Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Published wheel declares both BSD and proprietary classifiers, and ships no license file

オープン 初心者向け
  • 何か問題がありますか？
#2,131 コメント 0 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@estellesoulard がすでに取り組んでいます。

2026年9月21日 から。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
68/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
python
領域
build-system

調査の方向性

pyproject.toml から始めて、パッケージのメタデータと wheel のビルド設定を確認します。proprietary classifier が意図したものかどうかを確認し、その後 wheel をビルドして、その METADATA と dist-info の内容を調べます。公開されるメタデータで一貫して Apache-2.0 が示され、wheel に LICENSE ファイルが含まれていれば完了です。

索引モデルが issue の本文から書いたものです。

説明

bug

The published scaleway wheel declares two mutually exclusive license classifiers and ships no license file. Automated license review therefore resolves it to a proprietary license and blocks the dependency, even though this repository is Apache-2.0.

Measured, on 2026-09-03

The repository:

$ gh api repos/scaleway/scaleway-sdk-python
  default_branch: main
  license.spdx_id: Apache-2.0
  LICENSE at the root: 10756 bytes

The published package, every version from 2.9.0 to the current 2.12.0:

$ python -c "from importlib.metadata import metadata; ..."
  License          : 'BSD'
  license_expression: None
  classifier       : License :: OSI Approved :: BSD License
  classifier       : License :: Other/Proprietary License

And the installed distribution ships no license text at all:

$ ls .venv/lib/python3.12/site-packages/scaleway-2.11.0.dist-info
  INSTALLER  METADATA  RECORD  REQUESTED  WHEEL

So three sources disagree: the repository says Apache-2.0, the metadata says BSD, and a second classifier says proprietary. A tool has no way to prefer one.

What it costs a consumer

GitHub's dependency-review-action resolves the pair of classifiers to:

BSD-2-Clause AND BSD-3-Clause AND LicenseRef-scancode-proprietary-license

and fails the check:

The following dependencies have incompatible licenses:
  meta/ee-requirements.txt » scaleway@>= 2.9.0
  – License: BSD-2-Clause AND BSD-3-Clause AND LicenseRef-scancode-proprietary-license

AND is the operative word: the resolved expression requires satisfying the proprietary term too, so no allow-list of open licenses can accept it. The only ways out are to exempt the package by name — which accepts an unknown license on trust — or to drop the SDK.

I am building an Ansible collection that uses this SDK as its runtime client, exactly as the official scaleway.scaleway collection does. I would rather not ship an exemption that says "we assume this is fine".

What would fix it

Any one of these, in decreasing order of how much it settles:

  1. license = "Apache-2.0" as a PEP 639 SPDX expression in pyproject.toml, plus license-files = ["LICENSE"] so the wheel carries the text. This makes the package self-describing and needs no classifier at all.
  2. Remove the License :: Other/Proprietary License classifier and correct License :: OSI Approved :: BSD License to License :: OSI Approved :: Apache Software License.
  3. At minimum, include LICENSE in the distribution, so a scanner reading the file wins over ambiguous classifiers.

I am happy to open a pull request for (1) if that is welcome — it is a few lines in pyproject.toml.

One question I could not answer from the outside

Is the Other/Proprietary License classifier deliberate? If some part of the generated code carries different terms from the repository's Apache-2.0, that would be worth stating explicitly rather than leaving to a classifier — consumers who audit licenses will read it as covering the whole package.

主要言語
Python
スター
37
フォーク
17
平均マージ
1日 15時間
マージ済み PR（30日）
72

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

scaleway/scaleway-sdk-python のほかの issue

scaleway/scaleway-sdk-python の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。