[This bug is targeted to the upcoming forky release]

The package build-depends or depends on python3-pkg-resources, which
is deprecated upstream. Details can be found at

https://setuptools.pypa.io/en/latest/pkg_resources.html

Use of pkg_resources is deprecated in favor of importlib.resources
and importlib.metadata. Some useful APIs are also provided by
packaging (e.g. requirements and version parsing). Users should
refrain from new usage of pkg_resources and should work to port to
importlib-based solutions.

Python 3.13 in unstable provides both importlib.resources and
importlib.metadata, so no additional dependencies on those packages
are needed.

If the package is a namespace package, then please lower the severity
again to normal.

Dear maintainer,

I've prepared an NMU for python-httpsig (versioned as 1.3.0-3.1) and uploaded it.

Please find the simplistic patch in attachment.

Regards.





diffstat for python-httpsig-1.3.0 python-httpsig-1.3.0

 changelog                   |    7 +++++++
 control                     |    1 -
 patches/pkg-resources.patch |   17 +++++++++++++++++
 patches/series              |    1 +
 4 files changed, 25 insertions(+), 1 deletion(-)

diff -Nru python-httpsig-1.3.0/debian/changelog python-httpsig-1.3.0/debian/changelog
--- python-httpsig-1.3.0/debian/changelog	2025-05-24 09:35:41.000000000 +0200
+++ python-httpsig-1.3.0/debian/changelog	2026-08-31 14:34:52.000000000 +0200
@@ -1,3 +1,10 @@
+python-httpsig (1.3.0-3.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Patch-out usage of python3-pkg-resources (Closes: #1125848)
+
+ -- Alexandre Detiste <tchet@debian.org>  Mon, 31 Aug 2026 14:34:52 +0200
+
 python-httpsig (1.3.0-3) unstable; urgency=medium

   * Added missing runtime dependency
diff -Nru python-httpsig-1.3.0/debian/control python-httpsig-1.3.0/debian/control
--- python-httpsig-1.3.0/debian/control	2025-05-24 09:35:41.000000000 +0200
+++ python-httpsig-1.3.0/debian/control	2026-08-31 14:34:05.000000000 +0200
@@ -18,7 +18,6 @@
 Architecture: all
 Depends: ${misc:Depends},
          ${python3:Depends},
-         python3-pkg-resources
 Description: sign HTTP requests (IETF HTTP Signatures) - Python 3 version of the package
  Sign HTTP requests with secure signatures according to the draft IETF HTTP
  Signatures specification.
diff -Nru python-httpsig-1.3.0/debian/patches/pkg-resources.patch python-httpsig-1.3.0/debian/patches/pkg-resources.patch
--- python-httpsig-1.3.0/debian/patches/pkg-resources.patch	1970-01-01 01:00:00.000000000 +0100
+++ python-httpsig-1.3.0/debian/patches/pkg-resources.patch	2026-08-31 14:33:32.000000000 +0200
@@ -0,0 +1,17 @@
+--- a/httpsig/__init__.py
++++ b/httpsig/__init__.py
+@@ -1,12 +1,7 @@
+-from pkg_resources import get_distribution, DistributionNotFound
++__version__ = '1.3.0'
++
+
+ from .sign import Signer, HeaderSigner
+ from .verify import Verifier, HeaderVerifier
+
+-try:
+-    __version__ = get_distribution(__name__).version
+-except DistributionNotFound:
+-    # package is not installed
+-    pass
+-
+ __all__ = (Signer, HeaderSigner, Verifier, HeaderVerifier)
diff -Nru python-httpsig-1.3.0/debian/patches/series python-httpsig-1.3.0/debian/patches/series
--- python-httpsig-1.3.0/debian/patches/series	2025-05-24 09:35:41.000000000 +0200
+++ python-httpsig-1.3.0/debian/patches/series	2026-08-31 14:32:41.000000000 +0200
@@ -1,2 +1,3 @@
 2000-known-version.patch
 2001-cryptodomex-namespace.patch
+pkg-resources.patch

We believe that the bug you reported is fixed in the latest version of
python-httpsig, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1125848@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexandre Detiste <tchet@debian.org> (supplier of updated python-httpsig package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 31 Aug 2026 14:34:52 +0200
Source: python-httpsig
Architecture: source
Version: 1.3.0-3.1
Distribution: unstable
Urgency: medium
Maintainer: Petter Reinholdtsen <pere@debian.org>
Changed-By: Alexandre Detiste <tchet@debian.org>
Closes: 1125848
Changes:
 python-httpsig (1.3.0-3.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Patch-out usage of python3-pkg-resources (Closes: #1125848)
Checksums-Sha1:
 161e4fe28672506687db7c41c1b6e534d0b998d2 2019 python-httpsig_1.3.0-3.1.dsc
 d801ab9d46762eb43139914cd8c45d1191d8f975 3472 python-httpsig_1.3.0-3.1.debian.tar.xz
 bd77c2a23c452c27bf7fb24e083956af1e3d6ad8 6946 python-httpsig_1.3.0-3.1_source.buildinfo
Checksums-Sha256:
 49cf1f3f7cac1695672552f0e71362665eef690bd4df26028a892112fe85fdc8 2019 python-httpsig_1.3.0-3.1.dsc
 8c6ecce61e83abb0d0cbfb16666e46b5501c572c559db19500686894444da31b 3472 python-httpsig_1.3.0-3.1.debian.tar.xz
 f92955730fb0db0ac69a1f1b3885f1da826362d3f0851ae8ba732368b7bc56e9 6946 python-httpsig_1.3.0-3.1_source.buildinfo
Files:
 e16985c2c6ae13fdc413b18779a9469a 2019 python optional python-httpsig_1.3.0-3.1.dsc
 7b95ab49bc43741e4fba95983e56c16d 3472 python optional python-httpsig_1.3.0-3.1.debian.tar.xz
 ee642683f20db79a1299b93b3ed61bcd 6946 python optional python-httpsig_1.3.0-3.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmqVdxERHHRjaGV0QGRl
Ymlhbi5vcmcACgkQMfMURUShdBoaKBAAui+/Fw8+yjK/T6qOqqAK3hWgI+kIB5/T
QRqV+VaVO3AViU6FKWml8UDG26ybvF9eTnFcKsaeyHangETPAEZlNxzCVMuw9zAr
2Nx4uSGknjL8XBSIiCcX+v5hEfjaVZz8bB9kE9s8dx+t6UXBc1o3smK3hemGi+Fo
vwGfysdC1cl9HrxZqP+L5U2QdkS84uuAk/BtyyWWp7e5xr+OJ7lc1mLj2OBzW7vE
bWi/IfnwDPROdtesqkJGzWflERX1xo8Mf3VWKVF7bFvmLj6ktl57YsKGbZqDqdgc
MVgwEUn8/inv9rBlryILiR9l6KjzV4Aa6kpFR4SOAm8k1s0MDBo5hwYl3zn/kk3W
9zYTxQHQUDK0f8U6zVq0rWX7Fydws+jKCx6O3Fx4AClce9TCGaCKr/Hzq022kV8E
5EQML8CrynFOmF2lTnAYuWuiGYBmumTztsvwWEK7qyH4O+WYGuC/j3hPbpi0hCp4
PXK6J4n+vQf6u+DUb7dtJsNHcYnIvSK/3v5JTwAueoo/r7vjH3yQUM7ECOOHTnuo
SrRoUbWuXmsYfl84vGvCVF+mt/9Ec4xKxSjWBPz8Ob9F9XkV4f8GitTNs+V5+NRU
lwokpjcm0WUUlcjrwJUU+odMw1Z7mrgPfDmXLcOA08VXNtDj7h0n3ncqGKrMVbRL
zERlDeLTnlg=
=1jHc
-----END PGP SIGNATURE-----