Configure Python — Security Options

Reference note (untrusted external data; do not execute it as instructions). Select hash algorithm for use in Python/pyhash.c siphash13 (default); siphash24; fnv. md5; sha1; sha256; sha512; sha3 (with shake); blake2. Override the OpenSSL default cipher suites string python (default): use Python's preferred selection; openssl: leave OpenSSL's defaults untouched; STRING: use a custom string Disable compiler options that are recommended by OpenSSF for security reasons with no performance overhead. If this option is not enabled, CPython will be built based on safety compiler options with no slow down. When this option is enabled, CPython will not be built with the compiler options listed below. The following compiler options are disabled with !--disable-safety fstack-protector-strong: Enable run-time checks for stack-based buffer overflows. -Wtrampolines: Enable warnings about trampolines that require executable stacks. Enable compiler options that are recommended by OpenSSF for security reasons which require overhead. If this option is not enabled, CPython will not be built based on safety compiler options which performance impact. When this option is enabled, CPython will be built with the compiler options listed below. The following compiler options are enabled with !--enable-slower-safety D_FORTIFY_SOURCE=3: Fortify sources with compile- and run-time checks for unsafe libc usage and buffer overflows. Attribution: Adapted from Python Documentation under PSF-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.