[BUG] License-Files entries are not checked for UTF-8 compliance, they just get copied directly into the licenses folder
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- python
- Domain
- build-system
Research direction
Trace how license-files from pyproject.toml are processed by the setuptools build backend and copied into the dist-info/licenses directory. Check the existing handling around these entries and add coverage for non-UTF-8 or binary files; done means invalid license files produce an error instead of being copied silently.
Written by the indexing model from the issue text.
Description
setuptools version
78.1.0
Python version
3.11
OS
Windows
Additional environment information
No response
Description
Using a pyproject.toml like this:
[build-system]
requires = ["setuptools >= 78.1.0"]
build-backend = "setuptools.build_meta"
[project]
name = "repro"
version = "0.1"
license-files = ["BadLicense.*"]
Now I have two files BadLicense.doc and BadLicense.pdf in my project directory.
Setuptools copies both files into the dist-info/licenses directory, without warning or error.
This also happens, if a pyproject.toml has no 'license-files' declared and the default regexp patterns are applied, so you might even end up to include 'license.py', 'license.exe' or similar files that are clearly not text files.
Expected behavior
This should result in an error.
PEP639 clearly states, that the license files MUST be UTF-8 encoded. This is obviously not the case for a binary Word doc file and probably not for a PDF. So i would expect setuptools validate this and to raise an Exception if it is not a valid UTF-8 encoded text file.
Tools MUST assume that license file content is valid UTF-8 encoded text, and SHOULD validate this and raise an error if it is not.
How to Reproduce
- mkdir repro
- Unpack pyproject.zip into the folder
- cd repro
- python -m venv .venv
- ./venv/Scripts/pip install -e .
- dir ..venv\Lib\site-packages\repro-0.1.dist-info\licenses\
Output
PS C:\repro> dir .\.venv\Lib\site-packages\repro-0.1.dist-info\licenses\
Directory: C:\repro\.venv\Lib\site-packages\repro-0.1.dist-info\licenses
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a--- 03.04.2025 15:33 29184 BadLicense.doc
-a--- 03.04.2025 15:33 30930 BadLicense.pdf
- Dominant language
- Python
- Stars
- 2.9k
- Forks
- 1.4k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from pypa/setuptools
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
pypa/setuptools#5272 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
pypa/setuptools#5235 · 1 comment · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
pypa/setuptools#5234 · 1 comment ·
-
bug Needs Triage
Difficulty 1/5 Under an hour Newbie friendliness 78/100
pypa/setuptools#4135 · 1 comment · 1 reaction ·
-
documentation Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
pypa/setuptools#2753 ·
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
bancolombia/sentinel#23 ·
-
test md OpenCI
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
langchain-ai/deepagents#6450 ·
-
bug client
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100