Build fixes for in-repo Python interpreters (#283)

- Fix a duplicate hash for a python-build-standalone download.
- Fix an incorrect hash for the `python314` package on Ports.
- Also download and extract the `py31*-sqlite3` package from Ports into
  the output directory on FreeBSD - the `sqlite3` standard library
  module is packaged separately from the interpreter on Ports.
- Manually install pip and its dependencies in the interpreter's
  `site-packages` directory on FreeBSD - unlike python-build-standalone,
  the Ports packages for the interpreter don't contain pip (or even
  ensurepip).

Author: chrisnovakovic

third_party/cc/cpython/BUILD

@@ -5,7 +5,7 @@ _python_build_standalone_release = "20251031"
 _python_build_standalone_hashes = {
     "3.10.19": {
         "aarch64-apple-darwin": "24be196d33ee1b40393beff9df721ed596ec90b8be3f424122f1300f41a4a3b6",
-        "aarch64-unknown-linux-gnu": "ed1840fa7baa762d3506c161ee1887c29c3603737058a22639cd88ed69e4be9d",
+        "aarch64-unknown-linux-gnu": "a04c0cf04f45b6f8966f693beef5b3929d88978a04de4a6ec0bf330d71e0ffd1",
         "aarch64-unknown-linux-musl": "e2ddd1e8980ecba2221074b9e3fccd10d0fbf1994974250eb537b066a0879e04",
         "x86_64-apple-darwin": "5f3a156f063f4a6fa522b1ebb724a7554a67be32318b69041e83fd77a2bd761c",
         "x86_64_v2-unknown-linux-gnu": "e5fe6913158b40b5ac897897c51c5879cac2684c435bf217774200fb863c9660",
@@ -46,34 +46,63 @@ _python_build_standalone_hashes = {
 }
 
 _freebsd_ports_hashes = {
+    "py310-sqlite3-3.10.19_10": "61a51cdbbfacfebfc248ebb00288f93f5f3f575bf97f2db11293a5b4d005ac8d",
+    "py311-sqlite3-3.11.14_10": "79e883f79971e6d08293c3f44a4b88a197d8300a2f873f83829e2c028eeeaee2",
+    "py312-sqlite3-3.12.12_10": "64d9074b1664e17e619327c54faf18dfeca5b8f6c8ee988bb094e6241d101070",
+    "py313-sqlite3-3.13.9_10": "86e286e500a226e8ff26e51be1521e44505f6e472565a9457f80f1b428e5d378",
+    "py314-sqlite3-3.14.0_10": "fa487c001557053ce40801fb0234ef457d1b21becc9223b750d0c1917d7cf012",
     "python310-3.10.19": "1e06d1552d0d7a377606a0855bd13926261d59dffd18eb9a60ec97f64860ffc9",
     "python311-3.11.14": "b371de2a4a4137f8176b118f24d328fc12e4e9280071f6282db1c182e083b6b2",
     "python312-3.12.12_2": "a2cb0fa91ff0b6ca7aea19466c2c779416a6cb1e6cb56b43c64e33237e207778",
     "python313-3.13.9": "6a43c25e8034f5ddc80d5c07e407df67c91e46c185e16be5851e94d34858fb48",
-    "python314-3.14.0_1": "a6e1bd9f41c1bb500795679f5206a035b7c9228755c347bc078690111bb48ca4",
+    "python314-3.14.0_1": "e3bf79ff06ba94f942f92c9621d8c3bfbb95e2bab1f0aa86b267866a4868c5ff",
 }
 
 for minor in ["3.10", "3.11", "3.12", "3.13", "3.14"]:
     if CONFIG.OS == "freebsd":
-        package = filter(lambda v: v.startswith("python" + minor.replace(".", "")), _freebsd_ports_hashes.keys())[0]
+        minorint = int(minor.rpartition(".")[2])
 
-        download = remote_file(
-            name = tag(f"cpython_{minor}", "download"),
-            url = f"https://pkg.freebsd.org/FreeBSD:14:amd64/latest/All/{package}.pkg",
-            hashes = [_freebsd_ports_hashes[package]],
+        python_pkg_name = filter(lambda v: v.startswith("python" + minor.replace(".", "") + "-"), _freebsd_ports_hashes.keys())[0]
+        python_sqlite3_pkg_name = filter(lambda v: v.startswith("py" + minor.replace(".", "") + "-sqlite3"), _freebsd_ports_hashes.keys())[0]
+
+        python_pkg = remote_file(
+            name = tag(f"cpython_{minor}", "python_pkg"),
+            url = f"https://pkg.freebsd.org/FreeBSD:14:amd64/latest/All/{python_pkg_name}.pkg",
+            hashes = [_freebsd_ports_hashes[python_pkg_name]],
+        )
+
+        python_sqlite3_pkg = remote_file(
+            name = tag(f"cpython_{minor}", "python_sqlite3_pkg"),
+            url = f"https://pkg.freebsd.org/FreeBSD:14:amd64/latest/All/{python_sqlite3_pkg_name}.pkg",
+            hashes = [_freebsd_ports_hashes[python_sqlite3_pkg_name]],
         )
 
         genrule(
             name = f"cpython_{minor}",
-            srcs = [download],
+            srcs = {
+                "python": [python_pkg],
+                "python_sqlite3": [python_sqlite3_pkg],
+                "setuptools": ["//third_party/python:setuptools"] if minorint < 12 else [],
+                "wheel": ["//third_party/python:wheel"] if minorint < 12 else [],
+                "pip": ["//third_party/python:pip"],
+            },
             outs = [f"python_{minor}"],
             cmd = [
                 "mkdir $OUTS",
-                "tar -C $OUTS -xf $SRCS --strip-components=3 /usr/local",
+                "tar -C $OUTS -xf $SRCS_PYTHON --strip-components=3 /usr/local",
+                "tar -C $OUTS -xf $SRCS_PYTHON_SQLITE3 --strip-components=3 /usr/local",
                 # The contents of FreeBSD Ports packages are designed to be installed beneath /usr/local, so we'll have
                 # to do some slightly hacky rpath editing to make sure the Python interpreter can find libpython3.x at
                 # run time:
+                f"chmod +w $OUTS/bin/python{minor}",
                 f"$TOOLS_PATCHELF --set-rpath '$ORIGIN/../lib' $OUTS/bin/python{minor}",
+                # Manually download and install pip (and, on Python < 3.12, its dependencies, setuptools and wheel) for
+                # each interpreter - ensurepip is stripped out of Ports' python31* packages, and Ports currently
+                # contains only a single pip package for the default Python version.
+                f"mkdir -p $OUTS/lib/python{minor}/site-packages",
+                f"unzip $SRCS_SETUPTOOLS -d $OUTS/lib/python{minor}/site-packages" if minorint < 12 else "true",
+                f"unzip $SRCS_WHEEL -d $OUTS/lib/python{minor}/site-packages" if minorint < 12 else "true",
+                f"unzip $SRCS_PIP -d $OUTS/lib/python{minor}/site-packages",
             ],
             binary = True,
             entry_points = {
@@ -82,6 +111,7 @@ for minor in ["3.10", "3.11", "3.12", "3.13", "3.14"]:
             tools = {
                 "patchelf": "//third_party/cc/patchelf",
             },
+            requires = ["py_whl"],
             visibility = ["PUBLIC"],
         )
     else:

third_party/python/BUILD

@@ -193,6 +193,30 @@ python_multiversion_wheel(
     version = _coverage_version,
 )
 
+python_wheel(
+    name = "pip",
+    hashes = ["9655943313a94722b7774661c21049070f6bbb0a1516bf02f7c8d5d9201514cd"],
+    licences = ["MIT"],
+    version = "25.3",
+    visibility = ["//third_party/cc/cpython/..."],
+)
+
+python_wheel(
+    name = "setuptools",
+    hashes = ["062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922"],
+    licences = ["MIT"],
+    version = "80.9.0",
+    visibility = ["//third_party/cc/cpython/..."],
+)
+
+python_wheel(
+    name = "wheel",
+    hashes = ["708e7481cc80179af0e556bbf0cc00b8444c7321e2700b8d8580231d13017248"],
+    licences = ["MIT"],
+    version = "0.45.1",
+    visibility = ["//third_party/cc/cpython/..."],
+)
+
 python_wheel(
     name = "pluggy",
     hashes = ["d89c696a773f8bd377d18e5ecda92b7a3793cbe66c87060a6fb58c7b6e1061f7"],
@@ -344,13 +368,6 @@ pip_library(
     ],
 )
 
-pip_library(
-    name = "setuptools",
-    test_only = True,
-    licences = ["MIT"],
-    version = "47.1.1",
-)
-
 pip_library(
     name = "googleapis_common_protos",
     package_name = "googleapis-common-protos",