python: pkg_resources is deprecated

[cwegener]

Issue

pkg_resources is deprecated

Use of pkg_resources is deprecated in favor of importlib.resources, importlib.metadata and their backports (importlib_resources, importlib_metadata). Some useful APIs are also provided by packaging (e.g. requirements and version parsing). Users should refrain from new usage of pkg_resources and should work to port to importlib-based solutions.

https://setuptools.pypa.io/en/latest/pkg_resources.html

Action

fpm should start migrating away from pkg_resources to importlib.resources and importlib.metadata

[jordansissel]

Thanks for filing! This sounds like a good proposal, though I think we should keep the pkg_resources code for older versions of Python where importlib is not available (if this is relevant). Fpm can then choose to use importlib or pkg_resources depending on what is supported by the local Python.

[cwegener]

though I think we should keep the pkg_resources code for older versions of Python where importlib is not available (if this is relevant).

Not needed. There is a "shim" for old Python versions ... I've done quite a few 'pkg_resources' migrations already and haven't had any issues so far.

I'll see if I can find some time to prepare a PR

EDIT:

https://github.com/python/importlib_resources

https://github.com/python/importlib_metadata

[jordansissel]

There is a "shim" for old Python versions

how old are we talking? I don’t have any measurement of what versions of Python folks are using with fpm, but the Python docs report that importlib requires Python 3, and I’m not sure how many folks (Python 2 isn’t quite dead?) will be negatively impacted by such a change.

this said, it’s been a while since I’ve been active in a Python project and my familiarity is lacking for its tooling and supported versions.

[cwegener]

the Python docs report that importlib requires Python 3, and I’m not sure how many folks (Python 2 isn’t quite dead?) will be negatively impacted by such a change.

Correct. Importlib is 100% Python 3 only.

Aiming for Python 2 compatibility would be a deal breakerin that case.

I personally haven't seen Python 2 code in many years.

Even in the large enterprise space, which I left in 2019, I didn't really see that much Python 2 around anymore.

That's not to say that there will always be a number of Python 2 project which will simply never be migrated to Python 3.

The issues caused by pkg_resources in my day to day work are a much larger problem than old Python 2 code, but that's really just because I don't deal with any Python 2 code anymore.

I don’t have any measurement of what versions of Python folks are using with fpm

I think the PyPI telemetry is the only source to go by for making some overall guesses. That dataset basically contains information about what people are downloading with pip install. I'm not sure if it includes the Python interpreter information in that telemetry. I'll go and have a look.