[Packaging] Confirm and complete pre-existing source-package license files in 18 module repositories #53

New Issue

2026-09-08T02:23:55+02:00

zemion commented

2026-09-08 02:23:55 +02:00

Follow-up scope

Follow-up to release preparation #51, identified during actual npm source-package verification on 2026-09-08. This is a bounded licensing/provenance documentation task, not a proposal to change the product license.

Among the 25 repaired Git-root WebUI package facades, these 18 repositories have no root LICENSE, LICENCE, COPYING, or equivalent root license text. Their actual npm archives therefore contain no repository license file. The facade files allowlist includes LICENSE, but an allowlist entry cannot supply a missing file. The other seven repaired facades contain their existing license file.

Exact observed inventory

Repository	Selected source version	Existing Python declaration in `pyproject.toml`
`govoplan-connectors`	`0.1.26`	`AGPL-3.0-or-later` (`project.license`)
`govoplan-datasources`	`0.1.25`	`AGPL-3.0-or-later` (`project.license`)
`govoplan-dist-lists`	`0.1.21`	Not declared in inspected package metadata
`govoplan-encryption`	`0.1.20`	`AGPL-3.0-or-later` (`project.license`)
`govoplan-forms`	`0.1.23`	Not declared in inspected package metadata
`govoplan-identity-trust`	`0.1.21`	`AGPL-3.0-or-later` (`project.license`)
`govoplan-identity`	`0.1.21`	Not declared in inspected package metadata
`govoplan-notifications`	`0.1.20`	Not declared in inspected package metadata
`govoplan-payments`	`0.1.22`	Not declared in inspected package metadata
`govoplan-portal`	`0.1.22`	Not declared in inspected package metadata
`govoplan-postbox`	`0.1.23`	`AGPL-3.0-or-later` (`project.license`)
`govoplan-quick-access`	`0.1.21`	Not declared in inspected package metadata
`govoplan-reporting`	`0.1.21`	`AGPL-3.0-or-later` (`project.license.text`)
`govoplan-tasks`	`0.1.23`	Not declared in inspected package metadata
`govoplan-templates`	`0.1.22`	Not declared in inspected package metadata
`govoplan-views`	`0.1.22`	`AGPL-3.0-or-later` (`project.license`)
`govoplan-voting`	`0.1.21`	Not declared in inspected package metadata
`govoplan-workflow`	`0.1.23`	`AGPL-3.0-or-later` (`project.license`)

All 18 have no license field in either the owning webui/package.json or the Git-root package.json; no license classifier was present in the inspected pyproject.toml files. Reporting uses the existing TOML table form; the other seven declared licenses use a string. Thus eight repositories already declare AGPL-3.0-or-later in Python metadata, while ten have no declaration in these inspected package fields. This does not establish that no other licensing evidence exists.

The gaps and existing Python declarations were checked against the parents of the facade commits: all predate this packaging repair. The facades mirrored existing WebUI metadata and did not add, remove, or reinterpret license terms. No license file or replacement copyright attribution has been invented.

Maintainer decision required

The user/maintainer must confirm the intended license and authoritative provenance where absent before any license text or new declaration is added. For repositories with an existing declaration, confirm the authoritative corresponding license text and any required copyright/notice attribution; do not infer ownership or invent notices from repository names. Preserve optional module ownership and account for third-party notices separately.

This issue records a packaging/provenance gap. It does not assert legal clearance, non-compliance, or an automatic release blocker. Whether this affects a particular distribution or release requires the maintainer's explicit policy/licensing decision; no such decision is substituted by this audit.

Acceptance criteria

Record the maintainer-approved licensing disposition for each of the 18 repositories, including the ten without a declaration in the inspected package metadata.
Add only approved authoritative license/notice files and align Python, owning WebUI, and Git-root facade metadata without changing terms implicitly.
Verify actual npm source tarballs and applicable Python source/wheel artifacts include the intended license/notice material, not merely a files allowlist entry.
Add a workspace packaging check for the agreed documentation/metadata policy; any blocking release policy must be explicitly agreed rather than inferred from this issue.
Update owning source-package documentation and record the affected release versions after implementation. Do not move or rewrite immutable release tags.

Evidence and limits

Actual source-package verification: 25 npm tarballs, including export/CSS entry paths and webui/src/module.ts; 18 missing root-license cases listed above. Local evidence is /home/zemion/.cache/govoplan-facade-pack.HVrc1GxC/verification.json, alongside the per-package tarballs and their checksums. This issue is not an exhaustive workspace or dependency-license audit and does not expand the existing license design.

Duplicate check: all 52 existing open/closed Meta issue records were inspected before creation; the two license-related matches concerned unrelated domain stories, not source-package license files.

## Follow-up scope Follow-up to [release preparation #51](https://git.add-ideas.de/GovOPlaN/govoplan/issues/51), identified during actual npm source-package verification on 2026-09-08. This is a bounded licensing/provenance documentation task, not a proposal to change the product license. Among the 25 repaired Git-root WebUI package facades, these 18 repositories have no root `LICENSE`, `LICENCE`, `COPYING`, or equivalent root license text. Their actual npm archives therefore contain no repository license file. The facade `files` allowlist includes `LICENSE`, but an allowlist entry cannot supply a missing file. The other seven repaired facades contain their existing license file. ## Exact observed inventory | Repository | Selected source version | Existing Python declaration in `pyproject.toml` | | --- | --- | --- | | `govoplan-connectors` | `0.1.26` | `AGPL-3.0-or-later` (`project.license`) | | `govoplan-datasources` | `0.1.25` | `AGPL-3.0-or-later` (`project.license`) | | `govoplan-dist-lists` | `0.1.21` | Not declared in inspected package metadata | | `govoplan-encryption` | `0.1.20` | `AGPL-3.0-or-later` (`project.license`) | | `govoplan-forms` | `0.1.23` | Not declared in inspected package metadata | | `govoplan-identity-trust` | `0.1.21` | `AGPL-3.0-or-later` (`project.license`) | | `govoplan-identity` | `0.1.21` | Not declared in inspected package metadata | | `govoplan-notifications` | `0.1.20` | Not declared in inspected package metadata | | `govoplan-payments` | `0.1.22` | Not declared in inspected package metadata | | `govoplan-portal` | `0.1.22` | Not declared in inspected package metadata | | `govoplan-postbox` | `0.1.23` | `AGPL-3.0-or-later` (`project.license`) | | `govoplan-quick-access` | `0.1.21` | Not declared in inspected package metadata | | `govoplan-reporting` | `0.1.21` | `AGPL-3.0-or-later` (`project.license.text`) | | `govoplan-tasks` | `0.1.23` | Not declared in inspected package metadata | | `govoplan-templates` | `0.1.22` | Not declared in inspected package metadata | | `govoplan-views` | `0.1.22` | `AGPL-3.0-or-later` (`project.license`) | | `govoplan-voting` | `0.1.21` | Not declared in inspected package metadata | | `govoplan-workflow` | `0.1.23` | `AGPL-3.0-or-later` (`project.license`) | All 18 have no `license` field in either the owning `webui/package.json` or the Git-root `package.json`; no license classifier was present in the inspected `pyproject.toml` files. Reporting uses the existing TOML table form; the other seven declared licenses use a string. Thus eight repositories already declare `AGPL-3.0-or-later` in Python metadata, while ten have no declaration in these inspected package fields. This does not establish that no other licensing evidence exists. The gaps and existing Python declarations were checked against the parents of the facade commits: all predate this packaging repair. The facades mirrored existing WebUI metadata and did not add, remove, or reinterpret license terms. No license file or replacement copyright attribution has been invented. ## Maintainer decision required The user/maintainer must confirm the intended license and authoritative provenance where absent before any license text or new declaration is added. For repositories with an existing declaration, confirm the authoritative corresponding license text and any required copyright/notice attribution; do not infer ownership or invent notices from repository names. Preserve optional module ownership and account for third-party notices separately. This issue records a packaging/provenance gap. It does **not** assert legal clearance, non-compliance, or an automatic release blocker. Whether this affects a particular distribution or release requires the maintainer's explicit policy/licensing decision; no such decision is substituted by this audit. ## Acceptance criteria - [ ] Record the maintainer-approved licensing disposition for each of the 18 repositories, including the ten without a declaration in the inspected package metadata. - [ ] Add only approved authoritative license/notice files and align Python, owning WebUI, and Git-root facade metadata without changing terms implicitly. - [ ] Verify actual npm source tarballs and applicable Python source/wheel artifacts include the intended license/notice material, not merely a `files` allowlist entry. - [ ] Add a workspace packaging check for the agreed documentation/metadata policy; any blocking release policy must be explicitly agreed rather than inferred from this issue. - [ ] Update owning source-package documentation and record the affected release versions after implementation. Do not move or rewrite immutable release tags. ## Evidence and limits Actual source-package verification: 25 npm tarballs, including export/CSS entry paths and `webui/src/module.ts`; 18 missing root-license cases listed above. Local evidence is `/home/zemion/.cache/govoplan-facade-pack.HVrc1GxC/verification.json`, alongside the per-package tarballs and their checksums. This issue is not an exhaustive workspace or dependency-license audit and does not expand the existing license design. Duplicate check: all 52 existing open/closed Meta issue records were inspected before creation; the two license-related matches concerned unrelated domain stories, not source-package license files.

zemion added the area/release label 2026-09-08 02:23:55 +02:00

zemion referenced this issue

2026-09-08 03:12:03 +02:00

[Release] Publish accumulated usability and security hardening — September 2026 #51

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#53