Licensing and attribution

[Aspie96]

When building and distributing an executable using PyInstaller, it is my understanding that one is distributing, as part of that executable, both some modules of PyInstaller and some modules of CPython, as well as their respective dependencies.

Most FLOSS licenses require that certain statement be retained in all distributions, even if solely as part of a larger binary. Where can I find all attribution material which I need to provide the user in that scenario?

Thank you in advance.

[rokm]

Where can I find all attribution material which I need to provide the user in that scenario?

In the individual licenses of all components that your software uses and that end up collected into frozen application bundle. This includes CPython, all python packages, and any shared libraries that are collected from the build system (for example, on linux).

[rokm]

But I guess if you're asking whether PyInstaller compiles the list of licenses from collected components for you - it does not. See #5666.

[Aspie96]

Thank you a lot, @rokm.

I don't think including notices of components which didn't end up in the executable is an issue, so removing them isn't necessary.

To be clear, I am not asking for a way to collect the licenses of third-party dependencies which I myself included, just anything that Pylance itself would include when the Python program doesn't have dependencies (other than the standard library).

If I include the license file of my Python installation (which includes the license of CPython dependencies), along with the COPYING.tx file of PyInstaller itself, would that include everything that PyInstaller packages or are there any other dependencies which may be included (again, excluding any dependency of my own Python scripts)?

In the bootloader of PyInstaller, I see the following note:

The bootloader has to be kept standalone without any dependencies on 3rd party libraries.

This suggests, to me, that PyInstaller doesn't include any non-CPython dependencies (unless included by the user), would that be correct?

[rokm]

This suggests, to me, that PyInstaller doesn't include any non-CPython dependencies (unless included by the user), would that be correct?

The only external dependency of bootloader is the zlib library; on Windows, it is statically linked against the bundled copy. On most other platforms, it is linked against the system copy.

Other than that, it is kept standalone in order to be fully portable. (It is also not linked against the python shared library, but rather loads it via dlopen / LoadLibrary at run-time).

So yes, a minimal program that uses only stdlib will end up with only CPython components (shared library, stdlib modules and extensions; and their dependencies - openssl, tcl/tk, etc.) and PyInstaller components (bootloader, bootstrap/loader modules and script, and run-time hook scripts; all of which are permissively licensed). Note, however, that on linux, additional shared libraries might end up collected from the build system as dependencies of CPython extensions and their 1st-order dependencies (e.g., dependencies of openssl and/or tcl/tk libraries).

[Aspie96]

I'm commenting again on this for future users.

I shuld mention the license file for Python on Windows is incomplete. It contains the Python license itself and some Windows-specific notices.
This is acceptable for Python because it comes with full source code, where all required attribution notices will be contained.

Since a PyInstaller app may be distributed without source code (even if open source / source available, the user may be allowed to download the executable by itself)

The solution (INAL and this is not legal advice) is to include the FULL license file from the Python documentation (which, even as plaintext, is patently human-readable): https://github.com/python/cpython/blob/main/Doc/license.rst

For Windows distributions, you should also include the license file you find in the Windows installation.

The two files share a lot of information (namely, the Python license and its history), but this isn't a problem. If you really hate that this is the case, you may merge the two files, removing duplicated information.