Stop importing packaging in the distro; vendor a dependency-free replacement

.chloggen/remove-packaging-from-sitecustomize.yaml

@@ -0,0 +1,26 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'.
+change_type: enhancement
+
+# A single word describing the area of concern (e.g. distro, pyproto, exporter,
+# resource-detectors, deps, ci, release, docs).
+component: distro
+
+# A brief description of the change. Surround your text with quotes ("") if it
+# needs to start with a backtick (`).
+note: Stop importing ``packaging`` in the injector bootstrap script
+
+# One or more tracking issues related to the change. At least one is required.
+issues: [48]
+
+# (Optional) One or more lines of additional information to render under the
+# primary note. These lines are padded with 2 spaces and inserted directly into
+# the document. Use pipe (|) for multiline entries.
+subtext: |
+  ``sitecustomize.py``'s dependency-conflict check now uses a small vendored,
+  dependency-free PEP 440/508 implementation instead of ``packaging``, so the
+  distribution's own code no longer relies on ``packaging`` being importable in
+  the injected process. ``packaging`` currently still ships transitively via
+  ``opentelemetry-instrumentation``; the vendored copy can be dropped once that
+  package no longer requires it.
+
+change_logs: [user]

packages/dash0-opentelemetry/src/dash0/opentelemetry/injector/_packaging/__init__.py

@@ -0,0 +1,23 @@
+# Copyright The OpenTelemetry Authors
+# SPDX-License-Identifier: Apache-2.0
+
+"""Vendored, dependency-free replacements for the subset of ``packaging`` used
+by the injector bootstrap script (``sitecustomize.py``).
+
+This package exists so that the distribution's own code does not import
+``packaging`` at runtime. Only the behaviour actually relied on by
+``sitecustomize.py``'s dependency-conflict check is implemented, following
+PEP 440 (versions and specifiers) and PEP 508 (requirements and environment
+markers).
+
+This is a verbatim copy (only the internal import paths are rewritten) of
+``opentelemetry.instrumentation._packaging``, introduced upstream in
+open-telemetry/opentelemetry-python-contrib#4883. It is vendored here because
+that upstream removal is not guaranteed to land.
+
+TO BE REMOVED: once the same local implementation is available in
+``opentelemetry-instrumentation`` (i.e. it ships ``_packaging`` in a release
+this distribution pins), delete this vendored package together with its
+``tests/test_packaging_*.py`` and repoint the imports in ``sitecustomize.py``
+(and the tests) to ``opentelemetry.instrumentation._packaging`` instead.
+"""