pip problem with Debian 12 installation of python3-deprecation

[ultradian]

Description

I think there is some problem in the interface between pip and Debian when installing python3-deprecation via apt. Afterwards I do a pip3 list and see thinks it has version:
deprecation 2.0.7
although apt tells me:
python3-deprecation is already the newest version (2.1.0-2)

Expected behavior

should get
deprecation 2.1.0-2
instead since that is what is installed in the system

pip version

pip 23.0.1

Python version

Python 3.11.2

OS

Debian GNU/Linux 12 (bookworm)

How to Reproduce

apt install python3-deprecation
pip3 list

Output

deprecation 2.0.7

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[notatallshaw]

Try running pip3 show deprecation and dpkg -L python3-deprecation to confirm you're looking at the same package (on the same path). If the paths match this is very likely this is a metadata issue on debian's side, pip just reports the metadata from the Python package.

You should be able to find this from the pip3 show command by looking inside the path for a directory called deprecation-{version-number}.dist-info and inside that should be a file called METADATA which near the start should be a line Version: {version-number} which matches the version number of the directory and what pip reports.

[eli-schwartz]

https://packages.debian.org/bookworm/all/python3-deprecation/filelist

File list of package python3-deprecation in bookworm of architecture all

/usr/lib/python3/dist-packages/deprecation-2.0.7.egg-info/PKG-INFO
/usr/lib/python3/dist-packages/deprecation-2.0.7.egg-info/dependency_links.txt
/usr/lib/python3/dist-packages/deprecation-2.0.7.egg-info/requires.txt
/usr/lib/python3/dist-packages/deprecation-2.0.7.egg-info/top_level.txt
/usr/lib/python3/dist-packages/deprecation.py
/usr/share/doc/python3-deprecation/changelog.Debian.gz
/usr/share/doc/python3-deprecation/changelog.gz
/usr/share/doc/python3-deprecation/copyright

If we look at Debian's import of the new version: https://salsa.debian.org/python-team/packages/python-deprecation/-/commit/37e3c16c60cbcc0587a6ccbae5abf6894b011863

We see that although it changed lots of code, it didn't change deprecation.__version__ (which setup.py uses to programmatically single-source the version). And we can also see from the upstream github repository of the PyPI package, that the version was updated in git:
briancurtin/deprecation@a740a40

... but only after the actual release was git tagged in: briancurtin/deprecation@c2c1e6b

So Debian's packaging plainly imported from github, not from PyPI, for whatever reason. And as a result, they have packaged a version that isn't quite one thing but isn't the other either. The only material difference is that the metadata is wrong...

You could possibly report a bug to Debian. As for pip, it is doing the genuinely correct thing here.

[eli-schwartz]

And in case you were wondering -- it is incorrect in Debian sid as well, so if nobody reports the issue then Debian will be wrong probably forever.

[ultradian]

@eli-schwartz thanks for your investigation and these details. I'm not sure if I reported it correctly, but I submitted this to the Debian bug tracker on Jan 6, log #1092252. Perhaps I should add your observations to that bug? It's my first Debian bug report and I don't know what helps speed the process.

[eli-schwartz]

Ah, great.

Yes, I think you should add my observations to that bug, especially the part about how the version number in github was only fixed after the git tag. It will help speed the process because the Debian maintainer of the package will then have more information about the best way to fix it.

(Also please link to the pip bug report as "additional context" so they can read the discussion for themselves. In general, providing additional background links such as the same issue reported in another location, is always an excellent thing to do.)