Repository navigation
Missing notices for third-party dependencies in pyiceberg-core wheels #3239
Description
Apache Iceberg Rust version
main, 0.10.1
Describe the bug
The published pyiceberg-core Python package wheels (compiled archives) do not appear to contain the copyright notices required by dependencies that are part of the distribution.
To Reproduce
Take one of the wheels listed under the package on the Python Package Index and unarchive it (they're just zips with a different extension). https://pypi.org/project/pyiceberg-core/#files
Inside, you find a few files include the project's own license and the SBOM file. But no THIRD-PARTY-LICENSES or similar.
Expected behavior
Notices for the bundled dependencies must be present in the distributed artifacts. For example, we might include a THIRD-PARTY-NOTICES files which has a copy of each dependencies license, preceded by the name of the dependency.
Willingness to contribute
I can contribute a fix for this bug independently
Activity
blackmwk commentedon Sep 17, 2026
I'm not familiar with python, do we need to include these compiled files in our distribution?
dannycjones commentedon Sep 17, 2026
Yes, I think they are required. Otherwise, we force any consumer of PyIceberg (depending on pyiceberg-core) to bring in the Rust toolchain and compile it. :(
(@kevinjqliu is that fair to say?)
dannycjones commentedon Sep 17, 2026
I had an agent draft something but I cannot give it proper scrutiny until at least next week.
If anyone wants to pick this up, please go ahead. There's a draft of some changes in the following commit, but again, I've not given it any scrutiny. 63e0699
The mailing list thread also had some discussion that should be reviewed and worked in to the change. https://lists.apache.org/thread/k72c2y72w2j00xph2mn2bnsbvcbj43o4
kevinjqliu commentedon Sep 17, 2026
I believe so for the wheels. We can distribute only source distribution (sdist) only but that would require every consumer to compile it during installation using the rust toolchain.
I think its not too difficult to track all the required dependencies that goes into the python binding and then create entries for them in the LICENSE/NOTICE files
dannycjones commentedon Sep 28, 2026
I'm working on this at the moment, hope to share something today.