fix(rules): detect unrequired Python packages

When using PEP517 to build a Python package a RECORD file is included containing all the dependencies of a package. For backports (like importlib_metadata) projects usually specify until which Python version it is required combined with an optional import usually by checking sys.version_info and comparing the Python version.

As using the AST to figure out if a package is required is tricky and a lot of work and finding it out via shadowed imports of builtins for example with ExceptionGroup can work as shown below, but does not hold up for importlib.metadata as the backport is called importlib_metadata.

{ 'builtins.ExceptionGroup': {'usr/bin/optional.py'}, 'exceptiongroup.ExceptionGroup': {'usr/bin/optional.py'} }

Instead of these methods, rely on the project to provide a marker for example python_version < 3.11 for required packages.

Namcap/rules/pydepends.py

@@ -6,6 +6,7 @@ import ast
 import importlib
 import sys
 import sysconfig
+from packaging.metadata import parse_email, Metadata
 import Namcap.package
 from Namcap.util import is_script, script_type
 from Namcap.ruleclass import TarballRule
@@ -119,6 +120,26 @@ def get_imports(fileobj, filename, modules, gir_modules, gir_versions):
                     gir_versions[module.value] = version.value
 
 
+def get_unrequired_deps(metadata):
+    try:
+        raw, _ = parse_email(metadata.read())
+        parsed = Metadata.from_raw(raw)
+    except Exception:
+        return []
+
+    pyversion = f"{sys.version_info.major}.{sys.version_info.minor}"
+    environment = {"python_version": pyversion}
+    unrequired_dep = []
+    for dep in parsed.requires_dist:
+        if dep.marker is None:
+            continue
+        if "python_version" in str(dep.marker) and not dep.marker.evaluate(environment):
+            # Some modules on PyPi are typing-extensions while upstream calls them typing_extensions
+            unrequired_dep.append(f"python-{dep.name.replace('-', '_')}")
+
+    return unrequired_dep
+
+
 class PythonDependencyRule(TarballRule):
     name = "pydepends"
     description = "Checks python dependencies"
@@ -127,11 +148,14 @@ class PythonDependencyRule(TarballRule):
         modules = defaultdict(set)
         gir_modules = defaultdict(set)
         gir_versions = defaultdict(str)
+        unrequired_packages = []
 
         for entry in tar:
             if not entry.isfile():
                 continue
             f = tar.extractfile(entry)
+            if entry.name.endswith("METADATA"):
+                unrequired_packages = get_unrequired_deps(f)
             if not entry.name.endswith(".py") and not is_script(f):
                 continue
             if is_script(f) and script_type(f) not in ["python", "python3"]:
@@ -157,6 +181,8 @@ class PythonDependencyRule(TarballRule):
 
         # Print python module deps
         for pkg, libraries in (dependlist | gir_dependlist).items():
+            if pkg in unrequired_packages:
+                continue
             if isinstance(libraries, set):
                 files = list(libraries)
                 needing = set().union(*[liblist[lib] for lib in libraries])

[Chih-Hsuan Yen]

something like os.path.basename(entry.name) == "METADATA" may be better (untested)