Hey all, closing the loop here. It took a bit longer than expected but we’ve addressed this in iceberg-rust/pyiceberg-core and we’re moving forward with 0.11.0 RC3 for Iceberg Rust. Kudos to all those who helped move this forward, both here on the mailing list and through code review (Kevin, Renjie, Shawn, Xander, Oleks, Andrei).
* All the standard Rust crates only distribute Iceberg Rust source code, so they’re fine with their original NOTICE and LICENSE files. * The pyiceberg-core wheels (compiled archives as a Python package) now distribute an updated NOTICE and LICENSE file, which append all dependencies NOTICE and LICENSE files respectively to those originally distributed with the source only release. Danny From: Kevin Liu <[email protected]> Reply to: "[email protected]" <[email protected]> Date: Thursday, 17 September 2026 at 18:53 To: "[email protected]" <[email protected]> Subject: RE: [EXTERNAL] [DISCUSS] pyiceberg-core / iceberg-rust Python bindings appears not to include third-party notice files CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. Thanks for finding this. I think this was an oversight when we created the Python binding, and we should fix it before publishing pyiceberg-core again. The iceberg-rust release only contains source code and doesn’t bundle its dependencies, so we haven’t needed to list them in LICENSE and NOTICE. The pyiceberg-core wheels are different because they compile the Rust dependencies into the Python extension, so those wheels need to include the relevant third-party licenses and notices. Let’s figure out which libraries are bundled in the wheels first, and then add the appropriate entries to LICENSE and NOTICE. We have a repo-wide cargo deny check that prevents us from using and distributing libraries with licenses that are incompatible with ASF policy, so we don’t need to worry about that part. The issue here is making sure the required license texts and notices are included in the wheels. Happy to help resolve this On Wed, Sep 16, 2026 at 5:35 PM Shawn Chang <[email protected]<mailto:[email protected]>> wrote: Thanks Danny for catching this! I think this is important and we need to fix it. It looks like there are other apache projects already handling this nicely. e.g. https://github.com/apache/paimon-rust/blob/main/bindings/python/THIRD-PARTY-LICENSES.html Their workflow: 1. Get dependency scope from bindings/python/Cargo.toml 2. Generate report per target wheel. 3. Stage the license in bundled artifacts 4. Verify the license in artifacts I have no experience in working with legal-discuss before, but I assume we will need their inputs after we decided how the workflow/CI/generated third party licenses report is gonna look like in iceberg-rust. Best, Shawn On Wed, Sep 16, 2026 at 10:03 AM Ryan Blue <[email protected]<mailto:[email protected]>> wrote: Yes, if we are distributing third-party code in our compiled artifacts, then we need to make sure that the LICENSE and NOTICE for those compiled artifacts reflects all of what we are distributing. I'm not sure about the use of THIRD-PARTY-LICENSES, but it seems reasonable if you wanted to note at the bottom of LICENSE that third-party licenses are documented there. We definitely need a NOTICE file that has the legally required notices that we must provide. Ryan On Wed, Sep 16, 2026 at 8:36 AM Jones, Danny <[email protected]<mailto:[email protected]>> wrote: Hey iceberg-rust/pyiceberg-core folks, As I was reviewing the notices/license files we include in our releases, I noticed that for pyiceberg-core[1] we are distributing compiled dependencies and do not reproduce the copyright notices for dependencies in the wheels (Python archives containing the compiled code). I believe this is an issue that must be addressed before new releases of pyiceberg-core and more broadly iceberg-rust go out since they’re released together. Please do correct me if I’m misinterpreting this. I’ve opened a GitHub issue that documents how to identify the missing file in the distributed artifacts, and a proposed mitigation of including a THIRD-PARTY-LICENSES file in the wheels at build time. https://github.com/apache/iceberg-rust/issues/3239 Once we have a solution, I’d like to verify it meets the obligations via the legal-discuss@ mailing list[1]. If there’s any other step we need to take, please point me in the right direction. Thanks all, Danny [1]: https://pypi.org/project/pyiceberg-core/ [2]: https://lists.apache.org/[email protected]
