The MODULE.bazel.lock is different on Mac/Linux in 2.0.0

[al-babych-fivetran]

🐞 bug report

Affected Rule

The issue is caused by the rule:

pip.parse

Is this a regression?

Yes, it worked in 1.9.
But the lock file generation was reworked for v2.0.

Description

The bazel mod deps --lockfile_mode=update command produces different content for the MODULE.bazel.lock on different platforms (Linux/Mac).

Most likely, this is because of the

pip.parse(
      hub_name = "rules_python_publish_deps",
      python_version = "3.11",
      requirements_by_platform = {
          "//tools/publish:requirements_darwin.txt": "osx_*",
          "//tools/publish:requirements_linux.txt": "linux_*",
          "//tools/publish:requirements_windows.txt": "windows_*",
      },
  )

that downloads a different set of packages for different platforms. Since 2.0, all required packages have been added to the lock file's facts. The lock file's content depends on the platform where it was generated.

🔬 Minimal Reproduction

https://github.com/al-babych-fivetran/rules_python_lock_bug

This repo shows the issue itself and how it can break the build. This repo can be built on a Mac.

To reproduce the issue, it is enough to run the bazel mod deps --lockfile_mode=update under Linux.
The difference will be:

"pycparser": {
             "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl": "b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992",
-            "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz": "600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29"
+            "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz": "600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29",
+            "https://files.pythonhosted.org/packages/a0/e3/59cd50310fc9b59512193629e1984c1f95e5c8ae6e5d8c69532ccc65a7fe/pycparser-2.23-py3-none-any.whl": "e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934",
+            "https://files.pythonhosted.org/packages/fe/cf/d2d3b9f5699fb1e4615c8e32ff220203e43b248e1dfcc6736ad9057731ca/pycparser-2.23.tar.gz": "78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2"
           },

And in the rules_python:

• requirements_linux.txt (line 313): pycparser==2.23 (cffi 2.0.0 needs pycparser from source on Linux)
• requirements_darwin.txt: no pycparser (macOS uses pre-built cffi wheels)

The ofiuco rules were added to the example to show how this issue can break the build. Possibly, these rules do something wrong. But after the rules_python upgrade, the repository in the example can be built on Mac, but gives an error on Linux (look at the next section).

🔥 Exception or Error

ERROR: Analysis of target '//:main' failed; build aborted: MODULE.bazel.lock is no longer up-to-date because the extension '@@rules_python+//python/extensions:pip.bzl%pip' has changed its facts: {"dist_hashes": {"https://pypi.org/simple": {"backports-tarfile":
....
Please run `bazel mod deps --lockfile_mode=update` to update your lockfile.

🌍 Your Environment

Operating System:

  
Linux:
Linux  6.14.0-1021-gcp #22~24.04.1-Ubuntu SMP Sat Nov 22 06:23:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Mac:
Darwin  25.4.0 Darwin Kernel Version 25.4.0: Thu Mar 19 19:33:25 PDT 2026; root:xnu-12377.101.15~1/RELEASE_ARM64_T6041 arm64
  

Output of bazel version:

  
Mac:
Bazelisk version: 1.25.0
Build label: 9.0.2
Build target: @@//src/main/java/com/google/devtools/build/lib/bazel:BazelServer
Build time: Thu Apr 09 22:08:10 2026 (1775772490)
Build timestamp: 1775772490
Build timestamp as int: 1775772490

Linux:
Bazelisk version: v1.27.0
Build label: 9.0.2
Build target: @@//src/main/java/com/google/devtools/build/lib/bazel:BazelServer
Build time: Thu Apr 09 22:03:14 2026 (1775772194)
Build timestamp: 1775772194
Build timestamp as int: 1775772194
  

Rules_python version:

  
2.0.0
  

Anything else relevant?

[aignas]

Please test #3758

[al-babych-fivetran]

Please test #3758

Tried to override the rules_python from your branch: al-babych-fivetran/rules_python_lock_bug@40edcaf

No new facts were added to the MODULE.bazel.lock (generated on Mac).
Linux still fails, and bazel mod deps --lockfile_mode=update produces a similar diff:

"pycparser": {
             "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl": "b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992",
-            "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz": "600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29"
+            "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz": "600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29",
+            "https://files.pythonhosted.org/packages/a0/e3/59cd50310fc9b59512193629e1984c1f95e5c8ae6e5d8c69532ccc65a7fe/pycparser-2.23-py3-none-any.whl": "e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934",
+            "https://files.pythonhosted.org/packages/fe/cf/d2d3b9f5699fb1e4615c8e32ff220203e43b248e1dfcc6736ad9057731ca/pycparser-2.23.tar.gz": "78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2"
           },

[aignas]

OK, found another issue and fixed it, please check again if the CI is green there.

[al-babych-fivetran]

OK, found another issue and fixed it, please check again if the CI is green there.

Still have an issue. But it became worse (or better :) ).
Strange that after the update to the latest commit in testing PR, the lock file was not re-generated on mac.
But on Linux, I got the same error about a lock mismatch. But the difference this time is much larger.

The issue with pycparser is still in place:

@@ -880,7 +1021,9 @@
           },
           "pycparser": {
             "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl": "b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992",
-            "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz": "600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29"
+            "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz": "600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29",
+            "https://files.pythonhosted.org/packages/a0/e3/59cd50310fc9b59512193629e1984c1f95e5c8ae6e5d8c69532ccc65a7fe/pycparser-2.23-py3-none-any.whl": "e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934",
+            "https://files.pythonhosted.org/packages/fe/cf/d2d3b9f5699fb1e4615c8e32ff220203e43b248e1dfcc6736ad9057731ca/pycparser-2.23.tar.gz": "78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2"
           },

But new packages were added:

@@ -925,13 +1072,16 @@
         "https://pypi.org/simple/": {
           "backports_tarfile": "/simple/backports-tarfile/",
           "certifi": "/simple/certifi/",
+          "cffi": "/simple/cffi/",
           "charset_normalizer": "/simple/charset-normalizer/",
+          "cryptography": "/simple/cryptography/",
           "docutils": "/simple/docutils/",
           "idna": "/simple/idna/",
           "importlib_metadata": "/simple/importlib-metadata/",
           "jaraco_classes": "/simple/jaraco-classes/",
           "jaraco_context": "/simple/jaraco-context/",
           "jaraco_functools": "/simple/jaraco-functools/",
+          "jeepney": "/simple/jeepney/",
           "keyring": "/simple/keyring/",
           "markdown_it_py": "/simple/markdown-it-py/",
           "mdurl": "/simple/mdurl/",
@@ -945,6 +1095,7 @@
           "requests_toolbelt": "/simple/requests-toolbelt/",
           "rfc3986": "/simple/rfc3986/",
           "rich": "/simple/rich/",
+          "secretstorage": "/simple/secretstorage/",
           "twine": "/simple/twine/",
           "urllib3": "/simple/urllib3/",
           "zipp": "/simple/zipp/"

It makes no sense to list the changes that were added for these packages with the files.pythonhosted.org URL+SHA.