#1083390 fenics-ffcx: (build-)depends on deprecated module python3-pkg-resources

#1083390#5
Date:
2024-10-04 09:42:08 UTC
From:
To:
[This bug is targeted to the upcoming trixie release]

The package build-depends or depends on python3-pkg-resources, which is
deprecated upstream. Details can be found at

https://setuptools.pypa.io/en/latest/pkg_resources.html

Use of pkg_resources is deprecated in favor of importlib.resources,
importlib.metadata and their backports (importlib_resources, importlib_metadata).
Some useful APIs are also provided by packaging (e.g. requirements and version
parsing). Users should refrain from new usage of pkg_resources and should work
to port to importlib-based solutions.

Python 3.12 in unstable provides both importlib_resources and
importlib_metadata, so no additional dependencies on those packages are needed.

#1083390#10
Date:
2024-10-13 15:55:07 UTC
From:
To:
Hi Matthias,
can you help me determine from where the dependency on python3-pkg-resources
comes in?

I can't find it listed in debian/control, and the library itself doesn't even
use the pkg_resources python module.

Thanks,
Francesco

#1083390#17
Date:
2025-10-29 17:00:15 UTC
From:
To:
The fenics-ffcx package still uses the pkg_resources module.

Raising the severity of this issue. At the end of the
year 2025, raising the severity again to serious.

If the package is a namespace package, then please lower
the severity again to normal.

#1083390#24
Date:
2025-11-26 19:10:33 UTC
From:
To:
Matthias, like Francesco said, fenics-ffcx does not use
python3-pkg-resources

Do you mean python3-setuptools, not python3-pkg-resources?

Or should we move this bug to python3-setuptools, which does have a
dependency on python3-pkg-resources?

#1083390#31
Date:
2025-11-27 10:07:29 UTC
From:
To:
Control: tags -1 - moreinfo


pyproject.toml reads:

dependencies = [
     "numpy>=1.21",
     "cffi",
     "setuptools; python_version >= '3.12'",   # cffi with compilation
support requires setuptools
     "fenics-basix >= 0.9.0, <0.10.0",
     "fenics-ufl >= 2024.2.0, <2024.3.0",
]


so apparently this is dh_python misbehaving ...

anyway, I can't see any references to pkg_resources or setuptools in the
code.

#1083390#38
Date:
2025-11-28 23:12:56 UTC
From:
To:
Hi Matthias (2025.11.27_06:07:29_-0400)

It's consulting the fallback list first, rather than as a fallback.

And the fallback list contains:
$ grep setuptools /usr/share/dh-python/dist/cpython3_fallback
setuptools python3-pkg-resources

There's a reason that it's doing what it's doing here. We intentionally
wanted to map setuptools to pkg-resources in runtime dependencies.
Because almost all runtime dependencies are setuptools were really
dependencies on pkg-resources.

We used to ask packages to explicitly add runtime dependencies on
python3-setuptools, if they *really* needed setuptools itself at
runtime.

I didn't realise that was only happening in the fallback list, and not
in python3-setuptools itself (I assumed it was publishing a pydist file
to declare that it wanted that).

I'll remove the fallback list re-mapping. And see if I can really make
it be a fallback.

Stefano

#1083390#43
Date:
2025-11-28 23:26:30 UTC
From:
To:
Hi Matthias (2025.11.28_23:12:56_+0000)

Ah, from some more reading of the code, it's a fallback source of pydist
data. If a package were to publish pydist data, that would override
this. So it really is a fallback.

I'm not going to make dh-python consult dpkg file databases first, I'm
just going to improve the log messages so they more accurately show
what's going on.

Stefano

#1083390#58
Date:
2025-12-28 22:01:29 UTC
From:
To:
reassign 1083390 dh-python 6.20240422
fixed 1083390 6.20251201
thanks


As far as I can tell this bug has been fixed in dh-python 6.20251201

Drew