From a86349645374aba9d6772057af03fa9fe94e4d32 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 3 May 2026 22:54:26 +0300
Subject: [PATCH] resholve: move python27 into its own file

---
 pkgs/development/misc/resholve/default.nix  | 28 +------------
 pkgs/development/misc/resholve/deps.nix     |  6 +--
 pkgs/development/misc/resholve/oildev.nix   |  4 +-
 pkgs/development/misc/resholve/python27.nix | 45 +++++++++++++++++++++
 pkgs/development/misc/resholve/resholve.nix |  5 ++-
 pkgs/development/misc/resholve/test.nix     |  1 -
 6 files changed, 55 insertions(+), 34 deletions(-)
 create mode 100644 pkgs/development/misc/resholve/python27.nix

diff --git a/pkgs/development/misc/resholve/default.nix b/pkgs/development/misc/resholve/default.nix
index a8061d19fe0d..3e790cb3983b 100644
--- a/pkgs/development/misc/resholve/default.nix
+++ b/pkgs/development/misc/resholve/default.nix
@@ -12,33 +12,7 @@ let
         knownVulnerabilities = [ ];
       };
     });
-  # We are removing `meta.knownVulnerabilities` from `python27`,
-  # and setting it in `resholve` itself.
-  python27' = (removeKnownVulnerabilities pkgsBuildHost.python27).override {
-    self = python27';
-    pkgsBuildHost = pkgsBuildHost // {
-      python27 = python27';
-    };
-    # strip down that python version as much as possible
-    openssl = null;
-    bzip2 = null;
-    readline = null;
-    ncurses = null;
-    gdbm = null;
-    sqlite = null;
-    rebuildBytecode = false;
-    stripBytecode = true;
-    strip2to3 = true;
-    stripConfig = true;
-    stripIdlelib = true;
-    stripTests = true;
-    enableOptimizations = false;
-    packageOverrides = final: prev: {
-      pip = removeKnownVulnerabilities prev.pip;
-      setuptools = removeKnownVulnerabilities prev.setuptools;
-    };
-  };
-  callPackage = lib.callPackageWith (pkgsBuildHost // { python27 = python27'; });
+  callPackage = lib.callPackageWith pkgsBuildHost;
   source = callPackage ./source.nix { };
   deps = callPackage ./deps.nix { };
   # not exposed in all-packages
diff --git a/pkgs/development/misc/resholve/deps.nix b/pkgs/development/misc/resholve/deps.nix
index e96e049528c1..24749d8f6063 100644
--- a/pkgs/development/misc/resholve/deps.nix
+++ b/pkgs/development/misc/resholve/deps.nix
@@ -2,11 +2,12 @@
   lib,
   callPackage,
   fetchFromGitHub,
-  python27,
   fetchPypi,
   ...
 }:
-
+let
+  python27 = callPackage ./python27.nix { };
+in
 /*
   Notes on specific dependencies:
   - if/when python2.7 is removed from nixpkgs, this may need to figure
@@ -15,7 +16,6 @@
 
 rec {
   oil = callPackage ./oildev.nix {
-    inherit python27;
     inherit six;
     inherit typing;
   };
diff --git a/pkgs/development/misc/resholve/oildev.nix b/pkgs/development/misc/resholve/oildev.nix
index 7eb6314a2edc..9fe3b8ffeff2 100644
--- a/pkgs/development/misc/resholve/oildev.nix
+++ b/pkgs/development/misc/resholve/oildev.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  python27,
   callPackage,
   fetchFromGitHub,
   makeWrapper,
@@ -12,6 +11,9 @@
   six,
   typing,
 }:
+let
+  python27 = callPackage ./python27.nix { };
+in
 
 {
   /*
diff --git a/pkgs/development/misc/resholve/python27.nix b/pkgs/development/misc/resholve/python27.nix
new file mode 100644
index 000000000000..fd3aa80bcbe7
--- /dev/null
+++ b/pkgs/development/misc/resholve/python27.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  pkgsBuildHost,
+}:
+
+let
+  removeKnownVulnerabilities =
+    pkg:
+    pkg.overrideAttrs (old: {
+      meta = (old.meta or { }) // {
+        knownVulnerabilities = [ ];
+      };
+    });
+  # We are removing `meta.knownVulnerabilities` from `python27`,
+  # and setting it in `resholve` itself.
+  python27 = (removeKnownVulnerabilities pkgsBuildHost.python27).override {
+    self = python27;
+    pkgsBuildHost = pkgsBuildHost // {
+      inherit python27;
+    };
+    # python2-only overrides for bootstrapped-pip/pip/setuptools/wheel
+    # (no longer applied globally — kept local to resholve)
+    packageOverrides = lib.composeExtensions (import ./python2-packages.nix) (
+      _self: super: {
+        pip = removeKnownVulnerabilities super.pip;
+        setuptools = removeKnownVulnerabilities super.setuptools;
+      }
+    );
+    # strip down that python version as much as possible
+    openssl = null;
+    bzip2 = null;
+    readline = null;
+    ncurses = null;
+    gdbm = null;
+    sqlite = null;
+    rebuildBytecode = false;
+    stripBytecode = true;
+    strip2to3 = true;
+    stripConfig = true;
+    stripIdlelib = true;
+    stripTests = true;
+    enableOptimizations = false;
+  };
+in
+python27
diff --git a/pkgs/development/misc/resholve/resholve.nix b/pkgs/development/misc/resholve/resholve.nix
index 16c9924510e3..823216ba800a 100644
--- a/pkgs/development/misc/resholve/resholve.nix
+++ b/pkgs/development/misc/resholve/resholve.nix
@@ -1,7 +1,6 @@
 {
   lib,
   callPackage,
-  python27,
   fetchFromGitHub,
   installShellFiles,
   rSrc,
@@ -13,7 +12,9 @@
   resholve,
   resholve-utils,
 }:
-
+let
+  python27 = callPackage ./python27.nix { };
+in
 let
   sedparse = python27.pkgs.buildPythonPackage {
     pname = "sedparse";
diff --git a/pkgs/development/misc/resholve/test.nix b/pkgs/development/misc/resholve/test.nix
index 75b13b7c1900..a2cc8aaffe69 100644
--- a/pkgs/development/misc/resholve/test.nix
+++ b/pkgs/development/misc/resholve/test.nix
@@ -13,7 +13,6 @@
   bats,
   libressl,
   openssl,
-  python27,
   file,
   gettext,
   rSrc,