passlib required even for the client

[sjlongland]

Seems the amqtt client pulls in passlib even though it doesn't actually use it anywhere (it's used in the server for the file-based authentication back-end). It'd be nice if we could "do away" with this dependency on the client:

  File "/opt/wicen/wicen-rfid-aprs-bridge/lib/python3.7/site-packages/wicenrfidapiclient/session.py", line 974, in _connect_mqtt
    'auto-reconnect': False
  File "/opt/wicen/wicen-rfid-aprs-bridge/lib/python3.7/site-packages/amqtt/client.py", line 127, in __init__
    "amqtt.client.plugins", context, loop=self._loop
  File "/opt/wicen/wicen-rfid-aprs-bridge/lib/python3.7/site-packages/amqtt/plugins/manager.py", line 52, in __init__
    self._load_plugins(namespace)
  File "/opt/wicen/wicen-rfid-aprs-bridge/lib/python3.7/site-packages/amqtt/plugins/manager.py", line 63, in _load_plugins
    plugin = self._load_plugin(ep)
  File "/opt/wicen/wicen-rfid-aprs-bridge/lib/python3.7/site-packages/amqtt/plugins/manager.py", line 73, in _load_plugin
    plugin = ep.load(require=True)
  File "/opt/wicen/wicen-rfid-aprs-bridge/lib/python3.7/site-packages/pkg_resources/__init__.py", line 2410, in load
    self.require(*args, **kwargs)
  File "/opt/wicen/wicen-rfid-aprs-bridge/lib/python3.7/site-packages/pkg_resources/__init__.py", line 2433, in require
    items = working_set.resolve(reqs, env, installer, extras=self.extras)
  File "/opt/wicen/wicen-rfid-aprs-bridge/lib/python3.7/site-packages/pkg_resources/__init__.py", line 786, in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'passlib<2.0.0,>=1.7.0' distribution was not found and is required by the application

[FlorianLudwig]

Currently, we do not distinguish between client and server from a packaging point of view.

How did you install the amqtt? Installing just the client is not supported as far as I know.

We would need to either:

1. split amqtt into multiple packages (amqtt-client and amqtt-server and maybe amqtt-base)
2. use extra option when installing amqtt. I assume that the client does have less dependencies than the broker. So it could be amtt for the client and amqtt[broker] for the server part. But I am sure we will get bug reports for missing dependencies in the broker because the broker extra was not defined in the users dependecy / install. 🤔

[sjlongland]

Option (2) would probably be the approach I'd take… reasoning being that even in a server, you may be implementing the authentication module yourself using a mechanism other than passlib as the back-end (e.g. maybe you're calling out to RADIUS/LDAP…etc). We're already breaking APIs in 0.11: tweaking one's requirements.txt isn't a big deal.

Naming might be a challenge in this case, maybe amqtt[fileauthplugin] installs the dependencies needed for the built-in file-based auth plug-in. amqtt[all] might install "everything" (as amqtt does now).

My workaround right now is to simply add python3-passlib to my package's debian/control file so that apt/gdebi pulls in the dependency needed. Didn't affect the server itself (since that too, uses passlib), but this affects a client application that runs on an embedded device (Raspberry Pi 3).