[Buildroot] [PATCH 1/2] package/python-scipy: remove license file

[Buildroot] [PATCH 1/2] package/python-scipy: remove license file

[Bernd Kuhls]

Buildroot commit 5d695881f8dc68ff1efe2cce75dda462c5990e3c bumped the
package from 1.16.3 to 1.17.1. In Version 1.17.0 upstream removed the
license file scipy/sparse/linalg/_eigen/arpack/ARPACK/COPYING:
https://github.com/scipy/scipy/commit/14dffda0b83c46728a7c88998804a4663bb735b3

causing an error with make target python-scipy-legal-info:

ERROR: while checking hashes from package/python-scipy/python-scipy.hash
ERROR: scipy/sparse/linalg/_eigen/arpack/ARPACK/COPYING has wrong sha256 hash:
ERROR: expected: 0926566f9f406178d1214f8cc796e166b1213dd7c05e0c5b461a8b8ac9e50bbe
ERROR: got     :
ERROR: Incomplete download, or man-in-the-middle (MITM) attack

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
 package/python-scipy/python-scipy.hash | 1 -
 package/python-scipy/python-scipy.mk   | 1 -
 2 files changed, 2 deletions(-)

diff --git a/package/python-scipy/python-scipy.hash b/package/python-scipy/python-scipy.hash
index 27a72904d2..5be848c8ad 100644
--- a/package/python-scipy/python-scipy.hash
+++ b/package/python-scipy/python-scipy.hash
@@ -6,5 +6,4 @@ sha256  221e59f5e910fd7f94e44f0dac77436a11338c285c6346232e4a850a50da0e94  LICENS
 sha256  606209a000716c5f66e33e180ce08434b96ed17db4975ab9723c6b5fbcc89609  scipy/ndimage/LICENSE.txt
 sha256  3df9207af2fdb861af0ae3b22026f163b9bcfab4e525dc4943afe2ffa3f77624  scipy/optimize/tnc/LICENSE
 sha256  f0cedf52503b2d42b83411a0a16e6fefac346dfad8fddc66f50050150123470c  scipy/sparse/linalg/_dsolve/SuperLU/License.txt
-sha256  0926566f9f406178d1214f8cc796e166b1213dd7c05e0c5b461a8b8ac9e50bbe  scipy/sparse/linalg/_eigen/arpack/ARPACK/COPYING
 sha256  106d55c931fd6a84822e5345d900273d059f1c27310d02567ccb313c5d18c55d  scipy/spatial/COPYING_QHULL.txt
diff --git a/package/python-scipy/python-scipy.mk b/package/python-scipy/python-scipy.mk
index 8c536df130..e6e87d0cb8 100644
--- a/package/python-scipy/python-scipy.mk
+++ b/package/python-scipy/python-scipy.mk
@@ -19,7 +19,6 @@ PYTHON_SCIPY_LICENSE_FILES = \
 	scipy/ndimage/LICENSE.txt \
 	scipy/optimize/tnc/LICENSE \
 	scipy/sparse/linalg/_dsolve/SuperLU/License.txt \
-	scipy/sparse/linalg/_eigen/arpack/ARPACK/COPYING \
 	scipy/spatial/COPYING_QHULL.txt
 PYTHON_SCIPY_CPE_ID_VENDOR = scipy
 PYTHON_SCIPY_CPE_ID_PRODUCT = scipy
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 2/2] package/python-scipy: bump version to 1.18.1

[Bernd Kuhls]

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
v2: added license fix to series (Thomas), this patch is unchanged

 package/python-scipy/python-scipy.hash | 4 ++--
 package/python-scipy/python-scipy.mk   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/python-scipy/python-scipy.hash b/package/python-scipy/python-scipy.hash
index 5be848c8ad..bbc84fde43 100644
--- a/package/python-scipy/python-scipy.hash
+++ b/package/python-scipy/python-scipy.hash
@@ -1,6 +1,6 @@
 # md5, sha256 from https://pypi.org/pypi/scipy/json
-md5  d36aba61d4b01c50551efd38ca03752f  scipy-1.17.1.tar.gz
-sha256  95d8e012d8cb8816c226aef832200b1d45109ed4464303e997c5b13122b297c0  scipy-1.17.1.tar.gz
+md5  e71b80d5afd37a5abf6e413f287315d3  scipy-1.18.1.tar.gz
+sha256  52c4b7422442aba924d03ad4019852b08a92e64ea187b933135687bfe2747307  scipy-1.18.1.tar.gz
 # Locally computed sha256 checksums
 sha256  221e59f5e910fd7f94e44f0dac77436a11338c285c6346232e4a850a50da0e94  LICENSE.txt
 sha256  606209a000716c5f66e33e180ce08434b96ed17db4975ab9723c6b5fbcc89609  scipy/ndimage/LICENSE.txt
diff --git a/package/python-scipy/python-scipy.mk b/package/python-scipy/python-scipy.mk
index e6e87d0cb8..2d2d9ea2db 100644
--- a/package/python-scipy/python-scipy.mk
+++ b/package/python-scipy/python-scipy.mk
@@ -4,9 +4,9 @@
 #
 ################################################################################
 
-PYTHON_SCIPY_VERSION = 1.17.1
+PYTHON_SCIPY_VERSION = 1.18.1
 PYTHON_SCIPY_SOURCE = scipy-$(PYTHON_SCIPY_VERSION).tar.gz
-PYTHON_SCIPY_SITE = https://files.pythonhosted.org/packages/7a/97/5a3609c4f8d58b039179648e62dd220f89864f56f7357f5d4f45c29eb2cc
+PYTHON_SCIPY_SITE = https://files.pythonhosted.org/packages/7e/74/66de6258867beb2ef08f35f9f2ac017a52cacd5081714d239ff1a442d458
 PYTHON_SCIPY_LICENSE = \
 	BSD-3-Clause, \
 	BSD-2-Clause, \
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/2] package/python-scipy: remove license file

[Thomas Petazzoni via buildroot]

On Sat, Oct 03, 2026 at 06:07:12PM +0200, Bernd Kuhls wrote:
> Buildroot commit 5d695881f8dc68ff1efe2cce75dda462c5990e3c bumped the
> package from 1.16.3 to 1.17.1. In Version 1.17.0 upstream removed the
> license file scipy/sparse/linalg/_eigen/arpack/ARPACK/COPYING:
> https://github.com/scipy/scipy/commit/14dffda0b83c46728a7c88998804a4663bb735b3
> 
> causing an error with make target python-scipy-legal-info:
> 
> ERROR: while checking hashes from package/python-scipy/python-scipy.hash
> ERROR: scipy/sparse/linalg/_eigen/arpack/ARPACK/COPYING has wrong sha256 hash:
> ERROR: expected: 0926566f9f406178d1214f8cc796e166b1213dd7c05e0c5b461a8b8ac9e50bbe
> ERROR: got     :
> ERROR: Incomplete download, or man-in-the-middle (MITM) attack
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
> ---
>  package/python-scipy/python-scipy.hash | 1 -
>  package/python-scipy/python-scipy.mk   | 1 -
>  2 files changed, 2 deletions(-)
> 
> diff --git a/package/python-scipy/python-scipy.hash b/package/python-scipy/python-scipy.hash
> index 27a72904d2..5be848c8ad 100644
> --- a/package/python-scipy/python-scipy.hash
> +++ b/package/python-scipy/python-scipy.hash
> @@ -6,5 +6,4 @@ sha256  221e59f5e910fd7f94e44f0dac77436a11338c285c6346232e4a850a50da0e94  LICENS
>  sha256  606209a000716c5f66e33e180ce08434b96ed17db4975ab9723c6b5fbcc89609  scipy/ndimage/LICENSE.txt
>  sha256  3df9207af2fdb861af0ae3b22026f163b9bcfab4e525dc4943afe2ffa3f77624  scipy/optimize/tnc/LICENSE
>  sha256  f0cedf52503b2d42b83411a0a16e6fefac346dfad8fddc66f50050150123470c  scipy/sparse/linalg/_dsolve/SuperLU/License.txt
> -sha256  0926566f9f406178d1214f8cc796e166b1213dd7c05e0c5b461a8b8ac9e50bbe  scipy/sparse/linalg/_eigen/arpack/ARPACK/COPYING
>  sha256  106d55c931fd6a84822e5345d900273d059f1c27310d02567ccb313c5d18c55d  scipy/spatial/COPYING_QHULL.txt
> diff --git a/package/python-scipy/python-scipy.mk b/package/python-scipy/python-scipy.mk
> index 8c536df130..e6e87d0cb8 100644
> --- a/package/python-scipy/python-scipy.mk
> +++ b/package/python-scipy/python-scipy.mk
> @@ -19,7 +19,6 @@ PYTHON_SCIPY_LICENSE_FILES = \
>  	scipy/ndimage/LICENSE.txt \
>  	scipy/optimize/tnc/LICENSE \
>  	scipy/sparse/linalg/_dsolve/SuperLU/License.txt \
> -	scipy/sparse/linalg/_eigen/arpack/ARPACK/COPYING \

But shouldn't the <pkg>_LICENSE variable be updated?

It contains:

PYTHON_SCIPY_LICENSE = \
        BSD-3-Clause, \
        BSD-2-Clause, \
        BSD, \
        BSD-Style, \
        MIT, \
        Qhull

and I'm wondering if this "BSD" wasn't just for this ARPACK thing?

Also, would be ideal if your commit message for fixes could contain:

Fixes: <commit hash> ("<commit title>")

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/2] package/python-scipy: remove license file

[Fiona Klute via buildroot]

Hi Bernd, hi Thomas!

Am 03.10.26 um 18:31 schrieb Bernd Kuhls:
> Am Sat, 3 Oct 2026 18:15:47 +0200 schrieb Thomas Petazzoni via buildroot:
> 
>> and I'm wondering if this "BSD" wasn't just for this ARPACK thing?
> 
> Hi Thomas,
> 
> afaics scipy itself is distributed under the BSD license:
> https://github.com/scipy/scipy/blob/v1.18.1/pyproject.toml#L62
> 
> SciPy contains other libraries which are also distributed under the BSD
> license:
> https://github.com/scipy/scipy/blob/v1.18.1/LICENSES_bundled.txt
The problem is that there is no "the" BSD license, rather a whole family 
of similar licenses.

https://github.com/scipy/scipy/blob/v1.18.1/LICENSE.txt looks like what 
SPDX calls BSD-3-Clause [1], which is already in PYTHON_SCIPY_LICENSE 
separately. There is also a "BSD-Style", which is rather vague and 
should be replaced with a specific identifier.

Scipy has a list of licenses for files bundled from other projects: 
https://github.com/scipy/scipy/blob/v1.18.1/LICENSES_bundled.txt

I'm not familiar with the Scipy code and so can't vouch for its accuracy 
or completeness, but all the "License:" values given there are SPDX 
identifiers, so assuming the list is accurate and complete (if not, that 
needs to be fixed upstream!) you could just gather all unique values 
from there into PYTHON_SCIPY_LICENSE. :-)

Best regards,
Fiona


[1] https://spdx.org/licenses/BSD-3-Clause.html
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/2] package/python-scipy: remove license file

[Fiona Klute via buildroot]

Am 03.10.26 um 20:40 schrieb Fiona Klute:
> I'm not familiar with the Scipy code and so can't vouch for its accuracy 
> or completeness, but all the "License:" values given there are SPDX 
> identifiers, so assuming the list is accurate and complete (if not, that 
> needs to be fixed upstream!) you could just gather all unique values 
> from there into PYTHON_SCIPY_LICENSE. :-)
Slight correction, there are two entries that don't have SPDX 
identifiers/expressions, but those look very much like simple mistakes. 
I created an issue for that [1]. ;-)

Best regards,
Fiona


[1] https://github.com/scipy/scipy/issues/26345
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot