Thanks Danny for catching this! I think this is important and we need to fix it.
It looks like there are other apache projects already handling this nicely. e.g. https://github.com/apache/paimon-rust/blob/main/bindings/python/THIRD-PARTY-LICENSES.html Their workflow: 1. Get dependency scope from bindings/python/Cargo.toml 2. Generate report per target wheel. 3. Stage the license in bundled artifacts 4. Verify the license in artifacts I have no experience in working with legal-discuss before, but I assume we will need their inputs after we decided how the workflow/CI/generated third party licenses report is gonna look like in iceberg-rust. Best, Shawn On Wed, Sep 16, 2026 at 10:03 AM Ryan Blue <[email protected]> wrote: > Yes, if we are distributing third-party code in our compiled artifacts, > then we need to make sure that the LICENSE and NOTICE for those compiled > artifacts reflects all of what we are distributing. > > I'm not sure about the use of THIRD-PARTY-LICENSES, but it seems > reasonable if you wanted to note at the bottom of LICENSE that third-party > licenses are documented there. We definitely need a NOTICE file that has > the legally required notices that we must provide. > > Ryan > > On Wed, Sep 16, 2026 at 8:36 AM Jones, Danny <[email protected]> > wrote: > >> Hey iceberg-rust/pyiceberg-core folks, >> >> >> >> As I was reviewing the notices/license files we include in our releases, >> I noticed that for pyiceberg-core[1] we are distributing compiled >> dependencies and do not reproduce the copyright notices for dependencies in >> the wheels (Python archives containing the compiled code). I believe this >> is an issue that must be addressed before new releases of pyiceberg-core >> and more broadly iceberg-rust go out since they’re released together. >> >> >> >> Please do correct me if I’m misinterpreting this. I’ve opened a GitHub >> issue that documents how to identify the missing file in the distributed >> artifacts, and a proposed mitigation of including a THIRD-PARTY-LICENSES >> file in the wheels at build time. >> https://github.com/apache/iceberg-rust/issues/3239 >> >> >> >> Once we have a solution, I’d like to verify it meets the obligations via >> the legal-discuss@ mailing list[1]. If there’s any other step we need to >> take, please point me in the right direction. >> >> >> >> Thanks all, >> >> Danny >> >> >> >> [1]: https://pypi.org/project/pyiceberg-core/ >> >> [2]: https://lists.apache.org/[email protected] >> >
