From 3643baab9a24912545754b507eb80a73384e72a9 Mon Sep 17 00:00:00 2001
From: Karolina Surma <ksurma@redhat.com>
Date: Wed, 24 Sep 2025 16:42:29 +0200
Subject: [PATCH] Include licenses of incorporated software (rhbz#2133426)

Python includes a lot of differently licensed functions and  modules.
We gather the list from https://docs.python.org/3.13/license.html.

Detect changes to Doc/license.rst with file hash automatically in %prep.
---
 python3.13.spec | 47 ++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 42 insertions(+), 5 deletions(-)

diff --git a/python3.13.spec b/python3.13.spec
index 578adc4..212f53b 100644
--- a/python3.13.spec
+++ b/python3.13.spec
@@ -518,9 +518,38 @@ This package contains /usr/bin/python - the "python" command that runs Python 3.
 %package -n %{pkgname}-libs
 Summary:        Python runtime libraries
 
-# Bundled libb2 is CC0, covered by grandfathering exception
-# Bundled mimalloc is MIT
-%global libs_license Python-2.0.1 AND CC0-1.0 AND MIT
+# Python is generally licensed as Python-2.0.1 but also includes incorporated software
+# Combined manually from https://docs.python.org/3.13/license.html
+# Hash of Doc/license.rst which is compared in %%prep, generated with:
+# $ sha256sum Doc/license.rst | cut -f1 -d" "
+%global license_file_hash 62f2c9c2c75d511170eb464ad5f83b78cc1f37eb2eb49c2846c9aa6c4557ee99
+# Licenses of incorporated software:
+# Mersenne Twister in _random C extension contains code under BSD-3-Clause
+# socket.getaddrinfo() and socket.getnameinfo() are BSD-3-Clause
+# test.support.asynchat and test.support.asyncore are MIT-CMU
+# http.cookies is MIT-CMU
+# trace is under temporary SPDX ref: https://gitlab.com/fedora/legal/fedora-license-data/-/issues/657
+# trace: LicenseRef-Fedora-Temporary-Python-trace
+# uu is MIT-CMU
+# xmlrpc.client is MIT-CMU
+# test.test_epoll is MIT
+# select kqueue interface is BSD-2-Clause
+# SipHash algorithm in Python/pyhash.c is MIT
+# strtod and dtoa are dtoa
+# OpenSSL is not bundled
+# expat is not bundled
+# libffi is not bundled
+# zlib is not bundled
+# cfuhash used by tracemalloc is BSD-3-Clause
+# libmpdec is not bundled
+# C14N test suite in Lib/test/xmltestdata/c14n-20/ is BSD-3-Clause
+# mimalloc is MIT
+# parts of asyncio from uvloop are MIT
+# Python/qsbr.c is adapted from code under BSD-2-Clause
+# Bundled libb2 is not declared in the upstream document, but it's:
+# CC0-1.0, covered by grandfathering exception
+# We don't query upstream for changes, as 3.13 is the last Python version containing it.
+%global libs_license Python-2.0.1 AND CC0-1.0 AND MIT AND BSD-3-Clause AND MIT-CMU AND LicenseRef-Fedora-Temporary-Python-trace AND BSD-2-Clause AND dtoa
 %if %{with rpmwheels}
 Requires: %{python_wheel_pkg_prefix}-pip-wheel >= 23.1.2
 License: %{libs_license}
@@ -528,7 +557,7 @@ License: %{libs_license}
 Provides: bundled(python3dist(pip)) = %{pip_version}
 %pip_bundled_provides
 # License combined from Python libs + pip
-License: %{libs_license} AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
+License: %{libs_license} AND Apache-2.0 AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
 %endif
 
 %unversioned_obsoletes_of_python3_X_if_main libs
@@ -723,7 +752,7 @@ Provides: bundled(python3dist(pip)) = %{pip_version}
 Provides: bundled(python3dist(setuptools)) = %{setuptools_version}
 %setuptools_bundled_provides
 # License combined from Python libs + pip + setuptools
-License: %{libs_license} AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
+License: %{libs_license} AND Apache-2.0 AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
 %endif
 
 # This package doesn't depend on python3-libs, so we need to explicitly
@@ -792,6 +821,14 @@ rm Lib/ensurepip/_bundled/pip-%{pip_version}-py3-none-any.whl
 rm Lib/test/wheeldata/setuptools-%{setuptools_version}-py3-none-any.whl
 %endif
 
+# check if there were any changes to Doc/license.rst
+# if so, a review of %%libs_license and %%license_file_hash is needed
+found_hash=$(sha256sum Doc/license.rst | cut -f1 -d" ")
+if [ "$found_hash" != %{license_file_hash} ]; then
+    echo "File hash mismatch: review Doc/license.rst for changes"
+    exit 1
+fi
+
 # Remove all exe files to ensure we are not shipping prebuilt binaries
 # note that those are only used to create Microsoft Windows installers
 # and that functionality is broken on Linux anyway