The problem
StemDeck downloads from YouTube and SoundCloud. It ships yt-dlp, which carries 939 extractor modules covering every site yt-dlp has ever supported. A large number of those are pornography sites, named as such in the filenames.
Every desktop install puts those files on the user's disk, under their own account, in a folder they did not choose. They are never imported and never executed. That does not help: what is on someone's computer is a fact about their computer, regardless of whether it runs.
This is not about package size. It is about not putting files on an end user's machine that they would not want there and have no reason to have.
Constraints on any fix
- Extractors are not independent. Several import from each other across the package (
from ..extractor.<name> import ...). Deleting by a hand-written keep-list breaks the tree at import time, and the breakage is silent until someone pastes a link.
GenericIE is the final fallback for anything unrecognised and is referenced by name.- yt-dlp prefers
lazy_extractors.py when it is present and falls back to _extractors.py on ImportError. Removing modules without dealing with the lazy table leaves a table pointing at files that no longer exist.
- The pruning has to run in every packaging path (Windows, Linux, macOS, Docker) or the guarantee is only true on some platforms.
- It has to fail the build if the resulting tree does not import, rather than shipping something broken. A packaging step that silently half-works is worse than not having it.
- YouTube and SoundCloud extraction must be verified as still working after the prune, in the build, not assumed.
The problem
StemDeck downloads from YouTube and SoundCloud. It ships yt-dlp, which carries 939 extractor modules covering every site yt-dlp has ever supported. A large number of those are pornography sites, named as such in the filenames.
Every desktop install puts those files on the user's disk, under their own account, in a folder they did not choose. They are never imported and never executed. That does not help: what is on someone's computer is a fact about their computer, regardless of whether it runs.
This is not about package size. It is about not putting files on an end user's machine that they would not want there and have no reason to have.
Constraints on any fix
from ..extractor.<name> import ...). Deleting by a hand-written keep-list breaks the tree at import time, and the breakage is silent until someone pastes a link.GenericIEis the final fallback for anything unrecognised and is referenced by name.lazy_extractors.pywhen it is present and falls back to_extractors.pyonImportError. Removing modules without dealing with the lazy table leaves a table pointing at files that no longer exist.