
         run: |
           pip install -U pip
           pip install -U "setuptools<69" wheel twine
+          # Remove this hack once 'cffi' has a release supporting Python 3.13.
+          pip install -e "git+https://github.com/python-cffi/cffi.git#egg=cffi"
       - name: Install Build Dependencies
         if: matrix.python-version != '3.13'
         run: |
           pip install -U pip
           pip install -U "setuptools<69" wheel twine
+          pip install cffi
           pip install -U zope.proxy
 
       - name: Build zope.security (macOS x86_64)
@@ -329,6 +332,8 @@ jobs:
         if: matrix.python-version == '3.13'
         run: |
           pip install -U wheel "setuptools<69"
+          # Remove this hack once 'cffi' has a release supporting Python 3.13.
+          pip install -e "git+https://github.com/python-cffi/cffi.git#egg=cffi"
           # coverage might have a wheel on PyPI for a future python version which is
           # not ABI compatible with the current one, so build it from sdist:
           pip install -U --no-binary :all: coverage

From af92afe2723839a61d2eab48e50b64f989bf0285 Mon Sep 17 00:00:00 2001
From: Jens Vagelpohl <jens@plyp.com>
Date: Wed, 29 May 2024 17:56:24 +0200
Subject: [PATCH 4/4] - apply latest meta config template fixes

---
 .github/workflows/tests.yml | 8 +++-----
 .meta.toml                  | 9 +++------
 CHANGES.rst                 | 2 +-
 setup.py                    | 2 +-
 tox.ini                     | 4 +---
 5 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 4f41853..ff84eda 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -157,8 +157,7 @@ jobs:
         run: |
           pip install -U pip
           pip install -U "setuptools<69" wheel twine
-          # Remove this hack once 'cffi' has a release supporting Python 3.13.
-          pip install -e "git+https://github.com/python-cffi/cffi.git#egg=cffi"
+          pip install --pre cffi
       - name: Install Build Dependencies
         if: matrix.python-version != '3.13'
         run: |
@@ -328,12 +327,11 @@ jobs:
         with:
           name: zope.security-${{ runner.os }}-${{ matrix.python-version }}.whl
           path: dist/
-      - name: Install zope.security 3.13 ${{ matrix.python-version }}
+      - name: Install zope.security ${{ matrix.python-version }}
         if: matrix.python-version == '3.13'
         run: |
           pip install -U wheel "setuptools<69"
-          # Remove this hack once 'cffi' has a release supporting Python 3.13.
-          pip install -e "git+https://github.com/python-cffi/cffi.git#egg=cffi"
+          pip install --pre cffi
           # coverage might have a wheel on PyPI for a future python version which is
           # not ABI compatible with the current one, so build it from sdist:
           pip install -U --no-binary :all: coverage
diff --git a/.meta.toml b/.meta.toml
index 2174a33..425d95e 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/config/c-code
 [meta]
 template = "c-code"
-commit-id = "9f78efd3"
+commit-id = "13719585"
 
 [python]
 with-appveyor = true
@@ -16,15 +16,12 @@ with-macos = false
 [tox]
 use-flake8 = true
 additional-envlist = [
-    "py37-watch, py311-watch",
+    "py38-watch, py311-watch",
     ]
 testenv-setenv = [
     "ZOPE_INTERFACE_STRICT_IRO=1",
     "watch: ZOPE_WATCH_CHECKERS=1",
     ]
-testenv-deps = [
-    "py37: urllib3 < 2",
-    ]
 
 [coverage]
 fail-under = 99.5
@@ -57,7 +54,7 @@ additional-config = [
 
 [github-actions]
 additional-config = [
-    "- [\"3.7\",   \"py37-watch\"]",
+    "- [\"3.8\",   \"py38-watch\"]",
     "- [\"3.11\",  \"py311-watch\"]",
     ]
 additional-build-dependencies = [
diff --git a/CHANGES.rst b/CHANGES.rst
index f13a7c1..860fe5c 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -2,7 +2,7 @@
  Changes
 =========
 
-6.3 (unreleased)
+7.0 (unreleased)
 ----------------
 
 - Add preliminary support for Python 3.13 as of 3.13b1.
diff --git a/setup.py b/setup.py
index 60bb894..77819d6 100644
--- a/setup.py
+++ b/setup.py
@@ -104,7 +104,7 @@ def read(*rnames):
 
 
 setup(name='zope.security',
-      version='6.3.dev0',
+      version='7.0.dev0',
       author='Zope Foundation and Contributors',
       author_email='zope-dev@zope.org',
       description='Zope Security Framework',
diff --git a/tox.ini b/tox.ini
index 5c38db7..06e615d 100644
--- a/tox.ini
+++ b/tox.ini
@@ -13,14 +13,13 @@ envlist =
     pypy3
     docs
     coverage
-    py37-watch, py311-watch
+    py38-watch, py311-watch
 
 [testenv]
 usedevelop = true
 pip_pre = py313: true
 deps =
     setuptools < 69
-    py37: urllib3 < 2
     Sphinx
 setenv =
     pure: PURE_PYTHON=1
@@ -42,7 +41,6 @@ allowlist_externals =
     mkdir
 deps =
     coverage
-    py37: urllib3 < 2
 setenv =
     PURE_PYTHON=1
 commands =