Getting Pip working for Python 3.7 on Rasbian

Image from Han N (xhan104) on flickr (cc by-nc-nd)

I came across a Raspberry Pi Stack Exchange question where I had the same question, but it was closed as off-topic. How to install Python 3.7 with SSL?

The problem is that if you compile Python 3.7 on Raspbian Jessie, that Python won’t build the module _ssl. And since it won’t do that, pip won’t work, because pip requires a newer OpenSSL library than Jessie provides. Running python3 -m pip install anything would fail with:

pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.

Sure enough, checking the version:

$ openssl version
OpenSSL 1.0.1t  3 May 2016

Reveals 1.0.1, which is below the version Python 3.7 requires:

Python requires an OpenSSL 1.0.2 or 1.1 compatible libssl with X509_VERIFY_PARAM_set1_host().

Here’s How to make Python 3.7’s pip happy on Raspbian Jessie

First, a detour: I tried to resolve the original issue by compiling OpenSSL 1.0.2 from source on my Raspberry Pi. I added the backports apt source:

echo "deb-src http://archive.debian.org/debian/ jessie-backports main contrib non-free" | sudo tee /etc/apt/sources.list.d/jessie-backports.list
sudo apt update

Then I got the sources, made them and installed them. Spoiler — this didn’t fix the problem, because Python3’s make doesn’t use that library, even if I put it in /usr (developer beware). Here’s the code for that anyway:

apt-get source openssl/jessie-backports
cd openssl-1.0.2k/
./config --prefix=/usr
make
make test
sudo make install

Here’s what did work — installing the actual ARM library from backports. It was risky, but things are working as expected.

I found the version of the module to install from apt-cache policy:

sudo apt-cache policy libssl-dev

And in my case, this is what was needed:

sudo apt install -t jessie-backports libssl-dev=1.0.2l-1~bpo8+1

Then compiling Python 3.7 from source built _ssl and pip worked.

Bonus: Faster Pip Installs

Once you’ve got pip working, you’ll want it to be looking for piwheel sources. So if your distro is earlier than Stretch, add the following to /etc/pip.conf:

[global]
extra-index-url=https://www.piwheels.org/simple