Update macos-pkg-setup-template.sh

Co-authored-by: Service account <no-reply@microsoft.com>

.github/workflows/build-python-packages.yml

@@ -1,4 +1,3 @@
-
 name: Build Python package
 run-name: Generate Python ${{ inputs.VERSION || '3.12.3' }}
 on:
@@ -16,7 +15,7 @@ on:
       PLATFORMS:
         description: 'Platforms for execution in "os" or "os_arch" format (arch is "x64" by default)'
         required: true
-        default: 'ubuntu-20.04,ubuntu-20.04_arm64,ubuntu-22.04,ubuntu-22.04_arm64,ubuntu-24.04,ubuntu-24.04_arm64,macos-11_x64,macos-14_arm64,windows-2019_x64,windows-2019_x86,windows-2019_arm64'
+        default: 'ubuntu-20.04,ubuntu-22.04,ubuntu-22.04_arm64,ubuntu-24.04,ubuntu-24.04_arm64,macos-13_x64,macos-14_arm64,windows-2019_x64,windows-2019_x86,windows-2019_arm64'
   pull_request:
     paths-ignore:
     - 'versions-manifest.json'
@@ -40,29 +39,33 @@ jobs:
       - name: Generate execution matrix
         id: generate-matrix
         run: |
-          [String[]]$configurations = "${{ inputs.platforms || 'ubuntu-20.04,ubuntu-20.04_arm64,ubuntu-22.04,ubuntu-22.04_arm64,ubuntu-24.04,ubuntu-24.04_arm64,macos-11,macos-14_arm64,windows-2019_x64,windows-2019_x86,windows-2019_arm64' }}".Split(",").Trim()
+          [String[]]$configurations = "${{ inputs.platforms || 'ubuntu-20.04,ubuntu-22.04,ubuntu-22.04_arm64,ubuntu-24.04,ubuntu-24.04_arm64,macos-13,macos-14_arm64,windows-2019_x64,windows-2019_x86,windows-2019_arm64' }}".Split(",").Trim()
           $matrix = @()
-
+          
           foreach ($configuration in $configurations) {
             $parts = $configuration.Split("_")
             $os = $parts[0]
             $arch = if ($parts[1]) {$parts[1]} else {"x64"}
-
             switch -wildcard ($os) {
               "*ubuntu*" { $platform = $os.Replace("ubuntu","linux")}
               "*macos*" { $platform = 'darwin' }
               "*windows*" { $platform = 'win32' }
             }
-
-            if ($configuration -eq "windows-2019_arm64") {
+            
+            if ($configuration -eq "ubuntu-22.04_arm64") {
+              $os = "setup-actions-ubuntu-arm64-2-core"
+            }
+            elseif ($configuration -eq "ubuntu-24.04_arm64") {
+              $os = "setup-actions-ubuntu24-arm64-2-core"
+            }
+            elseif ($configuration -eq "windows-2019_arm64") {
               $os = "setup-actions-windows-arm64-4-core"
             }
+            
             $matrix += @{
               'platform' = $platform
               'os' = $os
               'arch' = $arch
-              
-
             }
           }
           echo "matrix=$($matrix | ConvertTo-Json -Compress -AsArray)" >> $env:GITHUB_OUTPUT
@@ -77,39 +80,40 @@ jobs:
     env:
       ARTIFACT_NAME: python-${{ inputs.VERSION || '3.12.3' }}-${{ matrix.platform }}-${{ matrix.arch }}
     steps:
-
       - name: Setup Environment on Windows ARM64 Runner
         if: matrix.os == 'setup-actions-windows-arm64-4-core'
         shell: powershell
         run: |
-          # Install Chocolatey
-          Set-ExecutionPolicy Bypass -Scope Process -Force
-          [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
-          iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
-          echo "C:\ProgramData\Chocolatey\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-      
-          # Install PowerShell
-          choco install powershell-core -y
-          echo "C:\Program Files\PowerShell\7" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-      
-          # Install Git
-          choco install git -y
-          echo "C:\Program Files\Git\cmd" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-      
-          
-           # Install 7-Zip
-          choco install 7zip -y
-          echo "C:\ProgramData\chocolatey\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+            # Install Chocolatey
+            Set-ExecutionPolicy Bypass -Scope Process -Force
+            [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
+            iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
+            echo "C:\ProgramData\Chocolatey\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+        
+            # Install PowerShell
+            choco install powershell-core -y
+            echo "C:\Program Files\PowerShell\7" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+        
+            # Install Git
+            choco install git -y
+            echo "C:\Program Files\Git\cmd" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+        
+            
+             # Install 7-Zip
+            choco install 7zip -y
+            echo "C:\ProgramData\chocolatey\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+            
+
       - name: Check out repository code
         uses: actions/checkout@v4
         with:
           submodules: true
 
-    
       - name: Build Python ${{ env.VERSION }}
         run: |
           ./builders/build-python.ps1 -Version $env:VERSION `
                   -Platform ${{ matrix.platform }} -Architecture ${{ matrix.arch }}
+                  
       - name: Publish artifact
         uses: actions/upload-artifact@v4
         with:
@@ -127,30 +131,29 @@ jobs:
     env:
       ARTIFACT_NAME: python-${{ inputs.VERSION || '3.12.3' }}-${{ matrix.platform }}-${{ matrix.arch }}
     steps:
-    
       - name: Setup Environment on Windows ARM64 Runner
         if: matrix.os == 'setup-actions-windows-arm64-4-core'
         shell: powershell
         run: |
-          # Install Chocolatey
-          Set-ExecutionPolicy Bypass -Scope Process -Force
-          [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
-          iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
-          echo "C:\ProgramData\Chocolatey\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-      
-          # Install PowerShell
-          choco install powershell-core -y
-          echo "C:\Program Files\PowerShell\7" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-      
-          # Install Git
-          choco install git -y
-          echo "C:\Program Files\Git\cmd" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-      
-          
-           # Install 7-Zip
-          choco install 7zip -y
-          echo "C:\ProgramData\chocolatey\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
-          
+            # Install Chocolatey
+            Set-ExecutionPolicy Bypass -Scope Process -Force
+            [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
+            iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
+            echo "C:\ProgramData\Chocolatey\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+        
+            # Install PowerShell
+            choco install powershell-core -y
+            echo "C:\Program Files\PowerShell\7" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+        
+            # Install Git
+            choco install git -y
+            echo "C:\Program Files\Git\cmd" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+        
+            
+             # Install 7-Zip
+            choco install 7zip -y
+            echo "C:\ProgramData\chocolatey\bin" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+            
       - name: Check out repository code
         uses: actions/checkout@v4
         with:
@@ -170,7 +173,6 @@ jobs:
           name: ${{ env.ARTIFACT_NAME }}
           path: ${{ runner.temp }}/${{ env.ARTIFACT_NAME }}
 
-    
       - name: Extract files
         run: |
           if ('${{ matrix.platform }}' -eq 'win32') {
@@ -209,6 +211,7 @@ jobs:
         run: |
           $pythonLocation = which python
           if ('${{ matrix.platform }}' -eq 'darwin') { otool -L $pythonLocation } else { ldd $pythonLocation }
+
       - name: Run tests
         run: |
             Install-Module Pester -Force -Scope CurrentUser -SkipPublisherCheck
@@ -243,6 +246,7 @@ jobs:
           release_name: ${{ env.VERSION }}
           body: |
             Python ${{ env.VERSION }}
+
       - name: Generate hash for packages
         run: |
           $childItems = Get-Childitem -Path '.'

.github/workflows/codeql-analysis.yml

@@ -13,4 +13,5 @@ jobs:
     name: CodeQL analysis 
     uses: actions/reusable-workflows/.github/workflows/codeql-analysis.yml@main
     with:
-     languages: "['python']"
+     languages: '["python"]'
+   

.github/workflows/releases-validation.yml

@@ -14,8 +14,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-20.04, ubuntu-22.04]
-        python: [3.9.13, 3.10.11, 3.11.8]
+        os: [macos-latest, windows-latest, ubuntu-20.04, ubuntu-22.04, macos-13]
+        python: [3.9.13, 3.10.11, 3.11.8, 3.12.7, 3.13.0]
     steps:
     - name: setup-python ${{ matrix.python }}
       uses: actions/setup-python@v5

builders/macos-python-builder.psm1

@@ -6,18 +6,17 @@ class macOSPythonBuilder : NixPythonBuilder {
     MacOS Python builder class.
 
     .DESCRIPTION
-    Contains methods that required to build macOS Python artifact from sources. Inherited from base NixPythonBuilder.
+    Contains methods required to build macOS Python artifacts from sources. Inherited from base NixPythonBuilder.
 
     While python.org provides precompiled binaries for macOS, switching to them risks breaking existing customers.
     If we wanted to start using the official binaries instead of building from source, we should avoid changing previous versions
     so we remain backwards compatible.
 
     .PARAMETER platform
-    The full name of platform for which Python should be built.
+    The full name of the platform for which Python should be built.
 
     .PARAMETER version
     The version of Python that should be built.
-
     #>
 
     macOSPythonBuilder(
@@ -31,14 +30,18 @@ class macOSPythonBuilder : NixPythonBuilder {
         .SYNOPSIS
         Prepare system environment by installing dependencies and required packages.
         #>
-        
-        if ($this.Version -eq "3.7.17") {
-            # We have preinstalled ncurses and readLine on the hoster runners. But we need to install bzip2 for 
-            # setting up an environemnt 
-            # If we get any issues realted to ncurses or readline we can try to run this command
-            # brew install ncurses readline
-            Execute-Command -Command "brew install bzip2"
-        }
+
+        # Only for Python 3.7.17, install additional dependencies
+    if ($this.Version -eq "3.7.17") {
+        Write-Host "Installing additional dependencies for Python 3.7.17..."
+        # Install necessary dependencies for Python 3.7.17
+        Execute-Command -Command "brew install bzip2 zlib readline ncurses sqlite3 openssl@3"
+
+        # Ensure the environment variables for zlib are set correctly
+        $zlibPrefix = (brew --prefix zlib)
+        $env:LDFLAGS += " -L$($zlibPrefix)/lib"
+        $env:CFLAGS += " -I$($zlibPrefix)/include"
+    }
     }
 
     [void] Configure() {
@@ -68,13 +71,13 @@ class macOSPythonBuilder : NixPythonBuilder {
         ### and then add the appropriate paths for the header and library files to configure command.
         ### Link to documentation (https://cpython-devguide.readthedocs.io/setup/#build-dependencies)
         if ($this.Version -lt "3.7.0") {
-            $env:LDFLAGS = "-L/usr/local/opt/openssl@1.1/lib -L/usr/local/opt/zlib/lib"
-            $env:CFLAGS = "-I/usr/local/opt/openssl@1.1/include -I/usr/local/opt/zlib/include"
+            $env:LDFLAGS = "-L/usr/local/opt/openssl@3/lib -L/usr/local/opt/zlib/lib"
+            $env:CFLAGS = "-I/usr/local/opt/openssl@3/include -I/usr/local/opt/zlib/include"
         } else {
-            $configureString += " --with-openssl=/usr/local/opt/openssl@1.1"
+            $configureString += " --with-openssl=/usr/local/opt/openssl@1.1"  # For Python 3.7.x, use OpenSSL 1.1
 
-            # For Python 3.7.2 and 3.7.3 we need to provide PATH for zlib to pack it properly. Otherwise the build will fail
-            # with the error: zipimport.ZipImportError: can't decompress data; zlib not available
+            # For Python 3.7.2, 3.7.3, and 3.7.17 we need to provide PATH for zlib to pack it properly.
+            # Otherwise, the build will fail with the error: zipimport.ZipImportError: can't decompress data; zlib not available
             if ($this.Version -eq "3.7.2" -or $this.Version -eq "3.7.3" -or $this.Version -eq "3.7.17") {
                 $env:LDFLAGS = "-L/usr/local/opt/zlib/lib"
                 $env:CFLAGS = "-I/usr/local/opt/zlib/include"
@@ -82,9 +85,11 @@ class macOSPythonBuilder : NixPythonBuilder {
 
             if ($this.Version -gt "3.7.12") {
                 $configureString += " --with-tcltk-includes='-I /usr/local/opt/tcl-tk/include' --with-tcltk-libs='-L/usr/local/opt/tcl-tk/lib -ltcl8.6 -ltk8.6'"
-	        }
+            }
 
+            # Specific for Python 3.7.17
             if ($this.Version -eq "3.7.17") {
+                Write-Host "Setting environment for Python 3.7.17..."
                 $env:LDFLAGS += " -L$(brew --prefix bzip2)/lib -L$(brew --prefix readline)/lib -L$(brew --prefix ncurses)/lib"
                 $env:CFLAGS += " -I$(brew --prefix bzip2)/include -I$(brew --prefix readline)/include -I$(brew --prefix ncurses)/include"
             }

builders/win-python-builder.psm1

@@ -1,4 +1,3 @@
-
 using module "./python-builder.psm1"
 
 class WinPythonBuilder : PythonBuilder {
@@ -65,7 +64,6 @@ class WinPythonBuilder : PythonBuilder {
                 $ArchitectureExtension = "-arm64"
         }
 
-
         return $ArchitectureExtension
     }
 

installers/macos-pkg-setup-template.sh

@@ -23,25 +23,47 @@ PYTHON_TOOLCACHE_VERSION_ARCH_PATH=$PYTHON_TOOLCACHE_VERSION_PATH/$ARCH
 PYTHON_FRAMEWORK_PATH="/Library/Frameworks/Python.framework/Versions/${MAJOR_VERSION}.${MINOR_VERSION}"
 PYTHON_APPLICATION_PATH="/Applications/Python ${MAJOR_VERSION}.${MINOR_VERSION}"
 
-echo "Check if Python hostedtoolcache folder exist..."
+# Check if zlib is installed
+echo "Checking if zlib is installed..."
+if ! brew list zlib &>/dev/null; then
+    echo "Installing zlib via brew..."
+    brew install zlib
+else
+    echo "zlib already installed."
+fi
+
+# Only for Python 3.7.17, install additional dependencies like zlib and others
+if [ "$MAJOR_VERSION" -eq 3 ] && [ "$MINOR_VERSION" -eq 7 ] && [ "$PYTHON_FULL_VERSION" == "3.7.17" ]; then
+    echo "Installing additional dependencies for Python 3.7.17..."
+    brew install bzip2 readline ncurses sqlite3 openssl@3
+    # Ensure the environment variables for zlib are set correctly
+    ZLIB_PREFIX=$(brew --prefix zlib)
+    export LDFLAGS="-L${ZLIB_PREFIX}/lib"
+    export CFLAGS="-I${ZLIB_PREFIX}/include"
+    export CPPFLAGS="-I${ZLIB_PREFIX}/include"
+    echo "zlib linked at ${ZLIB_PREFIX}/lib"
+fi
+
+# Check if Python hostedtoolcache folder exists...
+echo "Check if Python hostedtoolcache folder exists..."
 if [ ! -d $PYTHON_TOOLCACHE_PATH ]; then
     echo "Creating Python hostedtoolcache folder..."
     mkdir -p $PYTHON_TOOLCACHE_PATH
 else
-    # remove ALL other directories for same major.minor python versions
-    find $PYTHON_TOOLCACHE_PATH -name "${MAJOR_VERSION}.${MINOR_VERSION}.*"|while read python_version;do
+    # Remove ALL other directories for same major.minor python versions
+    find $PYTHON_TOOLCACHE_PATH -name "${MAJOR_VERSION}.${MINOR_VERSION}.*" | while read python_version; do
         python_version_arch="$python_version/$ARCH"
-        if [ -e "$python_version_arch" ];then
+        if [ -e "$python_version_arch" ]; then
             echo "Deleting Python $python_version_arch"
             rm -rf "$python_version_arch"
         fi
     done
 fi
 
-echo "Install Python binaries from prebuilt package"
+echo "Installing Python binaries from prebuilt package"
 sudo installer -pkg $PYTHON_PKG_NAME -target /
 
-echo "Create hostedtoolcach symlinks (Required for the backward compatibility)"
+echo "Creating hostedtoolcache symlinks (Required for the backward compatibility)"
 echo "Create Python $PYTHON_FULL_VERSION folder"
 mkdir -p $PYTHON_TOOLCACHE_VERSION_ARCH_PATH
 cd $PYTHON_TOOLCACHE_VERSION_ARCH_PATH
@@ -51,7 +73,7 @@ ln -s "${PYTHON_FRAMEWORK_PATH}/include" include
 ln -s "${PYTHON_FRAMEWORK_PATH}/share" share
 ln -s "${PYTHON_FRAMEWORK_PATH}/lib" lib
 
-echo "Create additional symlinks (Required for the UsePythonVersion Azure Pipelines task and the setup-python GitHub Action)"
+echo "Creating additional symlinks (Required for the UsePythonVersion Azure Pipelines task and the setup-python GitHub Action)"
 ln -s ./bin/$PYTHON_MAJOR_DOT_MINOR python
 
 cd bin/
@@ -73,8 +95,8 @@ export PIP_ROOT_USER_ACTION=ignore
 ./python -m ensurepip
 ./python -m pip install --upgrade --force-reinstall pip --disable-pip-version-check --no-warn-script-location
 
-echo "Install OpenSSL certificates"
+echo "Installing OpenSSL certificates"
 sh -e "${PYTHON_APPLICATION_PATH}/Install Certificates.command"
 
-echo "Create complete file"
+echo "Creating complete file"
 touch $PYTHON_TOOLCACHE_VERSION_PATH/${ARCH}.complete

tests/sources/python-config-test.py

@@ -54,15 +54,15 @@ else:
 if os_type == 'Darwin':
     ### Validate openssl links
     if version_major == 3 and version_minor < 7:
-        expected_ldflags = '-L/usr/local/opt/openssl@1.1/lib'
+        expected_ldflags = '-L/usr/local/opt/openssl@3/lib'
         ldflags = sysconfig.get_config_var('LDFLAGS')
 
         if not expected_ldflags in ldflags:
             print('Invalid ldflags: %s; Expected: %s' % (ldflags, expected_ldflags))
             exit(1)
     else:
-        expected_openssl_includes = '-I/usr/local/opt/openssl@1.1/include'
-        expected_openssl_ldflags ='-L/usr/local/opt/openssl@1.1/lib'
+        expected_openssl_includes = '-I/usr/local/opt/openssl@3/include'
+        expected_openssl_ldflags ='-L/usr/local/opt/openssl@3/lib'
 
         openssl_includes = sysconfig.get_config_var('OPENSSL_INCLUDES')
         openssl_ldflags = sysconfig.get_config_var('OPENSSL_LDFLAGS')