First python3-debian13 images for testing

- Remove distutils dep and add venv. I'm not sure this is sufficient
  for all python users, but hopefully it will be.
- Not too many changes otherwise

Signed-off-by: Appu Goundan <appu@google.com>

Author: loosebazooka

BUILD

@@ -149,17 +149,16 @@ PYTHON3 |= {
     for (tag_base, debug_mode, user) in VARIANTS
 }
 
-# python on debian12 has moved out of experimental
 PYTHON3 |= {
-    "{REGISTRY}/{PROJECT_ID}/python3-debian12:" + tag_base + "-" + arch: "//python3:python3" + debug_mode + "_" + user + "_" + arch + "_" + distro
+    "{REGISTRY}/{PROJECT_ID}/python3-" + distro + ":" + tag_base + "-" + arch: "//python3:python3" + debug_mode + "_" + user + "_" + arch + "_" + distro
     for distro in PYTHON_DISTROS
     for arch in PYTHON_ARCHITECTURES[distro]
     for (tag_base, debug_mode, user) in VARIANTS
 }
 
 # oci_image_index
 PYTHON3 |= {
-    "{REGISTRY}/{PROJECT_ID}/python3-debian12:" + tag_base: "//python3:python3" + debug_mode + "_" + user + "_" + distro
+    "{REGISTRY}/{PROJECT_ID}/python3-" + distro + ":" + tag_base: "//python3:python3" + debug_mode + "_" + user + "_" + distro
     for distro in PYTHON_DISTROS
     for (tag_base, debug_mode, user) in VARIANTS
 }

MODULE.bazel.lock

@@ -65,6 +65,14 @@ Debian 13 distroless images use the debian [UsrMerge](https://wiki.debian.org/Us
 | gcr.io/distroless/nodejs22-debian13   | latest, nonroot, debug, debug-nonroot | amd64, arm64, arm, s390x, ppc64le |
 | gcr.io/distroless/nodejs24-debian13   | latest, nonroot, debug, debug-nonroot | amd64, arm64, s390x, ppc64le      |
 
+#### Debian 13 (preview)
+
+Images that are still being worked on
+
+| Image                                 | Tags                                  | Architecture Suffixes             |
+| ------------------------------------- | ------------------------------------- | --------------------------------- |
+| gcr.io/distroless/python3-debian13    | latest, nonroot, debug, debug-nonroot | amd64, arm64                      |
+
 ## Why is distroless still using `gcr.io` instead of `pkg.dev`?
 
 Distroless's serving infrastructure has moved to artifact registry but we still use the `gcr.io` domain. Users will get the benefits of the newer infrastructure without changing their builds.

README.md

@@ -11,17 +11,20 @@ pkg_tar(
 )
 
 # This example runs a python program that walks the filesystem under "/etc" and prints every filename.
-oci_image(
-    name = "hello_debian12",
-    base = "//python3:python3_root_amd64_debian12",
-    cmd = [
-        "hello.py",
-        "/etc",
-    ],
-    tars = [
-        ":hello_py",
-    ],
-)
+[
+    oci_image(
+        name = "hello_" + distro,
+        base = "//python3:python3_root_amd64_" + distro,
+        cmd = [
+            "hello.py",
+            "/etc",
+        ],
+        tars = [
+            ":hello_py",
+        ],
+    )
+    for distro in DISTROS
+]
 
 # Run
 # podman load -i bazel-bin/examples/python3/tarball/tarball.tar

examples/python3/BUILD

@@ -1,16 +1,5 @@
 {
 	"packages": [
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "dash_0.5.12-2_amd64",
-			"name": "dash",
-			"sha256": "33ea40061da2f1a861ec46212b2b6a34f0776a049b1a3f0abce2fb8cb994258f",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20260110T225955Z/pool/main/d/dash/dash_0.5.12-2_amd64.deb"
-			],
-			"version": "0.5.12-2"
-		},
 		{
 			"arch": "amd64",
 			"dependencies": [],
@@ -275,28 +264,6 @@
 			],
 			"version": "1:1.2.13.dfsg-1"
 		},
-		{
-			"arch": "amd64",
-			"dependencies": [],
-			"key": "libc-bin_2.36-9-p-deb12u13_amd64",
-			"name": "libc-bin",
-			"sha256": "3f7a7caf9a34875fb076f08d168430ad8c338c71b0b7e6c02d19e914d7bc4277",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20260110T225955Z/pool/main/g/glibc/libc-bin_2.36-9+deb12u13_amd64.deb"
-			],
-			"version": "2.36-9+deb12u13"
-		},
-		{
-			"arch": "arm64",
-			"dependencies": [],
-			"key": "dash_0.5.12-2_arm64",
-			"name": "dash",
-			"sha256": "c1358e2a8054eb93efd460adf480224a16ea9e0b4d7b4c6cbcf8c8c91902a1d7",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20260110T225955Z/pool/main/d/dash/dash_0.5.12-2_arm64.deb"
-			],
-			"version": "0.5.12-2"
-		},
 		{
 			"arch": "arm64",
 			"dependencies": [],
@@ -560,17 +527,6 @@
 				"https://snapshot.debian.org/archive/debian/20260110T225955Z/pool/main/z/zlib/zlib1g_1.2.13.dfsg-1_arm64.deb"
 			],
 			"version": "1:1.2.13.dfsg-1"
-		},
-		{
-			"arch": "arm64",
-			"dependencies": [],
-			"key": "libc-bin_2.36-9-p-deb12u13_arm64",
-			"name": "libc-bin",
-			"sha256": "1199da233e4c893e0a44e81b2024667241c19f93eb12f4ec1e29585117270a85",
-			"urls": [
-				"https://snapshot.debian.org/archive/debian/20260110T225955Z/pool/main/g/glibc/libc-bin_2.36-9+deb12u13_arm64.deb"
-			],
-			"version": "2.36-9+deb12u13"
 		}
 	],
 	"version": 1

private/repos/deb/bookworm_python.lock.json

@@ -1,4 +1,4 @@
-# debian 12, limited architectures, java only
+# debian 12, limited architectures, python only
 version: 1
 
 sources:
@@ -14,7 +14,6 @@ archs:
   - arm64
 
 packages:
-  - dash
   - libbz2-1.0
   - libcom-err2
   - libcrypt1 # TODO: glibc library for -lcrypt; maybe should be in cc?
@@ -39,4 +38,3 @@ packages:
   - python3-distutils
   - python3.11-minimal
   - zlib1g
-  - libc-bin

private/repos/deb/bookworm_python.yaml

@@ -4,6 +4,7 @@ REPOS = [
     "trixie",
     "trixie_java",
     "trixie_adoptium",
+    "trixie_python",
     "bookworm",
     "bookworm_java",
     "bookworm_python",
@@ -24,7 +25,7 @@ apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
     for repo in REPOS
 ]
 
-use_repo(apt, "bookworm", "bookworm_java", "bookworm_python", "trixie", "trixie_java", "trixie_adoptium")
+use_repo(apt, "bookworm", "bookworm_java", "bookworm_python", "trixie", "trixie_java", "trixie_adoptium", "trixie_python")
 
 ### VERSIONS HUB REPO ###
 version = use_extension("//private/extensions:version.bzl", "version")