License information missing in 4.13 package on PyPi

[martin-traverse]

Hi, this update came through automatically and broke the license scan for my project. We had to downgrade to 4.12 until it is fixed.

Steps to reproduce

python -m venv ./venv
. venv/bin/activate
pip install typing-extensions
pip install pip-licenses
pip-licenses

Name               Version  License 
typing_extensions  4.13.0   UNKNOWN 

Key one to get fixed since this library is at the bottom of the stack for a lot of software! Please let me know if you need any extra info.

[martin-traverse]

For reference, from the previous version:

pip install "typing-extensions < 4.13" 

Name               Version  License                            
typing_extensions  4.12.2   Python Software Foundation License 

[gedalia]

same, hoping a hotfix will be available soon

[brianschubert]

Hi! This is an issue with pip-licenses, not typing-extensions. It seems that pip-licenses does not support PEP 639 license metadata, which typing-extensions uses since #507.

There's an open issue on pip-licenses tracker to add PEP 639 support: raimon49/pip-licenses#225, plus an open PR: raimon49/pip-licenses#213

Just as confirmation, I checked the typing-extensions 4.13.0 wheel on PyPI. It has the license info I would expect:

• typing_extensions-4.13.0.dist-info/licenses/METADATA contains the License-Expression: PSF-2.0 and License-File: LICENSE fields
• typing_extensions-4.13.0.dist-info/licenses/LICENSE is present and populated with the right license file

[Daraan]

(this is not an official reply)

With #507 the behavior was changed to match PEP 639 recommendations. pip-license is still expects the old format, its migration is still an open issue (raimon49/pip-licenses#225) but a PR (raimon49/pip-licenses#213) already exists; also a fork that implements it if you are interested.
However, maintenance seems low at the moment, best try to follow up with them.

[srittau]

I just confirmed that correct license information is present in both the published .tar.gz file and the wheel. I am closing this per @brianschubert and @Daraan and hope that pip-licenses will be fixed soon.

[martin-traverse]

Hi - the metadata in the wheel might be correct, but, it is a problem for us if there are no tools that actually support I!

I've looked at pip-licenses, licensecheck and scancode-toolkit, none of them support it. Would it make more sense to stick with the old standard, until the new standard has a bit more support?

#rememberPython3

[gedalia]

same here. This is the second package that we are forced to pin an old version of because they can't pass basic licensing checks. and there's no movement in the standard tools to fix.

[martin-traverse]

I have added comments to raimon49/pip-licenses#225, ansys/pip-licenses#5 and FHPythonUtils/LicenseCheck#112, @gedalia you could do the same?

I don't know how quickly any of them might release anything. Hopefully before someone raises a bunch of NVD tickets against the old versions....