tables: ship the licences of what the wheel bundles

pyproject.toml's explicit license-files list only ever named
LICENSE.txt, so nothing else ever reached dist-info/licenses/ --
confirmed against the real PyPI wheel, which has the same gap. Extend
it to the licences of what this build actually compiles in or links
(c-blosc + its bundled LZ4/zlib/zstd, HDF5, h5py, and our own added
BZIP2.txt), not the whole upstream LICENSES/ directory: most of the
rest of it (FastLZ, Snappy, Windows-only shims, the docs theme) covers
content this build never ships, and a wildcard would misdeclare it.
Update the post-build check to assert the exact set so a future patch
that stops applying fails loudly instead of silently shipping fewer
licences.

Author: luhenry

.github/workflows/build-tables.yml

@@ -169,9 +169,18 @@ jobs:
               n.split(".dist-info/licenses/", 1)[1] for n in names
               if ".dist-info/licenses/" in n and not n.endswith("/")
           }
-          assert "LICENSE.txt" in licences, licences
-          assert "LICENSES/BZIP2.txt" in licences, licences
-          assert "LICENSES/HDF5.txt" in licences, licences
+          # Everything the wheel actually compiles in or links (patches/tables):
+          # c-blosc and its bundled LZ4/zlib/zstd, HDF5, h5py (credited in
+          # hdf5extension.pyx/array.py), and our own added BZIP2.txt. Not
+          # upstream's whole LICENSES/ dir - most of the rest (FastLZ, Snappy,
+          # Windows-only shims, the docs theme) covers content this build
+          # never ships.
+          expected_licences = {
+              "LICENSE.txt", "LICENSES/BLOSC.txt", "LICENSES/BZIP2.txt",
+              "LICENSES/H5PY.txt", "LICENSES/HDF5.txt", "LICENSES/LZ4.txt",
+              "LICENSES/ZLIB.txt", "LICENSES/ZSTD.txt",
+          }
+          assert licences == expected_licences, licences
           EOF
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1

patches/tables/3.11.1/0003-Ship-the-licences-of-what-the-wheel-actually-bundles.patch

@@ -0,0 +1,63 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Sun, 6 Sep 2026 00:00:00 +0000
+Subject: [PATCH] Ship the licences of what the wheel actually bundles
+
+pyproject.toml's `license-files = ["LICENSE.txt"]` is an explicit PEP
+639 list, which replaces setuptools' default glob outright rather than
+extending it -- so only LICENSE.txt itself ever lands in
+`dist-info/licenses/`, confirmed against the real PyPI wheel
+(tables-3.11.1-cp311-abi3-manylinux2014_x86_64...whl also ships only
+LICENSE.txt).
+
+That leaves out the licences of what this build actually compiles in
+or links: c-blosc (LICENSES/BLOSC.txt) and its bundled LZ4/zlib/zstd
+(LICENSES/LZ4.txt, LICENSES/ZLIB.txt, LICENSES/ZSTD.txt, all compiled
+directly into tables' own extensions from c-blosc/internal-complibs,
+confirmed from this workflow's own build log's object file list), HDF5
+itself (LICENSES/HDF5.txt), and h5py, whose adapted code is credited in
+tables/hdf5extension.pyx and tables/array.py (LICENSES/H5PY.txt) --
+both of which ship. It also leaves out LICENSES/BZIP2.txt, which this
+workflow's own CIBW_BEFORE_ALL_LINUX already creates (bzip2 isn't on
+the manylinux policy allow-list, so auditwheel vendors it into the
+wheel) precisely so it can be shipped this way, but never actually
+was, since nothing added it to this list.
+
+Not a wildcard over the whole LICENSES/ directory: it also holds
+FASTLZ.txt and SNAPPY.txt for codecs this c-blosc checkout does not
+compile (no fastlz/snappy sources exist under
+c-blosc/internal-complibs, and neither identifier appears anywhere
+else in tables/ or src/), STDINT.txt and WIN32PTHREADS.txt for
+Windows-only build shims (no reference outside the Windows-specific
+build config), and CLOUD-SPTHEME.txt for the Sphinx theme used to
+build the documentation, not the wheel. Declaring those would falsely
+claim licences for content this build never ships.
+
+Upstream-Status: To upstream [not submitted: no cross-repo issue/PR contributions from this port]
+
+Signed-off-by: Ludovic Henry <git@ludovic.dev>
+---
+diff --git a/pyproject.toml b/pyproject.toml
+index f838c31..49d808f 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -112,7 +112,16 @@ pttree = "tables.scripts.pttree:main"
+ platforms = [ "any" ]
+ zip-safe = false
+ # include-package-data = true
+-license-files = [ "LICENSE.txt" ]
++license-files = [
++    "LICENSE.txt",
++    "LICENSES/BLOSC.txt",
++    "LICENSES/BZIP2.txt",
++    "LICENSES/H5PY.txt",
++    "LICENSES/HDF5.txt",
++    "LICENSES/LZ4.txt",
++    "LICENSES/ZLIB.txt",
++    "LICENSES/ZSTD.txt",
++]
+
+
+ [tool.setuptools.dynamic]
+--
+2.43.0