scripts/update_python_zip.py: build python3XY.zip from vcpkg's python3 port

[Fedr]

Adds scripts/update_python_zip.py, which builds python3XY.zip, the pure-Python standard library of an embedded interpreter, from the CPython sources of vcpkg's python3 port. Distribution steps call it to bundle a standard library that matches the Python vcpkg builds, instead of storing the zip in git. thirdparty/python/python312.zip and the workflows are not changed here.

update_python_zip.py [--vcpkg-tag TAG] [--output PATH]

• --vcpkg-tag: the vcpkg release tag. Default: vcpkg_version from .github/workflows/config.yml.
• --output: a zip file, or a directory that gets python3XY.zip. Default: the current directory.

What it does:

1. Reads ports/python3 at that vcpkg tag: version, source SHA512 and patch list.
2. Downloads python/cpython v<version>, the same archive vcpkg_from_github uses, and checks its SHA512 against the port's.
3. Applies the port's patches restricted to Lib/. Today only 0018-fix-sysconfig-include.patch touches Lib/sysconfig.py.
4. Leaves out what python.org's embeddable package leaves out: test, tests, idlelib, tkinter, turtledemo, ensurepip, venv, turtle.py, site-packages.
5. Compiles the way the embeddable package does: -OO, unchecked-hash .pyc, file names relative to Lib. It writes the .pyc and data files into the zip.

The script needs that Python minor version. If it runs under another one and uv is on PATH, it re-runs itself with uv run --python <X.Y>. It also needs git (for git apply) and network access to GitHub.

For vcpkg 2026.07.29 it builds a 3.79 MB, 596-entry zip from CPython 3.12.13. The committed thirdparty/python/python312.zip is python.org's 3.12.10. Loaded by vcpkg's python.exe/python312.dll 3.12.13 from a folder holding only that zip, json, sysconfig, logging, typing, argparse, unittest, subprocess and xml.dom.minidom import from it. The extension modules (_socket, _ssl, _sqlite3, ...) are not part of the zip; the distribution has to ship them as files.

Why not download the zip from python.org. python.org publishes the Windows embeddable packages (the source of python3XY.zip) only while a Python series gets bug-fix releases. 3.12 moved to security-fix-only releases after 3.12.10, and from 3.12.11 on python.org ships only the source tarballs. So 3.12.10 is the last 3.12 with python-3.12.x-embed-*.zip, which is why the committed zip was stuck there, and why there is nothing to download for vcpkg's 3.12.13:

Version	python.org files
3.12.10	installers plus python-3.12.10-embed-amd64.zip, -embed-arm64.zip, -embed-win32.zip
3.12.11	Python-3.12.11.tgz / .tar.xz only
3.12.13 (vcpkg 2026.07.29)	Python-3.12.13.tgz / .tar.xz only

A downloaded zip would also lack the vcpkg port's patches to Lib/ (today 0018-fix-sysconfig-include.patch). And a newer series (3.13, 3.14) would have embeddable packages only until it, too, moves to security-fix releases. The script builds from the same source tarball python.org publishes, checked against the port's SHA512, in the embeddable package's format: the same excluded packages, -OO, and unchecked-hash .pyc.

🤖 Generated with Claude Code

[Grantim]

since we have a script to build zip should we really store it in git history, or better just build it on distribution?