Add Apache-2.0 §4(b)/(c) provenance blocks and normalize upstream citations (#19394, #19395)

[jonyoder]

Adds Apache-2.0 §4(b)/(c) provenance headers to every file with ported third-party code, fixes two NOTICE errors, and retrofits the 12 pypa/packaging permalink citations in version/ to one pinned SHA in a symbol-name-first format.

This combines #19394 and #19395: #19394 already edits the same ~10 package headers #19395 needs, so doing the citation retrofit now avoids a second review pass over near-identical churn.

---

Provenance blocks (#19394) — 30 files

Package	Files	Count
version/	version.go, specifier.go, version_test.go, specifier_test.go, specifier_conformance_test.go, specifierset_conformance_test.go	6
distribution/	parse.go, internal/distributions/distribution.go, metadata.go, sdist.go, wheel.go, internal/packages/hash_manager.go, types/types.go	7
tags/	generate.go	1
wheelname/	wheelname.go	1
extras/	extras.go	1
internal/pep508/	tokenizer.go, marker.go, requirement.go, grammar_conformance_test.go	4
requirement/	requirement.go, conformance_test.go	2
marker/	evaluate.go, environment.go	2
reqtxt/	preprocess.go, shlex.go, classify.go, flatten.go, parse.go, types.go	6

Each block names the exact upstream symbols (not just "the tokenizer") and a per-file Changed: note specific to that file's actual divergence from upstream — not a copy-pasted paragraph. internal/pep508/tokenizer.go gets only the header block; nothing else in that file changed.

license/ (license.go, classifiers.go) deliberately gets no block despite reproducing rstudio/package-manager's getLicense/getLicenseTypes: that predecessor is Posit's own code, so there is no outside licensor for Apache §4(b)/(c) to satisfy — it's an internal Go-to-Go copy, not third-party-derived material.

Files were also excluded where citations exist only for verification/rationale rather than copied source or data (e.g. marker/marker.go, most _test.go regression files, tags/target.go, reqtxt/string.go) — see individual block Changed: notes for what each file actually ports.

NOTICE corrections (#19394)

1. uv-pep508/uv-pep440 override uv's workspace license per-crate to Apache-2.0 OR BSD-2-Clause, not the workspace's Apache-2.0 OR MIT NOTICE previously claimed. Added the missing konstin copyright line (their License-BSD reads Copyright (c) 2023 konstin) and the pypa/packaging → konstin → Astral → us provenance chain. I could not independently verify uv's live source in this sandbox — this is built from the issue's cited evidence (uv-pep508/src/lib.rs:50,1062, uv-pep440/CHANGELOG.md). Left the marker/ entry's uv-configuration citation untouched, since that crate does correctly inherit the workspace dual license.
2. The stale "no source incorporated yet" disclaimer issue #19394 asked me to remove was already removed in 70d9dd0 (Aug 2026) — verified via git log -S on NOTICE; no action needed here.
3. version/'s NOTICE entry credited only aquasecurity/go-pep440-version and never pypa/packaging, despite version.go carrying direct pypa citations. Added the pypa/packaging mention and the missing Aqua Security copyright line.

Citation normalization (#19395)

Re-grepped github.com/pypa/packaging/blob/ on origin/main: 12 citations (not the issue's claimed 13), a6407e3a×7 (not ×8) + 28d2fa07×4 + 4eb0753×1.

Picked 4eb0753dba8fcaaac8eb75463374e448f0931558 — it's the newest of the three (2026-07-28 vs. 2020-12-02 and 2021-01-04) and already anchors the version/ conformance-test citation in NOTICE. Added an exported version.UpstreamPackagingSHA const in version/version.go (exported, not just package-private, since version_test.go lives in the external version_test package and needs to cite it too); every citation now reads Pinned: see UpstreamPackagingSHA (L<n> at that commit) or Pinned: see version.UpstreamPackagingSHA (...) from outside the package.

I do have outbound network access in this sandbox (verified via GitHub's REST API), so I fetched pypa/packaging at 4eb0753 and re-verified every citation's logical block by symbol name, not just by line count:

• The two-dict preReleaseAliases/postReleaseAliases split now maps to upstream's single merged _LETTER_NORMALIZATION dict — noted in version.go's block.
• specifier_test.go's SPECIFIERS list and its companion invalid-case list — the two the issue flagged as already stale — are re-pointed to the correct current lines (L33-L43 and L55-L102); a comment on the invalid-case citation notes upstream's list has grown since (pre/post/dev-tagged prefix-matching, non-ASCII local-segment cases) beyond what this file ports.
• version_test.go's valid/invalid version lists similarly re-verified and re-pointed, with the same "upstream has grown" note.

Request for licensing review

Do not merge without a review from someone with authority on licensing. This is a public repo and the open questions are legal, not technical:

1. Is the uv-pep508/uv-pep440 per-crate license override (Apache-2.0 OR BSD-2-Clause) and the konstin copyright line correctly stated? I built this from the issue's cited evidence, not live verification of uv's current source.
2. Is the Changed: wording in each provenance block an adequate discharge of Apache §4(b) ("modified files... carry prominent notices")?
3. Is it right to give license/ no block at all, on the theory that a Posit-to-Posit copy from rstudio/package-manager doesn't trigger Apache §4(b)/(c) (no outside licensor to satisfy)? NOTICE's existing license/ paragraph still credits that predecessor either way.

I am not providing that sign-off myself, even though I made the edits.

Overlap with #58 / #59

#58 (19401-marker-string-escapes) and #59 (19402-url-token-whitespace) are open against this repo and touch internal/pep508/tokenizer.go, marker.go, and requirement.go. This PR only touches the header region (right after the SPDX line) of any file they also touch — nothing else. Expect a possible trivial rebase if either merges first.

Verification

• go build ./..., go vet ./..., gofmt -l .: clean
• go test ./... -count=1 -timeout 900s: 543 pass / 0 fail across 12 packages, identical before and after (comment/header-only change, confirmed by running the suite against both the base commit and this commit)
• go test ./... -race: clean
• golangci-lint run ./...: 2 pre-existing govet findings (reflect.Ptr deprecation) in distribution/internal/distributions/distribution.go:323,327 — present on main before this change, unrelated to the comment-only diff here. My local golangci-lint is v2.13.1; CI pins v2.11.2 (.github/workflows/ci.yml), so please treat CI's run as authoritative.
• MUTATION: NOT-DONE — comment/header-only change, no behavior touched.

🤖 Generated with Claude Code

[jonyoder]

Licensing review packet

This PR is held pending a licensing review. It is not blocked on engineering — CI is green and it merges cleanly. The point of this comment is to make the review short for whoever picks it up, by laying out the facts and the actual questions. Nothing below is a legal opinion, and no agent's reading of Apache-2.0 §4 counts as sign-off here.

Edited 2026-09-22: an earlier version of this comment said the pinned SHA was "consistent with the NOTICE's release 26.2 claim". That was wrong. It was based on a date and never checked. The pin errors are now fixed on the branch (see below), and the uv-pep508 claim has been checked against primary sources and holds.

What the PR changes

31 files. All comment/header text plus NOTICE edits, with one exception: version/version.go adds a new exported const UpstreamPackagingSHA, used by the inline citations. Each touched file gains a block after its existing SPDX line naming the upstream project, the exact symbols ported, the license, and a Changed: note. license/license.go and license/classifiers.go get no block, on the stated rationale that they derive from Posit's own rstudio/package-manager.

Licensing facts (verified, not assumed)

• Upstream pypa/packaging is dual-licensed Apache-2.0 OR BSD-2-Clause (LICENSE fetched and read). The PR's characterization matches upstream's own text.
• This repo is licensed Apache-2.0 OR MIT — a different pairing than upstream's. Not a contradiction, and NOTICE addresses it with "taken under whichever arm applies", but a reviewer should see the mismatch stated rather than infer it.
• A NOTICE with per-package attribution already existed. Before this PR, only version/ carried per-file citations. tokenizer.go, marker.go, requirement.go, and all of reqtxt/ and distribution/ had none.
• Verbatim copying does exist, which is what makes this a real question rather than a formality. version/specifier_test.go's specifier table is a value-for-value, order-for-order match to upstream's SPECIFIERS list, and tokenizer.go's OP regexp reproduces upstream's operator alternation in the same order. Both were checked against fetched upstream source.

uv-pep508 / uv-pep440 claim: verified, holds

Checked against astral-sh/uv at 07143223ba8778f40d2d003e3381e65f0180669f:

• Workspace license is MIT OR Apache-2.0. crates/uv-pep508/Cargo.toml and crates/uv-pep440/Cargo.toml both override it with license = "Apache-2.0 OR BSD-2-Clause".
• Both crates ship License-Apache and License-BSD. uv-pep508's License-BSD reads Copyright (c) 2023 konstin, and uv-pep440's has the same line.
• uv-pep508 began as konstin's independent pep508_rs crate. Its src/tests.rs opens with "Half of these tests are copied from Improve Requirement/Marker parser with context-sensitive tokenisation pypa/packaging#624", and uv's history shows konstin folding it in (uv #2275, #6200).

Pin errors — fixed at b15db55

The branch is rebased onto current main with no conflicts, and the edits from #58/#59 are kept. The pin errors are now fixed. Only comments and NOTICE changed; UpstreamPackagingSHA still has the same value. CI is green.

I checked which upstream commit each ported piece actually matches, instead of choosing one pin for everything:

• version/ conformance tests match 4eb0753 (pypa/packaging main, 2026-07-28) specifically. They include a non-ASCII case (Version and Specifier accept (erroneously) some non-ASCII letters in the *local version* segment pypa/packaging#469) that was added after 26.2 and isn't in the release. So the 4eb0753 pin is right, but it was wrongly labelled "release 26.2". The label now describes it as main, 128 commits after 26.2.
• version.go's _cmpkey / _parse_letter_version / letter normalization, the requirement/ cross-product, and tags/'s _LAST_GLIBC_MINOR are the same at both commits.
• The version/specifier.go helpers exist only in 26.2. 4eb0753 removed them in a specifiers.py rewrite. Those citations already said 26.2, so they were right.
• The tags/ pin moves from the tag object 6ce6143 to the actual 26.2 release commit 84a87ee. Note that 6ce6143 is on main today (NOTICE and tags/generate.go:410), so this PR also fixes an existing error.

#19395's one-SHA goal can't be fully met. The version/ tests need content from after 26.2, while the specifier helpers exist only in 26.2. Both pins are now real commits with correct labels, and NOTICE explains the split. 12 line references were checked against the pinned commits, plus 6 more by an independent reviewer, and none were wrong.

uv material is still unpinned. Nothing in this repo's history records which uv version was ported, and I didn't make one up.

Questions for the reviewer

1. Does Apache-2.0 §4(b) require a per-modified-file notice (what this PR adds), or does a NOTICE-file-level statement suffice for files that port upstream logic?
2. Is it acceptable for license/ to carry no upstream attribution, given its predecessor is Posit's own code but itself incorporates PyPI Trove-classifier data?
3. Is the uv-pep508/uv-pep440 per-crate license statement approved for publication? (Its facts are verified above.)
4. Should the repo's Apache-2.0 OR MIT be reconciled or footnoted against upstream's Apache-2.0 OR BSD-2-Clause, or is the current NOTICE wording sufficient?
5. Does re-pinning citations need review, or is it only a documentation-accuracy change? (The pins are now corrected. There are two, for the reason above.)

Minor, unrelated to licensing

UpstreamPackagingSHA is exported, so a comment-only PR adds public API surface to the library. Easy to make unexported if that's not intended.