Hello Fedorans and especially Pythonistas.
I'd like to retire python2-setuptools from Fedora 35+.
It contains utilities to execute code downloaded from the internet and it has
not been updated for 2 years. It has a potential of a security hole, although I
am not currently aware of any.
Unfortunately, 6 packages still (Build)Require python2-setuptools in Fedora 35:
I've split them into 3 categories:
1) Trac plugins: trac-(customfieldadmin|monotone|watchlist)-plugin
Note: trac-monotone-plugin is the only package that Requires python2-setuptools
in Fedora 35 on runtime.
Trac has been already updated to Python 3 in Fedora 34+
The plugins don't (and cannot) work with Python 2 when Trac runs on Python 3.
Bugzillas exists for years:
They were updated this February to point out the uselessness of the packages,
but nothign happened. I have a clear conscience if the packages stop building
(and installing in case of trac-monotone-plugin).
2) Packages that BuildRequire python2-setuptools but don't use it: NFStest
Pull request exists to remove the unused dependency:
3) Packages that BuildRequire python2-setuptools but don't have to:
The two packages use this concept in setup.py:
from setuptools import setup
from distutils.core import setup
technically, they don't need setuptools to build, the dependency is optional.
Unfortunately they used setuptools to build in the past and if we remove it,
the will change the .egg-info metadata directory to a file. Hence they will hit
a well known limitation in RPM:
To compensate a rather ugly scriptlet is needed. The changes were proposed:
However, I'd rather maintain the 2 scriptlets than python2-setuptools.
Please let me know if you see a problem.