On Nov 3, 2026, at 08:56, Eric Mok via Pythonmac-SIG <[email protected]>
wrote:
> A python-help volunteer suggested I ask here about the build provenance of
> the official Python 3.14.10macOS installer.
>
>
> Could you point me to the build recipe or component manifest used for this
> official installer?
>
>
> File: python-3.14.10-macos11.pkg
> SHA-256: 286c7018aa2730f6747ca433dccdc2b31be45f078a9ea0ffa44d5f06368fd2d7
>
>
> Release: https://www.python.org/downloads/release/python-31410/
>
>
> Static inspection of the package recorded Tk 9.0.5-pre-33904f039f48ed64 and
> zstd 1.5.7. However, the inspected
> v3.14.10/Mac/BuildScript/build-installer.py specifies Tcl/Tk 9.0.4, and I
> could not locate a zstd recipe there.
>
>
> I found the official explanation that Python 3.14.9 used a prerelease Tk to
> address the macOS hang. I am seeking the corresponding build information for
> this exact 3.14.10 installer.
>
> Could you clarify:
>
>
> 1. Which build-recipe revision and additional patches or configuration
> produced this installer?
As you noticed, there are some additional steps to producing the macOS
installer packages that at the moment are not included in the cpython repo. We
are in the process of fully integrating macOS installer builds into our current
release process automation. Unfortunately, that transition has taken a lot
longer to complete than it should have, for which I take responsibility. I am
working now to finally get it done at which time the entire process will be
visible in CI like other release manufacturing steps. Stay tuned!
> 2. Which exact Tk source revision and zstd source archive were used,
> including available checksums?
The 3.14.10 macOS installer used the same source versions of Tk and zstd as
were used for the 3.14.9 installer. These were:
name=f"Tk 9.0.5-pre-33904f039f48ed64",
url="https://core.tcl-lang.org/tk/tarball/33904f039f48ed64/tk9.0.5.tar.gz";,
checksum="51ea4221578b994ec7768df9165c6682eef487a148a15003a74135c33cab35b5",
name="Zstandard 1.5.7",
url="https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-1.5.7.tar.gz";,
checksum="eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3",
> 3. Is there an existing macOS component manifest, SBOM or release-build
> record covering this artifact?
At the moment, we do not yet publish standalone SBOMs for the macOS installers.
This is a known deficiency which we plan to correct in an upcoming release as
part of the release automation mentioned above.
In the meantime, there is a process to check the integrity of existing macOS
installer packages as documented in the "How to verify your downloaded files
are genuine" section on https://www.python.org/downloads/. In addition to using
sigstore, the macOS system utility pkgutil can be used to confirm that the
installer package file has been signed with the developer identity issued to
the Python Software Foundation by Apple and has been automatically inspected
and notarized by Apple to meet Gatekeeper requirements.
pkgutil --check-signature ./python-3.14.10-macos11.pkg
It is also possible to inspect BOMs produced by the Apple packaging tools that
are stored within the signed installer package file:
lsbom $(pkgutil --bom ./python-3.14.10-macos11.pkg)
Hope this helps!
--
Ned Deily
[email protected] -- []
_______________________________________________
Pythonmac-SIG mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/pythonmac-sig.python.org
Member address: [email protected]
