easy_install broken on latest Python 3.5 binary for macOS

[jaraco]

The latest binaries from Python.org are compiled without TLS 1.2. As a result, easy_install is broken:

~ $ python3.5 -V
Python 3.5.4
~ $ python3.5 -m easy_install requests
Searching for requests
Reading https://pypi.org/simple/requests/
Download error on https://pypi.org/simple/requests/: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:719) -- Some packages may not be found!
Couldn't find index page for 'requests' (maybe misspelled?)
Scanning index of all packages (this may take a while)
Reading https://pypi.org/simple/
Download error on https://pypi.org/simple/: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:719) -- Some packages may not be found!
No local packages or working download links found for requests
error: Could not find suitable distribution for Requirement.parse('requests')

By itself, this doesn't seem like such a big issue (just use pip), except that easy_install is involved in the downloads for setup_requires, so any packages that declare setup_requires where setup.py is invoked in an environment without those requirement being previously satisfied will fail. This situation is very common for packages that use setuptools_scm or similar (which is nearly all of them for the packages I maintain). This issue was reported in pypa/setuptools#1320.

I've explored the possibility of dropping setuptools_scm from setup.py, but that's already led to two additional issues, #219 and another yet unidentified downstream issue.

It sounds as if setuptools needs to be updated to support these newer protocols, but that's going to leave the packaging ecosystem broken for older setuptools.

[jaraco]

A big question I have - should Python 3.5 receive a new binary release for macOS to include TLS 1.2 support?

[jaraco]

This issue is largely a duplicate of #134.

[dstufft]

To be clear, Python itself doesn't control whether it has TLSv1.2 or not, the OpenSSL it's using does, and I think that Python 3.5 binaries are linking against the macOS provided OpenSSL which doesn't support TLSv1.2.

[jaraco]

Closing as duplicate.