Five things we learned during local validation that the original
docs didn't anticipate:
- PYTHON_BASEURL needs three %s slots (relocatable-python passes
version, version, os-version)
- mkdir -m 777 doesn't apply mode to existing dirs; need explicit chmod
- --no-unsign disabled relocatable-python's own re-sign step and
caused Apple Silicon Gatekeeper SIGKILLs at ensurepip time
- Signed pkg must move to outputs/ before cleanup() runs
- pyobjc 12.1 requires Python >= 3.10; 3.9 needs holdback to 11.1
Also confirmed all upstream SHAs (relocatable-python, munki-pkg) and
all 37 Python package pins are at latest available as of 2026-05-11.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
