feat: Add poetry-core bootstrap support for offline sdist deployments

Author: ZPascal

manifest.yml

@@ -24,6 +24,10 @@ dependency_deprecation_dates:
   name: python
   date: 2030-10-07
   link: https://peps.python.org/pep-0745/
+- version_line: 3.9.x
+  name: python
+  date: 2025-10-05
+  link: https://www.python.org/dev/peps/pep-0596/
 dependencies:
 - name: flit-core
   version: 3.12.0
@@ -98,21 +102,45 @@ dependencies:
   source: https://files.pythonhosted.org/packages/ca/5b/8ce5227713d692913c186d9a3164eee0236fbc3eaca87d7e2bd5dbb1da36/pipenv-2024.4.1.tar.gz
   source_sha256: e8ea6105c1cdda7d5c19df7bd6439a006751f3d4e017602c791e7b51314adf84
 - name: pipenv
-  version: 2026.5.2
-  uri: https://buildpacks.cloudfoundry.org/dependencies/pipenv/pipenv_2026.5.2_linux_noarch_cflinuxfs4_74c1a3ab.tgz
-  sha256: 74c1a3ab922ae87de22698eeec0aaa7ba54a1b7af767144eb52d34ef0c7acab5
+  version: 2026.0.3
+  uri: https://buildpacks.cloudfoundry.org/dependencies/pipenv/pipenv_2026.0.3_linux_noarch_cflinuxfs4_d8aebaca.tgz
+  sha256: d8aebacaafc6a876704920748c4918443d3a07ae70e9039937bfbbfacf7e12d0
   cf_stacks:
   - cflinuxfs4
-  source: https://files.pythonhosted.org/packages/00/bf/9e5a536eae91adcbed6ee9c44861250bdfdc42bf2663680ce44cf5253fdb/pipenv-2026.5.2.tar.gz
-  source_sha256: cf5985038a4cc4a1ffe9b48a2e580d2595245823dcc5684d07b1a53929ab47cc
+  source: https://files.pythonhosted.org/packages/90/03/8958464e0d366530477f07fd041ef6b9df56f3ea9c56d0db24cc8cd87fff/pipenv-2026.0.3.tar.gz
+  source_sha256: 9a39d13a41ed8e4368ad50620941191f357319c8ffb7df45875c7c5dc6604ff6
 - name: pipenv
-  version: 2026.5.2
-  uri: https://buildpacks.cloudfoundry.org/dependencies/pipenv/pipenv_2026.5.2_linux_noarch_cflinuxfs5_569f70b0.tgz
-  sha256: 569f70b09c3b3440c6385aad160bef6b3539fd7b6211a73bfe41600d8b3fdfad
+  version: 2026.0.3
+  uri: https://buildpacks.cloudfoundry.org/dependencies/pipenv/pipenv_2026.0.3_linux_noarch_cflinuxfs5_23a2629d.tgz
+  sha256: 23a2629da1873b0ffb25b79a5cce94263615437a7fc8a3be8f63550376ea6bd7
+  cf_stacks:
+  - cflinuxfs5
+  source: https://files.pythonhosted.org/packages/90/03/8958464e0d366530477f07fd041ef6b9df56f3ea9c56d0db24cc8cd87fff/pipenv-2026.0.3.tar.gz
+  source_sha256: 9a39d13a41ed8e4368ad50620941191f357319c8ffb7df45875c7c5dc6604ff6
+- name: python
+  version: 3.9.24
+  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.9.24_linux_x64_cflinuxfs3_e7fcaa7e.tgz
+  sha256: e7fcaa7ebfab1610a902c86a886515b8db074039284bdf6deb54353d664a5e79
+  cf_stacks:
+  - cflinuxfs3
+  source: https://www.python.org/ftp/python/3.9.24/Python-3.9.24.tgz
+  source_sha256: 9a32cfc683aecaadbd9ed891ac2af9451ff37f48a00a2d8e1f4ecd9c2a1ffdcb
+- name: python
+  version: 3.9.25
+  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.9.25_linux_x64_cflinuxfs4_47183960.tgz
+  sha256: 47183960e453a25d6e30b763a6e868f812b58234ba747f2a380c241109b8856c
+  cf_stacks:
+  - cflinuxfs4
+  source: https://www.python.org/ftp/python/3.9.25/Python-3.9.25.tgz
+  source_sha256: a7438eabd3a48139f42d4e058096af8d880b0bb6e8fb8c78838892e4ce5583f2
+- name: python
+  version: 3.10.9
+  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.10.9_linux_x64_cflinuxfs5_2b1ef984.tgz
+  sha256: 2b1ef9845d7f2a48ea757358b747a8a3b2620df008f6773bcede3ac4e171af59
   cf_stacks:
   - cflinuxfs5
-  source: https://files.pythonhosted.org/packages/00/bf/9e5a536eae91adcbed6ee9c44861250bdfdc42bf2663680ce44cf5253fdb/pipenv-2026.5.2.tar.gz
-  source_sha256: cf5985038a4cc4a1ffe9b48a2e580d2595245823dcc5684d07b1a53929ab47cc
+  source: https://www.python.org/ftp/python/3.10.9/Python-3.10.9.tgz
+  source_sha256: 4ccd7e46c8898f4c7862910a1703aa0e63525913a519abb2f55e26220a914d88
 - name: python
   version: 3.10.19
   uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.10.19_linux_x64_cflinuxfs3_d754b71d.tgz
@@ -122,21 +150,13 @@ dependencies:
   source: https://www.python.org/ftp/python/3.10.19/Python-3.10.19.tgz
   source_sha256: a078fb2d7a216071ebbe2e34b5f5355dd6b6e9b0cd1bacc4a41c63990c5a0eec
 - name: python
-  version: 3.10.20
-  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.10.20_linux_x64_cflinuxfs4_b4c18ea7.tgz
-  sha256: b4c18ea789c68f583899138a65f08dc1a576376239002cf1b01519e445fb7164
+  version: 3.10.19
+  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.10.19_linux_x64_cflinuxfs4_b9b2cdae.tgz
+  sha256: b9b2cdae0b86f5e921e5cb22be81b466812d77548dc732434ee0575443f4f038
   cf_stacks:
   - cflinuxfs4
-  source: https://www.python.org/ftp/python/3.10.20/Python-3.10.20.tgz
-  source_sha256: 4ff5fd4c5bab803b935019f3e31d7219cebd6f870d00389cea53b88bbe935d1a
-- name: python
-  version: 3.10.20
-  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.10.20_linux_x64_cflinuxfs5_8bb35886.tgz
-  sha256: 8bb358865558b85b8561c8b1cc08575dec51bf847d01be2d425e1295a7234de5
-  cf_stacks:
-  - cflinuxfs5
-  source: https://www.python.org/ftp/python/3.10.20/Python-3.10.20.tgz
-  source_sha256: 4ff5fd4c5bab803b935019f3e31d7219cebd6f870d00389cea53b88bbe935d1a
+  source: https://www.python.org/ftp/python/3.10.19/Python-3.10.19.tgz
+  source_sha256: a078fb2d7a216071ebbe2e34b5f5355dd6b6e9b0cd1bacc4a41c63990c5a0eec
 - name: python
   version: 3.11.14
   uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.11.14_linux_x64_cflinuxfs3_294394be.tgz
@@ -186,21 +206,21 @@ dependencies:
   source: https://www.python.org/ftp/python/3.13.9/Python-3.13.9.tgz
   source_sha256: c4c066af19c98fb7835d473bebd7e23be84f6e9874d47db9e39a68ee5d0ce35c
 - name: python
-  version: 3.13.13
-  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.13.13_linux_x64_cflinuxfs4_8311abbf.tgz
-  sha256: 8311abbf60e3c061a70eabca62ccddba613ee0eeac790ec6f7e42b75213a05f1
+  version: 3.13.12
+  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.13.12_linux_x64_cflinuxfs4_13421a49.tgz
+  sha256: 13421a490598ca03f9242df1230023737d401a456c1b6429721f7e88607032b3
   cf_stacks:
   - cflinuxfs4
-  source: https://www.python.org/ftp/python/3.13.13/Python-3.13.13.tgz
-  source_sha256: f9cde7b0e2ec8165d7326e2a0f59ea2686ce9d0c617dbbb3d66a7e54d31b74b9
+  source: https://www.python.org/ftp/python/3.13.12/Python-3.13.12.tgz
+  source_sha256: 12e7cb170ad2d1a69aee96a1cc7fc8de5b1e97a2bdac51683a3db016ec9a2996
 - name: python
-  version: 3.13.13
-  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.13.13_linux_x64_cflinuxfs5_953e784f.tgz
-  sha256: 953e784f168dfcb66192b209181f2bbf4f9b6e554edb1938d367d7b1498aaa5f
+  version: 3.13.12
+  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.13.12_linux_x64_cflinuxfs5_d923c02a.tgz
+  sha256: d923c02aa27386583a1ecea31220a1aaadb7cc323be32dc8f71b1dd5ba81af62
   cf_stacks:
   - cflinuxfs5
-  source: https://www.python.org/ftp/python/3.13.13/Python-3.13.13.tgz
-  source_sha256: f9cde7b0e2ec8165d7326e2a0f59ea2686ce9d0c617dbbb3d66a7e54d31b74b9
+  source: https://www.python.org/ftp/python/3.13.12/Python-3.13.12.tgz
+  source_sha256: 12e7cb170ad2d1a69aee96a1cc7fc8de5b1e97a2bdac51683a3db016ec9a2996
 - name: python
   version: 3.14.2
   uri: https://buildpack-dependencies.tanzu.vmware.com/cf/python/python_3.14.2_linux_x64_cflinuxfs3_82c1798d.tgz
@@ -210,30 +230,39 @@ dependencies:
   source: https://www.python.org/ftp/python/3.14.2/Python-3.14.2.tgz
   source_sha256: c609e078adab90e2c6bacb6afafacd5eaf60cd94cf670f1e159565725fcd448d
 - name: python
-  version: 3.14.4
-  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.14.4_linux_x64_cflinuxfs4_c99dfa05.tgz
-  sha256: c99dfa053d8b47dab158af2e072d0a4c80c6593443cb97e759e45de1934afc96
+  version: 3.14.3
+  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.14.3_linux_x64_cflinuxfs4_a54b3e20.tgz
+  sha256: a54b3e20698a979d70fdc15af5a426b6bcf861ba6f37055e1da535c6562a8122
   cf_stacks:
   - cflinuxfs4
-  source: https://www.python.org/ftp/python/3.14.4/Python-3.14.4.tgz
-  source_sha256: b4c059d5895f030e7df9663894ce3732bfa1b32cd3ab2883980266a45ce3cb3b
+  source: https://www.python.org/ftp/python/3.14.3/Python-3.14.3.tgz
+  source_sha256: d7fe130d0501ae047ca318fa92aa642603ab6f217901015a1df6ce650d5470cd
 - name: python
-  version: 3.14.4
-  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.14.4_linux_x64_cflinuxfs5_ae27ea8c.tgz
-  sha256: ae27ea8c3e4b063be4f1dfbfcb37b65fe55be0c9812f275f56e68df96e7283ec
+  version: 3.14.3
+  uri: https://buildpacks.cloudfoundry.org/dependencies/python/python_3.14.3_linux_x64_cflinuxfs5_62e6a7a7.tgz
+  sha256: 62e6a7a7a369c77412c1db87799128cd87a27bbfd14969c01ff4719a7bd7049f
   cf_stacks:
   - cflinuxfs5
-  source: https://www.python.org/ftp/python/3.14.4/Python-3.14.4.tgz
-  source_sha256: b4c059d5895f030e7df9663894ce3732bfa1b32cd3ab2883980266a45ce3cb3b
+  source: https://www.python.org/ftp/python/3.14.3/Python-3.14.3.tgz
+  source_sha256: d7fe130d0501ae047ca318fa92aa642603ab6f217901015a1df6ce650d5470cd
+- name: setuptools
+  version: 80.9.0
+  uri: https://buildpacks.cloudfoundry.org/dependencies/setuptools/setuptools_80.9.0_linux_noarch_any-stack_db9ec7d3.tgz
+  sha256: db9ec7d3c1b8e1494852b7228c3de7dd7449a1c4a53297ea9633a117eedf6787
+  cf_stacks:
+  - cflinuxfs4
+  - cflinuxfs3
+  source: https://files.pythonhosted.org/packages/18/5d/3bf57dcd21979b887f014ea83c24ae194cfcd12b9e0fda66b957c69d1fca/setuptools-80.9.0.tar.gz
+  source_sha256: f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c
 - name: setuptools
-  version: 82.0.1
-  uri: https://buildpacks.cloudfoundry.org/dependencies/setuptools/setuptools_82.0.1_linux_noarch_any-stack_934b4323.tgz
-  sha256: 934b4323475131e04577a24eff3774f75a1219948f49c63afcd5e35a507d8ba7
+  version: 82.0.0
+  uri: https://buildpacks.cloudfoundry.org/dependencies/setuptools/setuptools_82.0.0_linux_noarch_any-stack_284f639c.tgz
+  sha256: 284f639c6d85d6f159daa5eb35a28f0351f185ffebb50bd6deebf73d8d3ca444
   cf_stacks:
   - cflinuxfs4
   - cflinuxfs5
-  source: https://files.pythonhosted.org/packages/4f/db/cfac1baf10650ab4d1c111714410d2fbb77ac5a616db26775db562c8fab2/setuptools-82.0.1.tar.gz
-  source_sha256: 7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9
+  source: https://files.pythonhosted.org/packages/82/f3/748f4d6f65d1756b9ae577f329c951cda23fb900e4de9f70900ced962085/setuptools-82.0.0.tar.gz
+  source_sha256: 22e0a2d69474c6ae4feb01951cb69d515ed23728cf96d05513d36e42b62b37cb
 include_files:
 - CHANGELOG
 - CONTRIBUTING.md

src/python/supply/supply.go

@@ -743,19 +743,74 @@ func (s *Supplier) RunPipVendored() error {
 // dependencies - wheel and setuptools. These are packaged by the dependency
 // pipeline within the "pip" dependency.
 func (s *Supplier) InstallCommonBuildDependencies() error {
-	var commonDeps = []string{"wheel", "setuptools", "flit-core"}
+	// wheel and setuptools are packaged as pip-installable sdists inside the
+	// "pip" dependency tarball.  flit-core is a separate dependency whose
+	// tarball contains the raw Python source tree (not an sdist/wheel for pip).
+	//
+	// Bootstrap strategy:
+	//  1. Extract the pip tarball → /tmp/common_build_deps  (wheel/setuptools sdists land here)
+	//  2. Extract the flit-core tarball → /tmp/common_build_deps
+	//     → /tmp/common_build_deps/flit_core/ (source) + pyproject.toml
+	//  3. Set PYTHONPATH=/tmp/common_build_deps so flit_core is importable.
+	//  4. pip install /tmp/common_build_deps --no-build-isolation
+	//     → builds flit_core wheel using itself from PYTHONPATH and installs it.
+	//  5. pip install wheel setuptools --no-index --no-build-isolation --find-links=tempPath
+	//     → flit_core is now a real installed package, so wheel's build succeeds.
 	tempPath := filepath.Join("/tmp", "common_build_deps")
 	if err := s.Installer.InstallOnlyVersion("pip", tempPath); err != nil {
 		return err
 	}
+	if err := s.Installer.InstallOnlyVersion("flit-core", tempPath); err != nil {
+		return err
+	}
+
+	// Step 3: make flit_core source importable.
+	prevPythonPath := os.Getenv("PYTHONPATH")
+	newPythonPath := tempPath
+	if prevPythonPath != "" {
+		newPythonPath = tempPath + string(os.PathListSeparator) + prevPythonPath
+	}
+	os.Setenv("PYTHONPATH", newPythonPath)
+	defer os.Setenv("PYTHONPATH", prevPythonPath)
 
-	for _, dep := range commonDeps {
+	// Step 4: install flit_core from its source directory via bootstrap.
+	s.Log.Info("Installing build-time dependency flit-core (bootstrap)")
+	if err := s.runPipInstall(tempPath, "--no-build-isolation"); err != nil {
+		return fmt.Errorf("could not bootstrap-install flit-core: %v", err)
+	}
+
+	// Step 5: install wheel and setuptools (now flit_core is installed).
+	for _, dep := range []string{"wheel", "setuptools"} {
 		s.Log.Info("Installing build-time dependency %s", dep)
-		args := []string{dep, "--no-index", "--upgrade-strategy=only-if-needed", fmt.Sprintf("--find-links=%s", tempPath)}
+		args := []string{dep, "--no-index", "--no-build-isolation", "--upgrade-strategy=only-if-needed", fmt.Sprintf("--find-links=%s", tempPath)}
 		if err := s.runPipInstall(args...); err != nil {
 			return fmt.Errorf("could not install build-time dependency %s: %v", dep, err)
 		}
 	}
+
+	// Step 6: install poetry-core.
+	// poetry-core is bundled in the buildpack under vendor_bundled/poetry-core_2.1.3.tgz.
+	// Its pyproject.toml declares backend-path = ["src"] and requires = [],
+	// so it self-bootstraps with --no-build-isolation (no build deps required).
+	bpDir, err := libbuildpack.GetBuildpackDir()
+	if err != nil {
+		return fmt.Errorf("could not determine buildpack dir for poetry-core bootstrap: %v", err)
+	}
+	poetryCoreTar := filepath.Join(bpDir, "vendor_bundled", "poetry-core_2.1.3.tgz")
+	poetryCoreSrc := filepath.Join("/tmp", "poetry_core_src")
+	if err := os.MkdirAll(poetryCoreSrc, 0755); err != nil {
+		return fmt.Errorf("could not create poetry-core src dir: %v", err)
+	}
+	s.Log.Info("Extracting bundled poetry-core from %s", poetryCoreTar)
+	if err := s.Command.Execute("/", indentWriter(os.Stdout), indentWriter(os.Stderr),
+		"tar", "xzf", poetryCoreTar, "-C", poetryCoreSrc); err != nil {
+		return fmt.Errorf("could not extract poetry-core tarball: %v", err)
+	}
+	s.Log.Info("Installing build-time dependency poetry-core (bootstrap)")
+	if err := s.runPipInstall(poetryCoreSrc, "--no-build-isolation"); err != nil {
+		return fmt.Errorf("could not bootstrap-install poetry-core: %v", err)
+	}
+
 	return nil
 }