licenseproof

Your package has a license. Your wheel doesn't say so.

Real case, still reproducible today: protocolbuffers/protobuf#29440. The protobuf-7.36.0 wheel's METADATA says License: 3-Clause BSD License — free text, not an SPDX expression — and carries no License-Expression field at all (Metadata-Version 2.1). To be precise: the wheel does ship a dist-info/LICENSE file, so this is "missing License-Expression (PEP 639)", not "no license at all". A previous fix attempt (#9441) didn't fully fix it; the issue is still open. Any compliance tooling that keys on SPDX expressions sees this wheel as unparseable.

A sharper flavor of the same disease: ag-ui-protocol/ag-ui#1927 — the ag_ui_strands-0.1.9 wheel has License: None, no License-Expression, no License-File, and zero license files anywhere in the archive. The monorepo root is MIT-licensed, but the published artifact inherits none of it (the hatch wheel config only includes src/). Compliance scanners flag it "unknown license", which blocks enterprise adoption outright.

licenseproof checks that a published Python artifact actually carries usable license information — the release-integrity question nobody's CI asks.

This is deliberately not a generic license scanner (pip-licenses, ScanCode already cover that). It answers one narrow question: does this wheel/sdist contain license metadata and license text a compliance tool can use?

Part of the release-integrity series: readmeta (did your README render?), wheeltruth (did your wheel ship complete?), casecrash (will your filenames survive checkout?), tagtruth (does the tag match the release?), wheelreach (can your Python actually install it?), entryprobe (does the installed CLI actually start?), licenseproof (does the artifact say what license it's under?).

Quickstart

pip install licenseproof  # PyPI upload pending rate limits; from source meanwhile:
# git clone https://github.com/hahahahahahahahah6/licenseproof && pip install ./licenseproof
licenseproof check --wheel dist/mypackage-1.0-py3-none-any.whl

source:  dist/mypackage-1.0-py3-none-any.whl
verdict: LEGACY_LICENSE
detail:  License: 'MIT' (free text, not SPDX); no License-Expression (PEP 639)

clean (legacy license info is a warning; use --require-spdx to fail)

licenseproof check --sdist dist/mypackage-1.0.tar.gz
licenseproof check --package mypackage          # installed distribution
licenseproof check --wheel dist/x.whl --require-spdx
licenseproof check --wheel dist/x.whl --format json

Exit codes: 0 clean, 1 problems found, 2 errors (unreadable artifact, bad args).

Verdicts

Design notes:

• LEGACY_LICENSE is a warning by default, not a failure. Most of PyPI predates PEP 639; failing every one of them would be noise, not signal. --require-spdx is the strict mode for projects that have decided to move.
• A License: field containing UNKNOWN (or blank) counts as absent — that's setuptools' default, not information.
• License-File values are matched explicitly by layout: wheels/installed dists expect them under *.dist-info/licenses/ (PEP 639) or legacy *.dist-info/; sdists expect them project-root-relative under the top-level <name>-<version>/ directory. No basename-only fallbacks, no .. escapes.
• An unparseable situation is never a silent pass: a License-File reference that matches nothing is its own failing verdict, not ignored.

What licenseproof does not verify

It checks the presence and machine-readability of license information, not its meaning. A passing result confirms that the expected license metadata fields and referenced files are present — License-Expression is checked for presence, but SPDX identifiers and expressions are not semantically validated. It does not interpret license compatibility (can MIT depend on GPL?) or offer any legal interpretation. For "what does this license obligate me to do", use a real compliance tool — licenseproof just makes sure the artifact gives that tool something to work with.