Bug 2133426

Summary:	Python: Include licenses of the incorporated software in the RPM License tag
Product:	[Fedora] Fedora	Reporter:	Miro Hrončok <mhroncok>
Component:	python3.14	Assignee:	Karolina Surma <ksurma>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	low
Version:	rawhide	CC:	cstratak, ksurma, maxwell, mhroncok, pviktori, python-maint, python-packagers-sig, thrnciar, torsava, vstinner
Target Milestone:	---	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-09-29 10:04:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Miro Hrončok 2022-10-10 11:32:29 UTC

During the review of https://src.fedoraproject.org/rpms/python3.11/pull-request/78 the following question was asked:

Should we also include licences of the incorporated software? For some we use system libraries, but not for all.

https://docs.python.org/3/license.html#licenses-and-acknowledgements-for-incorporated-software



I am opening this Bugzilla to track it.

Comment 1 Karolina Surma 2025-05-07 16:03:37 UTC

Doing a scan of licenses of incorporated software.
There's no significant match for the trace license - https://docs.python.org/3/license.html#execution-tracing - I created https://gitlab.com/fedora/legal/fedora-license-data/-/issues/657

The rest of the files are as follows:

# Bundled mimalloc is MIT
# Mersenne Twister in _random C extension contains code under BSD-3-Clause
# socket module uses functions getaddrinfo() and getnameinfo() from WIDE Project, licensed under BSD-3-Clause
# test.support.asynchat and test.support.asyncore are MIT-CMU
# http.cookies is MIT-CMU
# uu is MIT-CMU
# trace: ???
# xmlrpc.client is MIT-CMU
# test.test_epoll is MIT
# select kqueue interface is BSD-2-Clause
# SipHash algorithm in Python/pyhash.c is MIT
# strtod and dtoa are dtoa
# cfuhash used by tracemalloc is BSD-3-Clause
# C14N test suite in Lib/test/xmltestdata/c14n-20/ is BSD-3-Clause
# parts of asyncio are MIT
# Python/qsbr.c is adapted from code under BSD-2-Clause
# Modules/_hacl contains code under MIT and MIT AND Apache-2.0

I skipped expat, libmpdec, libffi, zlib and openssl as it seems to me we always use the system libraries to build and ship them.

Question: Once we have the full list, should we only update the tag of -libs/-test, or the main Python license tag too?

Comment 2 Miro Hrončok 2025-05-07 18:14:03 UTC

The main python3(.14) package contains almost nothing. So I would say mainly -libs (+debug +freethreading*).

Comment 3 Karolina Surma 2025-09-23 08:44:41 UTC

Resolution of https://gitlab.com/fedora/legal/fedora-license-data/-/issues/657#note_2769699038: You can use a temporary ID LicenseRef-Fedora-Temporary-Python-trace.

Comment 4 Karolina Surma 2025-09-23 10:58:19 UTC

https://src.fedoraproject.org/rpms/python3.14/pull-request/107