setup.py detects the version of openssl by looking for openssl headers on a deduced search path. That path is not guaranteed to be equal to the real compiler search path, in particular not when building using the OSX 10.4 SDK on MacOSX 10.6: in that situation the compiler will use a header file with the following definition:

#define OPENSSL_VERSION_NUMBER  0x009070cfL

While setup.py reads the header file in /usr/include which contains this definition:

#define OPENSSL_VERSION_NUMBER  0x009080cfL

The actual version is below the sha256 cutoff in setup.py, while setup.py detects a newer version that is above that cutoff. That results in a tree where setup.py tries to build _sha256 using OpenSSL, but fails. That in turn results in a build of hashlib that doesn't work.


Note that this is a specific instance of Issue7724, but fixing this particular issue is probably easier than fixing the generic issue.