From 5b0bfb229f43fd6c0d630f9995e5913de8c8dc55 Mon Sep 17 00:00:00 2001
From: Jeremy Nimmer <jeremy.nimmer@tri.global>
Date: Sat, 4 Jan 2025 12:53:32 -0800
Subject: [PATCH] [wheel] Remove vendored libcrypt

This library was being pushed on us by python3-config because CPython
guaranteed its availability prior to 3.13 (deprecated in 3.11).
However, Drake has never actually needed it; therefore, excise it from
the list of linked libraries so that we can stop vendoring it.
---
 tools/wheel/image/dependencies/projects.cmake |  8 -------
 .../dependencies/projects/libxcrypt.cmake     | 22 -------------------
 tools/workspace/python/repository.bzl         |  6 +++++
 3 files changed, 6 insertions(+), 30 deletions(-)
 delete mode 100644 tools/wheel/image/dependencies/projects/libxcrypt.cmake

diff --git a/tools/wheel/image/dependencies/projects.cmake b/tools/wheel/image/dependencies/projects.cmake
index da284f7d90d8..00295a1b591e 100644
--- a/tools/wheel/image/dependencies/projects.cmake
+++ b/tools/wheel/image/dependencies/projects.cmake
@@ -1,11 +1,3 @@
-if(NOT APPLE)
-    # libxcrypt
-    set(libxcrypt_version 4.4.25)
-    set(libxcrypt_url "https://github.com/besser82/libxcrypt/archive/v${libxcrypt_version}/libxcrypt-${libxcrypt_version}.tar.gz")
-    set(libxcrypt_md5 "4828b1530f5bf35af0b45b35acc4db1d")
-    list(APPEND ALL_PROJECTS libxcrypt)
-endif()
-
 # zlib
 set(zlib_version 1.2.11)
 set(zlib_url "https://github.com/madler/zlib/archive/v${zlib_version}.zip")
diff --git a/tools/wheel/image/dependencies/projects/libxcrypt.cmake b/tools/wheel/image/dependencies/projects/libxcrypt.cmake
deleted file mode 100644
index 25bb45b844ca..000000000000
--- a/tools/wheel/image/dependencies/projects/libxcrypt.cmake
+++ /dev/null
@@ -1,22 +0,0 @@
-ExternalProject_Add(libxcrypt
-    URL ${libxcrypt_url}
-    URL_MD5 ${libxcrypt_md5}
-    ${COMMON_EP_ARGS}
-    BUILD_IN_SOURCE 1
-    PATCH_COMMAND ./autogen.sh
-    CONFIGURE_COMMAND ./configure
-        --prefix=${CMAKE_INSTALL_PREFIX}
-        --disable-static
-        --enable-shared
-        --enable-obsolete-api
-        --enable-hashes=all
-        CFLAGS=-fPIC
-        CXXFLAGS=-fPIC
-    BUILD_COMMAND make
-    INSTALL_COMMAND make install
-    )
-
-extract_license(libxcrypt
-    LICENSING
-    COPYING.LIB
-)
diff --git a/tools/workspace/python/repository.bzl b/tools/workspace/python/repository.bzl
index 09da29331301..5fdaa15ffad7 100644
--- a/tools/workspace/python/repository.bzl
+++ b/tools/workspace/python/repository.bzl
@@ -94,6 +94,12 @@ def _get_linkopts(repo_ctx, python_config):
     ).stdout.strip().split(" ")
     linkopts = [linkopt for linkopt in linkopts if linkopt]
 
+    # Opt-out of support for the (deprecated) _crypt module. Linking it just
+    # bloats our wheels for no good reason. Once Python 3.13 is our minimum
+    # supported version, we can remove this stanza.
+    if "-lcrypt" in linkopts:
+        linkopts.remove("-lcrypt")
+
     # Undo whitespace splits for options with a positional argument, e.g., we
     # want ["-framework CoreFoundation"] not ["-framework", "CoreFoundation"].
     for i in reversed(range(len(linkopts))):