You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@iceberg.apache.org by "Jones, Danny" <dj...@amazon.co.uk> on 2026/09/16 15:33:51 UTC
[DISCUSS] pyiceberg-core / iceberg-rust Python bindings appears not to include third-party notice files
Hey iceberg-rust/pyiceberg-core folks,
As I was reviewing the notices/license files we include in our releases, I noticed that for pyiceberg-core[1] we are distributing compiled dependencies and do not reproduce the copyright notices for dependencies in the wheels (Python archives containing the compiled code). I believe this is an issue that must be addressed before new releases of pyiceberg-core and more broadly iceberg-rust go out since they’re released together.
Please do correct me if I’m misinterpreting this. I’ve opened a GitHub issue that documents how to identify the missing file in the distributed artifacts, and a proposed mitigation of including a THIRD-PARTY-LICENSES file in the wheels at build time. https://github.com/apache/iceberg-rust/issues/3239
Once we have a solution, I’d like to verify it meets the obligations via the legal-discuss@ mailing list[1]. If there’s any other step we need to take, please point me in the right direction.
Thanks all,
Danny
[1]: https://pypi.org/project/pyiceberg-core/
[2]: https://lists.apache.org/list.html?legal-discuss@apache.org
Re: [DISCUSS] pyiceberg-core / iceberg-rust Python bindings appears not to include third-party notice files
Posted by Kevin Liu <ke...@apache.org>.
Thanks for finding this. I think this was an oversight when we created the
Python binding, and we should fix it before publishing pyiceberg-core again.
The iceberg-rust release only contains source code and doesn’t bundle its
dependencies, so we haven’t needed to list them in LICENSE and NOTICE. The
pyiceberg-core wheels are different because they compile the Rust
dependencies into the Python extension, so those wheels need to include the
relevant third-party licenses and notices.
Let’s figure out which libraries are bundled in the wheels first, and then
add the appropriate entries to LICENSE and NOTICE.
We have a repo-wide cargo deny check that prevents us from using and
distributing libraries with licenses that are incompatible with ASF policy,
so we don’t need to worry about that part. The issue here is making sure
the required license texts and notices are included in the wheels.
Happy to help resolve this
On Wed, Sep 16, 2026 at 5:35 PM Shawn Chang <ye...@gmail.com> wrote:
> Thanks Danny for catching this! I think this is important and we need to
> fix it.
>
> It looks like there are other apache projects already handling this
> nicely. e.g.
> https://github.com/apache/paimon-rust/blob/main/bindings/python/THIRD-PARTY-LICENSES.html
> Their workflow:
> 1. Get dependency scope from bindings/python/Cargo.toml
> 2. Generate report per target wheel.
> 3. Stage the license in bundled artifacts
> 4. Verify the license in artifacts
>
> I have no experience in working with legal-discuss before, but I assume we
> will need their inputs after we decided how the workflow/CI/generated third
> party licenses report is gonna look like in iceberg-rust.
>
> Best,
> Shawn
>
>
> On Wed, Sep 16, 2026 at 10:03 AM Ryan Blue <bl...@apache.org> wrote:
>
>> Yes, if we are distributing third-party code in our compiled artifacts,
>> then we need to make sure that the LICENSE and NOTICE for those compiled
>> artifacts reflects all of what we are distributing.
>>
>> I'm not sure about the use of THIRD-PARTY-LICENSES, but it seems
>> reasonable if you wanted to note at the bottom of LICENSE that third-party
>> licenses are documented there. We definitely need a NOTICE file that has
>> the legally required notices that we must provide.
>>
>> Ryan
>>
>> On Wed, Sep 16, 2026 at 8:36 AM Jones, Danny <dj...@amazon.co.uk>
>> wrote:
>>
>>> Hey iceberg-rust/pyiceberg-core folks,
>>>
>>>
>>>
>>> As I was reviewing the notices/license files we include in our releases,
>>> I noticed that for pyiceberg-core[1] we are distributing compiled
>>> dependencies and do not reproduce the copyright notices for dependencies in
>>> the wheels (Python archives containing the compiled code). I believe this
>>> is an issue that must be addressed before new releases of pyiceberg-core
>>> and more broadly iceberg-rust go out since they’re released together.
>>>
>>>
>>>
>>> Please do correct me if I’m misinterpreting this. I’ve opened a GitHub
>>> issue that documents how to identify the missing file in the distributed
>>> artifacts, and a proposed mitigation of including a THIRD-PARTY-LICENSES
>>> file in the wheels at build time.
>>> https://github.com/apache/iceberg-rust/issues/3239
>>>
>>>
>>>
>>> Once we have a solution, I’d like to verify it meets the obligations via
>>> the legal-discuss@ mailing list[1]. If there’s any other step we need
>>> to take, please point me in the right direction.
>>>
>>>
>>>
>>> Thanks all,
>>>
>>> Danny
>>>
>>>
>>>
>>> [1]: https://pypi.org/project/pyiceberg-core/
>>>
>>> [2]: https://lists.apache.org/list.html?legal-discuss@apache.org
>>>
>>
Re: [DISCUSS] pyiceberg-core / iceberg-rust Python bindings appears not to include third-party notice files
Posted by Shawn Chang <ye...@gmail.com>.
Thanks Danny for catching this! I think this is important and we need to
fix it.
It looks like there are other apache projects already handling this nicely.
e.g.
https://github.com/apache/paimon-rust/blob/main/bindings/python/THIRD-PARTY-LICENSES.html
Their workflow:
1. Get dependency scope from bindings/python/Cargo.toml
2. Generate report per target wheel.
3. Stage the license in bundled artifacts
4. Verify the license in artifacts
I have no experience in working with legal-discuss before, but I assume we
will need their inputs after we decided how the workflow/CI/generated third
party licenses report is gonna look like in iceberg-rust.
Best,
Shawn
On Wed, Sep 16, 2026 at 10:03 AM Ryan Blue <bl...@apache.org> wrote:
> Yes, if we are distributing third-party code in our compiled artifacts,
> then we need to make sure that the LICENSE and NOTICE for those compiled
> artifacts reflects all of what we are distributing.
>
> I'm not sure about the use of THIRD-PARTY-LICENSES, but it seems
> reasonable if you wanted to note at the bottom of LICENSE that third-party
> licenses are documented there. We definitely need a NOTICE file that has
> the legally required notices that we must provide.
>
> Ryan
>
> On Wed, Sep 16, 2026 at 8:36 AM Jones, Danny <dj...@amazon.co.uk>
> wrote:
>
>> Hey iceberg-rust/pyiceberg-core folks,
>>
>>
>>
>> As I was reviewing the notices/license files we include in our releases,
>> I noticed that for pyiceberg-core[1] we are distributing compiled
>> dependencies and do not reproduce the copyright notices for dependencies in
>> the wheels (Python archives containing the compiled code). I believe this
>> is an issue that must be addressed before new releases of pyiceberg-core
>> and more broadly iceberg-rust go out since they’re released together.
>>
>>
>>
>> Please do correct me if I’m misinterpreting this. I’ve opened a GitHub
>> issue that documents how to identify the missing file in the distributed
>> artifacts, and a proposed mitigation of including a THIRD-PARTY-LICENSES
>> file in the wheels at build time.
>> https://github.com/apache/iceberg-rust/issues/3239
>>
>>
>>
>> Once we have a solution, I’d like to verify it meets the obligations via
>> the legal-discuss@ mailing list[1]. If there’s any other step we need to
>> take, please point me in the right direction.
>>
>>
>>
>> Thanks all,
>>
>> Danny
>>
>>
>>
>> [1]: https://pypi.org/project/pyiceberg-core/
>>
>> [2]: https://lists.apache.org/list.html?legal-discuss@apache.org
>>
>
Re: [DISCUSS] pyiceberg-core / iceberg-rust Python bindings appears not to include third-party notice files
Posted by Ryan Blue <bl...@apache.org>.
Yes, if we are distributing third-party code in our compiled artifacts,
then we need to make sure that the LICENSE and NOTICE for those compiled
artifacts reflects all of what we are distributing.
I'm not sure about the use of THIRD-PARTY-LICENSES, but it seems reasonable
if you wanted to note at the bottom of LICENSE that third-party licenses
are documented there. We definitely need a NOTICE file that has the legally
required notices that we must provide.
Ryan
On Wed, Sep 16, 2026 at 8:36 AM Jones, Danny <dj...@amazon.co.uk> wrote:
> Hey iceberg-rust/pyiceberg-core folks,
>
>
>
> As I was reviewing the notices/license files we include in our releases, I
> noticed that for pyiceberg-core[1] we are distributing compiled
> dependencies and do not reproduce the copyright notices for dependencies in
> the wheels (Python archives containing the compiled code). I believe this
> is an issue that must be addressed before new releases of pyiceberg-core
> and more broadly iceberg-rust go out since they’re released together.
>
>
>
> Please do correct me if I’m misinterpreting this. I’ve opened a GitHub
> issue that documents how to identify the missing file in the distributed
> artifacts, and a proposed mitigation of including a THIRD-PARTY-LICENSES
> file in the wheels at build time.
> https://github.com/apache/iceberg-rust/issues/3239
>
>
>
> Once we have a solution, I’d like to verify it meets the obligations via
> the legal-discuss@ mailing list[1]. If there’s any other step we need to
> take, please point me in the right direction.
>
>
>
> Thanks all,
>
> Danny
>
>
>
> [1]: https://pypi.org/project/pyiceberg-core/
>
> [2]: https://lists.apache.org/list.html?legal-discuss@apache.org
>