fix: make imports attribute target-relative for venv mode

python/private/py_library.bzl

@@ -246,12 +246,24 @@ def _get_imports_and_venv_symlinks(ctx):
             fail("When venvs_site_packages is enabled, exactly one `imports` " +
                  "value must be specified, got {}".format(imports))
 
+        site_packages_root = paths.normalize(paths.join(
+            ctx.label.package,
+            imports[0],
+        ))
+
+        # Prevent escaping out of the repo root.
+        if site_packages_root.startswith("../") or site_packages_root == "..":
+            fail(("Invalid `imports` value '{}': resolves to '{}' which is " +
+                  "above the repo root").format(
+                imports[0],
+                site_packages_root,
+            ))
         venv_symlinks = get_venv_symlinks(
             ctx,
             ctx.files.srcs + ctx.files.data + ctx.files.pyi_srcs,
             package,
             version_str,
-            site_packages_root = imports[0],
+            site_packages_root = site_packages_root,
             namespace_package_files = ctx.files.namespace_package_files,
         )
     else:

python/private/venv_runfiles.bzl

@@ -250,7 +250,8 @@ def _get_file_venv_path(ctx, f, site_packages_root):
     Args:
         ctx: The current ctx.
         f: The file to compute the venv_path for.
-        site_packages_root: The site packages root path.
+        site_packages_root: The site packages root path; repo-relative
+            path.
 
     Returns:
         A tuple `(venv_path, rf_root_path)` if the file is under

tests/base_rules/py_executable_base_tests.bzl

@@ -194,7 +194,7 @@ def _test_debugger(name, config):
     rt_util.helper_target(
         py_library,
         name = name + "_debugger_venv",
-        imports = [native.package_name() + "/site-packages"],
+        imports = ["site-packages"],
         experimental_venvs_site_packages = "@rules_python//python/config_settings:venvs_site_packages",
         srcs = [rt_util.empty_file("site-packages/" + name + "_debugger_venv.py")],
     )

tests/modules/other/nspkg_delta/BUILD.bazel

@@ -6,5 +6,5 @@ py_library(
     name = "nspkg_delta",
     srcs = glob(["site-packages/**/*.py"]),
     experimental_venvs_site_packages = "@rules_python//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/modules/other/nspkg_gamma/BUILD.bazel

@@ -6,5 +6,5 @@ py_library(
     name = "nspkg_gamma",
     srcs = glob(["site-packages/**/*.py"]),
     experimental_venvs_site_packages = "@rules_python//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/modules/other/nspkg_single/BUILD.bazel

@@ -6,5 +6,5 @@ py_library(
     name = "nspkg_single",
     srcs = glob(["site-packages/**/*.py"]),
     experimental_venvs_site_packages = "@rules_python//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/modules/other/simple_v1/BUILD.bazel

@@ -10,5 +10,5 @@ py_library(
         exclude = ["site-packages/**/*.py"],
     ),
     experimental_venvs_site_packages = "@rules_python//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/modules/other/simple_v2/BUILD.bazel

@@ -10,6 +10,6 @@ py_library(
         exclude = ["site-packages/**/*.py"],
     ),
     experimental_venvs_site_packages = "@rules_python//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
     pyi_srcs = glob(["**/*.pyi"]),
 )

tests/modules/other/with_external_data/BUILD.bazel

@@ -19,5 +19,5 @@ py_library(
     srcs = ["site-packages/with_external_data.py"],
     data = [":external_data"],
     experimental_venvs_site_packages = "@rules_python//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/py_zipapp/BUILD.bazel

@@ -81,15 +81,5 @@ py_library(
     name = "some_dep",
     srcs = ["some_dep.py"],
     experimental_venvs_site_packages = "//python/config_settings:venvs_site_packages",
-    imports = select({
-        ":is_venvs_site_packages_enabled": ["tests/py_zipapp"],
-        "//conditions:default": ["."],
-    }),
-)
-
-config_setting(
-    name = "is_venvs_site_packages_enabled",
-    flag_values = {
-        "//python/config_settings:venvs_site_packages": "yes",
-    },
+    imports = ["."],
 )

tests/venv_site_packages_libs/ext_with_libs/BUILD.bazel

@@ -89,6 +89,6 @@ py_library(
         ":relocate_increment",
     ],
     experimental_venvs_site_packages = "//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
     tags = ["manual"],
 )

tests/venv_site_packages_libs/nested_with_pth/BUILD.bazel

@@ -7,5 +7,5 @@ py_library(
     srcs = glob(["site-packages/**/*.py"]),
     data = glob(["site-packages/*.pth"]),
     experimental_venvs_site_packages = "//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/venv_site_packages_libs/nspkg_alpha/BUILD.bazel

@@ -6,5 +6,5 @@ py_library(
     name = "nspkg_alpha",
     srcs = glob(["site-packages/**/*.py"]),
     experimental_venvs_site_packages = "//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/venv_site_packages_libs/nspkg_beta/BUILD.bazel

@@ -6,5 +6,5 @@ py_library(
     name = "nspkg_beta",
     srcs = glob(["site-packages/**/*.py"]),
     experimental_venvs_site_packages = "//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/venv_site_packages_libs/pkgutil_top/BUILD.bazel

@@ -6,5 +6,5 @@ py_library(
     name = "pkgutil_top",
     srcs = glob(["site-packages/**/*.py"]),
     experimental_venvs_site_packages = "//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )

tests/venv_site_packages_libs/pkgutil_top_sub/BUILD.bazel

@@ -6,5 +6,5 @@ py_library(
     name = "pkgutil_top_sub",
     srcs = glob(["site-packages/**/*.py"]),
     experimental_venvs_site_packages = "//python/config_settings:venvs_site_packages",
-    imports = [package_name() + "/site-packages"],
+    imports = ["site-packages"],
 )