From c8f5798d4ea0fa91149ebf5b602bdc883498bf6d Mon Sep 17 00:00:00 2001
From: Sander van Grieken <sander@outrightsolutions.nl>
Date: Wed, 18 Mar 2026 23:46:48 +0100
Subject: [PATCH] android: build pyqt_builder and sip ourselves, hash pin all
 hostpython_prerequisites

---
 contrib/android/Dockerfile                           | 2 +-
 contrib/android/p4a_recipes/pyparsing/__init__.py    | 8 ++++++++
 contrib/android/p4a_recipes/pyqt6/__init__.py        | 4 ++--
 contrib/android/p4a_recipes/pyqt_builder/__init__.py | 4 +++-
 contrib/android/p4a_recipes/setuptools/__init__.py   | 6 ++++++
 contrib/android/p4a_recipes/sip/__init__.py          | 2 +-
 6 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index d396fbe68..8a136c28e 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -235,7 +235,7 @@ RUN cd /opt \
     && /opt/venv/bin/python3 -m pip install --no-build-isolation --no-dependencies -e .
 
 # install python-for-android
-ENV P4A_CHECKOUT_COMMIT="3aa0db1ed9b7349625c5fdeff96df4e564403541"
+ENV P4A_CHECKOUT_COMMIT="0b9f7e763866cd3533417418d4b31e7b316b624e"
 # ^ from branch electrum_202602 (note: careful with force-pushing! see #8162)
 RUN cd /opt \
     && git clone https://github.com/spesmilo/python-for-android \
diff --git a/contrib/android/p4a_recipes/pyparsing/__init__.py b/contrib/android/p4a_recipes/pyparsing/__init__.py
index 04f515dbc..c6a3e9e1e 100644
--- a/contrib/android/p4a_recipes/pyparsing/__init__.py
+++ b/contrib/android/p4a_recipes/pyparsing/__init__.py
@@ -1,4 +1,5 @@
 from pythonforandroid.recipes.pyparsing import PyparsingRecipe
+from pythonforandroid.util import HashPinnedDependency
 
 
 assert PyparsingRecipe._version == "3.0.7"
@@ -15,5 +16,12 @@ class PyparsingRecipePinned(PyparsingRecipe):
     #         see "PyProjectRecipe" from https://github.com/kivy/python-for-android/pull/3007
     sha512sum = "1e692f4cdaa6b6e8ca2729d0a3e2ba16d978f1957c538b6de3a4220ec7d996bdbe87c41c43abab851fffa3b0498a05841373e435602917b8c095042e273badb5"
 
+    hostpython_prerequisites = [
+        HashPinnedDependency(package="setuptools==80.9.0",
+                             hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
+        HashPinnedDependency(package="pip==24.0",
+                             hashes=['sha256:ba0d021a166865d2265246961bec0152ff124de910c5cc39f1156ce3fa7c69dc']),
+    ]
+
 
 recipe = PyparsingRecipePinned()
diff --git a/contrib/android/p4a_recipes/pyqt6/__init__.py b/contrib/android/p4a_recipes/pyqt6/__init__.py
index 6a1821b28..1f08245d2 100644
--- a/contrib/android/p4a_recipes/pyqt6/__init__.py
+++ b/contrib/android/p4a_recipes/pyqt6/__init__.py
@@ -1,13 +1,13 @@
 import os
 
 from pythonforandroid.recipes.pyqt6 import PyQt6Recipe
-from pythonforandroid.util import load_source
+from pythonforandroid.util import load_source, HashPinnedDependency
 
 util = load_source('util', os.path.join(os.path.dirname(os.path.dirname(__file__)), 'util.py'))
 
 
 assert PyQt6Recipe._version == "6.10.2"
-assert PyQt6Recipe.depends == ['qt6', 'pyjnius', 'setuptools', 'pyqt6sip', 'hostpython3', 'python3'], PyQt6Recipe.depends
+assert PyQt6Recipe.depends == ['qt6', 'pyjnius', 'setuptools', 'pyqt6sip', 'hostpython3', 'pyqt_builder', 'python3'], PyQt6Recipe.depends
 assert PyQt6Recipe.python_depends == []
 
 
diff --git a/contrib/android/p4a_recipes/pyqt_builder/__init__.py b/contrib/android/p4a_recipes/pyqt_builder/__init__.py
index 516dc99aa..3849943fe 100644
--- a/contrib/android/p4a_recipes/pyqt_builder/__init__.py
+++ b/contrib/android/p4a_recipes/pyqt_builder/__init__.py
@@ -1,12 +1,14 @@
 from pythonforandroid.recipes.pyqt_builder import PyQtBuilderRecipe
+from pythonforandroid.util import HashPinnedDependency
 
 
 assert PyQtBuilderRecipe._version == "1.19.1"
-assert PyQtBuilderRecipe.depends == ["sip", "packaging", "python3"]
+assert PyQtBuilderRecipe.depends == ["packaging", "sip", "python3"], PyQtBuilderRecipe.depends
 assert PyQtBuilderRecipe.python_depends == []
 
 
 class PyQtBuilderRecipePinned(PyQtBuilderRecipe):
     sha512sum = "2308c51f93c37b1d13f312e4f2475d26b22d374ef284925fead9eab4aa89b994770431aca45170ac2154b4813fff151798f113f56d4cbf6c6e544fb463104a6d"
 
+
 recipe = PyQtBuilderRecipePinned()
diff --git a/contrib/android/p4a_recipes/setuptools/__init__.py b/contrib/android/p4a_recipes/setuptools/__init__.py
index 23c3596aa..d60d39043 100644
--- a/contrib/android/p4a_recipes/setuptools/__init__.py
+++ b/contrib/android/p4a_recipes/setuptools/__init__.py
@@ -1,4 +1,5 @@
 from pythonforandroid.recipes.setuptools import SetuptoolsRecipe
+from pythonforandroid.util import HashPinnedDependency
 
 
 assert SetuptoolsRecipe._version == "80.9.0"
@@ -7,6 +8,11 @@ assert SetuptoolsRecipe.python_depends == []
 
 
 class SetuptoolsRecipePinned(SetuptoolsRecipe):
+    hostpython_prerequisites = [
+        HashPinnedDependency(package='setuptools==80.9.0',
+                             hashes=[]),
+    ]
+
     sha512sum = "36eb1f219d29c6b9e135936bde2001ad70a971c8069cd0175d3a5325b450e6843a903d3f70043c9f534768ebeab8ab0c544b8f44456555d333f1ed72daa5c18b"
 
 
diff --git a/contrib/android/p4a_recipes/sip/__init__.py b/contrib/android/p4a_recipes/sip/__init__.py
index 417c9be16..456f707dc 100644
--- a/contrib/android/p4a_recipes/sip/__init__.py
+++ b/contrib/android/p4a_recipes/sip/__init__.py
@@ -2,7 +2,7 @@ from pythonforandroid.recipes.sip import SipRecipe
 
 
 assert SipRecipe._version == "6.15.1"
-assert SipRecipe.depends == ["setuptools", "packaging", "tomli", "python3"], SipRecipe.depends
+assert SipRecipe.depends == ["setuptools", "packaging", "python3"], SipRecipe.depends
 assert SipRecipe.python_depends == []