A Python 3 framework that installs to /Library/ManagedFrameworks/Python/Python3.framework.
Please see Apple's documentation on file system basics for context.
This is an intended replacement for /usr/bin/python, which Apple removed in macOS 12.3 (Spring 2022).
Builds and packages target Apple Silicon (arm64). Universal2 outputs are no longer produced. Build hosts and target machines must be Apple Silicon Macs.
CI builds Python 3.11.9, 3.12.10, 3.13.17, 3.14.9, and 3.15.1 with the shared recommended dependencies, including PyObjC 12.2.2 and CFFI 2.1.1 for Python 3.15 compatibility.
- Ships with PyObjC and other modules useful for Mac admins, similar in spirit to the Apple Python it replaces
- Installs to a location less likely to be overwritten, removed, or modified by other Python installations
After installing the package, /usr/local/bin/managed_python3 is a symlink to /Library/ManagedFrameworks/Python/Python3.framework/Versions/Current/Resources/Python.app/Contents/MacOS/Python.
Point your shebang directly at the symlink:
#!/Library/ManagedFrameworks/Python/Python3.framework/Versions/Current/bin/python3
print('This is an example script.')
For zsh scripts you can add a global alias to /etc/zshenv:
alias -g python3.framework='/Library/ManagedFrameworks/Python/Python3.framework/Versions/Current/bin/python3'
See Armin Briegel's "Moving to Zsh" Part II and IV.
Only a single package may be installed at any given time. The preinstall script removes any previous framework.
Python itself has its own release cadence; this package will see additional updates as 3rd-party libraries release fixes and security updates. Always test your scripts before deploying broadly.
Not supported.
pip is bundled but not recommended for installing external libraries into the framework. Use a virtual environment or a tool like pyenv instead. Pull requests to the recommended requirements file are welcome.
Build an unsigned framework on Apple Silicon with:
./build_python_framework_pkgs.zsh --python-version 3.15.1
Pass --installer-id, --application-id, and --notary-password to produce a signed and notarized .pkg.
The build bootstraps pip 26.2.2 from a SHA-256-verified wheel before accessing
PyPI, updates the pip bundled with ensurepip, and installs certifi 2026.10.19
and virtualenv 21.14.13. These updates address the
eMudhra/emSign certificate security incident
for the framework and newly created Python 3.11–3.15 virtual environments.
Python 3.13, 3.14, and 3.15 builds use the 3.13.17, 3.14.9, and 3.15.1 installers;
3.11 and 3.12 retain their last upstream macOS installers with patched ensurepip.
Before packaging, the build verifies package dependencies, CA stores, offline
venv and virtualenv creation, and HTTPS access through the standard library
and Requests. Pull requests build and notarize packages; publishing a release
requires a manual workflow run.
Existing virtual environments have their own copies of pip and certifi and must be updated separately using the advisory's instructions. Python 3.9 is outside this framework's supported versions; virtualenv's compatibility seed for that version does not include the fixed pip.
Do this in a clean virtual environment. After every Python package install, run pip freeze | xargs pip uninstall -y to reset the environment.
To update the signing certificate, run base64 -i /path/to/certificate.p12 -o base64string and import it into the GitHub Actions secrets store along with the matching password.
Built on two open-source tools by Greg Neagle: