Thanks for finding this. I think this was an oversight when we created the Python binding, and we should fix it before publishing pyiceberg-core again.
The iceberg-rust release only contains source code and doesn’t bundle its dependencies, so we haven’t needed to list them in LICENSE and NOTICE. The pyiceberg-core wheels are different because they compile the Rust dependencies into the Python extension, so those wheels need to include the relevant third-party licenses and notices. Let’s figure out which libraries are bundled in the wheels first, and then add the appropriate entries to LICENSE and NOTICE. We have a repo-wide cargo deny check that prevents us from using and distributing libraries with licenses that are incompatible with ASF policy, so we don’t need to worry about that part. The issue here is making sure the required license texts and notices are included in the wheels. Happy to help resolve this On Wed, Sep 16, 2026 at 5:35 PM Shawn Chang <[email protected]> wrote: > Thanks Danny for catching this! I think this is important and we need to > fix it. > > It looks like there are other apache projects already handling this > nicely. e.g. > https://github.com/apache/paimon-rust/blob/main/bindings/python/THIRD-PARTY-LICENSES.html > Their workflow: > 1. Get dependency scope from bindings/python/Cargo.toml > 2. Generate report per target wheel. > 3. Stage the license in bundled artifacts > 4. Verify the license in artifacts > > I have no experience in working with legal-discuss before, but I assume we > will need their inputs after we decided how the workflow/CI/generated third > party licenses report is gonna look like in iceberg-rust. > > Best, > Shawn > > > On Wed, Sep 16, 2026 at 10:03 AM Ryan Blue <[email protected]> wrote: > >> Yes, if we are distributing third-party code in our compiled artifacts, >> then we need to make sure that the LICENSE and NOTICE for those compiled >> artifacts reflects all of what we are distributing. >> >> I'm not sure about the use of THIRD-PARTY-LICENSES, but it seems >> reasonable if you wanted to note at the bottom of LICENSE that third-party >> licenses are documented there. We definitely need a NOTICE file that has >> the legally required notices that we must provide. >> >> Ryan >> >> On Wed, Sep 16, 2026 at 8:36 AM Jones, Danny <[email protected]> >> wrote: >> >>> Hey iceberg-rust/pyiceberg-core folks, >>> >>> >>> >>> As I was reviewing the notices/license files we include in our releases, >>> I noticed that for pyiceberg-core[1] we are distributing compiled >>> dependencies and do not reproduce the copyright notices for dependencies in >>> the wheels (Python archives containing the compiled code). I believe this >>> is an issue that must be addressed before new releases of pyiceberg-core >>> and more broadly iceberg-rust go out since they’re released together. >>> >>> >>> >>> Please do correct me if I’m misinterpreting this. I’ve opened a GitHub >>> issue that documents how to identify the missing file in the distributed >>> artifacts, and a proposed mitigation of including a THIRD-PARTY-LICENSES >>> file in the wheels at build time. >>> https://github.com/apache/iceberg-rust/issues/3239 >>> >>> >>> >>> Once we have a solution, I’d like to verify it meets the obligations via >>> the legal-discuss@ mailing list[1]. If there’s any other step we need >>> to take, please point me in the right direction. >>> >>> >>> >>> Thanks all, >>> >>> Danny >>> >>> >>> >>> [1]: https://pypi.org/project/pyiceberg-core/ >>> >>> [2]: https://lists.apache.org/[email protected] >>> >>
