Remove the temporary directory containing cacert.pem when done

Our verification machines were filling up /tmp/ with this temporary
folder.  This patch removes it when piptool exits.

rules_python/piptool.py

@@ -73,7 +73,9 @@ def extract_packages(package_names):
 def pip_main(argv):
     # Extract the certificates from the PAR following the example of get-pip.py
     # https://github.com/pypa/get-pip/blob/430ba37776ae2ad89/template.py#L164-L168
-    cert_path = os.path.join(tempfile.mkdtemp(), "cacert.pem")
+    cert_tmpdir = tempfile.mkdtemp()
+    cert_path = os.path.join(cert_tmpdir, "cacert.pem")
+    atexit.register(lambda: shutil.rmtree(cert_tmpdir, ignore_errors=True))
     with open(cert_path, "wb") as cert:
       cert.write(pkgutil.get_data("pip._vendor.requests", "cacert.pem"))
     argv = ["--disable-pip-version-check", "--cert", cert_path] + argv

tools/update_tools/Dockerfile

@@ -1,7 +1,7 @@
 FROM gcr.io/gcp-runtimes/ubuntu_16_0_4:latest
 
 # Install Bazel (https://docs.bazel.build/versions/master/install-ubuntu.html)
-RUN apt-get update -y && apt-get install openjdk-8-jdk -y
+RUN apt-get update -y && apt-get install openjdk-8-jdk git -y
 RUN echo "deb [arch=amd64] http://storage.googleapis.com/bazel-apt stable jdk1.8" | tee /etc/apt/sources.list.d/bazel.list
 RUN curl https://bazel.build/bazel-release.pub.gpg | apt-key add -
 RUN apt-get update -y && apt-get install bazel -y