[Bug 2045082] [NEW] drop python3-keyring from Recommends to Suggests

[Chris Peterson]

Public bug reported:

We should drop python3-keyring from Recommnds to Suggests. Having python3-keyring
as Recommends means it will always be installed when python-launchpadlib is
installed unless --no-install-recommends is specified. Many headless systems,
such as ubuntu-server, may require python-launchpadlib; but as far as I can
tell, there is no/limited need for a keyring service on a headless system.

The maintainers of python-launchpadlib have previously stated that
python3-keyring is not a hard dependency of python-launchpadlib and dropped
it from Depends to Suggests explicitly to avoid including unnecessary packages
on non-desktop machines[1]. There is a mismatch between the control file,
which moved python3-keyring to Recommends, and the changelog, which stated
Suggests. The wording in the changelog was updated to "Drop from Depends to
Recommends" in a later commit[2] (not currently in the imported source tree),
however if the motivation for the change is correct (which I believe it is),
then [2] should have moved python3-keyring from Recommends to Suggests.

A delta was previously introduced in python-secretstorage[3] to stop these
larger dependency packages from automatically being installed on server/cloud
images, however we should move the change here to python-launchpadlib as I
think it makes more sense semantically. The author of python-secretstorage has
also raised their concerns[4] with the delta we've introduced in that package,
which points out we are making python-secretstorage useless, and therefore the
dependent functionality in python3-keyring always useless (unless a Secret
Service package is already installed on the system).

I have already submitted a bug report[5] on Debian BTS to discuss this change
upstream, as well as a merge request[6] on the upstream VCS.

I will attach a debdiff with my proposed change.


[1] https://salsa.debian.org/python-team/packages/python-launchpadlib/-/commit/842dd5191ca3ef1acb800579b7a02cda6cbeeb31

[2] https://salsa.debian.org/python-team/packages/python-
launchpadlib/-/commit/9ec5e3b0278f4c43422174a3a77d4075a88d7103

[3] http://changelogs.ubuntu.com/changelogs/pool/main/p/python-
secretstorage/python-secretstorage_3.3.3-1ubuntu1/changelog

[4] https://bugs.launchpad.net/ubuntu/+source/python-
secretstorage/+bug/2041695/comments/1

[5] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056553

[6] https://salsa.debian.org/python-team/packages/python-
launchpadlib/-/merge_requests/4

** Affects: python-launchpadlib (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to python-launchpadlib in Ubuntu.
https://bugs.launchpad.net/bugs/2045082

Title:
  drop python3-keyring from Recommends to Suggests

Status in python-launchpadlib package in Ubuntu:
  New

Bug description:
  We should drop python3-keyring from Recommnds to Suggests. Having python3-keyring
  as Recommends means it will always be installed when python-launchpadlib is
  installed unless --no-install-recommends is specified. Many headless systems,
  such as ubuntu-server, may require python-launchpadlib; but as far as I can
  tell, there is no/limited need for a keyring service on a headless system.

  The maintainers of python-launchpadlib have previously stated that
  python3-keyring is not a hard dependency of python-launchpadlib and dropped
  it from Depends to Suggests explicitly to avoid including unnecessary packages
  on non-desktop machines[1]. There is a mismatch between the control file,
  which moved python3-keyring to Recommends, and the changelog, which stated
  Suggests. The wording in the changelog was updated to "Drop from Depends to
  Recommends" in a later commit[2] (not currently in the imported source tree),
  however if the motivation for the change is correct (which I believe it is),
  then [2] should have moved python3-keyring from Recommends to Suggests.

  A delta was previously introduced in python-secretstorage[3] to stop these
  larger dependency packages from automatically being installed on server/cloud
  images, however we should move the change here to python-launchpadlib as I
  think it makes more sense semantically. The author of python-secretstorage has
  also raised their concerns[4] with the delta we've introduced in that package,
  which points out we are making python-secretstorage useless, and therefore the
  dependent functionality in python3-keyring always useless (unless a Secret
  Service package is already installed on the system).

  I have already submitted a bug report[5] on Debian BTS to discuss this change
  upstream, as well as a merge request[6] on the upstream VCS.

  I will attach a debdiff with my proposed change.

  
  [1] https://salsa.debian.org/python-team/packages/python-launchpadlib/-/commit/842dd5191ca3ef1acb800579b7a02cda6cbeeb31

  [2] https://salsa.debian.org/python-team/packages/python-
  launchpadlib/-/commit/9ec5e3b0278f4c43422174a3a77d4075a88d7103

  [3] http://changelogs.ubuntu.com/changelogs/pool/main/p/python-
  secretstorage/python-secretstorage_3.3.3-1ubuntu1/changelog

  [4] https://bugs.launchpad.net/ubuntu/+source/python-
  secretstorage/+bug/2041695/comments/1

  [5] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056553

  [6] https://salsa.debian.org/python-team/packages/python-
  launchpadlib/-/merge_requests/4

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-launchpadlib/+bug/2045082/+subscriptions