bootstrap_python.sh

#!/bin/bash
# User-level Python toolchain for SPLed (no root / no sudo).
# Installs uv, a standalone CPython 3.13, and Poetry into the current user's
# ~/.local, then points Poetry at the uv 3.13 for the project virtualenv.
# uv and Poetry are version-pinned below; bump them there.
# Run AFTER bootstrap_ubuntu.sh (which provides pipx):
#   - the devcontainer bakes it into the image at build time (.devcontainer/Dockerfile)
#   - on a bare WSL/Ubuntu host:  ./bootstrap_python.sh
set -euo pipefail

# Pinned versions -- bump deliberately, in a reviewable commit. These are the versions
# validated together with the poks toolchain on CI's ubuntu-24.04 runner. Letting them
# float means an upstream release can turn CI red without any commit changing, and the
# nightly build then reports a regression that is not one. Poetry especially: its 2.x
# line is what introduced the bare-`python` PATH probe worked around below.
UV_VERSION="0.13.5"
POETRY_VERSION="2.4.1"
# Minor only: the 3.13 patch level deliberately floats so CPython security fixes are
# picked up. pyproject requires >=3.13,<3.14, so any 3.13.x satisfies the project.
PYTHON_VERSION="3.13"
# Floor for the floating patch: 3.13.17 is the first 3.13 whose bundled pip (26.2.2)
# no longer trusts the compromised emSign CAs. uv serves it from 0.13.5 on.
PYTHON_MIN_VERSION="3.13.17"

# pipx (from bootstrap_ubuntu.sh) installs isolated CLI tools into ~/.local/bin.
# --force on both installs below: pipx keys on the package NAME, not the version spec,
# so without it a re-run after a version bump above would keep the old version and
# silently ignore the pin. It also makes re-running this script idempotent.
pipx install --force "uv==$UV_VERSION"
pipx ensurepath                        # ~/.local/bin on PATH for future shells
export PATH="$HOME/.local/bin:$PATH"   # ...and for the rest of this script

# Standalone CPython (prebuilt: no from-source build, no GPG keyserver;
# matches pyproject requires-python <3.14,>=3.13).
uv python install "$PYTHON_VERSION"
# `install` keeps an already installed older patch; `upgrade` moves it to the newest patch uv serves.
uv python upgrade "$PYTHON_VERSION"
uv_py="$(uv python find "$PYTHON_VERSION")"
# The newest patch this uv serves can still be below the floor if UV_VERSION is too old.
if ! "$uv_py" -c "import sys; sys.exit(sys.version_info < tuple(map(int, '$PYTHON_MIN_VERSION'.split('.'))))"; then
    echo "ERROR: $uv_py is older than Python $PYTHON_MIN_VERSION. Raise UV_VERSION to a uv that serves it." >&2
    exit 1
fi

# Poetry 2.x ALWAYS probes PATH for a bare `python` when it resolves the venv
# interpreter — verified that `virtualenvs.use-poetry-python = true` does NOT suppress
# this. The base image ships no bare `python`, so `poetry install` dies with
# "[Errno 2] No such file or directory: 'python'". Give it one, pointing at the
# uv-managed 3.13 (which matches pyproject's requires-python). This is the same thing
# the pre-refactor image achieved; we just keep it in ~/.local instead of /usr/local.
#
# ONLY `python` — deliberately NOT `python3`: every host this runs on already has a
# system `python3`, and ~/.profile prepends ~/.local/bin, so a `python3` symlink here
# would silently shadow the OS `python3` for all of the user's other work on a bare
# WSL host. `python` alone satisfies Poetry's probe (verified) and shadows nothing.
ln -sf "$uv_py" "$HOME/.local/bin/python"

# Poetry, pinned by version and to the uv CPython, installed isolated via pipx.
pipx install --force --python "$uv_py" "poetry==$POETRY_VERSION"

# in-project set GLOBALLY (no --local): this script also runs at image-build time, where
# the CWD is not a writable project dir. build.sh --install re-applies `--local` in the
# workspace anyway. use-poetry-python additionally pins Poetry's own uv-3.13 as the venv
# interpreter (belt-and-suspenders alongside the `python` symlink above).
poetry config virtualenvs.in-project true
poetry config virtualenvs.use-poetry-python true

echo "bootstrap_python.sh complete. If 'poetry' is not found, open a new shell"
echo "(or: source ~/.bashrc) so ~/.local/bin is on PATH, then run ./build.sh --install"