bug#49168: ‘guix import pypi’ misses package dependencies

[Leo Prikler <leo.prikler@student.tugraz.at>]

Am Freitag, den 25.06.2021, 16:51 +0200 schrieb Ludovic Courtès:
> Hello,
> 
> Maxim Cournoyer <maxim.cournoyer@gmail.com> skribis:
> 
> > Ludovic Courtès <ludo@gnu.org> writes:
> 
> [...]
> 
> > > Why does the importer favor .whl in the first place?  Is it
> > > supposed to
> > > be more accurate or more widespread or something?
> > 
> > Yes, the METADATA file from the binary wheel is a better place to
> > look
> > than the source egg-info requires.txt file.  In my commit
> > 01589acc5e1, I
> > simplified a comment that used used to read as:
> > 
> > -  ;; First, try to compute the requirements using the wheel, since
> > that is the
> > -  ;; most reliable option. If a wheel is not provided for this
> > package, try
> > -  ;; getting them by reading either the "requirements.txt" file or
> > the
> > -  ;; "requires.txt" from the egg-info directory from the source
> > tarball. Note
> > -  ;; that "requirements.txt" is not mandatory, so this is likely
> > to fail.
> > +  ;; First, try to compute the requirements using the wheel, else,
> > fallback to
> > +  ;; reading the "requires.txt" from the egg-info directory from
> > the source
> > +  ;; tarball.
> > 
> > The wheel (.whl) binary format is well specified as PEP 427 [0] and
> > is
> > what pip primarily uses for installing Python packages, making it a
> > very
> > reliable source of metadata.  The Python egg is the predecessor of
> > the
> > wheel, and can be considered obsolete, which explains why it's used
> > as a
> > fallback.
> 
> Oh, I see.
> 
> > Perhaps it'd be best to raise the issue to the package maintainers
> > and
> > have them specify their metadata correctly?
> 
> Going back to the example at the beginning of this thread, what ‘guix
> import pypi tablib’ produces is missing ‘python-setuptools-scm’.
> Indeed, ‘METADATA’ doesn’t mention it.
> 
> Is it really a bug on their side, or is it something peculiar about
> Guix
> packaging?  Perhaps ‘python-setuptools-scm’ should be provided more
> or
> less by default?
Perhaps both?  It probably depends on how setuptools are used, but this
use appears internal to the mechanisms of setuptools itself and not
something, that requires.txt is concerned about.  In particular, I
think it is only relevant to the setup.py script and can probably be
detected by the presence of a certain form within it.

I'm not sure on the number of packages, that use this package vs. those
that don't, but I personally don't think we should make it an input in
every package.  It is probably already a native-input to those that
need it (or at least probably should be if it's propagated instead).

Of course we would also have to look at the METADATA of other packages
and check whether they actually mention python-setuptools-scm or are
also unaware of the dependency.

Regards,
Leo