Get matplotlib working with upstream Python

This patch adds support for using matplotlib plus its Gtk backend with
`--config=k8_upstream_python`. Unfortunately, the Tk backend doesn't
work because of how Python is packaged. See the following issue for
more information:
https://github.com/matplotlib/matplotlib/issues/23074

Separately, we need to patch pygobject and matplotlib for various
hermeticity reasons. To accomplish this, I've added patching support
for wheels downloaded via rules_python. I should have set it up to use
annotations (the same mechanism we use for injecting deps), but it was
a little cumbersome. Annotations are not set up for using in arguments
to repository rules. I instead opted for a separate JSON file. You can
find it at `tools/python/patches.json`.

You can try the two new example programs:

    $ bazel run --config=k8_upstream_python //build_tests:matplotlib_example
    $ bazel run --config=k8_upstream_python //build_tests:pygobject_example

Signed-off-by: Philipp Schrader <philipp.schrader@gmail.com>
Change-Id: I3c4e8648a8012aa23dedd53610e82d590d1c409d
diff --git a/WORKSPACE b/WORKSPACE
index 1f3a7ae..eaa227f 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -414,6 +414,7 @@
     patch_args = ["-p1"],
     patches = [
         "//third_party:rules_python/0001-Support-overriding-individual-packages.patch",
+        "//third_party:rules_python/0002-Allow-user-to-patch-wheels.patch",
     ],
     sha256 = "497ca47374f48c8b067d786b512ac10a276211810f4a580178ee9b9ad139323a",
     strip_prefix = "rules_python-0.16.1",
@@ -430,10 +431,14 @@
 
 load("@python3_9//:defs.bzl", python_interpreter = "interpreter")
 load("@rules_python//python:pip.bzl", "pip_parse")
+load("//tools/python:package_annotations.bzl", PYTHON_ANNOTATIONS = "ANNOTATIONS")
 
 pip_parse(
     name = "pip_deps",
+    annotations = PYTHON_ANNOTATIONS,
+    enable_implicit_namespace_pkgs = True,
     overrides = "//tools/python:whl_overrides.json",
+    patch_spec = "//tools/python:patches.json",
     python_interpreter_target = python_interpreter,
     require_overrides = RUNNING_IN_CI,
     requirements_lock = "//tools/python:requirements.lock.txt",
@@ -692,8 +697,8 @@
 http_archive(
     name = "gtk_runtime",
     build_file = "@//debian:gtk_runtime.BUILD",
-    sha256 = "934693e64bfe63f0c55cdf432fe183eb077d6875d4d6a3dce4e47dbe7e20f5a9",
-    url = "https://www.frc971.org/Build-Dependencies/gtk_runtime-3.tar.gz",
+    sha256 = "5a6014d1783363be6bc95843d03bbb6513e650eaea60be2b1a4c65bf21981f9b",
+    url = "https://www.frc971.org/Build-Dependencies/gtk_runtime-4.tar.gz",
 )
 
 # Downloaded from
diff --git a/build_tests/BUILD b/build_tests/BUILD
index 7c88992..718e817 100644
--- a/build_tests/BUILD
+++ b/build_tests/BUILD
@@ -232,3 +232,20 @@
         "@pip//scipy",
     ],
 )
+
+py_binary(
+    name = "pygobject_example",
+    srcs = ["pygobject_example.py"],
+    deps = [
+        "@pip//pygobject",
+    ],
+)
+
+py_binary(
+    name = "matplotlib_example",
+    srcs = ["matplotlib_example.py"],
+    deps = [
+        "@pip//matplotlib",
+        "@pip//pygobject",
+    ],
+)
diff --git a/build_tests/matplotlib_example.py b/build_tests/matplotlib_example.py
new file mode 100644
index 0000000..1331a20
--- /dev/null
+++ b/build_tests/matplotlib_example.py
@@ -0,0 +1,12 @@
+# This is the introductory example from
+# https://matplotlib.org/stable/tutorials/introductory/pyplot.html
+
+import matplotlib
+import matplotlib.pyplot as plt
+
+# Set up the gtk backend before running matplotlib.
+matplotlib.use("GTK3Agg")
+
+plt.plot([1, 2, 3, 4])
+plt.ylabel("some numbers")
+plt.show()
diff --git a/build_tests/pygobject_example.py b/build_tests/pygobject_example.py
new file mode 100644
index 0000000..c8e0bbd
--- /dev/null
+++ b/build_tests/pygobject_example.py
@@ -0,0 +1,26 @@
+# This is the extended example from
+# https://python-gtk-3-tutorial.readthedocs.io/en/latest/introduction.html#extended-example
+
+import gi
+
+gi.require_version("Gtk", "3.0")
+from gi.repository import Gtk
+
+
+class MyWindow(Gtk.Window):
+
+    def __init__(self):
+        super().__init__(title="Hello World")
+
+        self.button = Gtk.Button(label="Click Here")
+        self.button.connect("clicked", self.on_button_clicked)
+        self.add(self.button)
+
+    def on_button_clicked(self, widget):
+        print("Hello World")
+
+
+win = MyWindow()
+win.connect("destroy", Gtk.main_quit)
+win.show_all()
+Gtk.main()
diff --git a/debian/BUILD b/debian/BUILD
index f14db44..4291329 100644
--- a/debian/BUILD
+++ b/debian/BUILD
@@ -183,6 +183,7 @@
     packages = [
         "gir1.2-gtk-3.0",
         "libgtk-3-dev",
+        "librsvg2-common",
     ],
 )
 
diff --git a/debian/gtk_runtime.bzl b/debian/gtk_runtime.bzl
index 029419c..d8185f6 100644
--- a/debian/gtk_runtime.bzl
+++ b/debian/gtk_runtime.bzl
@@ -164,6 +164,8 @@
     "libpsl5_0.21.0-1.2_amd64.deb": "d716f5b4346ec85bb728f4530abeb1da4a79f696c72d7f774c59ba127c202fa7",
     "libpthread-stubs0-dev_0.4-1_amd64.deb": "54632f160e1e8a43656a87195a547391038c4ca0f53291b849cd4457ba5dfde9",
     "librest-0.7-0_0.8.1-1.1_amd64.deb": "5cd57a96145a362bf60428315ab3fc6c2f528ab38a06a905da2568575c23bdc8",
+    "librsvg2-2_2.50.3+dfsg-1_amd64.deb": "c5f6cdb66683d9b8cd23f0e02e6adb29d43bdca301872842fa98d44e23fa1091",
+    "librsvg2-common_2.50.3+dfsg-1_amd64.deb": "4c28fad9d68e82729388f0b113de3a6ad020856c0783a3eced7eb626e80fcae6",
     "libselinux1-dev_3.1-3_amd64.deb": "16b14d7e8ed88b9b07d1b52d84d04ab2fcdfcdc4b8cecc9dd34df06f3ce7d3fb",
     "libselinux1_3.1-3_amd64.deb": "339f5ede10500c16dd7192d73169c31c4b27ab12130347275f23044ec8c7d897",
     "libsensors-config_3.6.0-7_all.deb": "4265811140a591d27c99d026b63707d8235d98c73d7543c66ab9ec73c28523fc",
diff --git a/third_party/python/matplotlib/init.patch b/third_party/python/matplotlib/init.patch
new file mode 100644
index 0000000..8911145
--- /dev/null
+++ b/third_party/python/matplotlib/init.patch
@@ -0,0 +1,66 @@
+commit 78913db0555d6b47449ca3cb7478c94663a1e553
+Author: Philipp Schrader <philipp.schrader@gmail.com>
+Date:   Thu Oct 27 20:57:23 2022 -0700
+
+    Make matplotlib hermetic
+
+diff --git a/site-packages/matplotlib/__init__.py b/site-packages/matplotlib/__init__.py
+index ba9cd6c..083ef5b 100644
+--- a/site-packages/matplotlib/__init__.py
++++ b/site-packages/matplotlib/__init__.py
+@@ -104,6 +104,46 @@ import warnings
+ import numpy
+ from packaging.version import parse as parse_version
+ 
++
++from bazel_tools.tools.python.runfiles import runfiles
++
++def _hermeticity_fixup():
++    _runfiles = runfiles.Create()
++    runfiles_dir = _runfiles.EnvVars()["RUNFILES_DIR"]
++    if not runfiles_dir:
++        raise FileNotFoundError("Failed runfiles lookup.")
++
++    matplotlib_base = os.path.dirname(os.path.dirname(__file__))
++
++    # Hack to point matplotlib at its data.
++    os.environ["MATPLOTLIBDATA"] = os.path.join(matplotlib_base, "matplotlib", "mpl-data")
++    # Avoid reading /etc/matplotlib in all cases. Matplotlib is pretty happy to
++    # escape the sandbox by using absolute paths.
++    os.environ["MATPLOTLIBRC"] = os.path.join(os.environ["MATPLOTLIBDATA"], "matplotlibrc")
++    # There's a bug where the temp directory gets set if MATPLOTLIBRC isn't set.
++    # That causes the directory to not be created in time. We set the variable
++    # manually here to work around the bug.
++    os.environ["MPLCONFIGDIR"] = "/tmp/matplotlib-nobody"
++
++    gtk_runtime_base = os.path.join(runfiles_dir, "gtk_runtime")
++
++    # Tell fontconfig where to find matplotlib's sandboxed font files.
++    os.environ["FONTCONFIG_PATH"] = os.path.join(gtk_runtime_base, "etc/fonts")
++    os.environ["FONTCONFIG_FILE"] = "fonts.conf"
++    os.environ["FONTCONFIG_SYSROOT"] = gtk_runtime_base
++
++    ld_library_path = os.getenv("LD_LIBRARY_PATH") or ""
++    if ld_library_path:
++        ld_library_path = ":" + ld_library_path
++
++    os.environ["LD_LIBRARY_PATH"] = ":".join([
++        gtk_runtime_base + "/lib/x86_64-linux-gnu",
++        gtk_runtime_base + "/usr/lib/x86_64-linux-gnu",
++    ]) + ld_library_path
++
++_hermeticity_fixup()
++
++
+ # cbook must import matplotlib only within function
+ # definitions, so it is safe to import from it here.
+ from . import _api, _version, cbook, docstring, rcsetup
+@@ -524,7 +564,7 @@ def get_cachedir():
+ @_logged_cached('matplotlib data path: %s')
+ def get_data_path():
+     """Return the path to Matplotlib data."""
+-    return str(Path(__file__).with_name("mpl-data"))
++    return str(Path(os.environ["MATPLOTLIBDATA"]))
+ 
+ 
+ def matplotlib_fname():
diff --git a/third_party/python/pygobject/init.patch b/third_party/python/pygobject/init.patch
new file mode 100644
index 0000000..9604628
--- /dev/null
+++ b/third_party/python/pygobject/init.patch
@@ -0,0 +1,60 @@
+commit fe03a5f1aa619f4c1208ca1dce7d98db513dbec8
+Author: Philipp Schrader <philipp.schrader@gmail.com>
+Date:   Thu Oct 27 20:28:03 2022 -0700
+
+    Make pygobject hermetic
+
+diff --git a/site-packages/gi/__init__.py b/site-packages/gi/__init__.py
+index 3454790..a6f3246 100644
+--- a/site-packages/gi/__init__.py
++++ b/site-packages/gi/__init__.py
+@@ -27,6 +27,49 @@ import os
+ import importlib
+ import types
+ 
++from bazel_tools.tools.python.runfiles import runfiles
++
++def _hermeticity_fixup():
++    _runfiles = runfiles.Create()
++    runfiles_dir = _runfiles.EnvVars()["RUNFILES_DIR"]
++    if not runfiles_dir:
++        raise FileNotFoundError("Failed runfiles lookup.")
++
++    gtk_runtime_dir = os.path.join(runfiles_dir, "gtk_runtime")
++
++    ld_library_path = os.getenv("LD_LIBRARY_PATH") or ""
++    if ld_library_path:
++        ld_library_path = ":" + ld_library_path
++
++    os.environ["LD_LIBRARY_PATH"] = ":".join([
++        gtk_runtime_dir + "/lib/x86_64-linux-gnu",
++        gtk_runtime_dir + "/usr/lib/x86_64-linux-gnu",
++    ]) + ld_library_path
++
++    os.environ["GI_GIR_PATH"] = os.path.join(gtk_runtime_dir, "usr", "share", "gir-1.0")
++    os.environ["GI_TYPELIB_PATH"] = os.path.join(gtk_runtime_dir, "usr", "lib",
++                                                 "x86_64-linux-gnu",
++                                                 "girepository-1.0")
++
++    os.environ["GIO_EXTRA_MODULES"] = os.path.join(gtk_runtime_dir, "usr", "lib", "x86_64-linux-gnu", "gio", "modules")
++
++    # Tell fontconfig where to find the sandboxed font files.
++    os.environ["FONTCONFIG_PATH"] = os.path.join(gtk_runtime_dir, "etc/fonts/")
++    os.environ["FONTCONFIG_FILE"] = os.path.join(gtk_runtime_dir, "etc/fonts/fonts.conf")
++    # The sysroot here needs to be "/". If it were _base, then the font caches
++    # would contain _base-relative paths in them. Unfortunately pango interprets
++    # those as absolute paths and ends up failing to find all fonts.
++    os.environ["FONTCONFIG_SYSROOT"] = "/"
++    os.environ["GDK_PIXBUF_MODULEDIR"] = os.path.join(gtk_runtime_dir, "usr", "lib",
++                                                      "x86_64-linux-gnu", "gdk-pixbuf-2.0",
++                                                      "2.10.0", "loaders")
++    os.environ["GDK_PIXBUF_MODULE_FILE"] = os.path.join(os.environ["GDK_PIXBUF_MODULEDIR"], "loaders.cache")
++    os.system(os.path.join(gtk_runtime_dir, "usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders") + " --update-cache")
++
++
++_hermeticity_fixup()
++
++
+ _static_binding_error = ('When using gi.repository you must not import static '
+                          'modules like "gobject". Please change all occurrences '
+                          'of "import gobject" to "from gi.repository import GObject". '
diff --git a/third_party/rules_python/0002-Allow-user-to-patch-wheels.patch b/third_party/rules_python/0002-Allow-user-to-patch-wheels.patch
new file mode 100644
index 0000000..9db2d9e
--- /dev/null
+++ b/third_party/rules_python/0002-Allow-user-to-patch-wheels.patch
@@ -0,0 +1,333 @@
+From f828c9aad94b56655b352c4bed9b475d7430865e Mon Sep 17 00:00:00 2001
+From: Philipp Schrader <philipp.schrader@gmail.com>
+Date: Sat, 24 Sep 2022 15:56:33 -0700
+Subject: [PATCH] Allow user to patch wheels
+
+There are two parts here. First we need to let the user inject patches
+to specific wheels. We do that via a new JSON file that can be
+specified in the WORKSPACE via the `patch_spec` attribute.
+The second part is to allow the user to inject `deps` in the specific
+wheels. This is important because the patches for the wheels may want
+to pull in other libraries that the wheel normally does not depend on.
+The `deps` injection is done via a new attribute on the annotation.
+
+I submitted a PR to rules_python for the `deps` injection part here:
+https://github.com/bazelbuild/rules_python/pull/853
+However, the maintainers would like to take a different approach for
+which I will write a proposal. The approach here will not be what's
+eventually upstreamed.
+---
+ .../pip_install/extract_wheels/annotation.py  |  5 +++
+ python/pip_install/extract_wheels/bazel.py    | 13 +++++++-
+ .../extract_wheels/extract_single_wheel.py    | 29 +++++++++++++++++
+ .../parse_requirements_to_bzl.py              | 25 ++++++++++++++-
+ python/pip_install/pip_repository.bzl         | 31 ++++++++++++++++++-
+ 5 files changed, 100 insertions(+), 3 deletions(-)
+
+diff --git a/python/pip_install/extract_wheels/annotation.py b/python/pip_install/extract_wheels/annotation.py
+index 48aaa80..fe8b4dc 100644
+--- a/python/pip_install/extract_wheels/annotation.py
++++ b/python/pip_install/extract_wheels/annotation.py
+@@ -19,6 +19,7 @@ class Annotation(OrderedDict):
+             "data",
+             "data_exclude_glob",
+             "srcs_exclude_glob",
++            "deps",
+         ):
+             if field not in content:
+                 missing.append(field)
+@@ -61,6 +62,10 @@ class Annotation(OrderedDict):
+     def srcs_exclude_glob(self) -> List[str]:
+         return self["srcs_exclude_glob"]
+ 
++    @property
++    def deps(self) -> List[str]:
++        return self["deps"]
++
+ 
+ class AnnotationsMap:
+     """A mapping of python package names to [Annotation]"""
+diff --git a/python/pip_install/extract_wheels/bazel.py b/python/pip_install/extract_wheels/bazel.py
+index 8f442c9..f4b7f26 100644
+--- a/python/pip_install/extract_wheels/bazel.py
++++ b/python/pip_install/extract_wheels/bazel.py
+@@ -2,6 +2,7 @@
+ import json
+ import os
+ import shutil
++import subprocess
+ import textwrap
+ from pathlib import Path
+ from typing import Dict, Iterable, List, Optional, Set
+@@ -335,6 +336,9 @@ def extract_wheel(
+     incremental: bool = False,
+     incremental_dir: Path = Path("."),
+     annotation: Optional[annotation.Annotation] = None,
++    patches: Optional[List[os.PathLike]] = None,
++    patch_args: Optional[List[os.PathLike]] = None,
++    patch_tool: Optional[str] = "patch",
+ ) -> Optional[str]:
+     """Extracts wheel into given directory and creates py_library and filegroup targets.
+ 
+@@ -415,6 +419,7 @@ def extract_wheel(
+         data = []
+         data_exclude = pip_data_exclude
+         srcs_exclude = []
++        deps = []
+         if annotation:
+             for src, dest in annotation.copy_files.items():
+                 data.append(dest)
+@@ -427,6 +432,7 @@ def extract_wheel(
+             data.extend(annotation.data)
+             data_exclude.extend(annotation.data_exclude_glob)
+             srcs_exclude.extend(annotation.srcs_exclude_glob)
++            deps.extend('"%s"' % dep for dep in annotation.deps)
+             if annotation.additive_build_content:
+                 additional_content.append(annotation.additive_build_content)
+ 
+@@ -434,7 +440,7 @@ def extract_wheel(
+             name=PY_LIBRARY_LABEL
+             if incremental
+             else sanitise_name(whl.name, repo_prefix),
+-            dependencies=sanitised_dependencies,
++            dependencies=sanitised_dependencies + deps,
+             whl_file_deps=sanitised_wheel_file_dependencies,
+             data_exclude=data_exclude,
+             data=data,
+@@ -444,6 +450,11 @@ def extract_wheel(
+         )
+         build_file.write(contents)
+ 
++    if patches:
++        base_cmd = [patch_tool] + (patch_args or []) + ["--input"]
++        for patch in patches:
++            subprocess.run(base_cmd + [patch], check=True, cwd=directory)
++
+     if not incremental:
+         os.remove(whl.path)
+         return f"//{directory}"
+diff --git a/python/pip_install/extract_wheels/extract_single_wheel.py b/python/pip_install/extract_wheels/extract_single_wheel.py
+index 8742d25..50a1243 100644
+--- a/python/pip_install/extract_wheels/extract_single_wheel.py
++++ b/python/pip_install/extract_wheels/extract_single_wheel.py
+@@ -1,4 +1,5 @@
+ import argparse
++import contextlib
+ import errno
+ import glob
+ import os
+@@ -35,6 +36,16 @@ def configure_reproducible_wheels() -> None:
+         os.environ["PYTHONHASHSEED"] = "0"
+ 
+ 
++@contextlib.contextmanager
++def chdir_context(new_cwd: os.PathLike) -> None:
++    old_cwd = os.getcwd()
++    try:
++        os.chdir(new_cwd)
++        yield
++    finally:
++        os.chdir(old_cwd)
++
++
+ def main() -> None:
+     parser = argparse.ArgumentParser(
+         description="Build and/or fetch a single wheel based on the requirement passed in"
+@@ -55,6 +66,21 @@ def main() -> None:
+         action="store_true",
+         help="If set, skips the pip download step. The .whl file is assumbed to be downloaded by bazel.",
+     )
++    parser.add_argument(
++        "--patch-file",
++        action="append",
++        help="The patch files to apply. Can be repeated for multiple patches.",
++    )
++    parser.add_argument(
++        "--patch-arg",
++        action="append",
++        help="Arguments to pass to the patch tool. Can be repeated for multiple arguments.",
++    )
++    parser.add_argument(
++        "--patch-tool",
++        type=str,
++        help="Path of the patch tool to execute for applying patches.",
++    )
+     arguments.parse_common_args(parser)
+     args = parser.parse_args()
+     deserialized_args = dict(vars(args))
+@@ -104,6 +130,9 @@ def main() -> None:
+         incremental=True,
+         repo_prefix=args.repo_prefix,
+         annotation=args.annotation,
++        patches=args.patch_file,
++        patch_args=args.patch_arg,
++        patch_tool=args.patch_tool,
+     )
+ 
+ 
+diff --git a/python/pip_install/extract_wheels/parse_requirements_to_bzl.py b/python/pip_install/extract_wheels/parse_requirements_to_bzl.py
+index 60936a9..3dd179b 100644
+--- a/python/pip_install/extract_wheels/parse_requirements_to_bzl.py
++++ b/python/pip_install/extract_wheels/parse_requirements_to_bzl.py
+@@ -88,6 +88,7 @@ def parse_whl_library_args(args: argparse.Namespace) -> Dict[str, Any]:
+         "bzlmod",
+         "overrides",
+         "require_overrides",
++        "patch_spec",
+     ):
+         if arg in whl_library_args:
+             whl_library_args.pop(arg)
+@@ -104,6 +105,7 @@ def generate_parsed_requirements_contents(
+     bzlmod: bool = False,
+     overrides: Optional[Dict[str, Dict[str, str]]] = None,
+     require_overrides: bool = False,
++    patch_spec: Optional[Dict[str, Dict[str, str]]] = None,
+ ) -> str:
+     """
+     Parse each requirement from the requirements_lock file, and prepare arguments for each
+@@ -147,13 +149,19 @@ def generate_parsed_requirements_contents(
+                     else:
+                         override = _NOP_OVERRIDE
+ 
++                clean_name = _clean_name(override_name.split("=")[0])
++                patch_attributes = _patch_spec.get(clean_name, {{}})
++
+                 whl_library(
+                     name = name,
+                     requirement = requirement,
+                     annotation = _get_annotation(requirement),
+                     url = override["url"],
+                     sha256 = override["sha256"],
+-                    **whl_config
++                    **dict(
++                        patch_attributes.items() +
++                        _config.items(),
++                    )
+                 )
+ """
+     return textwrap.dedent(
+@@ -172,6 +180,7 @@ def generate_parsed_requirements_contents(
+         _bzlmod = {bzlmod}
+         _overrides = {overrides}
+         _require_overrides = {require_overrides}
++        _patch_spec = {patch_spec}
+ 
+         _NOP_OVERRIDE = {{
+             "url": None,
+@@ -229,6 +238,7 @@ def generate_parsed_requirements_contents(
+             bzlmod=bzlmod,
+             overrides=overrides or {},
+             require_overrides=require_overrides,
++            patch_spec=patch_spec or {},
+         )
+     )
+ 
+@@ -301,6 +311,13 @@ If set, it will take precedence over python_interpreter.",
+         action="store_true",
+         help="If set, requires that every requirement has a URL override in the --overrides JSON file.",
+     )
++    parser.add_argument(
++        "--patch_spec",
++        type=Path,
++        help=("A json encoded file containing patch specifications for packages. "
++              "Keys are the normalized names of packages. "
++              "Values are objects with keys 'patches', 'patch_args', and 'patch_tool'."),
++    )
+     arguments.parse_common_args(parser)
+     args = parser.parse_args()
+ 
+@@ -331,6 +348,11 @@ If set, it will take precedence over python_interpreter.",
+     else:
+         overrides = None
+ 
++    if args.patch_spec:
++        patch_spec = json.loads(args.patch_spec.read_text())
++    else:
++        patch_spec = None
++
+     output.write(
+         textwrap.dedent(
+             """\
+@@ -355,6 +377,7 @@ If set, it will take precedence over python_interpreter.",
+             bzlmod=args.bzlmod,
+             overrides=overrides,
+             require_overrides=args.require_overrides,
++            patch_spec=patch_spec,
+         )
+     )
+ 
+diff --git a/python/pip_install/pip_repository.bzl b/python/pip_install/pip_repository.bzl
+index 5af0731..bf7f99a 100644
+--- a/python/pip_install/pip_repository.bzl
++++ b/python/pip_install/pip_repository.bzl
+@@ -327,6 +327,9 @@ def _pip_repository_impl(rctx):
+         args += ["--overrides", overrides_file]
+     if rctx.attr.require_overrides:
+         args += ["--require-overrides"]
++    if rctx.attr.patch_spec:
++        patch_spec_file = rctx.path(rctx.attr.patch_spec).realpath
++        args += ["--patch_spec", patch_spec_file]
+     progress_message = "Parsing requirements to starlark"
+ 
+     args += ["--repo", rctx.attr.name, "--repo-prefix", rctx.attr.repo_prefix]
+@@ -460,6 +463,10 @@ we do not create the install_deps() macro.
+         default = False,
+         doc = "If True, every requirement must have an entry in the \"overrides\" JSON file.",
+     ),
++    "patch_spec": attr.label(
++        allow_single_file = True,
++        doc = "A JSON file containing patches for various modules. TBD",
++    ),
+     "requirements": attr.label(
+         allow_single_file = True,
+         doc = "A 'requirements.txt' pip requirements file.",
+@@ -562,6 +569,12 @@ def _whl_library_impl(rctx):
+         if not download_result.success:
+             fail("Failed to download {}".format(rctx.attr.url))
+         args.append("--pre-downloaded")
++    if rctx.attr.patches:
++        patch_files = [str(rctx.path(path).realpath) for path in rctx.attr.patches]
++        args.extend(["--patch-file=" + file for file in patch_files] + [
++            "--patch-tool",
++            rctx.attr.patch_tool,
++        ] + ["--patch-arg=" + arg for arg in rctx.attr.patch_args])
+ 
+     args = _parse_optional_attrs(rctx, args)
+ 
+@@ -604,6 +617,20 @@ whl_library_attrs = {
+             "Optionally set this when using the 'url' parameter. " +
+             "Must be the expected checksum of the downloaded file."
+         ),
++    ),
++    "patches": attr.label_list(
++        doc = (
++            "The patch files to apply. List of strings, Labels, or paths. " +
++            "The paths within the files are relative to the 'site-packages' directory " +
++            "into which the wheel is extracted."
++        ),
++    ),
++    "patch_args": attr.string_list(
++        doc = "Arguments to pass to the patch tool. List of strings.",
++    ),
++    "patch_tool": attr.string(
++        doc = "Path of the patch tool to execute for applying patches. String.",
++        default = "patch",
+     )
+ }
+ 
+@@ -624,7 +651,8 @@ def package_annotation(
+         copy_executables = {},
+         data = [],
+         data_exclude_glob = [],
+-        srcs_exclude_glob = []):
++        srcs_exclude_glob = [],
++        deps = []):
+     """Annotations to apply to the BUILD file content from package generated from a `pip_repository` rule.
+ 
+     [cf]: https://github.com/bazelbuild/bazel-skylib/blob/main/docs/copy_file_doc.md
+@@ -650,4 +678,5 @@ def package_annotation(
+         data = data,
+         data_exclude_glob = data_exclude_glob,
+         srcs_exclude_glob = srcs_exclude_glob,
++        deps = deps,
+     ))
diff --git a/tools/python/package_annotations.bzl b/tools/python/package_annotations.bzl
new file mode 100644
index 0000000..b359d72
--- /dev/null
+++ b/tools/python/package_annotations.bzl
@@ -0,0 +1,12 @@
+load("@rules_python//python:pip.bzl", "package_annotation")
+
+ANNOTATIONS = {
+    "matplotlib": package_annotation(
+        data = ["@gtk_runtime//:gtk_runtime"],
+        deps = ["@bazel_tools//tools/python/runfiles"],
+    ),
+    "pygobject": package_annotation(
+        data = ["@gtk_runtime//:gtk_runtime"],
+        deps = ["@bazel_tools//tools/python/runfiles"],
+    ),
+}
diff --git a/tools/python/patches.json b/tools/python/patches.json
new file mode 100644
index 0000000..bfda933
--- /dev/null
+++ b/tools/python/patches.json
@@ -0,0 +1,14 @@
+{
+    "matplotlib": {
+        "patches": [
+            "//third_party:python/matplotlib/init.patch"
+        ],
+        "patch_args": ["-p1"]
+    },
+    "pygobject": {
+        "patches": [
+            "//third_party:python/pygobject/init.patch"
+        ],
+        "patch_args": ["-p1"]
+    }
+}
diff --git a/tools/python/runtime_binary.sh b/tools/python/runtime_binary.sh
index 1a4b3dc..6dc34c1 100755
--- a/tools/python/runtime_binary.sh
+++ b/tools/python/runtime_binary.sh
@@ -23,7 +23,11 @@
 for path in ${PYTHONPATH//:/ }; do
   if [[ "$path" == *.runfiles/python3_9_x86_64-unknown-linux-gnu ]]; then
     PYTHON_BIN="$path"/bin/python3
-    export LD_LIBRARY_PATH="$path"/lib
+    LD_LIBRARY_PATH=":${path}/lib"
+    LD_LIBRARY_PATH+=":${path}/../gtk_runtime/lib/x86_64-linux-gnu"
+    LD_LIBRARY_PATH+=":${path}/../gtk_runtime/usr/lib/x86_64-linux-gnu"
+    LD_LIBRARY_PATH+=":${path}/../gtk_runtime/usr/lib"
+    export LD_LIBRARY_PATH
     break
   elif [[ "$path" == *.runfiles/python_repo ]]; then
     PYTHON_BIN="$path"/usr/bin/python3