merge heads

Doc/library/idle.rst

@@ -248,7 +248,8 @@ Configure IDLE
    help sources can be specified.  Non-default user setting are saved in a
    .idlerc directory in the user's home directory.  Problems caused by bad user
    configuration files are solved by editing or deleting one or more of the
-   files in .idlerc.
+   files in .idlerc.  On OS X, open the configuration dialog by selecting
+   Preferences in the application menu.
 
 Configure Extensions
    Open a configuration dialog for setting preferences for extensions

Doc/library/unittest.rst

@@ -47,7 +47,7 @@ test runner
    Module :mod:`doctest`
       Another test-support module with a very different flavor.
 
-   `Simple Smalltalk Testing: With Patterns <http://www.XProgramming.com/testfram.htm>`_
+   `Simple Smalltalk Testing: With Patterns <https://web.archive.org/web/20150315073817/http://www.xprogramming.com/testfram.htm>`_
       Kent Beck's original paper on testing frameworks using the pattern shared
       by :mod:`unittest`.
 

Lib/idlelib/help.txt

@@ -129,7 +129,9 @@ Options Menu (Shell and Editor):
         Configure IDLE -- Open a configuration dialog.  Fonts, indentation,
                           keybindings, and color themes may be altered.
                           Startup Preferences may be set, and additional Help
-                          sources can be specified.
+                          sources can be specified.  On OS X, open the
+                          configuration dialog by selecting Preferences
+                          in the application menu.
 
         ---
         Code Context (toggle) -- Open a pane at the top of the edit window

Mac/BuildScript/build-installer.py

@@ -237,9 +237,9 @@ def library_recipes():
 
         result.extend([
           dict(
-              name="OpenSSL 1.0.2a",
+              name="OpenSSL 1.0.2c",
-              url="https://www.openssl.org/source/openssl-1.0.2a.tar.gz",
+              url="https://www.openssl.org/source/openssl-1.0.2c.tar.gz",
-              checksum='a06c547dac9044161a477211049f60ef',
+              checksum='8c8d81a9ae7005276e486702edbcd4b6',
               patches=[
                   "openssl_sdk_makedepend.patch",
                    ],

Mac/BuildScript/openssl_sdk_makedepend.patch

@@ -2,7 +2,7 @@
 # Parent  25a9af415e8c3faf591c360d5f0e361d049b2b43
 # openssl_sdk_makedepend.patch
 #
-# 	using openssl 1.0.2a
+# 	using openssl 1.0.2c
 #
 # - support building with an OS X SDK
 # - allow "make depend" to use compilers with names other than "gcc"

Mac/BuildScript/resources/ReadMe.rtf

@@ -1,4 +1,4 @@
-{\rtf1\ansi\ansicpg1252\cocoartf1347\cocoasubrtf570
+{\rtf1\ansi\ansicpg1252\cocoartf1348\cocoasubrtf170
 {\fonttbl\f0\fswiss\fcharset0 Helvetica;\f1\fmodern\fcharset0 CourierNewPSMT;}
 {\colortbl;\red255\green255\blue255;}
 \margl1440\margr1440\vieww13380\viewh14600\viewkind0
@@ -24,7 +24,7 @@ Python.org provides two installer variants for download: one that installs a
 \i0  variant.  Unless you are installing to an 10.5 system or you need to build applications that can run on 10.5 systems, use the 10.6 variant if possible.  There are some additional operating system functions that are supported starting with 10.6 and you may see better performance using 64-bit mode.  By default, Python will automatically run in 64-bit mode if your system supports it.  Also see 
 \i Certificate verification and OpenSSL
 \i0  below.  The Pythons installed by these installers are built with private copies of some third-party libraries not included with or newer than those in OS X itself.  The list of these libraries varies by installer variant and is included at the end of the License.rtf file.
-\b \ul \ulc0 \
+\b \ul \
 \
 Update your version of Tcl/Tk to use IDLE or other Tk applications
 \b0 \ulnone \
@@ -36,6 +36,71 @@ To use IDLE or other programs that use the Tkinter graphical user interface tool
 \i0  for this version of Python and of Mac OS X.\
 
 \b \ul \
+Certificate verification and OpenSSL\
+
+\b0 \ulnone \
+Python 3.5 includes a number of network security enhancements that were released in Python 3.4.3 and Python 2.7.10.  {\field{\*\fldinst{HYPERLINK "https://www.python.org/dev/peps/pep-0476/"}}{\fldrslt PEP 476}} changes several standard library modules, like 
+\i httplib
+\i0 , 
+\i urllib
+\i0 , and 
+\i xmlrpclib
+\i0 , to by default verify certificates presented by servers over secure (TLS) connections.  The verification is performed by the OpenSSL libraries that Python is linked to.  Prior to 3.4.3, both python.org installers dynamically linked with Apple-supplied OpenSSL libraries shipped with OS X.  OS X provides a multiple level security framework that stores trust certificates in system and user keychains managed by the 
+\i Keychain Access 
+\i0 application and the 
+\i security
+\i0  command line utility.\
+\
+For OS X 10.5, Apple provides 
+\i OpenSSL 0.9.7
+\i0  libraries.  This version of Apple's OpenSSL 
+\b does not
+\b0  use the certificates from the system security framework, even when used on newer versions of OS X.  Instead it consults a traditional OpenSSL concatenated certificate file (
+\i cafile
+\i0 ) or certificate directory (
+\i capath
+\i0 ), located in 
+\f1 /System/Library/OpenSSL
+\f0 .  These directories are typically empty and not managed by OS X; you must manage them yourself or supply your own SSL contexts.  OpenSSL 0.9.7 is obsolete by current security standards, lacking a number of important features found in later versions.  Among the problems this causes is the inability to verify higher-security certificates now used by python.org services, including 
+\i t{\field{\*\fldinst{HYPERLINK "https://pypi.python.org/pypi"}}{\fldrslt he Python Package Index, PyPI}}
+\i0 .  To solve this problem, the 
+\i 10.5+ 32-bit-only python.org variant
+\i0  is linked with a private copy of 
+\i OpenSSL 1.0.2
+\i0 ; it consults the same default certificate directory, 
+\f1 /System/Library/OpenSSL
+\f0 .   As before, it is still necessary to manage certificates yourself when you use this Python variant and, with certificate verification now enabled by default, you may now need to take additional steps to ensure your Python programs have access to CA certificates you trust.  If you use this Python variant to build standalone applications with third-party tools like {\field{\*\fldinst{HYPERLINK "https://pypi.python.org/pypi/py2app/"}}{\fldrslt 
+\f1 py2app}}, you may now need to bundle CA certificates in them or otherwise supply non-default SSL contexts.\
+\
+For OS X 10.6+, Apple also provides 
+\i OpenSSL
+\i0  
+\i 0.9.8 libraries
+\i0 .  Apple's 0.9.8 version includes an important additional feature: if a certificate cannot be verified using the manually administered certificates in 
+\f1 /System/Library/OpenSSL
+\f0 , the certificates managed by the system security framework In the user and system keychains are also consulted (using Apple private APIs).  For this reason, the 
+\i 64-bit/32-bit 10.6+ python.org variant
+\i0  continues to be dynamically linked with Apple's OpenSSL 0.9.8 since it was felt that the loss of the system-provided certificates and management tools outweighs the additional security features provided by newer versions of OpenSSL.  This will likely change in future releases of the python.org installers as Apple has deprecated use of the system-supplied OpenSSL libraries.  If you do need features from newer versions of OpenSSL, there are third-party OpenSSL wrapper packages available through 
+\i PyPI
+\i0 .\
+\
+The bundled 
+\f1 pip
+\f0  included with the Python 3.5 installers has its own default certificate store for verifying download connections.\
+\
+
+\b \ul Other changes\
+
+\b0 \ulnone \
+\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
+\cf0 For other changes in this release, see the 
+\i What's new
+\i0  section in the {\field{\*\fldinst{HYPERLINK "https://www.python.org/doc/"}}{\fldrslt Documentation Set}} for this release and its 
+\i Release Notes
+\i0  link at {\field{\*\fldinst{HYPERLINK "https://www.python.org/downloads/"}}{\fldrslt https://www.python.org/downloads/}}.\
+\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
+
+\b \cf0 \ul \
 Python 3 and Python 2 Co-existence\
 
 \b0 \ulnone \

Mac/BuildScript/scripts/postflight.ensurepip

@@ -10,15 +10,15 @@ RELFWKBIN="../../..${FWK}/bin"
 
 umask 022
 
-"${FWK}/bin/python${PYVER}" -m ensurepip --upgrade
+"${FWK}/bin/python${PYVER}" -E -s -m ensurepip --upgrade
 
-"${FWK}/bin/python${PYVER}" -Wi \
+"${FWK}/bin/python${PYVER}" -E -s -Wi \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x badsyntax \
     "${FWK}/lib/python${PYVER}/site-packages"
 
-"${FWK}/bin/python${PYVER}" -Wi -O \
+"${FWK}/bin/python${PYVER}" -E -s -Wi -O \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x badsyntax \
     "${FWK}/lib/python${PYVER}/site-packages"
 

Mac/BuildScript/scripts/postflight.framework

@@ -6,23 +6,23 @@
 PYVER="@PYVER@"
 FWK="/Library/Frameworks/Python.framework/Versions/@PYVER@"
 
-"${FWK}/bin/python@PYVER@" -Wi \
+"${FWK}/bin/python@PYVER@" -E -s -Wi \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x 'bad_coding|badsyntax|site-packages|lib2to3/tests/data' \
     "${FWK}/lib/python${PYVER}"
 
-"${FWK}/bin/python@PYVER@" -Wi -O \
+"${FWK}/bin/python@PYVER@" -E -s -Wi -O \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x 'bad_coding|badsyntax|site-packages|lib2to3/tests/data' \
     "${FWK}/lib/python${PYVER}"
 
-"${FWK}/bin/python@PYVER@" -Wi \
+"${FWK}/bin/python@PYVER@" -E -s -Wi \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x badsyntax \
     "${FWK}/lib/python${PYVER}/site-packages"
 
-"${FWK}/bin/python@PYVER@" -Wi -O \
+"${FWK}/bin/python@PYVER@" -E -s -Wi -O \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x badsyntax \
     "${FWK}/lib/python${PYVER}/site-packages"
 

Misc/NEWS

@@ -102,6 +102,12 @@ Documentation
 - Issue #24351: Clarify what is meant by "identifier" in the context of
   string.Template instances.
 
+Build
+-----
+
+- Issue #24432: Update Windows builds and OS X 10.5 installer to use OpenSSL
+  1.0.2c.
+
 
 What's New in Python 3.5.0 beta 2?
 ==================================

PCbuild/get_externals.bat

@@ -54,7 +54,7 @@ echo.Fetching external libraries...
 for %%e in (
             bzip2-1.0.6
             nasm-2.11.06
-            openssl-1.0.2a
+            openssl-1.0.2c
             tcl-core-8.6.4.1
             tk-8.6.4.1
             tix-8.4.3.4

PCbuild/prepare_ssl.py

@@ -1,3 +1,4 @@
+#! /usr/bin/env python3
 # Script for preparing OpenSSL for building on Windows.
 # Uses Perl to create nmake makefiles and otherwise prepare the way
 # for building on 32 or 64 bit platforms.

PCbuild/python.props

@@ -34,7 +34,7 @@
     <sqlite3Dir>$(ExternalsDir)sqlite-3.8.3.1\</sqlite3Dir>
     <bz2Dir>$(ExternalsDir)bzip2-1.0.6\</bz2Dir>
     <lzmaDir>$(ExternalsDir)xz-5.0.5\</lzmaDir>
-    <opensslDir>$(ExternalsDir)openssl-1.0.2a\</opensslDir>
+    <opensslDir>$(ExternalsDir)openssl-1.0.2c\</opensslDir>
     <nasmDir>$(ExternalsDir)\nasm-2.11.06\</nasmDir>
     
     <!-- Suffix for all binaries when building for debug -->

PCbuild/python3dll.vcxproj

@@ -109,7 +109,7 @@
       </_Lines>
     </ItemGroup>
     <MakeDir Directories="$(IntDir)" />
-    <WriteLinesToFile File="$(IntDir)python3_d.def" Lines="@(_Lines->'%(New)')" />
+    <WriteLinesToFile File="$(IntDir)python3_d.def" Lines="@(_Lines->'%(New)')" Overwrite="true" />
   </Target>
   
   <Target Name="BuildStubDef" BeforeTargets="PreLinkEvent" Inputs="..\PC\python3.def" Outputs="$(IntDir)python3stub.def">
@@ -132,7 +132,7 @@
       <_Lines Include="@(_Symbols->'%(Symbol)')" />
     </ItemGroup>
     <MakeDir Directories="$(IntDir)" />
-    <WriteLinesToFile File="$(IntDir)python3stub.def" Lines="@(_Lines)" />
+    <WriteLinesToFile File="$(IntDir)python3stub.def" Lines="@(_Lines)" Overwrite="true" />
   </Target>
   <Target Name="_CleanStubDef" BeforeTargets="CoreClean">
     <ItemGroup>

PCbuild/readme.txt

@@ -197,7 +197,7 @@ _lzma
     Homepage:
         http://tukaani.org/xz/
 _ssl
-    Python wrapper for version 1.0.1j of the OpenSSL secure sockets
+    Python wrapper for version 1.0.2c of the OpenSSL secure sockets
     library, which is built by ssl.vcxproj
     Homepage:
         http://www.openssl.org/

Tools/msi/build.bat

@@ -8,9 +8,10 @@ set BUILDX64=
 set BUILDDOC=
 
 :CheckOpts
-if '%1'=='-x86' (set BUILDX86=1) && shift && goto CheckOpts
+if "%1" EQU "-h" goto Help
-if '%1'=='-x64' (set BUILDX64=1) && shift && goto CheckOpts
+if "%1" EQU "-x86" (set BUILDX86=1) && shift && goto CheckOpts
-if '%1'=='--doc' (set BUILDDOC=1) && shift && goto CheckOpts
+if "%1" EQU "-x64" (set BUILDX64=1) && shift && goto CheckOpts
+if "%1" EQU "--doc" (set BUILDDOC=1) && shift && goto CheckOpts
 
 if not defined BUILDX86 if not defined BUILDX64 (set BUILDX86=1) && (set BUILDX64=1)
 
@@ -44,3 +45,12 @@ if defined BUILDX64 (
     msbuild "%D%bundle\snapshot.wixproj" /p:Platform=x64
     if errorlevel 1 goto :eof
 )
+
+exit /B 0
+
+:Help
+echo build.bat [-x86] [-x64] [--doc] [-h]
+echo.
+echo    -x86                Build x86 installers
+echo    -x64                Build x64 installers
+echo    --doc               Build CHM documentation

Tools/msi/bundle/packagegroups/postinstall.wxs

@@ -36,7 +36,7 @@
                 <MsiProperty Name="TARGETDIR" Value="[TargetDir]" />
             </MsiPackage>
             
-            <?define CompileAllCommand=-$(var.ShortVersion)$(var.Suffix32) -Wi "[TargetDir]\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "[TargetDir]\Lib"?>
+            <?define CompileAllCommand=-$(var.ShortVersion)$(var.Suffix32) -E -s -Wi "[TargetDir]\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "[TargetDir]\Lib"?>
             <ExePackage Id="compileall_AllUsers"
                         SourceFile="py.exe"
                         Compressed="yes"

Tools/msi/msi.targets

@@ -24,7 +24,7 @@
         </ItemGroup>
     </Target>
 
-    <Target Name="_TransformWxlTemplates" AfterTargets="PrepareForBuild" Inputs="@(WxlTemplate)" Outputs="$(IntermediateOutputPath)%(Filename).wxl">
+    <Target Name="_TransformWxlTemplates" AfterTargets="PrepareForBuild">
         <PropertyGroup>
             <_Content>$([System.IO.File]::ReadAllText(%(WxlTemplate.FullPath)).Replace(`{{ShortVersion}}`, `$(MajorVersionNumber).$(MinorVersionNumber)`).Replace(`{{LongVersion}}`, `$(PythonVersion)`).Replace(`{{Bitness}}`, `$(Bitness)`))</_Content>
             <_ExistingContent Condition="Exists('$(IntermediateOutputPath)%(WxlTemplate.Filename).wxl')">$([System.IO.File]::ReadAllText($(IntermediateOutputPath)%(WxlTemplate.Filename).wxl))</_ExistingContent>

Tools/msi/pip/pip.wxs

@@ -27,8 +27,8 @@
         <?endif ?>
         
         <!-- Install/uninstall pip -->
-        <CustomAction Id="SetUpdatePipCommandLine" Property="UpdatePip" Value='"[PYTHON_EXE]" -m ensurepip -U --default-pip' Execute="immediate" />
+        <CustomAction Id="SetUpdatePipCommandLine" Property="UpdatePip" Value='"[PYTHON_EXE]" -E -s -m ensurepip -U --default-pip' Execute="immediate" />
-        <CustomAction Id="SetRemovePipCommandLine" Property="UpdatePip" Value='"[PYTHON_EXE]" -B -m ensurepip._uninstall' Execute="immediate" />
+        <CustomAction Id="SetRemovePipCommandLine" Property="UpdatePip" Value='"[PYTHON_EXE]" -E -s -B -m ensurepip._uninstall' Execute="immediate" />
         
         <InstallExecuteSequence>
             <Custom Action="SetUpdatePipCommandLine" Before="UpdatePip">(&amp;DefaultFeature=3) AND NOT (!DefaultFeature=3)</Custom>