asset dependency is GPL

[kbielefe]

The asset library included in #228 is GPL-3, and therefore not importable from Apache-licensed code. This came up as a surprise item in our latest release readiness review when a routine upgrade of pyhocon pulled in a GPL library.

[klamann]

Today, there are 3 dependencies of pyhocon that are GPLv3+ licensed: aadict, asset, globre.

aadict and globre are transitive dependencies of asset:

pyhocon==0.3.56
  - asset [required: Any, installed: 0.6.13]
    - aadict [required: >=0.2.2, installed: 0.2.3]
      - six [required: >=1.6.0, installed: 1.15.0]
    - globre [required: >=0.1.5, installed: 0.1.5]
    - six [required: >=1.10.0, installed: 1.15.0]
  - pyparsing [required: >=2.0.3, installed: 2.4.7]

From what I can see, asset is only used in one place to resolve a package-relative path in an include statement like this:

include package("package:assets/test.conf")

It should be possible to rewrite this one line so that we don't need the asset library and all of its transitive dependencies, right?

[klamann]

Let's say we want to replicate

>>> asset.load("pyhocon:config_tree.py").filename
'/path/to/.venv/lib/python3.7/site-packages/pyhocon/config_tree.py'

We could define a function like

import importlib
from pathlib import Path

def resolve_package_path(package_path: str) -> Path:
    package_name, path_relative = package_path.split(':', maxsplit=1)
    package_dir = importlib.util.find_spec(package_name).submodule_search_locations[0]
    return Path(package_dir) / path_relative

This should replicate the behaviour we want

import asset
assert str(resolve_package_path("pyhocon:config_tree.py")) == asset.load("pyhocon:config_tree.py").filename

So this one function with 3 lines of code should allow us to avoid using the asset library. I haven't looked into all possible edge cases, but it's a start.

[scottj97]

Should this be closed? #247 resolved this?

[kbielefe]

As far as I'm concerned, it can be closed. I'm not familiar with your process.

[klamann]

yes, this was solved in #247 and the change was published in version 0.3.57

[kbielefe]

Since I opened this, I'm going ahead and closing. Thanks for addressing this! It enabled us to start taking upgrades again.