Bug#1025164: lintian: missing-prerequisite-for-pyproject-backend tag needs to check Build-Depends-Indep too

[Louis-Philippe Véronneau <pollo@debian.org>]

On 2022-12-01 01 h 52, Stuart Prescott wrote:
> Hi Scott
>
> On 01/12/2022 15:16, Scott Kitterman wrote:
> > On Wednesday, November 30, 2022 10:38:30 PM EST Stuart Prescott wrote:
> > > Hi Scott,
> > >
> > > On 01/12/2022 02:16, Scott Kitterman wrote:
> > > > Package: lintian
> > > > Version: 2.115.3
> > > > Severity: normal
> > > > X-Debbugs-Cc: debian-python@lists.debian.org
> > > >
> > > > The missing-prerequisite-for-pyproject-backend check appears to only
> > > > look for the prerequisite packages in Build-Depends, but since they
> > > > aren't needed for clean, they could be in Build-Depends-Indep, leading
> > > > to false positives.
> > > >
> > > > Scott K
> > >
> > > I contemplated filing a similar the other day but in writing it up, I
> > > realised that lintian was correct. Policy requires that the 'clean'
> > > target be functional with only the Build-Depends (and Build-Conflicts)
> > > satisfied, and pybuild + the build-backend dependencies are involved in
> > > the cleaning step.
> >
> > Not always.  At least with the package I ran into this on, clean works 
> > fine
> > without them.
>
> Yes indeed...
>
> - the most obvious case where that works is where 'clean' is explicit in 
> d/rules
>
> - it would also be possible for it to work in situations where dh-python 
> is (redundantly?) listed in B-D (not B-D-I), since the pyproject 
> plugin's 'clean' operation has no dependency on `build`, `installer`, 
> and the backend.
>
> However, this for this second case:
>
> - it might result in pybuild picking a different plugin through lack of 
> dependencies like `tomli`. That might just work... but also feels 
> slightly terrifying.
>
> - there's not _currently_ any backend-specific cleaning code, but 
> perhaps there should be, which would then need the deps to be in B-D? 
> (Is that in the spec somewhere?)
>
> I guess the main thing to be careful of in any rewording of this 
> explanation is that for the most common case of using "%:\n\tdh 
> --buildsystem pybuild", dh-python (or pybuild-plugin-pyproject) is 
> needed in B-D not B-D-I to be policy-compliant.
>
> cheers
> Stuart

I've proposed a fix here:

https://salsa.debian.org/lintian/lintian/-/merge_requests/426

It's not precise enough to flag packages that would declare everything 
as a Build-Depends-Indep though. This would be much more complex and I 
feel this situation is overall pretty rare.

--
  ⢀⣴⠾⠻⢶⣦⠀
  ⣾⠁⢠⠒⠀⣿⡁  Louis-Philippe Véronneau
  ⢿⡄⠘⠷⠚⠋   pollo@debian.org / veronneau.org
  ⠈⠳⣄

Attachment: OpenPGP_0xE1E5457C8BAD4113.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature
Description: OpenPGP digital signature