Thanks for getting back to me! I'm happy to further discuss my thoughts.

I'm by no means an expert here, but I was very confused why Ubuntu 20.04
did not install gcc and python3-dev when installing python3-fonttools,
but Ubuntu 22.04 started to.

Looking at the chain, pythran is an ahead-of-time compiler for Python.
While scipy definitely needs it at build time to compile its extensions,
it is highly unusual for compiled binaries to require their compiler at
runtime. If python3-pythran is currently listed as a runtime Depends for
python3-scipy, that in my opinion is the root bug here. Demoting it to a
Build-Depends (or at least a Recommends) would prevent gcc and
python3-dev from leaking into production environments for anyone using
Scipy or its dependents.

For context on why this matters: my environment has strict security
controls, and development packages like python3-dev and gcc are simply
not allowed in production. Because of this dependency chain, my only
viable solution was to completely remove matplotlib (and therefore this
entire tree) from my project.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2119324

Title:
  python3-fonttools pulls in unnecessary development dependencies

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/fonttools/+bug/2119324/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to