Skip to content

Conversation

@Avasam
Copy link
Collaborator

@Avasam Avasam commented Apr 29, 2025

Closes #1127

Considerations for a SPDX license expression for the distribution (PEP 639 – Improving License Clarity with Better Package Metadata) or SBOM (PEP 770 – Improving measurability of Python packages with Software Bill-of-Materials) are left as a different topic of discussion.

@@ -0,0 +1,246 @@
A. HISTORY OF THE SOFTWARE
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -0,0 +1,41 @@

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Avasam Avasam marked this pull request as ready for review April 29, 2025 23:37
@Avasam Avasam requested a review from mhammond April 29, 2025 23:37
@Avasam Avasam changed the title Add missing licenses Add missing license files Oct 7, 2025
("pythonwin", (str(scintilla_licence_path),)),
("win32comext/mapi", (str(mapi_stubs_licence_path),)),
("win32com", ("com/License.txt",)),
("win32comext", ("com/License.txt",)),
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i don't quite get the first arg here and why it's not specified below (or why win32com already did that :) But why is this even needed given the files added up above?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First element of the tuple is arg is the destination package (and its submodules if the path contains a /), second element is an iterable of sources

It's needed because win32com and win32comext end up as their own top-level packages, but License.txt is not found in either sources (would be com/win32com/License.txt and com/win32comext/License.txt) simply because it would be redundant (given that then entire com folder currently shares the same license information).

Hopefully this image helps visualize what I'm saying:
image

win32/License.txt doesn't need this treatment because their source and packaged locations match.


Sidenote: Using the same technique, win32/License.txt and com/License.txt could be deduplicated in source and moved to the root of the repository. But that may make things more confusing with the PSF SPDX identifier in the project root metadata and mentioned in the readme. My goal isn't to update any of that in this PR, just to add missing license information that should already apply to specific places.


This distributed package contains components under multiple licenses:

- `mapi.pyd` is licensed under the MIT License. See [com/win32comext/mapi/src/MAPIStubLibrary/LICENSE](https://github.com/mhammond/pywin32/blob/main/com/win32comext/mapi/src/MAPIStubLibrary/LICENSE) for details.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see why that license compels mapi.pyd?

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It takes some digging to find it but this matches my own analysis: Per the readme, mapi.pyd is built from headers downloaded from this Microsoft repo which is MIT-licensed.

Copy link
Collaborator Author

@Avasam Avasam Oct 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's more than just headers, I believe there's actual vendored code that gets compiled (I could be wrong), mapiStubLibrary.cpp and stubutils.cpp are declared as sources in setup.py. (I don't see it being used anywhere. Do we simply just re-expose the library code ?)

pywin32/setup.py

Lines 1429 to 1446 in e319b77

{mapi}/MAPIStubLibrary/library/mapiStubLibrary.cpp
{mapi}/MAPIStubLibrary/library/stubutils.cpp
""".format(**dirs)
).split(),
),
WinExt_win32com_mapi(
"exchange",
libraries="advapi32 legacy_stdio_definitions",
include_dirs=["{mapi}/MapiStubLibrary/include".format(**dirs)],
sources=(
"""
{mapi}/exchange.i {mapi}/exchange.cpp
{mapi}/PyIExchangeManageStore.i {mapi}/PyIExchangeManageStore.cpp
{mapi}/PyIExchangeManageStoreEx.i {mapi}/PyIExchangeManageStoreEx.cpp
{mapi}/mapiutil.cpp
{mapi}/exchangeguids.cpp
{mapi}/MAPIStubLibrary/library/mapiStubLibrary.cpp
{mapi}/MAPIStubLibrary/library/stubutils.cpp

If accurate, mapi.pyd and exchange.pyd are shipped containing MIT-licensed code.
If it was just the headers, then this wouldn't apply.

It would be more accurate to say that it contains MIT-licensed code. I've updated this.

@Avasam Avasam requested a review from mhammond October 11, 2025 02:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing license

3 participants