#4050 more dependency tweaks

* record DLL found in pkcs11 subdir and don't try to use this subdir as a python module,
* record 'decorator' by hand,
* document the details on the 'mpdecimal' unnecessary dependency warning,
* skip more optional deps
* always remove extra python modules when making 'light' builds, even if not zipping the modules

packaging/MSWindows/BUILD.py

@@ -54,6 +54,12 @@
 
 BUILD_CUDA_KERNEL = "packaging\\MSWindows\\BUILD_CUDA_KERNEL.BAT"
 
+EXTRA_PYTHON_MODULES = [
+    "unittest", "psutil", "pynvml",
+    "browser_cookie3",
+    "gssapi", "ldap", "ldap3", "pyu2f", "sqlite3",
+]
+
 
 def parse_command_line(argv: list[str]):
     from argparse import ArgumentParser, BooleanOptionalAction
@@ -589,6 +595,7 @@ def delete_dist_files(*exps: str) -> None:
 
 
 def delete_libs(*exps: str) -> None:
+    debug(f"deleting libraries: {exps}")
     delete_dist_files(*(f"lib/{exp}" for exp in exps))
 
 
@@ -729,11 +736,8 @@ def zip_modules(light: bool) -> None:
         "concurrent", "collections",
         "asyncio",
     ]
-    EXTRAS = ["unittest", "gssapi", "browser_cookie3", "pynvml", "ldap", "ldap3", "pyu2f", "sqlite3", "psutil"]
-    if light:
-        delete_libs(*EXTRAS)
-    else:
-        ZIPPED += EXTRAS
+    if not light:
+        ZIPPED += EXTRA_PYTHON_MODULES
     log_command(["zip", "--move", "-ur", "library.zip"] + ZIPPED, "zip.log", cwd=LIB_DIR)
 
 
@@ -1071,14 +1075,18 @@ def rec_cuda(path: str) -> None:
     debug("adding python modules")
     SKIP_DIRS = (
         "xpra", "tlb",
-        "gi", "girepository-1.0", "gstreamer-1.0", "gtk-3.0", "gdk-pixbuf-2.0",
+        "gi", "gio", "pkcs11", "girepository-1.0", "gstreamer-1.0", "gtk-3.0", "gdk-pixbuf-2.0",
     )
     for child in os.listdir(LIB_DIR):
         if child in SKIP_DIRS or child.endswith(".dll"):
             continue
         path = os.path.join(LIB_DIR, child)
         if os.path.isdir(path) or path.endswith(".py") or path.endswith(".pyd"):
             rec_py_lib(os.path.join("lib", child))
+    # add this one by hand because cx_Freeze hides it in `library.zip`,
+    # and we don't want to start unpacking a large ZIP file and converting .pyc to .py
+    # just for one filename:
+    rec_py_lib(os.path.join("lib", "decorator.py"))
 
     # summary: list of packages
     packages = tuple(sorted(set(sbom_data["package"] for sbom_data in sbom.values())))
@@ -1317,6 +1325,9 @@ def build(args) -> None:
         rec_sbom()
         export_sbom()
 
+    if args.light:
+        delete_libs(EXTRA_PYTHON_MODULES)
+
     if args.zip_modules:
         zip_modules(args.light)
 

packaging/MSWindows/cyclonedx_sbom.py

@@ -85,6 +85,11 @@
                 "adwaita-icon-theme",
                 # python dependencies we don't want:
                 "tcl", "tk", "headers", "tzdata",
+                # python works fine without `mpdec` so perhaps the current builds of Python
+                # do not yet use the unbundled mpdec library and the MSYS2 package dependencies are therefore wrong?
+                # in any case, it will become a hard dependency in python 3.13: /mingw64/bin/libmpdec-4.dll
+                # at which point this workaround can be removed:
+                "mpdecimal",
                 # webp tools can use this, but we don't ship them:
                 "giflib",
                 # cairo, why?
@@ -98,6 +103,10 @@
                 "gsettings-desktop-schemas",
                 # libproxy wants this package, but we don't:
                 "duktape",
+                # ncurses works just fine without it:
+                "libsystre",
+                # sqlite tools use this, but we don't ship them:
+                "readline",
             )
             ):
                 continue