search

astral-sh / uv

An extremely fast Python package and project manager, written in Rust.
https://docs.astral.sh/uv
Apache License 2.0
25.74k stars 750 forks source link

AGPL License file in Source Distributes Confused License Scanners ... #7566

Closed rlgloden closed 1 month ago

rlgloden commented 1 month ago

Sorry to bother for such a stupid problem but corporate scanners are flagging the AGPL license in the uv-0.4.13\ecosystem\pretix\license file in the uv source code zip ... which we have to scan before using the executable ... even if we use pip to install it.

I can't tell if pretix package is currently even used in tests yet but its existence in the source code zip is causing issues convincing our decision makers that uv isn't really AGPL and the pretix is only being used for test purposes.

charliermarsh commented 1 month ago

We can just remove it. I'll replace it with something that isn't AGPL.

charliermarsh commented 1 month ago

(It's just an example project that we resolve during the test suite.)

rlgloden commented 1 month ago

Again ... sorry for such a silly bother!!!

musicinmybrain commented 1 month ago

This was actually really helpful for me in the Fedora package, as pretix has additional custom/nonstandard terms (“exceptions”) on top of the AGPL. Even though plain AGPL-3.0-only code is acceptable in Fedora, I was having to use a modified source archive with the contents of ecosystem/pretix/ removed while waiting for legal review of pretix’s idiosyncratic extra terms. Since saleor is just BSD-3-Clause, I can now go back to distributing the unmodified uv source archives in the source RPMs.