← All tasks
pythonCycloneDX/cyclonedx-python-lib #743Not a task: already works

[LEGAL] get rid of (optional/transitive) dependencies licensed under GPL

envgap__CycloneDX__cyclonedx-python-lib-743

Original GitHub issue ↗Dated source checkout ↗Opened 2024-11-20

01 / FAILURE SIGNATURE

As reported upstream

No identifying execution failure has been captured.
Not a benchmark task.
  • The project already builds and runs before the fix, so there is nothing to repair.

02 / ENVIRONMENT RECIPE

Base commit
ea0a3d5a3ca312db0a3db9f317ea294412aad204
Manifest
pyproject.toml
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

CycloneDX/cyclonedx-python-lib #743 · read the original issue
there may be use-cases where people want to re-distribute this library with all its dependencies.

some (optional/transitive) dependencies might be licensed under GPL, which prevents an assembled re-distribution. 
see 
- https://github.com/CycloneDX/cyclonedx-python-lib/issues/568
- https://github.com/CycloneDX/cyclonedx-python-lib/discussions/658


----

yes, it is not under the control of this very library, how others assemble or redistribute this library, but some community members argue otherwise - or are concerned anyway. 
Therefore, this issue exists.

if anybody wants for work on a replacement fir the currently optional dependencies, here is the list of requirements:
- all current features must be supported, still .
   the dependencies in question are optional already, replacing them with optional dependencies that dont do the required job is a no-go.
- provide (unit) tests for your change.
  some might already exist, better add additional ones

----

here is a list of all dependencies' libraries
```shellSession
$ python -m venv lib
$ lib/bin/pip install cyclonedx-python-lib[validation]
$ grep -E '^License: |^License-Expression: |^Classifier: License' lib/lib/python*/site-packages/*.dist-info/METADATA
lib/lib/python3.11/site-packages/arrow-1.3.0.dist-info/METADATA:Classifier: License :: OSI Approved :: Apache Software License
lib/lib/python3.11/site-packages/attrs-24.2.0.dist-info/METADATA:License-Expression: MIT
lib/lib/python3.11/site-packages/attrs-24.2.0.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/boolean.py-4.0.dist-info/METADATA:License: BSD-2-Clause
lib/lib/python3.11/site-packages/cyclonedx_python_lib-8.5.0.dist-info/METADATA:License: Apache-2.0
lib/lib/python3.11/site-packages/cyclonedx_python_lib-8.5.0.dist-info/METADATA:Classifier: License :: OSI Approved :: Apache Software License
lib/lib/python3.11/site-packages/defusedxml-0.7.1.dist-info/METADATA:License: PSFL
lib/lib/python3.11/site-packages/defusedxml-0.7.1.dist-info/METADATA:Classifier: License :: OSI Approved :: Python Software Foundation License
lib/lib/python3.11/site-packages/fqdn-1.5.1.dist-info/METADATA:License: MPL 2.0
lib/lib/python3.11/site-packages/fqdn-1.5.1.dist-info/METADATA:Classifier: License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0)
lib/lib/python3.11/site-packages/idna-3.10.dist-info/METADATA:Classifier: License :: OSI Approved :: BSD License
lib/lib/python3.11/site-packages/isoduration-20.11.0.dist-info/METADATA:License: UNKNOWN
lib/lib/python3.11/site-packages/isoduration-20.11.0.dist-info/METADATA:Classifier: License :: OSI Approved :: ISC License (ISCL)
lib/lib/python3.11/site-packages/jsonpointer-3.0.0.dist-info/METADATA:License: Modified BSD License
lib/lib/python3.11/site-packages/jsonpointer-3.0.0.dist-info/METADATA:Classifier: License :: OSI Approved :: BSD License
lib/lib/python3.11/site-packages/jsonschema-4.23.0.dist-info/METADATA:License: MIT
lib/lib/python3.11/site-packages/jsonschema-4.23.0.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/jsonschema_specifications-2024.10.1.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/license_expression-30.4.0.dist-info/METADATA:License: Apache-2.0
lib/lib/python3.11/site-packages/lxml-5.3.0.dist-info/METADATA:License: BSD-3-Clause
lib/lib/python3.11/site-packages/lxml-5.3.0.dist-info/METADATA:Classifier: License :: OSI Approved :: BSD License
lib/lib/python3.11/site-packages/packageurl_python-0.16.0.dist-info/METADATA:License: MIT
lib/lib/python3.11/site-packages/packageurl_python-0.16.0.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/packageurl_python-0.16.0.dist-info/METADATA:License: MIT
lib/lib/python3.11/site-packages/pip-23.0.1.dist-info/METADATA:License: MIT
lib/lib/python3.11/site-packages/pip-23.0.1.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/py_serializable-1.1.2.dist-info/METADATA:License: Apache-2.0
lib/lib/python3.11/site-packages/py_serializable-1.1.2.dist-info/METADATA:Classifier: License :: OSI Approved :: Apache Software License
lib/lib/python3.11/site-packages/python_dateutil-2.9.0.post0.dist-info/METADATA:License: Dual License
lib/lib/python3.11/site-packages/python_dateutil-2.9.0.post0.dist-info/METADATA:Classifier: License :: OSI Approved :: BSD License
lib/lib/python3.11/site-packages/python_dateutil-2.9.0.post0.dist-info/METADATA:Classifier: License :: OSI Approved :: Apache Software License
lib/lib/python3.11/site-packages/referencing-0.35.1.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/rfc3339_validator-0.1.4.dist-info/METADATA:License: MIT license
lib/lib/python3.11/site-packages/rfc3339_validator-0.1.4.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/rfc3987-1.3.8.dist-info/METADATA:License: GNU GPLv3+
lib/lib/python3.11/site-packages/rfc3987-1.3.8.dist-info/METADATA:Classifier: License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
lib/lib/python3.11/site-packages/rpds_py-0.21.0.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/setuptools-66.1.1.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/six-1.16.0.dist-info/METADATA:License: MIT
lib/lib/python3.11/site-packages/six-1.16.0.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/sortedcontainers-2.4.0.dist-info/METADATA:License: Apache 2.0
lib/lib/python3.11/site-packages/sortedcontainers-2.4.0.dist-info/METADATA:Classifier: License :: OSI Approved :: Apache Software License
lib/lib/python3.11/site-packages/types_python_dateutil-2.9.0.20241003.dist-info/METADATA:License: Apache-2.0
lib/lib/python3.11/site-packages/types_python_dateutil-2.9.0.20241003.dist-info/METADATA:Classifier: License :: OSI Approved :: Apache Software License
lib/lib/python3.11/site-packages/uri_template-1.3.0.dist-info/METADATA:License: MIT License
lib/lib/python3.11/site-packages/uri_template-1.3.0.dist-info/METADATA:Classifier: License :: OSI Approved :: MIT License
lib/lib/python3.11/site-packages/webcolors-24.11.1.dist-info/METADATA:License: BSD-3-Clause
lib/lib/python3.11/site-packages/webcolors-24.11.1.dist-info/METADATA:Classifier: License :: OSI Approved :: BSD License
```

##  affected dependencies:
- `rfc3987` -  <https://pypi.org/project/rfc3987/>
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]