Use "vendoring" to manage 3rd party dependencies

pyproject.toml

@@ -4,8 +4,6 @@ description="The spack package manager"
 dependencies=[
   "clingo",
   "setuptools",
-  "six",
-  "types-six",
 ]
 dynamic = ["version"]
 
@@ -21,8 +19,8 @@ dev = [
   "pytest",
   "pytest-xdist",
   "setuptools",
-  "click==8.0.2",
-  'black==21.12b0',
+  "click",
+  'black',
   "mypy",
   "isort",
   "flake8",
@@ -195,3 +193,43 @@ ignore_errors = true
 
 [tool.coverage.html]
 directory = "htmlcov"
+
+[tool.vendoring]
+destination = "lib/spack/external/_vendoring"
+requirements = "lib/spack/external/vendor.txt"
+namespace = ""
+
+protected-files = ["__init__.py", "README.rst", "vendor.txt"]
+patches-dir = "lib/spack/external/patches"
+
+[tool.vendoring.transformations]
+substitute = [
+]
+drop = [
+  # contains unnecessary scripts
+  "bin/",
+  # interpreter and OS specific msgpack libs
+  "msgpack/*.so",
+  # unneeded parts of setuptools
+  "easy_install.py",
+  "setuptools",
+  "pkg_resources/_vendor/",
+  "pkg_resources/extern/",
+  # trim vendored pygments styles and lexers
+  "pygments/styles/[!_]*.py",
+  '^pygments/lexers/(?!python|__init__|_mapping).*\.py$',
+  # trim rich's markdown support
+  "rich/markdown.py",
+]
+
+[tool.vendoring.typing-stubs]
+six = ["six.__init__", "six.moves.__init__", "six.moves.configparser"]
+distro = []
+
+[tool.vendoring.license.directories]
+setuptools = "pkg_resources"
+
+[tool.vendoring.license.fallback-urls]
+CacheControl = "https://raw.githubusercontent.com/ionrock/cachecontrol/v0.12.6/LICENSE.txt"
+distlib = "https://bitbucket.org/pypa/distlib/raw/master/LICENSE.txt"
+webencodings = "https://github.com/SimonSapin/python-webencodings/raw/master/LICENSE"