python.pkgs.buildPythonPackage: use distutils-cfg to block downloads, fixes #25428

While we tell pip not to fetch (with the `--no-index` option),
`setuptools` can do so itself. In the past we used a `distutils.cfg`
with `allow-hosts = None` to prevent setuptools from fetching itself.
This was removed when we started building wheels in
2562f94de4e4fd2ddc677187fa2e2848L69.

The `dist-utils.cfg` code was still there, and adding it to
`buildInputs` is sufficient.

Tested with python.pkgs.passlib by removing the `checkInputs` / `nose`.

1 files changed, 3 insertions, 1 deletions

diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index bc586e0b3cee..dae465edc0d8 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -6,6 +6,8 @@
 , setuptools
 , unzip
 , ensureNewerSourcesHook
+# Prevent impurities by blocking setuptools/easy-install from downloading sdists
+, distutils-cfg
 }:
 
 { name
@@ -60,7 +62,7 @@ python.stdenv.mkDerivation (builtins.removeAttrs attrs ["disabled" "checkInputs"
 
   inherit pythonPath;
 
-  buildInputs = [ wrapPython ] ++ buildInputs ++ pythonPath
+  buildInputs = [ distutils-cfg wrapPython ] ++ buildInputs ++ pythonPath
     ++ [ (ensureNewerSourcesHook { year = "1980"; }) ]
     ++ (lib.optional (lib.hasSuffix "zip" attrs.src.name or "") unzip)
     ++ lib.optionals doCheck checkInputs;