You should talk to PyPI's developers about implementing this as a warning (not as a refusal to download packages). You might also want to check for different classes of licenses.

But there are some parts of your script that don't make sense:

1. "version = info.keys()[0]": What "info.keys()[0]" points to is undefined. "info" is a dictionary, and dictionaries are unordered. If you're trying to find the most recent version, you need to convert the keys to a list and sort it appropriately. As it is, you're just grabbing an arbitrary version.

2. You're only looking at the "License" field, which I don't tend to use because the license I'm using is a trove classifier.

3. Your script completely ignores the license field, because it always overwrites it with "gpl version 3". So it's always going to detect any package as free.

4. Your list of "free licenses" includes things that are not licenses at all, like "general public", and licenses which may or may not be libre, like "artistic". Since any arbitrary text can be typed in the license field, you ought to be very strict with what strings you accept. The warning can then display this license so that the user can personally check it.

By the way, while you should use trove classifiers, I would highly recommend against just assuming that any package with the "OSI Approved" or "DFSG Approved" classifier is libre, partly because the OSI has approved some proprietary licenses and partly because this isn't a declaration of a license, just a statement of fact which may or may not be true.

Reply via email to