Issue #17128: Build OS X installer for 3.6 with private copy of OpenSSL. · pythoncapi/cpython@dde4f63 · GitHub
Skip to content

Commit dde4f63

Browse files
ned-deilyned-deily
committed
Issue python#17128: Build OS X installer for 3.6 with private copy of OpenSSL.
Also provide a sample Install Certificates command script to install a set of root certificates from the third-party certifi module.
1 parent 6d6602c commit dde4f63

5 files changed

Lines changed: 115 additions & 82 deletions

File tree

‎Mac/BuildScript/build-installer.py‎

Lines changed: 17 additions & 40 deletions

‎Mac/BuildScript/resources/ReadMe.rtf‎

Lines changed: 36 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
{\rtf1\ansi\ansicpg1252\cocoartf1404\cocoasubrtf460
1+
{\rtf1\ansi\ansicpg1252\cocoartf1504
22
{\fonttbl\f0\fswiss\fcharset0 Helvetica;\f1\fmodern\fcharset0 CourierNewPSMT;}
33
{\colortbl;\red255\green255\blue255;}
4+
{\*\expandedcolortbl;\csgray\c100000;}
45
\margl1440\margr1440\vieww13380\viewh14600\viewkind0
56
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural\partightenfactor0
67

@@ -11,60 +12,56 @@
1112
\b \cf0 \ul \ulc0 Which installer variant should I use?
1213
\b0 \ulnone \
1314
\
14-
For the initial alpha releases of Python 3.6, Python.org provides only one installer variant for download: one that installs a
15+
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural\partightenfactor0
16+
17+
\b \cf0 **NEW**
18+
\b0 For Python 3.6, the python.org website now provides only one installer variant for download: one that installs a
1519
\i 64-bit/32-bit Intel
1620
\i0 Python capable of running on
1721
\i Mac OS X 10.6 (Snow Leopard)
18-
\i0 or later. This will change prior to the beta releases of 3.6.0. This ReadMe was installed with the
22+
\i0 or later. This ReadMe was installed with the
1923
\i $MACOSX_DEPLOYMENT_TARGET
20-
\i0 variant. By default, Python will automatically run in 64-bit mode if your system supports it. Also see
21-
\i Certificate verification and OpenSSL
22-
\i0 below. The Pythons installed by this installer is built with private copies of some third-party libraries not included with or newer than those in OS X itself. The list of these libraries varies by installer variant and is included at the end of the License.rtf file.
24+
\i0 variant. By default, Python will automatically run in 64-bit mode if your system supports it. The Python installed by this installer is built with private copies of some third-party libraries not included with or newer than those in OS X itself. The list of these libraries is included at the end of the License.rtf file.
2325
\b \ul \
2426
\
25-
Update your version of Tcl/Tk to use IDLE or other Tk applications
26-
\b0 \ulnone \
27-
\
28-
To use IDLE or other programs that use the Tkinter graphical user interface toolkit, you need to install a newer third-party version of the
29-
\i Tcl/Tk
30-
\i0 frameworks. Visit {\field{\*\fldinst{HYPERLINK "https://www.python.org/download/mac/tcltk/"}}{\fldrslt https://www.python.org/download/mac/tcltk/}} for current information about supported and recommended versions of
31-
\i Tcl/Tk
32-
\i0 for this version of Python and of Mac OS X. For the initial alpha releases of Python 3.6, the installer is linked with Tcl/Tk 8.5; this will change prior to the beta releases of 3.6.0.\
33-
34-
\b \ul \
3527
Certificate verification and OpenSSL\
28+
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural\partightenfactor0
3629
37-
\b0 \ulnone \
38-
Python 3.6 includes a number of network security enhancements that were released in Python 3.4.3 and Python 2.7.10. {\field{\*\fldinst{HYPERLINK "https://www.python.org/dev/peps/pep-0476/"}}{\fldrslt PEP 476}} changes several standard library modules, like
39-
\i httplib
40-
\i0 ,
41-
\i urllib
42-
\i0 , and
43-
\i xmlrpclib
44-
\i0 , to by default verify certificates presented by servers over secure (TLS) connections. The verification is performed by the OpenSSL libraries that Python is linked to. Prior to 3.4.3, both python.org installers dynamically linked with Apple-supplied OpenSSL libraries shipped with OS X. OS X provides a multiple level security framework that stores trust certificates in system and user keychains managed by the
30+
\b0 \cf0 \ulnone \
31+
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural\partightenfactor0
32+
33+
\b \cf0 **NEW**
34+
\b0 This variant of Python 3.6 now includes its own private copy of OpenSSL 1.0.2. Unlike previous releases, the deprecated Apple-supplied OpenSSL libraries are no longer used. This also means that the trust certificates in system and user keychains managed by the
4535
\i Keychain Access
4636
\i0 application and the
4737
\i security
48-
\i0 command line utility.\
49-
\
50-
For OS X 10.6+, Apple also provides
51-
\i OpenSSL
52-
\i0
53-
\i 0.9.8 libraries
54-
\i0 . Apple's 0.9.8 version includes an important additional feature: if a certificate cannot be verified using the manually administered certificates in
55-
\f1 /System/Library/OpenSSL
56-
\f0 , the certificates managed by the system security framework In the user and system keychains are also consulted (using Apple private APIs). For the initial alpha releases of Python 3.6, the
57-
\i 64-bit/32-bit 10.6+ python.org variant
58-
\i0 continues to be dynamically linked with Apple's OpenSSL 0.9.8 since it was felt that the loss of the system-provided certificates and management tools outweighs the additional security features provided by newer versions of OpenSSL. This will change prior to the beta releases of 3.6.0 as Apple has deprecated use of the system-supplied OpenSSL libraries. If you do need features from newer versions of OpenSSL, there are third-party OpenSSL wrapper packages available through
59-
\i PyPI
60-
\i0 .\
38+
\i0 command line utility are no longer used as defaults by the Python
39+
\f1 ssl
40+
\f0 module. For 3.6.0b1, a sample command script is included in
41+
\f1 /Applications/Python 3.6
42+
\f0 to install a curated bundle of default root certificates from the third-party
43+
\f1 certifi
44+
\f0 package ({\field{\*\fldinst{HYPERLINK "https://pypi.python.org/pypi/certifi"}}{\fldrslt https://pypi.python.org/pypi/certifi}}). If you choose to use
45+
\f1 certifi
46+
\f0 , you should consider subscribing to the{\field{\*\fldinst{HYPERLINK "https://certifi.io/en/latest/"}}{\fldrslt project's email update service}} to be notified when the certificate bundle is updated.\
6147
\
6248
The bundled
6349
\f1 pip
64-
\f0 included with the Python 3.6 installers has its own default certificate store for verifying download connections.\
50+
\f0 included with the Python 3.6 installer has its own default certificate store for verifying download connections.\
51+
\
52+
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural\partightenfactor0
53+
54+
\b \cf0 \ul Update your version of Tcl/Tk to use IDLE or other Tk applications
55+
\b0 \ulnone \
6556
\
57+
To use IDLE or other programs that use the Tkinter graphical user interface toolkit, you need to install a newer third-party version of the
58+
\i Tcl/Tk
59+
\i0 frameworks. Visit {\field{\*\fldinst{HYPERLINK "https://www.python.org/download/mac/tcltk/"}}{\fldrslt https://www.python.org/download/mac/tcltk/}} for current information about supported and recommended versions of
60+
\i Tcl/Tk
61+
\i0 for this version of Python and of Mac OS X. For the initial alpha releases of Python 3.6, the installer is still linked with Tcl/Tk 8.5; this will change prior to the beta 2 release of 3.6.0.\
6662

67-
\b \ul Other changes\
63+
\b \ul \
64+
Other changes\
6865
6966
\b0 \ulnone \
7067
For other changes in this release, see the

‎Mac/BuildScript/resources/Welcome.rtf‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
{\rtf1\ansi\ansicpg1252\cocoartf1343\cocoasubrtf160
1+
{\rtf1\ansi\ansicpg1252\cocoartf1504
22
\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
33
{\colortbl;\red255\green255\blue255;}
4+
{\*\expandedcolortbl;\csgray\c100000;}
45
\paperw11905\paperh16837\margl1440\margr1440\vieww12200\viewh10880\viewkind0
5-
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640
6+
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\partightenfactor0
67

78
\f0\fs24 \cf0 This package will install
89
\b Python $FULL_VERSION
@@ -16,8 +17,14 @@
1617
\b IDLE
1718
\b0 .\
1819
\
20+
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\partightenfactor0
1921

20-
\b IMPORTANT:
22+
\b \cf0 NEW:
23+
\b0 There are important changes in this release regarding network security and trust certificates. Please see the ReadMe for more details.\
24+
\
25+
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\partightenfactor0
26+
27+
\b \cf0 IMPORTANT:
2128
\b0
2229
\b IDLE
2330
\b0 and other programs using the

‎Mac/BuildScript/resources/install_certificates.command‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/sh
2+
3+
/Library/Frameworks/Python.framework/Versions/@PYVER@/bin/python@PYVER@ << "EOF"
4+
5+
# install_certifi.py
6+
#
7+
# sample script to install or update a set of default Root Certificates
8+
# for the ssl module. Uses the certificates provided by the certifi package:
9+
# https://pypi.python.org/pypi/certifi
10+
11+
import os
12+
import os.path
13+
import ssl
14+
import stat
15+
import subprocess
16+
import sys
17+
18+
STAT_0o775 = ( stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
19+
| stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
20+
| stat.S_IROTH | stat.S_IXOTH )
21+
22+
def main():
23+
openssl_dir, openssl_cafile = os.path.split(
24+
ssl.get_default_verify_paths().openssl_cafile)
25+
26+
print(" -- pip install --upgrade certifi")
27+
subprocess.check_call([sys.executable,
28+
"-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])
29+
30+
import certifi
31+
32+
# change working directory to the default SSL directory
33+
os.chdir(openssl_dir)
34+
relpath_to_certifi_cafile = os.path.relpath(certifi.where())
35+
print(" -- removing any existing file or link")
36+
try:
37+
os.remove(openssl_cafile)
38+
except FileNotFoundError:
39+
pass
40+
print(" -- creating symlink to certifi certificate bundle")
41+
os.symlink(relpath_to_certifi_cafile, openssl_cafile)
42+
print(" -- setting permissions")
43+
os.chmod(openssl_cafile, STAT_0o775)
44+
print(" -- update complete")
45+
46+
if __name__ == '__main__':
47+
main()
48+
EOF

‎Misc/NEWS‎

Lines changed: 4 additions & 0 deletions

0 commit comments

Comments
 (0)