Skip to content

[BUG] License-Files entries are not checked for UTF-8 compliance, they just get copied directly into the licenses folder #4936

Open
@schlenk

Description

@schlenk

setuptools version

78.1.0

Python version

3.11

OS

Windows

Additional environment information

No response

Description

Using a pyproject.toml like this:

[build-system]
requires = ["setuptools >= 78.1.0"]
build-backend = "setuptools.build_meta"

[project]
name = "repro"
version = "0.1"
license-files = ["BadLicense.*"]

Now I have two files BadLicense.doc and BadLicense.pdf in my project directory.

Setuptools copies both files into the dist-info/licenses directory, without warning or error.

This also happens, if a pyproject.toml has no 'license-files' declared and the default regexp patterns are applied, so you might even end up to include 'license.py', 'license.exe' or similar files that are clearly not text files.

Expected behavior

This should result in an error.

PEP639 clearly states, that the license files MUST be UTF-8 encoded. This is obviously not the case for a binary Word doc file and probably not for a PDF. So i would expect setuptools validate this and to raise an Exception if it is not a valid UTF-8 encoded text file.

Tools MUST assume that license file content is valid UTF-8 encoded text, and SHOULD validate this and raise an error if it is not.

How to Reproduce

  1. mkdir repro
  2. Unpack pyproject.zip into the folder
  3. cd repro
  4. python -m venv .venv
  5. ./venv/Scripts/pip install -e .
  6. dir ..venv\Lib\site-packages\repro-0.1.dist-info\licenses\

pyproject.zip

Output

PS C:\repro> dir .\.venv\Lib\site-packages\repro-0.1.dist-info\licenses\

    Directory: C:\repro\.venv\Lib\site-packages\repro-0.1.dist-info\licenses

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a---          03.04.2025    15:33          29184 BadLicense.doc
-a---          03.04.2025    15:33          30930 BadLicense.pdf

Metadata

Metadata

Assignees

No one assigned

    Labels

    Needs TriageIssues that need to be evaluated for severity and status.bug

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions