Fixes for Tink Python's create_release.sh script:

 - Save a copy of the WORKSPACE before building wheels, and restore it afterwards.
 - Give ownership of all the files in the Tink Python folder to the non-root user.

PiperOrigin-RevId: 459043624

python/tools/distribution/create_release.sh

@@ -46,6 +46,10 @@ build_linux() {
   # https://docs.docker.com/engine/security/trust/content_trust/).
   export DOCKER_CONTENT_TRUST=1
 
+  # We use setup.py to build wheels; setup.py makes changes to the WORKSPACE
+  # file so we save a copy for backup.
+  cp WORKSPACE WORKSPACE.bak
+
   # Build binary wheels.
   docker run \
     --volume "${TINK_PYTHON_ROOT_PATH}/..:/tmp/tink" \
@@ -60,6 +64,12 @@ build_linux() {
     "${IMAGE}" \
     "${workdir}/tools/distribution/test_linux_binary_wheels.sh"
 
+  # Restore the original WORKSPACE.
+  mv WORKSPACE.bak WORKSPACE
+
+  # Docker runs as root so we transfer ownership to the non-root user.
+  sudo chown -R "$(id -un):$(id -gn)" "${TINK_PYTHON_ROOT_PATH}"
+
   echo "### Building Linux source distribution ###"
   local sorted=( $( echo "${PYTHON_VERSIONS[@]}" \
     | xargs -n1 | sort -V | xargs ) )