Package and version pages currently show license values from registry metadata. Cached archives can be browsed, but proxy does not retain license evidence from their contents or expose full license and notice text.
Persist a typed license report for each scanned artifact and expose it through the API and the version page. Reports should use the git-pkgs/licenses scan shape, including root and nested expressions, manifest declarations, legal files, decoded text, skipped files, errors, scanner version, and corpus provenance.
Store results per artifact content hash and filename. A package version can have several artifacts, such as a PyPI sdist and multiple wheels, whose license files may differ. Keep registry-derived package and version licenses separate, then derive a version summary from the current artifact reports when presenting it.
Add:
GET /api/licenses/{ecosystem}/{name}/{version}, returning the current report for each cached artifact and a derived version summary.- A license section on
/ui/package/{ecosystem}/{name}/{version} with scanned expressions, declared values, license and notice files, scan status, and provenance.
- Links from reported legal files to the existing source-browse endpoint when the artifact can be browsed.
The API and UI should read persisted reports rather than scanning during the request. A report must only be reused when its content hash and scanner identity still match the cached artifact. Unsupported files should retain an explicit unsupported status without preventing the artifact from being served.
Initial scope covers artifacts cached through normal server traffic and the mirror API. Existing cached artifacts can show an unscanned state; bulk backfill and the proxy mirror CLI are outside this issue.
Tests should send a real package archive through a public package endpoint, persist its report, and verify the API response and rendered version page. Include a version with two artifact variants so results are not accidentally stored at version level.
Related work:
Package and version pages currently show license values from registry metadata. Cached archives can be browsed, but proxy does not retain license evidence from their contents or expose full license and notice text.
Persist a typed license report for each scanned artifact and expose it through the API and the version page. Reports should use the
git-pkgs/licensesscan shape, including root and nested expressions, manifest declarations, legal files, decoded text, skipped files, errors, scanner version, and corpus provenance.Store results per artifact content hash and filename. A package version can have several artifacts, such as a PyPI sdist and multiple wheels, whose license files may differ. Keep registry-derived package and version licenses separate, then derive a version summary from the current artifact reports when presenting it.
Add:
GET /api/licenses/{ecosystem}/{name}/{version}, returning the current report for each cached artifact and a derived version summary./ui/package/{ecosystem}/{name}/{version}with scanned expressions, declared values, license and notice files, scan status, and provenance.The API and UI should read persisted reports rather than scanning during the request. A report must only be reused when its content hash and scanner identity still match the cached artifact. Unsupported files should retain an explicit unsupported status without preventing the artifact from being served.
Initial scope covers artifacts cached through normal server traffic and the mirror API. Existing cached artifacts can show an unscanned state; bulk backfill and the
proxy mirrorCLI are outside this issue.Tests should send a real package archive through a public package endpoint, persist its report, and verify the API response and rendered version page. Include a version with two artifact variants so results are not accidentally stored at version level.
Related work: