_find_and_load_licence() in pre-compile might be unsafe #50
Open
Description
Basically, what I'm thinking of is:
>>> [f for f in importlib.metadata.files("validate-pyproject") if f.stem == 'LICENSE']
[PackagePath('validate_pyproject-0.9.post1.dev3+g3b0db8c.dist-info/LICENSE.txt'),
PackagePath('validate_pyproject/_vendor/fastjsonschema/LICENSE')]i.e. both the package license file and the vendored fastjsonschema's LICENSE file matches this:
def _find_and_load_licence(files: Optional[Sequence[_M.PackagePath]]) -> str:
if files is None: # pragma: no cover
raise ImportError("Could not find LICENSE for package")
try:
return next(f for f in files if f.stem.upper() == "LICENSE").read_text("UTF-8")and I think it might be UB that the license file from dist-info is returned first.
That said, in Gentoo we remove the LICENSE* files from .dist-info since they are redundant to our license metadata, so this doesn't work correctly at all. Could you perhaps install the license file directly as part of package data, and use it similarly to how FJS's license is grabbed?
Metadata
Assignees
Labels
No labels