google / google/deps.dev

Support PEP 639 for PyPI licenses

Open
#94 3 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
443
Forks
54
Avg merge
1d 22h
Merged PRs (30d)
3

Description

Hi,
we are noticing a lot of cases where packages are missing their licenses even though they can be found easily.
one of the examples for python packages is 'pydantic':

1. both on https://pypi.org/project/pydantic/ and https://github.com/pydantic/pydantic you can see they are using MIT license.
2. when calling ''https://api.deps.dev/v3/systems/pypi/packages/pydantic/versions/2.7.4'' the response I'm getting:
`{"versionKey":{"system":"PYPI", "name":"pydantic", "version":"2.7.4"}, "publishedAt":"2024-06-12T14:11:54Z", "isDefault":true, "licenses":[], "advisoryKeys":[], "links":[{"label":"SOURCE_REPO", "url":"https://github.com/pydantic/pydantic"}, {"label":"HOMEPAGE", "url":"https://github.com/pydantic/pydantic"}, {"label":"DOCUMENTATION", "url":"https://docs.pydantic.dev"}], "slsaProvenances":[], "registries":["https://pypi.org/simple"], "relatedProjects":[{"projectKey":{"id":"github.com/pydantic/pydantic"}, "relationProvenance":"UNVERIFIED_METADATA", "relationType":"SOURCE_REPO"}]` as you can see the licenses array is empty.
3. on https://deps.dev/pypi/pydantic you can't find the license but there is some indication for dependencies licenses.
4. According to https://docs.deps.dev/faq/#how-are-licenses-determined - the licenses are determined from the package metadata - if you look at the pydantic package metadata you would find also:
`License-Expression: MIT
License-File: LICENSE
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Environment :: MacOS X
Classifier: Framework :: Hypothesis
Classifier: Framework :: Pydantic
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License`

is there any issue for resolving/verifying those metadatas?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.