Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] License-Files entries are not checked for UTF-8 compliance, they just get copied directly into the licenses folder #4936

Open
schlenk opened this issue Apr 3, 2025 · 0 comments
Labels
bug Needs Triage Issues that need to be evaluated for severity and status.

Comments

@schlenk
Copy link

schlenk commented Apr 3, 2025

setuptools version

78.1.0

Python version

3.11

OS

Windows

Additional environment information

No response

Description

Using a pyproject.toml like this:

[build-system]
requires = ["setuptools >= 78.1.0"]
build-backend = "setuptools.build_meta"

[project]
name = "repro"
version = "0.1"
license-files = ["BadLicense.*"]

Now I have two files BadLicense.doc and BadLicense.pdf in my project directory.

Setuptools copies both files into the dist-info/licenses directory, without warning or error.

This also happens, if a pyproject.toml has no 'license-files' declared and the default regexp patterns are applied, so you might even end up to include 'license.py', 'license.exe' or similar files that are clearly not text files.

Expected behavior

This should result in an error.

PEP639 clearly states, that the license files MUST be UTF-8 encoded. This is obviously not the case for a binary Word doc file and probably not for a PDF. So i would expect setuptools validate this and to raise an Exception if it is not a valid UTF-8 encoded text file.

Tools MUST assume that license file content is valid UTF-8 encoded text, and SHOULD validate this and raise an error if it is not.

How to Reproduce

  1. mkdir repro
  2. Unpack pyproject.zip into the folder
  3. cd repro
  4. python -m venv .venv
  5. ./venv/Scripts/pip install -e .
  6. dir ..venv\Lib\site-packages\repro-0.1.dist-info\licenses\

pyproject.zip

Output

PS C:\repro> dir .\.venv\Lib\site-packages\repro-0.1.dist-info\licenses\

    Directory: C:\repro\.venv\Lib\site-packages\repro-0.1.dist-info\licenses

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a---          03.04.2025    15:33          29184 BadLicense.doc
-a---          03.04.2025    15:33          30930 BadLicense.pdf
@schlenk schlenk added bug Needs Triage Issues that need to be evaluated for severity and status. labels Apr 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Needs Triage Issues that need to be evaluated for severity and status.
Projects
None yet
Development

No branches or pull requests

1 participant