Thanks for the comment.

build dependencies are handled via pyproject.toml

Can you confirm this is true? I've added pyproject.toml which some systems use, but not all.

Hi, I see docutils is being added in my prod environments and caused some alarms to go off.

Is there something I could do to help remove it ?

I see it is currently added in pyproject.toml and setup_requires - which should handle most common cases today ?

Howdy Abdeali,

Hi, I see docutils is being added in my prod environments and caused some alarms to go off.

That's right, and you have found the correct issue on this project for working to resolve this.

Is there something I could do to help remove it ?

Yes, thank you for the offer. Can I ask that you enlist others as well, including @stoniko who opened this issue?

I see it is currently added in pyproject.toml and setup_requires - which should handle most common cases today ?

It's essential to continue to meet the need for which 'docutils' was first added to 'install_requires': because that was in the past the only way to ensure this build dependency was installed when building the package.

To remove it from that field, what is needed is: Official assurance, ideally from the Python Packaging Authority https://www.pypa.io/ who is responsible for the packaging standards, that we have in place the correct information to allow everyone who builds 'python-daemon' from source (that is, starting with only the Python sdist tarball) that they will automatically have the necessary 'docutils' installed while building.

I don't know whether 'pyproject.toml' does that. If we assume everyone's build tools will correctly parse and interpret that specification, who is left out? What do the currently supported PyPA standards say about that?

So, prerequisite to consider removing it from 'install_requires', we need clear instruction that we already have what's needed (and, if we don't already, exactly what to put in place) to know that all supported build environments will correctly get the 'docutils' dependency.

That's the work that needs to be done. I welcome anyone doing it to co-ordinate, either on this issue or via email (mine is ben+python@benfinney.id.au.

Hi Ben,

I was following this before the holidays and found myself back at it. I spoke with one of my friends who is involved with pypa regarding this, and I'll summarize our conversation below:

• install_requires / setup_requires have no effect on build requires
• PEP-517 [1] defines a build-system independent format for python projects which also describes how to instruct a PEP-517-compatible build front-end (i.e., setuptools) what is required to build a given project.
• PEP-517/518 describe the build-system.requires argument in pyproject.toml that as the documentation says, require those to be installed when building the project.

Now, for a bit I am a bit confused on. Is the ask here to ensure that python-daemon can build even on pre-PEP-517 toolchains? E.g., setuptools 61.0.0 introduced support for pyproject.toml (and build-system.requires), so as long as the user building from source is processing the pyproject.toml with either setuptools >== 61.0.0 or another frontend compatible with PEP-517/518.

setup_requires and install_requires are officially deprecated in favor of PEP-518 [2]

Please let me know if this helps (or not ;) ). I am happy to provide clarification and/or funnel some questions back towards my resource.

Best,
Neil

[1] https://peps.python.org/pep-0517/
[2] https://peps.python.org/pep-0518/

@neil

I spoke with one of my friends who is involved with pypa regarding this, and I'll summarize our conversation below

Thank you, that helps a lot.

Is the ask here to ensure that python-daemon can build even on pre-PEP-517 toolchains? E.g., setuptools 61.0.0 introduced support for pyproject.toml (and build-system.requires), so as long as the user building from source is processing the pyproject.toml with either setuptools >== 61.0.0 or another frontend compatible with PEP-517/518.

Right, it's the "so long as" condition that I'm cautious about there. How (and when) can we be assured we're not leaving anyone stranded by removing earlier support?