Previous Home Next

8.17. python 3.14.4

Rebuild python in the final target environment with LibreSSL, pip, and optimized runtime support.

Input assumption: Python-3.14.4.tar.xz and python-3.14.4-libressl-hostflags-guard.patch are already present in /sources from the chapter 4 source staging step and the book's distributed patch files.

Source URL: https://www.python.org/ftp/python/3.14.4/Python-3.14.4.tar.xz

Patch file: patches/python-3.14.4-libressl-hostflags-guard.patch

Upstream build note: upstream configure --help documents --enable-optimizations as the stable optimization path using PGO. The same configure help documents --with-pkg-config, --with-openssl-rpath, --with-platlibdir, --with-tzpath, --with-ensurepip, and --without-static-libpython.

LibreSSL note: this build relies on LibreSSL's installed openssl.pc file instead of --with-openssl=/system, because the book's include directory is /system/headers, not /system/include.

Licenses:

Python-2.0

Dependencies:

musl (libc)
LibreSSL
SQLite
pkgconf
xz
zlib-ng
make

python is a general-purpose programming language and runtime. we need it to provide an optimized final python3 runtime with pip3, _ssl, _hashlib, and SQLite module support for system tools and package builds.

Extract and Enter the Source Tree

cd /sources
rm -rf Python-3.14.4
tar -xf Python-3.14.4.tar.xz
cd Python-3.14.4

Apply LibreSSL Patch

patch -Np1 -i ../python-3.14.4-libressl-hostflags-guard.patch

Configure python

--enable-optimizations makes the build slower because Python performs profile-guided optimization. --with-ensurepip=install installs the bundled pip tooling so later Python package sections can use pip3.

ax_cv_c_float_words_bigendian=no \
lbi_configure \
    --enable-shared \
    --enable-optimizations \
    --with-pkg-config=yes \
    --with-openssl-rpath=auto \
    --with-ensurepip=install \
    --without-static-libpython \
    --with-tzpath= \
    --with-platlibdir=libraries

Build python

make $LWI_MAKE_FLAGS

Install python

make install

Move pip Scripts to /system/binaries

ensurepip may install pip3 and pip3.14 into /system/bin instead of the book's configured /system/binaries directory.

if [ -d /system/bin ]; then
    for pip_script in pip3 pip3.14; do
        if [ -e "/system/bin/$pip_script" ]; then
            mv -f "/system/bin/$pip_script" /system/binaries/
        fi
    done

    rmdir /system/bin 2>/dev/null || true
fi

Verify pip

pip3 --version

After this step is complete, you can remove the extracted source directory and source tarball from /sources if you do not plan to rebuild python again.

Command Explanations

rm -rf Python-3.14.4: Removes any previous Python source tree before rebuilding.
patch -Np1 -i ../python-...patch: Applies the book's LibreSSL host-flags guard patch.
ax_cv_c_float_words_bigendian=no: Preanswers a Python configure probe for the target.
lbi_configure: Applies the book's /system install layout.
--enable-shared, --enable-optimizations, and --with-ensurepip=install: Build shared Python, enable optimized build behavior, and install pip.
--with-pkg-config=yes and --with-openssl-rpath=auto: Use pkgconf metadata and automatic OpenSSL/LibreSSL runtime path handling.
make $LWI_MAKE_FLAGS and make install: Build and install Python.
mv -f /system/bin/pip* /system/binaries/: Moves pip scripts out of upstream's default bin directory.
pip3 --version: Verifies the installed pip command.

Previous Home Next