Keep libpython static libraries in compressed form

docker/Dockerfile

@@ -135,16 +135,18 @@ RUN manylinux-entrypoint /build_scripts/build-cpython.sh 3.10.1
 
 
 FROM build_cpython AS all_python
-COPY build_scripts/install-pypy.sh /build_scripts/install-pypy.sh
-COPY build_scripts/pypy.sha256 /build_scripts/pypy.sha256
+COPY build_scripts/install-pypy.sh \
+     build_scripts/pypy.sha256 \
+     build_scripts/finalize-python.sh \
+     /build_scripts/
 RUN manylinux-entrypoint /build_scripts/install-pypy.sh 3.7 7.3.7
 RUN manylinux-entrypoint /build_scripts/install-pypy.sh 3.8 7.3.7
 COPY --from=build_cpython36 /opt/_internal /opt/_internal/
 COPY --from=build_cpython37 /opt/_internal /opt/_internal/
 COPY --from=build_cpython38 /opt/_internal /opt/_internal/
 COPY --from=build_cpython39 /opt/_internal /opt/_internal/
 COPY --from=build_cpython310 /opt/_internal /opt/_internal/
-RUN hardlink -cv /opt/_internal
+RUN manylinux-entrypoint /build_scripts/finalize-python.sh
 
 
 FROM runtime_base

docker/build_scripts/build-cpython.sh

@@ -55,9 +55,6 @@ fi
 popd
 rm -rf Python-${CPYTHON_VERSION} Python-${CPYTHON_VERSION}.tgz Python-${CPYTHON_VERSION}.tgz.asc
 
-# we don't need libpython*.a, and they're many megabytes
-find ${PREFIX} -name '*.a' -print0 | xargs -0 rm -f
-
 # We do not need precompiled .pyc and .pyo files.
 clean_pyc ${PREFIX}
 

docker/build_scripts/finalize-python.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Stop at any error, show all commands
+set -exuo pipefail
+
+# most people don't need libpython*.a, and they're many megabytes.
+# compress them all together for best efficiency
+pushd /opt/_internal
+XZ_OPT=-9e tar -cJf static-libs-for-embedding-only.tar.xz cpython-*/lib/libpython*.a
+popd
+find /opt/_internal -name '*.a' -print0 | xargs -0 rm -f
+
+hardlink -cv /opt/_internal