Replace system python with hermetic Python from rules_python

MODULE.bazel

@@ -21,6 +21,8 @@ bazel_dep(name = "rules_java", version = "5.3.5")
 bazel_dep(name = "rules_jvm_external", version = "5.1")
 bazel_dep(name = "rules_pkg", version = "0.7.0")
 bazel_dep(name = "rules_python", version = "0.28.0")
+python = use_extension("@rules_python//extensions:python.bzl", "python")
+python.toolchain(python_version = "3.12")
 bazel_dep(name = "platforms", version = "0.0.8")
 bazel_dep(name = "zlib", version = "1.2.11")
 

WORKSPACE

@@ -164,11 +164,21 @@ http_archive(
     patch_cmds = ["find google -type f -name BUILD.bazel -delete"],
 )
 
-load("@system_python//:pip.bzl", "pip_parse")
+load("@rules_python//python:repositories.bzl", "python_register_toolchains")
+
+python_register_toolchains(
+    name = "python_3_12",
+    python_version = "3.12",
+)
+
+load("@python_3_12//:defs.bzl", "interpreter")
+
+load("@rules_python//python:pip.bzl", "pip_parse")
 
 pip_parse(
     name = "pip_deps",
-    requirements = "//python:requirements.txt",
+    requirements_lock = "//python:requirements.txt",
+    python_interpreter_target = interpreter,
 )
 
 load("@pip_deps//:requirements.bzl", "install_deps")

protobuf_deps.bzl

@@ -2,7 +2,6 @@
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("//python/dist:python_downloads.bzl", "python_nuget_package", "python_source_archive")
-load("//python/dist:system_python.bzl", "system_python")
 
 PROTOBUF_MAVEN_ARTIFACTS = [
     "com.google.caliper:caliper:1.0-beta-3",
@@ -105,12 +104,6 @@ def protobuf_deps():
             url = "https://github.com/bazelbuild/rules_python/releases/download/0.28.0/rules_python-0.28.0.tar.gz",
         )
 
-    if not native.existing_rule("system_python"):
-        system_python(
-            name = "system_python",
-            minimum_python_version = "3.7",
-        )
-
     if not native.existing_rule("rules_jvm_external"):
         _github_archive(
             name = "rules_jvm_external",

python/BUILD.bazel

@@ -138,8 +138,6 @@ selects.config_setting_group(
 # begin:github_only
 _message_target_compatible_with = {
     "@platforms//os:windows": ["@platforms//:incompatible"],
-    "@system_python//:none": ["@platforms//:incompatible"],
-    "@system_python//:unsupported": ["@platforms//:incompatible"],
     "//conditions:default": [],
 }
 

python/build_targets.bzl

@@ -87,7 +87,7 @@ def build_targets(name):
         ],
         deps = select({
             "//conditions:default": [],
-            ":use_fast_cpp_protos": ["@system_python//:python_headers"],
+            ":use_fast_cpp_protos": ["@rules_python//python/cc:current_py_cc_headers"],
         }),
     )
 
@@ -136,7 +136,7 @@ def build_targets(name):
             "@com_google_absl//absl/strings",
         ] + select({
             "//conditions:default": [],
-            ":use_fast_cpp_protos": ["@system_python//:python_headers"],
+            ":use_fast_cpp_protos": ["@rules_python//python/cc:current_py_cc_headers"],
         }),
     )
 
@@ -421,7 +421,7 @@ def build_targets(name):
         hdrs = ["google/protobuf/proto_api.h"],
         visibility = ["//visibility:public"],
         deps = [
-            "@system_python//:python_headers",
+            "@rules_python//python/cc:current_py_cc_headers",
         ],
     )
 
@@ -435,7 +435,6 @@ def build_targets(name):
         env = {"PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": "python"},
         failure_list = "//conformance:failure_list_python.txt",
         target_compatible_with = select({
-            "@system_python//:none": ["@platforms//:incompatible"],
             ":use_fast_cpp_protos": ["@platforms//:incompatible"],
             "//conditions:default": [],
         }),
@@ -450,7 +449,6 @@ def build_targets(name):
         env = {"PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": "cpp"},
         failure_list = "//conformance:failure_list_python.txt",
         target_compatible_with = select({
-            "@system_python//:none": ["@platforms//:incompatible"],
             ":use_fast_cpp_protos": [],
             "//conditions:default": ["@platforms//:incompatible"],
         }),
@@ -464,7 +462,6 @@ def build_targets(name):
         env = {"PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION": "upb"},
         failure_list = "//conformance:failure_list_python_upb.txt",
         target_compatible_with = select({
-            "@system_python//:none": ["@platforms//:incompatible"],
             ":use_fast_cpp_protos": ["@platforms//:incompatible"],
             "//conditions:default": [],
         }),

python/dist/BUILD.bazel

@@ -11,7 +11,6 @@ load("@pip_deps//:requirements.bzl", "requirement")
 load("@rules_pkg//pkg:mappings.bzl", "pkg_files", "strip_prefix")
 load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
 load("@rules_python//python:packaging.bzl", "py_wheel")
-load("@system_python//:version.bzl", "SYSTEM_PYTHON_VERSION")
 load("//:protobuf_version.bzl", "PROTOBUF_PYTHON_VERSION")
 load(":dist.bzl", "py_dist", "py_dist_module")
 load(":py_proto_library.bzl", "py_proto_library")
@@ -272,7 +271,6 @@ pkg_tar(
     package_file_name = "protobuf.tar.gz",
     strip_prefix = ".",
     target_compatible_with = select({
-        "@system_python//:none": ["@platforms//:incompatible"],
         "//conditions:default": [],
     }),
 )
@@ -291,7 +289,6 @@ genrule(
         mv protobuf/dist/*.tar.gz $@
     """,
     target_compatible_with = select({
-        "@system_python//:none": ["@platforms//:incompatible"],
         "//conditions:default": [],
     }),
     tools = [requirement("setuptools")],
@@ -333,24 +330,12 @@ py_wheel(
         "//conditions:default": "any",
     }),
     python_requires = ">=3.8",
-    # LINT.IfChange(python_tag)
-    python_tag = selects.with_or({
-        ("//python:limited_api_3.8", "//python:full_api_3.8"): "cp38",
-        "//python:full_api_3.9": "cp39",
-        "//python:limited_api_3.10": "cp310",
-        "//conditions:default": "cp" + SYSTEM_PYTHON_VERSION,
-    }),
-    # LINT.ThenChange(
-    #    :full_api_version,
-    #    :limited_api_wheels,
-    # )
     strip_path_prefixes = [
         "python/dist/",
         "python/",
         "src/",
     ],
     target_compatible_with = select({
-        "@system_python//:none": ["@platforms//:incompatible"],
         "//conditions:default": [],
     }),
     version = PROTOBUF_PYTHON_VERSION,
@@ -390,7 +375,6 @@ py_wheel(
         "src/",
     ],
     target_compatible_with = select({
-        "@system_python//:none": ["@platforms//:incompatible"],
         "//conditions:default": [],
     }),
     version = PROTOBUF_PYTHON_VERSION,
@@ -416,7 +400,6 @@ py_wheel(
         "src/",
     ],
     target_compatible_with = select({
-        "@system_python//:none": ["@platforms//:incompatible"],
         "//conditions:default": [],
     }),
     version = PROTOBUF_PYTHON_VERSION,

python/dist/dist.bzl

@@ -1,7 +1,6 @@
 """Rules to create python distribution files and properly name them"""
 
 load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
-load("@system_python//:version.bzl", "SYSTEM_PYTHON_VERSION")
 
 def _get_suffix(limited_api, python_version, cpu):
     """Computes an ABI version tag for an extension module per PEP 3149."""
@@ -15,27 +14,6 @@ def _get_suffix(limited_api, python_version, cpu):
         else:
             fail("Unsupported CPU: " + cpu)
         return ".cp{}-{}.{}".format(python_version, abi, "pyd")
-
-    if python_version == "system":
-        python_version = SYSTEM_PYTHON_VERSION
-        if int(python_version) < 38:
-            python_version += "m"
-        abis = {
-            "darwin_arm64": "darwin",
-            "darwin_x86_64": "darwin",
-            "darwin": "darwin",
-            "osx-x86_64": "darwin",
-            "osx-aarch_64": "darwin",
-            "linux-aarch_64": "aarch64-linux-gnu",
-            "linux-x86_64": "x86_64-linux-gnu",
-            "k8": "x86_64-linux-gnu",
-        }
-
-        return ".cpython-{}-{}.{}".format(
-            python_version,
-            abis[cpu],
-            "so" if limited_api else "abi3.so",
-        )
     elif limited_api:
         return ".abi3.so"