Skip to content

License metadata is inconsistent: package declares AGPL-3.0, GPL-3.0, and MIT in different places #68

Description

@vauppaluru-ctrl

Summary

PyJHora 4.5.5 declares three different licenses across its packaging metadata and source headers. The published PyPI package carries an OSI Approved :: MIT License classifier while shipping the full AGPL-3.0 license text, so tooling and users get contradictory answers depending on where they look.

I don't think this reflects an intentional dual-licensing arrangement — it looks like drift between setup.py, _package_info.py, and the built metadata. Flagging it because it's the kind of thing that quietly misleads downstream users.

Evidence

Installed from PyPI with pip install PyJHora==4.5.5 (Python 3.12):

Location Declares
dist-info/licenses/LICENSE full AGPL-3.0 text
METADATA line 6 License: GNU AFFERO GENERAL PUBLIC LICENSE
setup.py lines 13–23 (header) GNU Affero General Public License
METADATA line 672 Classifier: License :: OSI Approved :: MIT License
_package_info.py line 47 "License :: OSI Approved :: GNU General Public License v3 (GPLv3)"
_package_info.py lines 6–16 (header) GNU General Public License (not Affero)

GitHub's own repo detection reports AGPL-3.0, which agrees with the LICENSE file and disagrees with the PyPI classifier.

Reproduction

pip download PyJHora==4.5.5 --no-deps
# unpack the wheel, then:
grep -n "License" pyjhora-4.5.5.dist-info/METADATA | head
grep -n "License ::" jhora/_package_info.py
head -5 pyjhora-4.5.5.dist-info/licenses/LICENSE

Or against an existing install:

python -c "import importlib.metadata as m; d=m.metadata('PyJHora'); print(d['License']); print([c for c in d.get_all('Classifier') if 'License' in c])"

Why this matters

The three licenses imply materially different obligations for anyone building on the package:

  • MIT — permissive; closed-source commercial use is fine.
  • GPL-3.0 — copyleft on distribution. Shipping an application requires source disclosure, but network/server use does not.
  • AGPL-3.0 — copyleft on distribution and network interaction (§13). Hosting PyJHora behind an API also triggers source disclosure.

The GPL vs. AGPL distinction in particular decides whether server-side hosting carries obligations, so users can't resolve this by picking the most conservative reading and moving on — they need to know which one you intended.

Worth noting: pyswisseph is itself AGPL-3.0, so the MIT classifier could lead someone to believe they have more freedom than the dependency chain actually permits.

Suggested fix

If AGPL-3.0 is the intent (which the LICENSE file, setup.py header, and METADATA License: field all agree on):

  1. In _package_info.py, change the classifier on line 47 to
    "License :: OSI Approved :: GNU Affero General Public License v3"
  2. In _package_info.py, update the lines 6–16 header to say Affero General Public License, matching setup.py
  3. Track down the source of the MIT classifier in the built metadata (likely a pyproject.toml / setup.cfg license entry overriding _package_info.classifiers) and correct it
  4. Consider the PEP 639 form — License-Expression: AGPL-3.0-only — which replaces the free-text field and classifiers with a single unambiguous declaration

Happy to open a PR for items 1–2 if that's useful.

Thanks for the library — the coverage of divisional charts, ashtakavarga, and the dasha systems in one package is genuinely impressive, and the fidelity to PVR Narasimha Rao's treatment shows.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions