Use of pkg_resources is deprecated about req2flatpak

[johannesjh]

Thank you for reporting this issue. A warning in my IDE made me aware of this issue. Moving away from pkg_resources will require a rewrite of the req2flatpak's RequirementsParser class. I would appreciate any help, contributions welcome!

• the packaging package provides functionality for parsing requirements, see https://packaging.pypa.io/en/stable/requirements.html ...it should be fairly easy to use this functionality. Maybe we can vendor the functionality instead of introducing a hard dependency on the packaging package.
• not sure, does importlib also provide functionality for parsing requirements? this would have the advantage that we dont need external packages.

[Zipdox2]

I was only made aware of this when I dug around in your code after I got a Error parsing requirements: A single version number must be specified. error. Apparently not having a version specified for a package in requirements.txt causes this error. Should I file another bug report for this?

[johannesjh]

That error message is not a bug, but a deliberate scoping/design decision for req2flatpak. Some explanation:

What does the error message "A single version number must be specified" mean? - It means that for each package that you specify in your requirements.txt, the version number must be fixed, also known as "frozen". I.e., a single version number. No ranges, no "greater than" constrains, but a single version.

Why does req2flatpak have this limitation? Why does it only accept a single, fixed version number for each package? - That is because req2flatpak aims to do one thing well. It aims to be good at creating a flatpak manifest for a set of fully resolved dependencies with frozen version numbers. In contrast, req2flatpak does not resolve dependencies, nor does it freeze versions.

How then is req2flatpak meant to be used? How can you get a list of fully resolved, frozen dependencies for your project? Many tools exist for this purpose. E.g., poetry, pip-tools, and many others. For example if you are using poetry, you can use the poetry export command to export a requirements.txt file that is fully resolved and frozen. In the same way, if using pip-tools, you can use the pip-compile command to resolve your dependencies and freeze your package versions.

Hope this helps! Best regards, Johannes

[Zipdox2]

Ah ok. Any chance that req2flatpak could be made to use these tools internally to resolve the dependencies?

[johannesjh]

No, I won't include any one of these tools internally into req2flatpak.

Why? First, dependency resolution and the freezing of versions is no simple task. Second, a one-size-fits-all solution that most people agree on simply does not exist. To find out more, you can search for "python packaging hell", pip compile, poetry, pdm, pep 517, pep 582, pipenv, flit, hatch, or read through some official or opiniated articles. I want to strictly avoid tying req2flatpak too closely to any one of these tools.