Subject: Bug#1084006: zope.configuration: (build-)depends on deprecated module python3-pkg-resources

From: Matthias Klose <[email-masked]>
Date: Fri, 04 Oct 2024 09:52:51 +0000

Package: src:zope.configuration
Version: 5.0.1-1
Severity: normal
Tags: sid trixie
User: [email-masked]
Usertags: pkg-resources-deprecation

[This bug is targeted to the upcoming trixie release]

The package build-depends or depends on python3-pkg-resources, which is
deprecated upstream. Details can be found at

    https://setuptools.pypa.io/en/latest/pkg_resources.html

Use of pkg_resources is deprecated in favor of importlib.resources,
importlib.metadata and their backports (importlib_resources, importlib_metadata).
Some useful APIs are also provided by packaging (e.g. requirements and version
parsing). Users should refrain from new usage of pkg_resources and should work
to port to importlib-based solutions.

Python 3.12 in unstable provides both importlib_resources and
importlib_metadata, so no additional dependencies on those packages are needed.

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Fri, 04 Oct 2024 09:53:48 +0000

Thank you for filing a new Bug report with Debian.

You can follow progress on this Bug here: 1084006: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1084006.

This is an automatically generated reply to let you know your message
has been received.

Your message has been forwarded to the package maintainers (but not
other interested parties, as you requested) for their attention; they
will reply in due course.

Your message has been sent to the package maintainer(s):
 Debian Python Team <[email-masked]>

If you wish to submit further information on this problem, please
send it to [email-masked].

Please do not send mail to [email-masked] unless you wish
to report a problem with the Bug-tracking system.

-- 
1084006: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1084006
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: Colin Watson <[email-masked]>
Date: Fri, 4 Oct 2024 11:22:32 +0100

While pkg_resources is indeed deprecated upstream, there's nothing that
we can sensibly do about it at the Debian level in lazr.* or zope.*, and
it's not even as clear as you might hope what to do upstream.  They all
do something like this in an __init__.py (with unimportant variations):

  __import__('pkg_resources').declare_namespace(__name__)

As
https://packaging.python.org/en/latest/guides/packaging-namespace-packages/#pkg-resources-style-namespace-packages
says:

  If you are creating a new distribution within an existing namespace
  package that uses this method then it’s recommended to continue using
  this as the different methods are not cross-compatible and it’s not
  advisable to try to migrate an existing package.

I know pkg_resources is deprecated for most other purposes, but even
upstream currently advises here not to try to migrate in this case.
Now, I know there've been some attempts to figure this out:
https://github.com/pypa/sample-namespace-packages thinks a migration may
be possible as long as developers are willing to accept some
limitations.  But it's still a difficult migration and upstream hasn't
really got going on it; for Zope, see
https://github.com/zopefoundation/meta/issues/194.

Please can you reconsider, and not force this for Debian trixie?  I
think we need to keep pkg_resources around for this use case until a
good deal more work has been done on migrating away from it for
namespace packages.

-- 
Colin Watson (he/him)                              [[email-masked]]

---

From: Matthias Klose <[email-masked]>
Date: Sat, 5 Oct 2024 04:34:54 +0200

> good deal more work has been done on migrating away from it for

I don't want to force it.  the separation of this module into it's own 
module is a Debian specific change to avoid runtime dependencies on 
pkg_resources.  So you'll find a lot of hard-coded dependencies that are 
just not used anymore. That's what I want to catch for the trixie release.

Matthias