python-packaging-license-checker

name	python-packaging-license-checker
description	Use this skill to check whether a Python package license is compatible with redistribution in Red Hat products, using the Fedora License Data as the authoritative policy source. Produces a structured six-field verdict with escalation guidance for non-trivial cases.
allowed-tools	Bash Skill WebFetch

Python Package License Compatibility Checker

Evaluate whether a Python package license permits redistribution in Red Hat products.

Policy basis: Red Hat redistribution policy follows the Fedora Linux license policy. Use the Fedora License Data as the authoritative source -- NOT OSI-approval status.

Inputs

• package_name: Python package name
• repo_url: upstream repository URL (if already known — skip the source-finder step and clone this directly)
• source_available: whether buildable source exists (if already known)
• upstream_org: name and primary country of the maintaining organisation (if already known)

Step 1: Locate and clone the source repository

If a repo_url is provided, skip the source-finder step and use the provided URL directly with the git-shallow-clone skill.

Otherwise, use the python-packaging-source-finder skill to find the upstream repo URL:

Skill: python-packaging-source-finder

Then use the git-shallow-clone skill to clone the repository locally:

Skill: git-shallow-clone

This gives a local path to the cloned repo for deterministic license inspection.

Step 2: Read the license from source

Search the cloned repo root for license files in this order: LICENSE, LICENSE.txt, LICENSE.md, COPYING, COPYING.txt, LICENCE, LICENCE.txt

ls <clone_path>/{LICENSE,COPYING,LICENCE}{,.txt,.md} 2>/dev/null | head -1

Read the license file (up to 128 KB) and map to an SPDX identifier. If the file exceeds 128 KB, read only the first 128 KB and note the truncation. If the file cannot be read within 30 seconds, treat it as unreadable and set Verdict: NEEDS-HUMAN-REVIEW with a note explaining the timeout.

Also check pyproject.toml or setup.cfg for a license field as a secondary signal. If the PyPI metadata license differs from the source file, set Source verified: MISMATCH (PyPI: [X], repo: [Y]) and use the source file as authoritative.

Normalise to SPDX ID using exact then fuzzy matching:

• Deterministic: "Apache 2" -> Apache-2.0, "GPL v2" -> GPL-2.0-only, "MIT License" -> MIT, "LGPLv2.1" -> LGPL-2.1-only
• Ambiguous (do NOT auto-map): "BSD", "GPLv3" -> set NEEDS-HUMAN-REVIEW. These tokens map to multiple SPDX IDs; require human confirmation.

Compound expressions: If the license contains AND or OR:

• AND: split into components; every component must be individually allowed. If any single component is not-allowed, the whole expression is BLOCKED. Document the split in Notes.
• OR: evaluate each component; use the most permissive allowed one. If none are allowed, the overall verdict is the best individual verdict.

If no license file found and no SPDX mapping possible: Verdict: NEEDS-HUMAN-REVIEW.

Clean up the clone when done:

if [ -n "${CLONE_DIR}" ] && echo "${CLONE_DIR}" | grep -q '^/tmp/'; then
  rm -rf -- "${CLONE_DIR}"
else
  echo "ERROR: refusing to delete '${CLONE_DIR}' -- not under /tmp/" >&2
fi

Step 3: Look up license in Fedora License Data

Fetch the live data:

WebFetch: https://gitlab.com/fedora/legal/fedora-license-data/-/jobs/artifacts/main/raw/fedora-licenses.json?job=json

Search for an entry matching the SPDX ID (case-insensitive on spdx_abbrev). Each entry has a status field which may be a string or an array. Normalise to an array and apply the following deterministic mapping.

Fedora License Data defines these status values:

Status	Meaning	Outcome
allowed	Approved for Fedora packages	Proceed to Step 4
allowed-fonts	Approved only for font packages	Proceed to Step 4 (add note: "License approved for fonts only; verify component type")
allowed-documentation	Approved only for documentation	Proceed to Step 4 (add note: "License approved for documentation only; verify component type")
allowed-content	Approved only for content (non-code)	Proceed to Step 4 (add note: "License approved for content only; verify component type")
not-allowed	Explicitly prohibited	Verdict: BLOCKED

Apply fail-closed logic:

• If any entry is "not-allowed" -> Verdict: BLOCKED
• If all entries are one of the allowed* statuses above (and none "not-allowed") -> proceed to Step 4
• If the status field is missing, empty, or contains a value not listed in the table above -> Verdict: NEEDS-HUMAN-REVIEW (note the unrecognised value)
• SPDX ID not found in data -> Verdict: NEEDS-HUMAN-REVIEW

Fallback table (use only when the JSON fetch fails):

Status	SPDX identifiers (representative)
allowed	MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, PSF-2.0, CC0-1.0
allowed	GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later
allowed	LGPL-2.0-only, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-or-later
allowed	AGPL-3.0-only, AGPL-3.0-or-later, MPL-2.0, EUPL-1.2, EPL-2.0
not-allowed	SSPL-1.0, BUSL-1.1, Commons-Clause
ESCALATE	Any custom/proprietary license not in SPDX

When using fallback, append to Notes: "Fedora License Data unreachable; fallback table used. Verify at https://docs.fedoraproject.org/en-US/legal/allowed-licenses/"

Step 4: Verdict refinement (apply in order)

Rule A -- Proprietary or custom license (not in Fedora data):

First check the Vendor Agreements table below. If covered by an agreement: Verdict: ALLOWED, Notes: "Covered by Red Hat [Vendor] redistribution agreement."

Otherwise:

• Red Hat / IBM-owned upstream (e.g. Neural Magic): Verdict: ESCALATE-TO-LEGAL. Notes: "Red Hat-owned proprietary license. Must be relicensed before inclusion. Open a ServiceNow opensource-legal ticket."
• Third-party proprietary: Verdict: ESCALATE-TO-LEGAL. Notes: "Third-party proprietary license. May be includable as a EULA-listed component. Open a legal-review task."

Rule B -- AGPL-3.0 (status=allowed, SPDX is AGPL-3.0-only or -or-later): Verdict: ALLOWED-WITH-CAVEAT. Notes: "AGPL-3.0 is allowed for redistribution but is frequently part of a dual-licensing strategy, increasing risk. PM sign-off required."

Rule C -- All other allowed licenses: Verdict: ALLOWED. Notes: omit unless compliance note needed (e.g. LGPL dynamic linking does not propagate copyleft).

Rule D -- Not-allowed: Verdict: BLOCKED. Notes: "License is on the Fedora not-allowed list."

Step 5: Compliance checks

Build compliance (independent of license verdict): If source_available is false or no buildable source exists (no setup.py, pyproject.toml, or equivalent):

• Build compliance: BUILD-COMPLIANCE-FLAG
• Append to Notes: "No buildable source. Options: (1) request upstream sdist, (2) make dependency optional, (3) file PSX exception with 6-month deadline per PSS.SBR.02.02."
• Otherwise: Build compliance: OK

Export compliance (independent of license verdict): Check the upstream org's primary country against these authoritative machine-readable sources:

• US OFAC SDN List (XML): https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/exports/SDN.XML
• EU Consolidated Sanctions (RSS/FSF): https://webgate.ec.europa.eu/europeaid/fsd/fsf/public/rss
• Red Hat geopolitical policy: consult [e-mail]

For each source checked, record the following metadata:

• source_url: the URL fetched
• retrieved_at: ISO 8601 timestamp of the fetch
• fetch_outcome: success or failure
• retry_count: number of retries attempted (0 if first attempt succeeded)

If flagged by any source:

• Export compliance: EXPORT-COMPLIANCE-FLAG
• Append to Notes: "Upstream org may require export compliance review. Contact [e-mail]. Source: <source_url>; Fetched: <retrieved_at>; Outcome: <fetch_outcome>; Retries: <retry_count>. Geopolitical sensitivity does not automatically block inclusion."

If sources are unreachable after 2 retries:

• Export compliance: EXPORT-COMPLIANCE-FLAG
• Append to Notes: "Export sanctions data unreachable (Retries: <retry_count>). Verdict: NEEDS-HUMAN-REVIEW"

Otherwise: Export compliance: OK

Output Format

Produce ONLY this six-field block. No preamble, no extra text.

_License:_ [SPDX expression, or "non-SPDX: [raw string]" if unmappable]
_Source verified:_ YES | NO | MISMATCH (PyPI: [X], repo: [Y])
_Verdict:_ ALLOWED | ALLOWED-WITH-CAVEAT | NEEDS-HUMAN-REVIEW | ESCALATE-TO-LEGAL | BLOCKED
_Build compliance:_ OK | BUILD-COMPLIANCE-FLAG
_Export compliance:_ OK | EXPORT-COMPLIANCE-FLAG
_Notes:_ [Actionable guidance. Omit if verdict is ALLOWED and all flags are OK.]

Vendor Agreements

Vendor	Covered components
NVIDIA	CUDA libraries, runtimes, NCCL, and related NVIDIA components
Intel Gaudi	Gaudi AI accelerator software and libraries
IBM Spyre	IBM Spyre AI hardware and associated software components

Quick Reference

Scenario	Verdict	Build
MIT, Apache-2.0, BSD-*, ISC, PSF-2.0	ALLOWED	OK
GPL-*, LGPL-*	ALLOWED	OK
AGPL-3.0-*	ALLOWED-WITH-CAVEAT	OK
SSPL-1.0, BUSL-1.1, Commons-Clause	BLOCKED	--
RH-owned proprietary	ESCALATE-TO-LEGAL	--
Third-party proprietary (no vendor agreement)	ESCALATE-TO-LEGAL	--
PyPI/repo license mismatch	per repo license (MISMATCH noted)	OK
No buildable source	per license	FLAG

Error Handling

• Fedora data unreachable: Use fallback table; append note.
• Source repo not found: If python-packaging-source-finder returns null/low confidence, set Source verified: NO, verdict: NEEDS-HUMAN-REVIEW.
• Source repo private/inaccessible: Set Source verified: NO. Verdict: NEEDS-HUMAN-REVIEW.
• Multiple conflicting LICENSE files: Source verified: MISMATCH, verdict: NEEDS-HUMAN-REVIEW. Note the conflicting files.