Container only. Supersedes 1.1.3 for image users; the wheel and sdist are unchanged in
substance.
Fixed
-
The container image did not carry SDIP's own
LICENSEorNOTICE.pyproject.toml
declareslicense-files = ["LICENSE", "NOTICE"], but the Dockerfile never copied those
files into the build context — souvbuilt adist-infowith nolicenses/
directory at all, and said nothing about it.The image is a redistribution of an Apache-2.0 work that has a NOTICE, so both files
must travel with it. They now do.Why it went unnoticed through a release whose entire purpose was attribution: every
dependency still shipped its own licence — 115 of them. Any spot check finds licence
files throughout the image and concludes it is fine. The one package missing its licence
was SDIP itself, and it was missing because it is the only package built from the
local context rather than installed from an index.
Added
- A publish-time gate asserting the pushed image carries
LICENSEandNOTICE, and
that the NOTICE inside is the version carrying the current attribution — not merely that
a file with the right name exists.
Install
docker pull ghcr.io/zahidaramai/sdip:1.1.4
pip install git+https://github.com/zahidaramai/sdip@v1.1.4