Is the my-test-package intended to be delivered along with the setuptools package?

[dus7eh]

In recent release 71.0.1 one of previous changes to exclude package data and tests was reverted: 1a52f11

Is this intended? I'm asking since SCA tools starting with this version detect such test package (my-test-package) as a dependency with unknown License.
This raises some dependency management issues and I wanted to know if this is how you intend to proceed.

[dus7eh]

Any maintainers who could answer to my question?

[SamuelHans]

Would like to know this too with my-test-package.

[abravalheri]

Could you please clarify this better? Setuptools itself has no dependency on my-test-package. Worst case scenario it is a test fixture with no further meaning.

Probably a false positive in the tool that is generating the report.

[dus7eh]

For the sake of clarity check out screenshots below showing filesystem changes when installing two different versions of setuptools. (it is based on a python:3.11 base image)

setuptools==71.0.0

setuptools==71.0.1

Yes, it seems to be a test package which has a regular package structure and .egg file. That's why it's treated by SCA tools as a python package. It is flagged since it has an unknown licensing set in metadata along with other dummy data.

If this is how you're going to deliever I can somewhat live with that. However be aware that it will most likely show up in SBOMs and SCA scans as an independent component.

[webknjaz]

These should definitely be included in sdists, but probably not wheels.

cc @abravalheri ^

[abravalheri]

@webknjaz, including them in the wheel, seems to be a deliberate decision from #4479 (even if temporarily due to an existing limitstion).

[webknjaz]

Oh, I didn't realize. Thanks for pointing out!