Cooperative package management for Python

Posted Sep 2, 2021 0:22 UTC (Thu) by stefanor (subscriber, #32895)
In reply to: Cooperative package management for Python by NYKevin
Parent article: Cooperative package management for Python

> There is no logical reason for that limitation.

Yes there is, it's minimising the payload of Python to support applications written in Python.

On a clean Debian bullseye install, installing python3-venv requires an additional 7 binary packages using 5MiB of disk space, over just python3.
They are: ca-certificates openssl python-pip-whl python3-distutils python3-lib2to3 python3-venv python3.9-venv

We've simplified things over time. python-pip-whl currently contains 31 wheels, in the past these were all separate binary packages.

The harried sysadmin you describe will get an error message describing exactly what they need to do to resolve their issue. This probably one of tens of such issues they'll see while automating their deployment.

Cooperative package management for Python

Posted Sep 2, 2021 19:14 UTC (Thu) by NYKevin (subscriber, #129325) [Link] (1 responses)

% apt show ca-certificates
Package: ca-certificates
Version: 20210119
Priority: optional
Section: misc
Maintainer: Julien Cristau <jcristau@debian.org>
Installed-Size: 391 kB
Depends: openssl (>= 1.1.1), debconf (>= 0.5) | debconf-2.0
Breaks: ca-certificates-java (<< 20121112+nmu1)
Enhances: openssl
Download-Size: 247 kB
APT-Manual-Installed: yes
APT-Sources: [my employer's private mirror]
Description: Common CA certificates
Contains the certificate authorities shipped with Mozilla's browser to allow
SSL-based applications to check for the authenticity of SSL connections.
.
Please note that Debian can neither confirm nor deny whether the
certificate authorities whose certificates are included in this package
have in any way been audited for trustworthiness or RFC 3647 compliance.
Full responsibility to assess them belongs to the local system
administrator.

I am willing to concede that it is technically possible that someone, somewhere, might not want to have this ~400 KiB package, and/or OpenSSL, installed.

The other five, however, are nonsense. Two of the packages you list are just more specific versions of venv, and pip-whl and distutils are both part of the Python stdlib proper, which Debian has artificially split out. That leaves lib2to3, and I would be shocked if that *wasn't* self-inflicted by Debian supporting old versions of Python. Upstream certainly shouldn't be depending on it anymore.

In short: The only real argument I'm seeing here is "some people want Python, but don't want OpenSSL." I'm skeptical that this is a very large or interesting class of users, worth the inconvenience it causes to everybody else.

> The harried sysadmin you describe will get an error message describing exactly what they need to do to resolve their issue.

No. They will click the big shiny "deploy" button, deployment will not actually happen, and they will then spend 20+ minutes digging through logs until they eventually figure out that it's the venv step which is failing.

Cooperative package management for Python

Posted Sep 10, 2021 9:09 UTC (Fri) by laarmen (subscriber, #63948) [Link]

You're focusing on the functionality here, but there's an important point made by stefanor : venv pulls in several MiB of dependencies.

My guess is that a choice has been made to spare those MiB for all the Debian installs which simply want to use a Python program, not *develop* one (or deploy an application with dependencies not satisfied by Debian...). This is fairly logical and in keeping with other Debian packaging practices, such as not shipping the library headers with the main lib package, etc...

And yes, there's a lot of other ways some space could be saved on Debian installs.