[BUG] Deprecated metadata fields are included as Dynamic fields

[di]

setuptools version

75.8.0

Python version

n/a

OS

n/a

Additional environment information

Ref: pypi/warehouse#17389

Description

Since #4698, setuptools will record the deprecated Requires field as a Dynamic field.

PEP 643 says:

A new field, Dynamic, will be added to the Core Metadata Specification. This field will be multiple use, and will be allowed to contain the name of another core metadata field.

I read this to mean that this can only contain the name of a core metadata field that is valid for the given metadata version, and shouldn't include deprecated fields. Since Requires was deprecated in 1.2 and Dynamic was added in 2.2, Requires should never be included as a Dynamic field.

Expected behavior

Setuptools should not write deprecated Core metadata fields to Dynamic.

How to Reproduce

This setup.py:

from setuptools import setup

setup(
    name="test",
    version="0.0.0",
    requires=["foo"],
    install_requires=["bar"],
)

Built with:

$ python -m build -w

Output

This results in the following METADATA file:

Metadata-Version: 2.2
Name: test
Version: 0.0.0
Requires: foo
Requires-Dist: bar
Dynamic: requires
Dynamic: requires-dist

[abravalheri]

Thank you very much, @di, for reporting this.

I think we need a clarification on the topic. It is not immediate for me that this is what is specified by the standard. My interpretation is that as long as it is a valid metadata field, then it can be Dynamic (the only two fields excluded in the PEP are name and version). Since the field can still be written, although deprecated, it should respect Dynamic, shouldn't it?

On a side note:

I will double check if setuptools is emitting a warning for people using requires (we should add one if not there yet).

/cc @pfmoore as the author of the PEP

[pfmoore]

My intention was that any field could be marked as Dynamic. I hadn’t considered the case of fields that were deprecated before Dynamic was added, but I think it makes no difference - they are deprecated, but still allowed. I will admit that the core metadata spec isn’t clear on this either - are tools allowed to reject metadata containing deprecated fields? If the answer is “yes” (and making it say that would be a spec change IMO), then my answer here changes.

Including fields that were removed in an older version isn’t allowed, though, just the same as it’s not allowed to include an invalid field. But I’m not aware of any fields that have been removed rather than deprecated.

I agree that it would be helpful for setuptools to warn (or maybe even outright error if the deprecation is sufficiently old) if a deprecated field is used.

[di]

Thanks. I filed pypa/packaging.python.org#1787 to update the spec and pypi/warehouse#17409 to bring PyPI's behavior inline here.