feat(python3): add riscv64 support for debian13

[brianredbeard]

This change enables riscv64 architecture support for the Python 3 distroless images based on Debian 13 (Trixie).

Updates include:

• Adding riscv64 to the trixie_python debian repository configuration.
• Updating Bazel lockfiles and repository lock files with riscv64 package metadata.
• Adding the required ld.so.cache for riscv64.
• Updating the README to reflect supported architectures.

[gemini-code-assist]

Code Review

This pull request adds support for the riscv64 architecture to the python3-debian13 distroless images. The changes include updating python3/config.bzl, trixie_python.yaml, and the associated lock files to include riscv64 package metadata, as well as updating the README.md. I have no feedback to provide.

[loosebazooka]

Can I get some additional info about the usecase here? Also is the current state of the ld.so.cache sufficient for what you need to do?

[loosebazooka]

Actually looks like you need to run the rule to generate the ld.so.cache for riscv:
You need docker with multiplatform support to do this

bazel run //python3:update_ldconfig

[brianredbeard]

Thanks for the reminder about the ldcache generation. I hacked past it because of a transient issue and forgot to implement that step.

As to the use case, in the distro-integration* working group meetings of @riseproject-dev, we have been identifying the need for RISC-V contributions across the the open-source ecosystem to ensure feature parity with other architectures.

We have a special focus on Kubernetes (we're currently using Kubernetes to run the recently announced native RISC-V GitHub actions runners), but also generally on cloud-native infrastructure. Put simply, if one wants to have RISC-V support in the cloud, all of the RISC-V undercloud components need to exist.

I would have also submitted PRs for NodeJS, but I noticed that the distroless policy seems to be to load the binary releases directly from nodejs.org. Unfortunately, RISC-V is only "experimental" status and so does not publish official RISC-V binaries (though the various distros do publish their own binary builds, limited to their individual packaging policies).

*: The irony of me opening a pull-request in distroless is not lost on me. 😂