Merge branch 'cb-update-python3' into 'master'

Update python from 3.9.17 to 3.9.21

See merge request https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/8061



Merged-by: Ian Baum <ibaum@gitlab.com>
Approved-by: Dustin Collins <714871-dustinmm80@users.noreply.gitlab.com>
Approved-by: Ian Baum <ibaum@gitlab.com>
Co-authored-by: Clemens Beck <cbeck@gitlab.com>

config/software/python3.rb

@@ -23,7 +23,7 @@ name 'python3'
 # files/gitlab-cookbooks/gitlab/attributes/default.rb
 # spec/chef/recipes/gitaly_spec.rb
 # spec/chef/recipes/gitlab-rails_spec.rb
-default_version '3.9.17'
+default_version '3.9.21'
 dependency 'libedit'
 dependency 'ncurses'
@@ -40,7 +40,7 @@ license_file 'LICENSE'
 skip_transitive_dependency_licensing true
 source url: "https://www.python.org/ftp/python/#{version}/Python-#{version}.tgz",
-       sha256: '8ead58f669f7e19d777c3556b62fae29a81d7f06a7122ff9bc57f7dd82d7e014'
+       sha256: '667c3ba2ca98d39ead1162f6548c3475768582e2ff89e0821d25eb956ac09944'
 relative_path "Python-#{version}"

scripts/renovate/checksums/software/python3.sh

+#!/usr/bin/env bash
+
+# Fetch and replace the python3 checksum.
+# Dependencies: wget, sed, awk
+
+set -eo pipefail
+
+source "$(dirname "$0")/shared.sh"
+build_file="config/software/python3.rb"
+
+get_checksum() {
+  local version="$1"
+  local archive_url="https://www.python.org/ftp/python/${version}/Python-${version}.tgz"
+
+  # Python does not publish sha sums for their source tarballs, so we calculate it from the archive.
+  wget -q -O - "$archive_url" | sha256sum | awk '{print $1}'
+}
+
+version=$(get_default_version "$build_file")
+checksum=$(get_checksum "$version")
+replace_sha256_checksum "$checksum" "$build_file"