Allow non-types dependencies (#5769)

Remove the check in check_consistency that ensures that only other
type packages from typeshed are being depended on. Instead, add an
explanation to CONTRIBUTING that spells out the requirements. This
adds a higher, but reasonable burden on maintainers to check the
dependencies manually.

Part of #5768

Author: srittau

CONTRIBUTING.md

@@ -94,7 +94,10 @@ supported:
   unknown and needs to be updated.
 * `python2` (default: `false`): If set to `true`, the top-level stubs
   support both Python 2 and Python 3.
-* `requires` (optional): A list of other stub packages that this package uses.
+* `requires` (optional): A list of other stub packages or packages with type
+  information that are imported by the stubs in this package. Only packages
+  generated by typeshed or required by the upstream package are allowed to
+  be listed here, for security reasons.
 * `extra_description` (optional): Can be used to add a custom description to
   the package's long description. It should be a multi-line string in
   Markdown format.

tests/check_consistent.py

@@ -163,7 +163,6 @@ def _strip_dep_version(dependency):
 
 
 def check_metadata():
-    known_distributions = set(os.listdir("stubs"))
     for distribution in os.listdir("stubs"):
         with open(os.path.join("stubs", distribution, "METADATA.toml")) as f:
             data = toml.loads(f.read())
@@ -179,13 +178,10 @@ def check_metadata():
         assert isinstance(data.get("requires", []), list), f"Invalid requires value for {distribution}"
         for dep in data.get("requires", []):
             assert isinstance(dep, str), f"Invalid dependency {dep} for {distribution}"
-            assert dep.startswith("types-"), f"Only stub dependencies supported, got {dep}"
-            dep = dep[len("types-"):]
             for space in " \t\n":
                 assert space not in dep, f"For consistency dependency should not have whitespace: {dep}"
             assert ";" not in dep, f"Semicolons in dependencies are not supported, got {dep}"
             stripped, relation, dep_version = _strip_dep_version(dep)
-            assert stripped in known_distributions, f"Only dependencies from typeshed are supported, got {stripped}"
             if relation:
                 msg = f"Bad version in dependency {dep}"
                 assert relation in {"==", ">", ">=", "<", "<="}, msg