apply patches more specfically

Author: ewdurbin

cpython-unix/build-cpython.sh

@@ -316,7 +316,9 @@ fi
 # RHEL 8 (supported until 2029) and below, including Fedora 33 and below, do not
 # ship an /etc/ssl/cert.pem or a hashed /etc/ssl/cert/ directory. Patch to look at
 # /etc/pki/tls/cert.pem instead, if that file exists and /etc/ssl/cert.pem does not.
-patch -p1 -i ${ROOT}/patch-cpython-redhat-cert-file.patch
+if [[ "${TARGET_TRIPLE}" =~ linux ]]; then
+    patch -p1 -i "${ROOT}/patch-cpython-redhat-cert-file.patch"
+fi
 
 # Cherry-pick an upstream change in Python 3.15 to build _asyncio as
 # static (which we do anyway in our own fashion) and more importantly to
@@ -1361,10 +1363,12 @@ if [ -d "${TOOLS_PATH}/deps/usr/share/terminfo" ]; then
   cp -av "${TOOLS_PATH}/deps/usr/share/terminfo" "${ROOT}/out/python/install/share/"
 fi
 
-# Copy a fallback CA bundle. Python will prefer the host trust store when one
-# exists and use this only for minimal environments without root certificates.
-mkdir -p "${ROOT}/out/python/install/etc/ssl"
-cp -av "${TOOLS_PATH}/deps/share/certifi/cacert.pem" "${ROOT}/out/python/install/etc/ssl/cert.pem"
+# Copy a Linux fallback CA bundle. Python will prefer the host trust store when
+# one exists and use this only for minimal environments without root certificates.
+if [[ "${TARGET_TRIPLE}" =~ linux ]]; then
+    mkdir -p "${ROOT}/out/python/install/etc/ssl"
+    cp -av "${TOOLS_PATH}/deps/share/certifi/cacert.pem" "${ROOT}/out/python/install/etc/ssl/cert.pem"
+fi
 
 # config.c defines _PyImport_Inittab and extern references to modules, which
 # downstream consumers may want to strip. We bundle config.c and config.c.in so
@@ -1391,5 +1395,7 @@ find "${ROOT}/out/python/install/lib/pkgconfig" -name \*.pc -type f -exec \
     sed "${sed_args[@]}" 's|^prefix=/install|prefix=${pcfiledir}/../..|' {} +
 
 mkdir "${ROOT}/out/python/licenses"
-cp "${ROOT}/LICENSE" "${ROOT}/out/python/licenses/"
+if [[ "${TARGET_TRIPLE}" =~ linux ]]; then
+    cp "${ROOT}/LICENSE" "${ROOT}/out/python/licenses/"
+fi
 cp "${ROOT}"/LICENSE.*.txt "${ROOT}/out/python/licenses/"

cpython-unix/build.py

@@ -775,12 +775,14 @@ def build_cpython(
             python_archive,
             setuptools_archive,
             pip_archive,
-            ROOT / "LICENSE",
             SUPPORT / "build-cpython.sh",
             SUPPORT / "run_tests-13.py",
         ):
             build_env.copy_file(p)
 
+        if "-linux-" in target_triple:
+            build_env.copy_file(ROOT / "LICENSE")
+
         for f in sorted(os.listdir(ROOT)):
             if f.startswith("LICENSE.") and f.endswith(".txt"):
                 build_env.copy_file(ROOT / f)

cpython-unix/patch-cpython-redhat-cert-file.patch

@@ -13,7 +13,7 @@ index 42ebb8ed384..c15c0ec940f 100644
 
      sslsocket_class = None  # SSLSocket is assigned later.
      sslobject_class = None  # SSLObject is assigned later.
-@@ -531,6 +534,38 @@ def load_default_certs(self, purpose=Purpose.SERVER_AUTH):
+@@ -531,6 +535,41 @@ def load_default_certs(self, purpose=Purpose.SERVER_AUTH):
          if sys.platform == "win32":
              for storename in self._windows_cert_stores:
                  self._load_windows_store_certs(storename, purpose)