6 files changed, 87 insertions, 112 deletions
diff --git a/Mac/BuildScript/README.txt b/Mac/BuildScript/README.txt
index db687be..f8b25fa 100644
--- a/Mac/BuildScript/README.txt
+++ b/Mac/BuildScript/README.txt
@@ -1,25 +1,15 @@
 Building a Python Mac OS X distribution
 =======================================
 
-The ``build-installer.py`` script creates Python distributions, including
-certain third-party libraries as necessary.  It builds a complete 
-framework-based Python out-of-tree, installs it in a funny place with 
-$DESTROOT, massages that installation to remove .pyc files and such, creates 
-an Installer package from the installation plus other files in ``resources`` 
+The ``build-install.py`` script creates Python distributions, including
+certain third-party libraries as necessary.  It builds a complete
+framework-based Python out-of-tree, installs it in a funny place with
+$DESTROOT, massages that installation to remove .pyc files and such, creates
+an Installer package from the installation plus other files in ``resources``
 and ``scripts`` and placed that on a ``.dmg`` disk image.
 
-This installers built by this script are legacy bundle installers that have
-been supported from the early days of OS X.  In particular, they are supported
-on OS X 10.3.9, the earliest supported release for builds from this script.
-
-Beginning with Python 3.4.2, PSF practice is to build two installer variants
-using the newer flat package format, supported on 10.5+, and signed with the
-builder's Apple developer key, allowing downloaded packages to satisfy Apple's
-default Gatekeeper policy (e.g. starting with 10.8, Apple store downloads and
-Apple developer ID signed apps and installer packages).  The process for
-transforming the output build artifacts into signed flat packages is not
-yet integrated into ``build-installer.py``.  The steps prior to the flat
-package creation are the same as for 3.4.1 below.
+For Python 3.4.0, PSF practice is to build two installer variants
+for each release.
 
 1.  32-bit-only, i386 and PPC universal, capable on running on all machines
     supported by Mac OS X 10.5 through (at least) 10.9::
@@ -31,7 +21,6 @@ package creation are the same as for 3.4.1 below.
 
     - builds the following third-party libraries
 
-        * libcrypto and libssl from OpenSSL 1.0.1 (new, as of 3.4.3)
         * NCurses 5.9 (http://bugs.python.org/issue15037)
         * SQLite 3.8.11
         * XZ 5.0.5
@@ -73,7 +62,6 @@ package creation are the same as for 3.4.1 below.
 
     - uses system-supplied versions of third-party libraries
 
-        * libcrypto and libssl from Apple OpenSSL 0.9.8
         * readline module links with Apple BSD editline (libedit)
 
     - requires ActiveState Tcl/Tk 8.5.15.1 (or later) to be installed for building
@@ -102,6 +90,47 @@ package creation are the same as for 3.4.1 below.
           that the Xcode 3 gcc-4.2 compiler has had.
 
 
+*   For Python 2.7.x and 3.2.x, the 32-bit-only installer was configured to
+    support Mac OS X 10.3.9 through (at least) 10.6.  Because it is
+    believed that there are few systems still running OS X 10.3 or 10.4
+    and because it has become increasingly difficult to test and
+    support the differences in these earlier systems, as of Python 3.3.0 the PSF
+    32-bit installer no longer supports them.  For reference in building such
+    an installer yourself, the details are::
+
+        /usr/bin/python build-installer.py \
+            --sdk-path=/Developer/SDKs/MacOSX10.4u.sdk \
+            --universal-archs=32-bit \
+            --dep-target=10.3
+
+    - builds the following third-party libraries
+
+        * Bzip2
+        * NCurses
+        * GNU Readline (GPL)
+        * SQLite 3
+        * XZ
+        * Zlib 1.2.3
+        * Oracle Sleepycat DB 4.8 (Python 2.x only)
+
+    - requires ActiveState ``Tcl/Tk 8.4`` (currently 8.4.20) to be installed for building
+
+    - recommended build environment:
+
+        * Mac OS X 10.5.8 PPC or Intel
+        * Xcode 3.1.4 (or later)
+        * ``MacOSX10.4u`` SDK (later SDKs do not support PPC G3 processors)
+        * ``MACOSX_DEPLOYMENT_TARGET=10.3``
+        * Apple ``gcc-4.0``
+        * system Python 2.5 for documentation build with Sphinx
+
+    - alternate build environments:
+
+        * Mac OS X 10.6.8 with Xcode 3.2.6
+            - need to change ``/System/Library/Frameworks/{Tcl,Tk}.framework/Version/Current`` to ``8.4``
+
+
+
 General Prerequisites
 ---------------------
 
@@ -145,7 +174,7 @@ Here are the steps you need to follow to build a Python installer:
 Building other universal installers
 ...................................
 
-It is also possible to build a 4-way universal installer that runs on 
+It is also possible to build a 4-way universal installer that runs on
 OS X 10.5 Leopard or later::
 
     /usr/bin/python /build-installer.py \
@@ -179,7 +208,7 @@ a PPC G4 system with OS X 10.5 and at least one Intel system running OS X
 
     /usr/local/bin/pythonn.n -m test -w -u all,-largefile
     /usr/local/bin/pythonn.n-32 -m test -w -u all
-    
+
 Certain tests will be skipped and some cause the interpreter to fail
 which will likely generate ``Python quit unexpectedly`` alert messages
 to be generated at several points during a test run.  These are normal
diff --git a/Mac/BuildScript/build-installer.py b/Mac/BuildScript/build-installer.py
index f363ebd..e8a1126 100755
--- a/Mac/BuildScript/build-installer.py
+++ b/Mac/BuildScript/build-installer.py
@@ -572,7 +572,7 @@ def getTclTkVersion(configfile, versionline):
     """
     try:
         f = open(configfile, "r")
-    except:
+    except OSError:
         fatal("Framework configuration file not found: %s" % configfile)
 
     for l in f:
@@ -814,7 +814,7 @@ def downloadURL(url, fname):
     except:
         try:
             os.unlink(fname)
-        except:
+        except OSError:
             pass
 
 def verifyThirdPartyFile(url, checksum, fname):
diff --git a/Mac/BuildScript/resources/ReadMe.rtf b/Mac/BuildScript/resources/ReadMe.rtf
index 52d8b80..65e3f14 100644
--- a/Mac/BuildScript/resources/ReadMe.rtf
+++ b/Mac/BuildScript/resources/ReadMe.rtf
@@ -1,4 +1,4 @@
-{\rtf1\ansi\ansicpg1252\cocoartf1347\cocoasubrtf570
+{\rtf1\ansi\ansicpg1252\cocoartf1348\cocoasubrtf170
 {\fonttbl\f0\fswiss\fcharset0 Helvetica;\f1\fmodern\fcharset0 CourierNewPSMT;}
 {\colortbl;\red255\green255\blue255;}
 \margl1440\margr1440\vieww13380\viewh14600\viewkind0
@@ -24,7 +24,7 @@ Python.org provides two installer variants for download: one that installs a
 \i0  variant.  Unless you are installing to an 10.5 system or you need to build applications that can run on 10.5 systems, use the 10.6 variant if possible.  There are some additional operating system functions that are supported starting with 10.6 and you may see better performance using 64-bit mode.  By default, Python will automatically run in 64-bit mode if your system supports it.  Also see 
 \i Certificate verification and OpenSSL
 \i0  below.  The Pythons installed by these installers are built with private copies of some third-party libraries not included with or newer than those in OS X itself.  The list of these libraries varies by installer variant and is included at the end of the License.rtf file.
-\b \ul \ulc0 \
+\b \ul \
 \
 Update your version of Tcl/Tk to use IDLE or other Tk applications
 \b0 \ulnone \
@@ -36,75 +36,16 @@ To use IDLE or other programs that use the Tkinter graphical user interface tool
 \i0  for this version of Python and of Mac OS X.\
 
 \b \ul \
-Installing on OS X 10.8 (Mountain Lion) or later systems\
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
-\cf0 \ulnone [CHANGED for Python 3.4.2]
-\b0 \
-\
-As of Python 3.4.2, installer packages from python.org are now compatible with the Gatekeeper security feature introduced in OS X 10.8.   Downloaded packages can now be directly installed by double-clicking with the default system security settings.  Python.org installer packages for OS X are signed with the Developer ID of the builder, as identified on {\field{\*\fldinst{HYPERLINK "https://www.python.org/downloads/"}}{\fldrslt the download page}} for this release.  To inspect the digital signature of the package, click on the lock icon in the upper right corner of the 
-\i Install Python
-\i0  installer window.  Refer to Apple\'92s support pages for {\field{\*\fldinst{HYPERLINK "http://support.apple.com/kb/ht5290"}}{\fldrslt more information on Gatekeeper}}.\
-\
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
-
-\b \cf0 \ul Simplified web-based installs\
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
-\cf0 \ulnone [NEW for Python 3.4.2]
-\b0 \
-\
-With the change to the newer flat format installer package, the download file now has a 
-\f1 .pkg
-\f0  extension as it is no longer necessary to embed the installer within a disk image (
-\f1 .dmg
-\f0 ) container.   If you download the Python installer through a web browser, the OS X installer application may open automatically to allow you to perform the install.  If your browser settings do not allow automatic open, double click on the downloaded installer file.\
-\
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
+Certificate verification and OpenSSL\
 
-\b \cf0 \ul New Installation Options and Defaults\
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
-\cf0 \ulnone [NEW for Python 3.4.0]
-\b0 \
-\
-The Python installer now includes an option to automatically install or upgrade 
-\f1 pip
-\f0 , a tool for installing and managing Python packages.  This option is enabled by default and no Internet access is required.  If you do not want the installer to do this, select the 
-\i Customize
-\i0  option at the 
-\i Installation Type
-\i0  step and uncheck the 
-\i Install or ugprade pip
-\i0  option.\
-\
-To make it easier to use scripts installed by third-party Python packages, with 
-\f1 pip
-\f0  or by other means, the 
-\i Shell profile updater
-\i0  option is now enabled by default, as has been the case with Python 2.7.x installers. You can also turn this option off by selecting 
-\i Customize
-\i0  and unchecking the 
-\i Shell profile updater
-\i0  option. You can also update your shell profile later by launching the 
-\i Update Shell Profile
-\i0  command found in the 
-\f1 /Applications/Python $VERSION 
-\f0 folder.  You may need to start a new terminal window for the changes to take effect.\
-\
-For other changes in this release, see the Release Notes link for this release at {\field{\*\fldinst{HYPERLINK "https://www.python.org/downloads/"}}{\fldrslt https://www.python.org/downloads/}}.\
-\
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
-
-\b \cf0 \ul Certificate verification and OpenSSL\
-\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
-\cf0 \ulnone [CHANGED for Python 3.4.3]
-\b0 \
-\
-Python 3.4.3 includes a number of network security enhancements that have been approved for inclusion in Python 3.4 maintenance releases.  {\field{\*\fldinst{HYPERLINK "https://www.python.org/dev/peps/pep-0476/"}}{\fldrslt PEP 476}} changes several standard library modules, like 
+\b0 \ulnone \
+Python 3.5 includes a number of network security enhancements that were released in Python 3.4.3 and Python 2.7.10.  {\field{\*\fldinst{HYPERLINK "https://www.python.org/dev/peps/pep-0476/"}}{\fldrslt PEP 476}} changes several standard library modules, like 
 \i httplib
 \i0 , 
 \i urllib
 \i0 , and 
 \i xmlrpclib
-\i0 , to by default verify certificates presented by servers over secure (TLS) connections.  The verification is performed by the OpenSSL libraries that Python is linked to.  Prior to 3.4.3, the python.org installers dynamically linked with Apple-supplied OpenSSL libraries shipped with OS X.  OS X provides a multiple level security framework that stores trust certificates in system and user keychains managed by the 
+\i0 , to by default verify certificates presented by servers over secure (TLS) connections.  The verification is performed by the OpenSSL libraries that Python is linked to.  Prior to 3.4.3, both python.org installers dynamically linked with Apple-supplied OpenSSL libraries shipped with OS X.  OS X provides a multiple level security framework that stores trust certificates in system and user keychains managed by the 
 \i Keychain Access 
 \i0 application and the 
 \i security
@@ -122,10 +63,10 @@ For OS X 10.5, Apple provides
 \f1 /System/Library/OpenSSL
 \f0 .  These directories are typically empty and not managed by OS X; you must manage them yourself or supply your own SSL contexts.  OpenSSL 0.9.7 is obsolete by current security standards, lacking a number of important features found in later versions.  Among the problems this causes is the inability to verify higher-security certificates now used by python.org services, including 
 \i t{\field{\*\fldinst{HYPERLINK "https://pypi.python.org/pypi"}}{\fldrslt he Python Package Index, PyPI}}
-\i0 .  To solve this problem, as of 3.4.3 the 
+\i0 .  To solve this problem, the 
 \i 10.5+ 32-bit-only python.org variant
 \i0  is linked with a private copy of 
-\i OpenSSL 1.0
+\i OpenSSL 1.0.2
 \i0 ; it consults the same default certificate directory, 
 \f1 /System/Library/OpenSSL
 \f0 .   As before, it is still necessary to manage certificates yourself when you use this Python variant and, with certificate verification now enabled by default, you may now need to take additional steps to ensure your Python programs have access to CA certificates you trust.  If you use this Python variant to build standalone applications with third-party tools like {\field{\*\fldinst{HYPERLINK "https://pypi.python.org/pypi/py2app/"}}{\fldrslt 
@@ -137,7 +78,7 @@ For OS X 10.6+, Apple also provides
 \i 0.9.8 libraries
 \i0 .  Apple's 0.9.8 version includes an important additional feature: if a certificate cannot be verified using the manually administered certificates in 
 \f1 /System/Library/OpenSSL
-\f0 , the certificates managed by the system security framework In the user and system keychains are also consulted (using Apple private APIs).  For this reason, for 3.4.3 the 
+\f0 , the certificates managed by the system security framework In the user and system keychains are also consulted (using Apple private APIs).  For this reason, the 
 \i 64-bit/32-bit 10.6+ python.org variant
 \i0  continues to be dynamically linked with Apple's OpenSSL 0.9.8 since it was felt that the loss of the system-provided certificates and management tools outweighs the additional security features provided by newer versions of OpenSSL.  This will likely change in future releases of the python.org installers as Apple has deprecated use of the system-supplied OpenSSL libraries.  If you do need features from newer versions of OpenSSL, there are third-party OpenSSL wrapper packages available through 
 \i PyPI
@@ -145,7 +86,18 @@ For OS X 10.6+, Apple also provides
 \
 The bundled 
 \f1 pip
-\f0  included with 3.4.3 has its own default certificate store for verifying download connections.\
+\f0  included with the Python 3.5 installers has its own default certificate store for verifying download connections.\
+\
+
+\b \ul Other changes\
+
+\b0 \ulnone \
+\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
+\cf0 For other changes in this release, see the 
+\i What's new
+\i0  section in the {\field{\*\fldinst{HYPERLINK "https://www.python.org/doc/"}}{\fldrslt Documentation Set}} for this release and its 
+\i Release Notes
+\i0  link at {\field{\*\fldinst{HYPERLINK "https://www.python.org/downloads/"}}{\fldrslt https://www.python.org/downloads/}}.\
 \pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\pardirnatural
 
 \b \cf0 \ul \
diff --git a/Mac/BuildScript/resources/Welcome.rtf b/Mac/BuildScript/resources/Welcome.rtf
index 2527787..dfb75d8 100644
--- a/Mac/BuildScript/resources/Welcome.rtf
+++ b/Mac/BuildScript/resources/Welcome.rtf
@@ -1,5 +1,5 @@
 {\rtf1\ansi\ansicpg1252\cocoartf1343\cocoasubrtf160
-\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;\f1\fmodern\fcharset0 CourierNewPSMT;}
+\cocoascreenfonts1{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
 {\colortbl;\red255\green255\blue255;}
 \paperw11905\paperh16837\margl1440\margr1440\vieww12200\viewh10880\viewkind0
 \pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640
@@ -17,12 +17,6 @@
 \b0 .\
 \
 
-\b NEW for Python 3.4.3: 
-\b0  3.4.3 includes network security enhancements that may require changes to your Python applications.  See the 
-\f1 ReadMe
-\f0  file and {\field{\*\fldinst{HYPERLINK "https://docs.python.org/3/whatsnew/3.4.html#changed-in-3-4-3"}}{\fldrslt the Python documentation}} for more information.\
-\
-
 \b IMPORTANT:
 \b0  
 \b IDLE
diff --git a/Mac/BuildScript/scripts/postflight.ensurepip b/Mac/BuildScript/scripts/postflight.ensurepip
index bf893d1..3074fa3 100755
--- a/Mac/BuildScript/scripts/postflight.ensurepip
+++ b/Mac/BuildScript/scripts/postflight.ensurepip
@@ -10,15 +10,15 @@ RELFWKBIN="../../..${FWK}/bin"
 
 umask 022
 
-"${FWK}/bin/python${PYVER}" -m ensurepip --upgrade
+"${FWK}/bin/python${PYVER}" -E -s -m ensurepip --upgrade
 
-"${FWK}/bin/python${PYVER}" -Wi \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+"${FWK}/bin/python${PYVER}" -E -s -Wi \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x badsyntax \
     "${FWK}/lib/python${PYVER}/site-packages"
 
-"${FWK}/bin/python${PYVER}" -Wi -O \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+"${FWK}/bin/python${PYVER}" -E -s -Wi -O \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x badsyntax \
     "${FWK}/lib/python${PYVER}/site-packages"
 
diff --git a/Mac/BuildScript/scripts/postflight.framework b/Mac/BuildScript/scripts/postflight.framework
index eb08297..0f2e52c 100755
--- a/Mac/BuildScript/scripts/postflight.framework
+++ b/Mac/BuildScript/scripts/postflight.framework
@@ -6,23 +6,23 @@
 PYVER="@PYVER@"
 FWK="/Library/Frameworks/Python.framework/Versions/@PYVER@"
 
-"${FWK}/bin/python@PYVER@" -Wi \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+"${FWK}/bin/python@PYVER@" -E -s -Wi \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x 'bad_coding|badsyntax|site-packages|lib2to3/tests/data' \
     "${FWK}/lib/python${PYVER}"
 
-"${FWK}/bin/python@PYVER@" -Wi -O \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+"${FWK}/bin/python@PYVER@" -E -s -Wi -O \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x 'bad_coding|badsyntax|site-packages|lib2to3/tests/data' \
     "${FWK}/lib/python${PYVER}"
 
-"${FWK}/bin/python@PYVER@" -Wi \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+"${FWK}/bin/python@PYVER@" -E -s -Wi \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x badsyntax \
     "${FWK}/lib/python${PYVER}/site-packages"
 
-"${FWK}/bin/python@PYVER@" -Wi -O \
-    "${FWK}/lib/python${PYVER}/compileall.py" \
+"${FWK}/bin/python@PYVER@" -E -s -Wi -O \
+    "${FWK}/lib/python${PYVER}/compileall.py" -q -j0 \
     -f -x badsyntax \
     "${FWK}/lib/python${PYVER}/site-packages"