resholve: move python27 into its own file

pkgs/development/misc/resholve/default.nix

@@ -12,33 +12,7 @@ let
         knownVulnerabilities = [ ];
       };
     });
-  # We are removing `meta.knownVulnerabilities` from `python27`,
-  # and setting it in `resholve` itself.
-  python27' = (removeKnownVulnerabilities pkgsBuildHost.python27).override {
-    self = python27';
-    pkgsBuildHost = pkgsBuildHost // {
-      python27 = python27';
-    };
-    # strip down that python version as much as possible
-    openssl = null;
-    bzip2 = null;
-    readline = null;
-    ncurses = null;
-    gdbm = null;
-    sqlite = null;
-    rebuildBytecode = false;
-    stripBytecode = true;
-    strip2to3 = true;
-    stripConfig = true;
-    stripIdlelib = true;
-    stripTests = true;
-    enableOptimizations = false;
-    packageOverrides = final: prev: {
-      pip = removeKnownVulnerabilities prev.pip;
-      setuptools = removeKnownVulnerabilities prev.setuptools;
-    };
-  };
-  callPackage = lib.callPackageWith (pkgsBuildHost // { python27 = python27'; });
+  callPackage = lib.callPackageWith pkgsBuildHost;
   source = callPackage ./source.nix { };
   deps = callPackage ./deps.nix { };
   # not exposed in all-packages

pkgs/development/misc/resholve/deps.nix

@@ -2,11 +2,12 @@
   lib,
   callPackage,
   fetchFromGitHub,
-  python27,
   fetchPypi,
   ...
 }:
-
+let
+  python27 = callPackage ./python27.nix { };
+in
 /*
   Notes on specific dependencies:
   - if/when python2.7 is removed from nixpkgs, this may need to figure
@@ -15,7 +16,6 @@
 
 rec {
   oil = callPackage ./oildev.nix {
-    inherit python27;
     inherit six;
     inherit typing;
   };

pkgs/development/misc/resholve/oildev.nix

@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  python27,
   callPackage,
   fetchFromGitHub,
   makeWrapper,
@@ -12,6 +11,9 @@
   six,
   typing,
 }:
+let
+  python27 = callPackage ./python27.nix { };
+in
 
 {
   /*

pkgs/development/misc/resholve/python27.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  pkgsBuildHost,
+}:
+
+let
+  removeKnownVulnerabilities =
+    pkg:
+    pkg.overrideAttrs (old: {
+      meta = (old.meta or { }) // {
+        knownVulnerabilities = [ ];
+      };
+    });
+  # We are removing `meta.knownVulnerabilities` from `python27`,
+  # and setting it in `resholve` itself.
+  python27 = (removeKnownVulnerabilities pkgsBuildHost.python27).override {
+    self = python27;
+    pkgsBuildHost = pkgsBuildHost // {
+      inherit python27;
+    };
+    # python2-only overrides for bootstrapped-pip/pip/setuptools/wheel
+    # (no longer applied globally — kept local to resholve)
+    packageOverrides = lib.composeExtensions (import ./python2-packages.nix) (
+      _self: super: {
+        pip = removeKnownVulnerabilities super.pip;
+        setuptools = removeKnownVulnerabilities super.setuptools;
+      }
+    );
+    # strip down that python version as much as possible
+    openssl = null;
+    bzip2 = null;
+    readline = null;
+    ncurses = null;
+    gdbm = null;
+    sqlite = null;
+    rebuildBytecode = false;
+    stripBytecode = true;
+    strip2to3 = true;
+    stripConfig = true;
+    stripIdlelib = true;
+    stripTests = true;
+    enableOptimizations = false;
+  };
+in
+python27

pkgs/development/misc/resholve/resholve.nix

@@ -1,7 +1,6 @@
 {
   lib,
   callPackage,
-  python27,
   fetchFromGitHub,
   installShellFiles,
   rSrc,
@@ -13,7 +12,9 @@
   resholve,
   resholve-utils,
 }:
-
+let
+  python27 = callPackage ./python27.nix { };
+in
 let
   sedparse = python27.pkgs.buildPythonPackage {
     pname = "sedparse";

pkgs/development/misc/resholve/test.nix

@@ -13,7 +13,6 @@
   bats,
   libressl,
   openssl,
-  python27,
   file,
   gettext,
   rSrc,