Ship third-party notices as a single THIRD-PARTY-NOTICES.txt across all SDK packages#6422
Merged
Merged
Conversation
Bundle thirdparty/licenses/ into the Python wheel (as meshlib/third_party_licenses
package data) and the NuGet package (third_party_licenses/), completing the notices
across the remaining SDK distribution channels. The wheel enumeration uses
rglob("*") + is_file() so extensionless (LICENSE, COPYING) and nested
(c-blosc/LICENSES/*) files are all included.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Route the third-party notices into the wheel's .dist-info/licenses/ through the pyproject license-files globs -- the standard PEP 639 home for bundled license files -- instead of shipping them as meshlib/ package data. Requires setuptools >= 77 so license-files preserves the folder structure (older setuptools flattens, colliding same-named LICENSE files). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Grantim
added
test-pip-build
setuptools >= 77 rejects `license = { file = ... }` ("project.license must be
string"), which broke the wheel build on current setuptools regardless of the
notices change. Use the PEP 639 expression `LicenseRef-MeshLib`; the LICENSE
file itself still ships via license-files.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
PEP 639 / setuptools 83 rejects `License ::` trove classifiers when a `license` expression is set (InvalidConfigError). The LicenseRef-MeshLib expression now conveys the license, so remove the two license classifiers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The `<file src="./thirdparty/licenses/**">` wildcard silently matched no files in `nuget pack` (nuget does not error on an unmatched glob), so the notices were absent from the .nupkg even though the pack step was green. Follow the repo's proven approach (add_files) and enumerate the tree explicitly, recursing so nested files (e.g. c-blosc/LICENSES/*) keep their per-component structure. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace folder-shipping with one aggregated file, produced at package time by scripts/gen_third_party_notices.py from the per-component thirdparty/licenses/ source. CMake generates it at configure and installs the single file (deb/macOS/vcpkg); make_install_folder.py (Windows), build_wheel.py (wheel, into .dist-info/licenses/ via license-files, PEP 639) and generate_nuget_spec.py (NuGet, one <file> entry) each generate and ship it. The per-component folder, manifest, and drift-check remain the maintained source. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Grantim
changed the title
Grantim
removed
test-pip-build
Fedr
approved these changes
Jul 16, 2026
Grantim
added
test-pip-build
Commit the aggregated notices file and drop the per-component folder and the generator: every channel ships the file by plain copy with no package-time generation, and the checker validates sections instead of files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…notices-wheel-nuget # Conflicts: # thirdparty/licenses/Eigen/COPYING.MPL2 # thirdparty/licenses/Eigen/COPYING.README # thirdparty/licenses/manifest.json
oitel
approved these changes
Jul 16, 2026
Comment on lines
+13
to
+14
| # Ship MeshLib's own LICENSE plus the bundled third-party notices into the | ||
| # wheel's .dist-info/licenses/ (PEP 639). See docs/third_party_licenses.md. |
| @@ -1,5 +1,5 @@ | |||
| [build-system] | |||
| requires = ["setuptools >= 61.0"] | |||
| requires = ["setuptools >= 77.0"] | |||
Contributor
Author
There was a problem hiding this comment.
setuptools 77.0 is from March 2025 -- the first release with PEP 639 support (license expression + license-files), so it is the minimum floor. CI installs the latest anyway (83.x currently).
Comment on lines
+58
to
+59
| # Third-party notices ship in the wheel's .dist-info/licenses/ via the | ||
| # license-files entry in pyproject.toml (see docs/third_party_licenses.md). |
Comment on lines
+365
to
+366
| # Third-party license notices of the bundled OSS components | ||
| # (see docs/third_party_licenses.md). |
Comment on lines
+43
to
+44
| # Third-party license notices of the bundled OSS components, shipped at the package | ||
| # root via the <file> entry in template.nuspec (see docs/third_party_licenses.md). |
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ships the third-party license notices as one
THIRD-PARTY-NOTICES.txtin every SDK package, following the common single-file convention.The file is committed at
thirdparty/licenses/THIRD-PARTY-NOTICES.txtand is the hand-maintained source of truth: one#-ruled section per component (id, license, upstream, then the verbatim text(s)), inmanifest.jsonorder. The former per-component folder and the package-time generator are gone -- nothing is generated at build time, and no content is duplicated in the repo.Every channel ships the committed file by plain copy:
install(FILES ...)to${MR_RESOURCES_DIR}make_install_folder.pycopies it to the install rootlicense-filesinpyproject.tomlplaces it in.dist-info/licenses/(PEP 639,license = "LicenseRef-MeshLib", setuptools >= 77)scripts/check_third_party_licenses.py(daily + on release) now verifies each manifest component has a matching non-empty section (license/upstream match, manifest order, no orphan sections) on top of the existing version tripwire.manifest.jsondrops the per-componentfileslists; docs updated.Test plan
python scripts/check_third_party_licenses.pygreen (41 components); negative tests (removed / license-mismatched / orphan / misordered section) each fail with a targeted error.test-pip-build):.dist-info/licenses/THIRD-PARTY-NOTICES.txtpresent in the built wheel.upload-binaries):THIRD-PARTY-NOTICES.txtat the nupkg root and in the linux-vcpkg archive undershare/MeshLib/.