sdist is missing license file

[mtelka]

Recently the license file got removed from git and so it is no longer in the sdist package too. I think this is wrong because the MIT license explicitly states this:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

and so I believe the full license wording should be included in the sdist package.

Disclaimer: IANAL

[jaraco]

See jaraco/skeleton#171 (comment) where I explain the rationale. For anyone who wants to bikeshed on the topic, they can bring it there, but it's going to take a compelling case that both human and mechanical agents are unable to detect the included license.

[Avasam]

FWIW, it does make a visual difference on GitHub. The following "license" information no longer shows on the sidebar or root navigation of the repo.

(note this isn't a comment on how things should or shouldn't be done, I'm only pointing out a visual difference)

[jaraco]

Yeah, that's unfortunate, and it makes me sad, but I just don't see a solution that doesn't violate the DRY principle and impede scalability. This issue was fixed in #4992.

[Avasam]

For future readers:

Another real tangible effect: running pip install .[core,type] or tox run will add a LICENSE file in the repo.
Since it's not in a folder to be ignored, contributors can't add a .gitignore with *.
Since it's an important file in the vast majority of projects, people are probably not going to want to globally ignore it as https://blog.jaraco.com/skeleton/#ignoring-artifacts recommends (granted, a checked-in but gitignored license file just means you can't accidentally modify it, so maybe not that bad)

So that only leaves per-project specific, for example by using .git/info/exclude (which the doc also mentions), and is simply what I went for

[jaraco]

For future readers:

Another real tangible effect: running pip install .[core,type] or tox run will add a LICENSE file in the repo. Since it's not in a folder to be ignored, contributors can't add a .gitignore with *. Since it's an important file in the vast majority of projects, people are probably not going to want to globally ignore it as https://blog.jaraco.com/skeleton/#ignoring-artifacts recommends (granted, a checked-in but gitignored license file just means you can't accidentally modify it, so maybe not that bad)

So that only leaves per-project specific, for example by using .git/info/exclude (which the doc also mentions), and is simply what I went for

That also affects me. I agree, it's something to be addressed with the current coherent.licensed implementation. Ideally the file wouldn't need to be manifest on the filesystem to be included in the sdist and wheel metadata. Ideally, it would do something like it does in coherent.build where only one line of code is necessary to inject the file but otherwise not leave a trace.

There's a separate issue that the license is going to be resolved when building the sdist to a wheel, which is unnecessary and redundant and probably an annoyance for system integrators that wish to avoid network access during builds.

These issues apply to skeleton projects as much as setuptools, so I'll track them there.

[uncatchable-de]

@jaraco The additional network call also causes trouble when downloading the sdist of another package, if the network is restricted to certain endpoints. For example this call fails if only connections to pypi are allowed, as it tries to connect now to raw.githubusercontent.com as well:
pip download --no-deps --no-binary :all: -d downloads charset-normalizer==3.4.2

Even if an older setuptools version is installed before, it will download setuptools 80.7.1 and fail when trying to connect to raw.githubusercontent.com to download the license. Is there a way to disable the license download with an environment variable?