Repository navigation
License: enumerate bundled MIT UI components in sdist PKG-INFO License-File #755
Description
Activity
@elijahbenizzy I can work on this, please assign it to me
Reacted by Stefan Krawczyk@Haricharanpanjwani, this issue has been inactive for 15 days.
Are you still working on it? Drop a comment to let us know.If there is no update within 7 days, the assignment will be removed
so someone else can pick it up
(per the assignment policy).@Haricharanpanjwani, this issue has been inactive for 15 days. Are you still working on it? Drop a comment to let us know.
If there is no update within 7 days, the assignment will be removed so someone else can pick it up (per the assignment policy).
I am working on it, will have the PR soon
@andreahlert @elijahbenizzy can you please review the PR #835?
@Haricharanpanjwani, this issue has been inactive for 20 days.
Are you still working on it? Drop a comment to let us know.If there is no update within 7 days, the assignment will be removed
so someone else can pick it up
(per the assignment policy).@Haricharanpanjwani, this issue has been inactive for 20 days. Are you still working on it? Drop a comment to let us know.
If there is no update within 7 days, the assignment will be removed so someone else can pick it up (per the assignment policy).
I am waiting for review on PR #835 from @andreahlert @elijahbenizzy
Sorry, I missed this completely.
This has been resolved indirectly by #858, which excludes website/** from the sdist. Since the referenced MIT-licensed UI components are no longer packaged there, they no longer need to be enumerated in the sdist’s License-File metadata. Closing as superseded.
Raised by Jarek Potiuk during the 0.42.0-incubating RC3 PPMC review. Non-blocking for the release.
Issue
The sdist tarball's
PKG-INFOLicense-Filemetadata only referencesLICENSE-wheel,NOTICE, andDISCLAIMER. It does not separately enumerate the third-party MIT-licensed UI components inwebsite/src/components/ui/(Magic UI + shadcn).The components ARE properly attributed in the LICENSE file (Apache 2.0 + appended MIT notices), and our
.rat-excludescovers them. So this is a metadata-completeness gap, not a licensing gap.What downstream tooling expects
Some downstream consumers (e.g. PyPI license scanners, package indexers, Linux distro packagers) read
License-Fileto enumerate every distinct license file shipped with the artifact. Today they would see only Apache 2.0 + the project NOTICE/DISCLAIMER and might miss that there are MIT components inside.Suggested fix
Either:
LICENSE-third-party-ui) and add it topyproject.toml'slicense-fileslistLICENSEfile to the sdistlicense-fileslist (it already contains the Apache 2.0 text + MIT appendices)The latter is simpler. The former is more discoverable.
References