and link with a private copy of OpenSSL, like installers targeted
for 10.5 already do, since Apple has deprecated use of the system
OpenSSL and removed its header files from the Xcode 7 SDK. Note
that this configuration is not currently used to build any
python.org-supplied installers and that the private copy of
OpenSSL requires its own root certificates.
Among other issues, the Apple-supplied 0.9.7 libs for the 10.5 ABI cannot
verify newer SHA-256 certs as now used by python.org services. Document
in the installer ReadMe some of the certificate management issues that
users now need to be more concerned with due to PEP 476's enabling cert
verification by default. For now, continue to use the Apple-supplied
0.9.8 libs for the 10.6+ installer since they use Apple private APIs to
verify certificates using the system- and user-managed CA keychain stores.
The backport of ensurepip to 2.7.9 allows pip to optionally be installed
or upgraded using the bundled pip provided by the new ensurepip module.
The option can be specified persistently using the configure option:
./configure --with-ensurepip[=upgrade|install|no]
It can also be overridden on either the "install" or "altinstall" targets:
make [alt]install ENSUREPIP=[upgrade|install|no]
For Python 2, the default option is "no" (do not install pip).
