deprecate 3.7 (#11611)

* deprecate 3.7

we don't have a timeline for removing support yet, but start warning

* add coverage for a 3.7 builder

.github/workflows/ci.yml

@@ -223,11 +223,11 @@ jobs:
           - {OS: 'macos-13', ARCH: 'x86_64'}
           - {OS: 'macos-14', ARCH: 'arm64'}
         PYTHON:
-          - {VERSION: "3.7", NOXSESSION: "tests-nocoverage"}
+          - {VERSION: "3.7", NOXSESSION: "tests"}
           - {VERSION: "3.12", NOXSESSION: "tests"}
         exclude:
           # We only test latest Python on arm64. py37 won't work since there's no universal2 binary
-          - PYTHON: {VERSION: "3.7", NOXSESSION: "tests-nocoverage"}
+          - PYTHON: {VERSION: "3.7", NOXSESSION: "tests"}
             RUNNER: {OS: 'macos-14', ARCH: 'arm64'}
     timeout-minutes: 15
     steps:

CHANGELOG.rst

@@ -8,6 +8,9 @@ Changelog
 
 .. note:: This version is not yet released and is under active development.
 
+* Deprecated Python 3.7 support. Python 3.7 is no longer supported by the
+  Python core team. Support for Python 3.7 will be removed in a future
+  ``cryptography`` release.
 * Enforce the :rfc:`5280` requirement that extended key usage extensions must
   not be empty.
 * Added support for timestamp extraction to the

src/cryptography/__init__.py

@@ -4,10 +4,23 @@
 
 from __future__ import annotations
 
+import sys
+import warnings
+
+from cryptography import utils
 from cryptography.__about__ import __author__, __copyright__, __version__
 
 __all__ = [
     "__author__",
     "__copyright__",
     "__version__",
 ]
+
+if sys.version_info[:2] == (3, 7):
+    warnings.warn(
+        "Python 3.7 is no longer supported by the Python core team "
+        "and support for it is deprecated in cryptography. A future "
+        "release of cryptography will remove support for Python 3.7.",
+        utils.CryptographyDeprecationWarning,
+        stacklevel=2,
+    )