pip download will give you a .tar.gz even if you remove the --only-binary options. There is some risk here the you will get a whl for your host platform. I took an allowlist approach in https://github.com/alexgartner-bc/rules_pip/commit/acd9b016466ad983e60a02d5e4e6bd723df0933d but I don't really want to maintain that.