search

pandas-dev / pandas

Flexible and powerful data analysis / manipulation library for Python, providing labeled data structures similar to R data.frame objects, statistical functions, and much more
https://pandas.pydata.org
BSD 3-Clause "New" or "Revised" License
43.69k stars 17.92k forks source link

BUILD: 3rd party licenses are missing from pandas binary wheels distributed on pypi #58632

Closed markdryan closed 1 month ago

markdryan commented 5 months ago

Installation check

Platform

all

Installation Method

pip install

pandas Version

2.2.2

Python Version

all

Installation Logs

The source code of the pandas project clearly identifies the licenses of the third party code that it uses. Unfortunately, these licenses, and the copyright notices they contain, don't seem to be replicated in the binary wheels the pandas project uploads to pypi, e.g., pandas-2.2.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

If we just take the first of these licenses, the BOTTLENECK license, we see the following clause.

   * Redistributions in binary form must reproduce the above copyright
      notice, this list of conditions and the following disclaimer in the
      documentation and/or other materials provided with the distribution.

As far as I can tell, this is not being done. I can't find the "above copyright", which in this case is

Copyright (c) 2010-2019 Keith Goodman
Copyright (c) 2019 Bottleneck Developers
All rights reserved.

, anywhere in the pandas-2.2.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl I downloaded from pypi.

Many of the licenses under the LICENSES folder have similar clauses which similarly do not appear to be honoured by the pandas binary wheels.

Numpy and scipy have had a similar issue in the past. They addressed this by appending an OS specific text file containing the licenses for all the bundled dependencies to the LICENSE.txt file included in their binary wheels, during the wheel build process.

Note that the third party licenses are included in the pandas source distributions so this seems only to be an issue with the binary wheels.

Finally, I wasn't sure whether to enter this under DOC or BUILD, but seeing as how any fix for this issue would presumably need to be made in the CI, I opted for BUILD.

lithomas1 commented 5 months ago

Thanks for the report.

I'm marking this for 2.2.3, since this is something that should be important to fix before the next release.