use importlib.metadata when available

[tgbugs]

Avoid the pkg_resources perf clif re:
pypa/setuptools#510

I think this replicates the behavior of the pkg_resources variant (which is retained unmodified as a failover) while using importlib.metadata instead.

[mgorny]

I really like having support for importlib.metadata but duplicating all the code doesn't seem right. Perhaps remove support for pkg_resources entirely and use importlib_metadata package as a fallback for ancient Pythons.

[tiran]

I prefer to avoid additional dependencies when existing dependencies work fine.

The PR duplicates a fair amount of code and and introduces at least one bug.

[mgorny]

I prefer to avoid additional dependencies when existing dependencies work fine.

Actually, you are adding additional dependencies, given that setuptools are normally a build-time dependency only, and given that pkg_resources is deprecated and broken in at least a few ways the number of packages depending at runtime on setuptools is getting smaller.

And unfortunately, importing pkg_resources in certifi tends to scan metadata of all packages which means random packages suddenly break when there's something wrong somewhere on the system.

[tiran]

I'm really not in the mood to get into a dispute with you.

Fact is that pkg_resource is not deprecated. It is merely discouraged in favor of newer APIs like importlib.metadata.

Use of pkg_resources is discouraged in favor of importlib.resources, importlib.metadata, and their backports (importlib_resources, importlib_metadata). Please consider using those libraries instead of pkg_resources.

I'm ok to use importlib.metadata with Python 3.8 and newer. In fact I opened a new PR that replaces pkg_resources with importlib for Python >= 3.8. For 3.6 and 3.7 I'm not going to introduce a new dependency on importlib_metadata backport. pkg_resources has been around for over 15 years (a little shorter than I have been packaging Python software) and was pretty much always available until about 3 ago. importlib_metadata is newer and not always available in some of my use cases.

Please let me remind you that this package is still in beta phase. It won't leave beta until either Debian and Ubuntu have fixed their Python package spec or Ubuntu 20.04 and Debian Buster have reached EOL.

[tgbugs]

@tiran can you point me to the bug? I tried to retain existing behavior with as few modifications as possible, but I clearly missed something.