Thank you for your work, though, you've oversimplified this one:

A) core is not the Maltrail. core is only holding the core functions required by the both sensors and server
B) thirdparty is usable for (e.g.) users using git method (currently all of users). I don't see a problem of it staying there as is because those same libraries are not versatile in updates nor features
C) There is a bigger issue here, which is not related to the PyPI structuring and that is the installation of Maltrail as a service on generic *nix systems. Just pip install maltrail won't do much in current state

The intent isnt for this to be final, nor for pip install maltrail to become a solution for installation of maltrail. Both are possible, but would be more disruptive to the current codebase, and would be a wasted effort to do unless you are interested in publishing to PyPI, and providing support for installation from PyPI, which may not be appropriate at the moment.

The objective is solely to make some of the maltrail functionality available to other applications, as described at #6297 . I would use this immediately, and I suspect others would also, and with more app developers relying on maltrail, hopefully that results in more people helping with maintaining it also.

If you do want sensors and server included in the PyPI package, I can do that also. Then the PyPI sdist would be approaching what distro packagers could be able to consume, and of course they would add the service files needed.

Including thirdparty in a PyPI package is possible too, and such vendoring is not uncommon, especially of six. I can do that also, and in my distro packaging I then just patch to the source to de-vendor these.

@stamparm , could you please give me more direction on how to proceed. I would really like to use maltrail's features as part of a library I am building without resorting to copying&pasting them.

@jayvdb as far as I can see, you are interested ONLY into trails, because bundling ONLY the core doesn't make any sense. There is no point in making maltrail PyPI package which will hold only trails inside (along with dummy core). Hence, I'll need to drop this until I do it properly (for all the functionality)

I am also using a few parts of core, which is why I included it.

As indicated above, I am happy to do a more complete version if that is what you want, and your last post indicates that, so I will do that today.

@jayvdb please, I'll do this when I catch time. I just need to think about it to do it properly