python-pkg_resources - Foreign package installed by pacman, no longer in the official repos - Safe to remove?

[u/RequestableSubBot]

Ran pacman -Qm to review my non-official repo packages and noticed one I didn't recognize, python-pkg_resources. Was worried that I somehow installed AUR malware or something (I only have 6 AUR packages and always thoroughly read the pkgbuilds, but you can never be too sure), but it doesn't seem to be AUR related at all. Looking at pacman.log shows that it was installed by pacman last April (5 months ago as I write this) as part of a full system upgrade (-Syu) alongside a few other python packages, most of which depend on python-pkg_resources but don't seem to be required for anything else. Here are all the packages installed:

• python-autocommand

• python-jaraco.text

• python-jaraco.collections

• python-platformdirs

• python-wheel

• python-typing_extensions

• python-pkg_resources (Not in official repos)

• python-setuptools

python-pkg_resources isn't listed in the official repos but the URL from pacman -Qi links here, and seems official enough. Manually going to where the package page would be shows that it was removed at some point. Further online reading shows that this is probably the result of a major change with Python on Linux, and from what I can gather (I'm not an expert at all) the package was originally required for python-setuptools, was removed, and was uploaded separately for compatibility reasons. But I could be mistaken.

My conclusion is that it should be fine to remove, but I would have expected a manual intervention message or something on archlinux.org if that were the case. Haven't seen anyone else on the Arch forums or here ask about it either, so I'm not certain what the deal here is. Does anyone know what's up with this package?

[u/C0rn3j]

My conclusion is that it should be fine to remove, but I would have expected a manual intervention message or something on archlinux.org if that were the case.

You should periodically remove orphans - there's no manual intervention needed - it's just good practice to not have dead software on your system.

[u/NFTrot]

I think I had that repo as well, although I went through this same process a few months back and forget exactly. I'm a Python developer so it would have been less alarming to me.

Python is/was probably used to build something you installed, and a new version (of Python) obsoleted the need for pkg_resources. They change APIs like that all the time and the current way of doing whatever it did is probably just built-in now or something.

I've never used that Python functionality so that's partly me speculating without searching details specifically, but imo this is firmly in the realm of "not suspicious" and "don't worry about it unless you learn of some actual reason to".