Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add license to PyPI classifiers #570

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

WilliamRoyNelson
Copy link

@WilliamRoyNelson WilliamRoyNelson commented Sep 6, 2024

Adds license to PyPI project classifiers

The reason that it is very important for this information to be present is that in an enterprise environment, security tools like Sonatype Nexus IQ are used to manage open source software risk. Nexus IQ specifically can be configured to classify packages according to their license. This prevents developers from inadvertently using licenses like GNU General Public License v2.0 without realizing that they may be legally obligated to make their entire project open source.

My understanding is that Nexus IQ uses the classifiers panel to determine a project's license.
Because Cohere does not currently have a classifiers panel, Nexus cannot determine the license and treats it as a high-risk package.
image

I also slightly modified the project.urls
I don't know why it doesn't currently display on PyPI, possibly the quotation marks, possibly it should be source instead of Repository The Poetry Docs suggest that repository is valid, but I don't see the link on PyPI. Maybe Repository should be lower case: repository

I used NumPy as a model:
https://github.com/numpy/numpy/blob/main/pyproject.toml#L53-L59

[project.urls]
homepage = "https://numpy.org"
documentation = "https://numpy.org/doc/"
source = "https://github.com/numpy/numpy"
download = "https://pypi.org/project/numpy/#files"
tracker = "https://github.com/numpy/numpy/issues"
"release notes" = "https://numpy.org/doc/stable/release"

image

@billytrend-cohere
Copy link
Collaborator

Thanks for providing this diff @WilliamRoyNelson and the detailed explanation: it sounds fairly critical. We can't directly merge this but @dsinghvi will track this so it can be added to the fern generators that we use!! Will defer to him for prioritisation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants