Re: [bitbake-devel] [PATCH v4 00/11] bitbake-setup PyPI Packaging

--=-13GVg1Nk9BYYruQ1WNxE
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, 2026-06-24 at 10:20 -0700, Rob Woolley via
lists.openembedded.org wrote:
> This is an update to the previous series to rebase on master. It is also
> available at: https://github.com/robwoolley/bitbake/tree/b4/add-pypi-v8
>=20
> This version of the series integrates the vendoring module to update
> beautifulsoup4, ply, progressbar, simplediff, and typing_extensions.
>=20
> I also included Richard's latest commit to add version variables to the
> bitbake scripts and dropped the mechanism that I proposed.

Hi Rob,

Patches 1-5 and 11 look good to me.

For patches 6-10 which improve vendoring of upstream packages, I think
we need to document things clearly. I've also made a couple of review
comments on some of these patches.

Looking at the Python vendoring module [1]:

    Should I use it?

    This tool has no stability promises -- it has only one intended
    user: pip. There may be unannounced changes to this codebase at any
    time, as long as the intended user (i.e. the pip project) is
    prepared for those changes.

    As a general rule of thumb, if the project is going to be a PyPI
    package, it should not use this tool.

    Many downstream redistributors have policies against this kind of
    bundling of dependencies, which means that they'll patch your
    software to debundle it. This can cause various kinds of issues, due
    to violations of assumptions being made about where the dependencies
    are available/which versions are being used. These issues result in
    difficult-to-debug errors, which are fairly difficult to communicate
    with end users.

    pip is a very special case with a thorough rationale [2] for
    vendoring/bundling dependencies with itself.

We need to write down why we're using vendoring despite this warning,
with a rationale (similar to how pip documents this).

We also need to document who's going to run `vendoring sync` and how
often. Do we automate this or rely on running it manually?

[1]: https://pypi.org/project/vendoring/
[2]: https://pip.pypa.io/en/latest/development/vendoring-policy/#rationale

Best regards,

--=20
Paul Barker


--=-13GVg1Nk9BYYruQ1WNxE
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iIcEABYKAC8WIQSzjPXf5Y1BDWhU2iCrY1Tsnbr0bgUCakI1hhEccGF1bEBwYmFy
a2VyLmRldgAKCRCrY1Tsnbr0bmFIAPwPiAjvosK57lpKDLfK4x5odsUsQto1YQrY
4EnYfycyPAD+JU64nNTl+zX+oznNdvhV3ZHTWA9pG6+84rxMoz4I/gc=
=vO5H
-----END PGP SIGNATURE-----

--=-13GVg1Nk9BYYruQ1WNxE--