python3-mako depends on pkg-resources

[Tony Theodore]

I would have thought pkg-resources/setuptools would be part of the transitive dependencies, but both are missing.

See https://github.com/mxe/mxe/commit/3b61050dabf8b3fb0fae9e373ebb88205758ced0#r71983265

[Lucas Kanashiro (lucaskanashiro)]

Thanks for taking the time to file this bug and trying to make Ubuntu better.

python3-pkg-resources should indeed be a runtime dependency of python3-mako, at least for the current version we have in the archive which is 1.1.3. In this version, pkg_resources is conditionally imported, I think this is the reason why no one complained about it so far:

mako/util.py-33- else:
mako/util.py:34: import pkg_resources
mako/util.py-35-
mako/util.py:36: for impl in pkg_resources.iter_entry_points(self.group, name):
mako/util.py-37- self.impls[name] = impl.load
mako/util.py-38- return impl.load()

https://github.com/sqlalchemy/mako/blob/rel_1_1_3/mako/util.py#L30-L44

In the latest upstream version (1.2.0), pkg_resources is no more used:

    .. change::
        :tags: changed, setup

        Replaced the use of ``pkg_resources`` with the ``importlib`` library.
        For Python < 3.8 the library ``importlib_metadata`` is used.

https://github.com/sqlalchemy/mako/blob/main/doc/build/changelog.rst

This dependency seems to be missing in all supported Ubuntu releases.

[Lucas Kanashiro (lucaskanashiro)]

Forwarded the bug to debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010237

[Athos Ribeiro (athos-ribeiro)]

reproducer (ONLY RUN THESE COMMANDS IN A DISPOSABLE ENVIRONMENT. It removes a few seeded packages):

# apt remove -y python3-pkg-resources
# python3 -c "from mako.util import PluginLoader as PL; PL('foo').load('bar')"

Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib/python3/dist-packages/mako/util.py", line 34, in load
    import pkg_resources
ModuleNotFoundError: No module named 'pkg_resources'

I am setting the importance to low because

- I could not find a straightforward real use case where we hit the "buggy" code path. AFAICT, this is triggered when non-registered plugin is loaded.
- The latest upstream version (which may be available for the kinetic cycle) is not affected.
- python3-pkg-resources is a seeded package:

$ seeded-in-ubuntu -b python3-pkg-resources
python3-pkg-resources is seeded in:
  kubuntu: daily-live
  lubuntu: daily-live
  ubuntu-budgie: daily-live
  ubuntu-mate: daily-live
  ubuntu-server: daily-live, daily-preinstalled
  ubuntu: daily-canary, daily-live, daily-preinstalled
  ubuntukylin: daily-live
  ubuntustudio: dvd
  xubuntu: daily-live

[Athos Ribeiro (athos-ribeiro)]

Actually, for

- I could not find a straightforward real use case where we hit the "buggy" code path. AFAICT, this is triggered when non-registered plugin is loaded.

https://github.com/mxe/mxe/commit/3b61050dabf8b3fb0fae9e373ebb88205758ced0
Pointed by Tony is a good example on how this could be triggered.

[Michał Małoszewski (michal-maloszewski99)]

Still resolving that bug. ETA 20.06.2022
Next steps: Finding alternative solution than the current one.

[Michał Małoszewski (michal-maloszewski99)]

Still finding solution.

[Michał Małoszewski (michal-maloszewski99)]

Pull Request sent to inner review

[Launchpad Janitor (janitor)]

This bug was fixed in the package mako - 1.1.3+ds1-3ubuntu1

---------------
mako (1.1.3+ds1-3ubuntu1) kinetic; urgency=medium

  * Add dependency on python3-pkg-resources (LP: #1970153).

 -- Michał Małoszewski <email address hidden> Wed, 22 Jun 2022 14:22:19 +0000