feat: allow patching the interpreter fetched via toolchains

python/repositories.bzl

@@ -31,7 +31,7 @@ load(
     "MINOR_MAPPING",
     "PLATFORMS",
     "TOOL_VERSIONS",
-    "get_release_url",
+    "get_release_info",
 )
 
 def http_archive(**kwargs):
@@ -142,6 +142,12 @@ def _python_repository_impl(rctx):
             stripPrefix = rctx.attr.strip_prefix,
         )
 
+    patches = rctx.attr.patches
+    if patches:
+        for patch in patches:
+            # Should take the strip as an attr, but this is fine for the moment
+            rctx.patch(patch, strip = 1)
+
     # Write distutils.cfg to the Python installation.
     if "windows" in rctx.os.name:
         distutils_path = "Lib/distutils/distutils.cfg"
@@ -310,6 +316,10 @@ python_repository = repository_rule(
             doc = "Whether the check for root should be ignored or not. This causes cache misses with .pyc files.",
             mandatory = False,
         ),
+        "patches": attr.label_list(
+            doc = "A list of patch files to apply to the unpacked interpreter",
+            mandatory = False,
+        ),
         "platform": attr.string(
             doc = "The platform name for the Python interpreter tarball.",
             mandatory = True,
@@ -389,14 +399,15 @@ def python_register_toolchains(
         if not sha256:
             continue
 
-        (release_filename, url, strip_prefix) = get_release_url(platform, python_version, base_url, tool_versions)
+        (release_filename, url, strip_prefix, patches) = get_release_info(platform, python_version, base_url, tool_versions)
 
         python_repository(
             name = "{name}_{platform}".format(
                 name = name,
                 platform = platform,
             ),
             sha256 = sha256,
+            patches = patches,
             platform = platform,
             python_version = python_version,
             release_filename = release_filename,

python/versions.bzl

@@ -248,7 +248,7 @@ PLATFORMS = {
     ),
 }
 
-def get_release_url(platform, python_version, base_url = DEFAULT_RELEASE_BASE_URL, tool_versions = TOOL_VERSIONS):
+def get_release_info(platform, python_version, base_url = DEFAULT_RELEASE_BASE_URL, tool_versions = TOOL_VERSIONS):
     """Resolve the release URL for the requested interpreter version
 
     Args:
@@ -276,7 +276,15 @@ def get_release_url(platform, python_version, base_url = DEFAULT_RELEASE_BASE_UR
         build = "shared-install_only" if (WINDOWS_NAME in platform) else "install_only",
     )
     url = "/".join([base_url, release_filename])
-    return (release_filename, url, strip_prefix)
+
+    patches = tool_versions[python_version].get("patches", [])
+    if type(patches) == type({}):
+        if platform in patches.keys():
+            patches = patches[platform]
+        else:
+            patches = []
+
+    return (release_filename, url, strip_prefix, patches)
 
 def print_toolchains_checksums(name):
     native.genrule(
@@ -307,8 +315,8 @@ def _commands_for_version(python_version):
         "echo \"{python_version}: {platform}: $$(curl --location --fail {release_url_sha256} 2>/dev/null || curl --location --fail {release_url} 2>/dev/null | shasum -a 256 | awk '{{ print $$1 }}')\"".format(
             python_version = python_version,
             platform = platform,
-            release_url = get_release_url(platform, python_version)[1],
-            release_url_sha256 = get_release_url(platform, python_version)[1] + ".sha256",
+            release_url = get_release_info(platform, python_version)[1],
+            release_url_sha256 = get_release_info(platform, python_version)[1] + ".sha256",
         )
         for platform in TOOL_VERSIONS[python_version]["sha256"].keys()
     ])