Scaffold Lemma pyqtgraph LGPL pin stubs (PG-07) - #189
Conversation
Add requirements.lock and QT-LGPL-COMPLIANCE.md with the verified macOS PySide6 hash; remaining OS/arch hashes stay explicitly incomplete.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📝 WalkthroughWalkthroughThis change adds a new Markdown compliance notice for the Lemma pyqtgraph sidecar. The document defines the PySide6 LGPL distribution boundary, relinking instructions, source-offer references, and a platform hash and status matrix. ChangesLemma sidecar compliance notice
Estimated code review effort: 1 (Trivial) | ~3 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🔵 Human review recommended
It introduces licensing/compliance artifacts and an intentionally incomplete dependency hash matrix that should receive careful human review before merging.
Pull request overview
This PR scaffolds the Lemma pyqtgraph sidecar’s dependency pinning and Qt/PySide6 LGPL compliance documentation, establishing placeholders for a future “post-core” OSS manifest while noting that the platform hash matrix is not yet complete.
Changes:
- Added an initial
requirements.lockwith hashed pins forpyqtgraph==0.14.0and a verified macOS universalPySide6==6.11.1wheel hash (with TODOs for the rest of the matrix). - Added
QT-LGPL-COMPLIANCE.mddocumenting the intended LGPL-3.0 dynamic-link distribution approach and relinking/source guidance.
File summaries
| File | Description |
|---|---|
| apps/desktop/sidecars/lemma_pyqtgraph/requirements.lock | Introduces hashed dependency pins and explicitly marks the OS/arch matrix as incomplete. |
| apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md | Adds LGPL compliance notes and relinking/source-offer guidance for PySide6/Qt in the Lemma sidecar context. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
| - Users may replace the dynamically linked PySide6 libraries with a compatible | ||
| LGPL build; relink instructions: install an alternate PySide6 6.11.1 wheel set | ||
| into the sidecar virtualenv and restart the Lemma helper process. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md`:
- Around line 21-25: Replace the upstream PyPI/Qt source reference in the
“Source offer” section with an immutable CommonPlace-controlled source archive
or written offer for PySide6/Qt 6.11.1, documenting exact source revisions,
applied modifications, and clear user retrieval instructions; retain the
existing wheel-hash reference.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3c2fa728-36e0-463b-8486-229bb52166c6
⛔ Files ignored due to path filters (1)
apps/desktop/sidecars/lemma_pyqtgraph/requirements.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md
| ## Source offer | ||
|
|
||
| - Corresponding PySide6 / Qt source for the pinned wheels is available from the | ||
| upstream PyPI / Qt Company release channels for version `6.11.1`. | ||
| - Exact wheel hashes for completed platforms live in `requirements.lock`. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate compliance doc =="
fd -a 'QT-LGPL-COMPLIANCE.md|requirements.lock|pyproject.toml' . | sed 's#^\./##'
echo
echo "== target file =="
if [ -f apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md ]; then
cat -n apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md
fi
echo
echo "== relevant lock lines =="
if [ -f apps/desktop/sidecars/lemma_pyqtgraph/requirements.lock ]; then
rg -n "PySide6|QT-LGPL|license|sha|hash|pyside6|PySide" apps/desktop/sidecars/lemma_pyqtgraph/requirements.lock -C 3 || true
fi
echo
echo "== any source offer mentions =="
rg -n "source offer|source archive|written offer|Corresponding|PYPI|PyPI|Qt Company|source distribution|qsource|pyside6" . -g 'MD' -g '*.md' -g '*.txt' -g 'requirements*.lock' || trueRepository: Travis-Gilbert/CommonPlace
Length of output: 3377
🌐 Web query:
Qt LGPL source offer distributor must provide source or written offer upstream link insufficient official Qt open source licensing
💡 Result:
Under the terms of the GNU Lesser General Public License (LGPL), which governs the use of Qt in open-source applications, you are required to provide the complete corresponding source code of the Qt libraries used, including any modifications you may have made [1][2]. According to official Qt guidance, simply providing a link to the upstream Qt Project or The Qt Company source code repositories is insufficient [1][2]. The obligation to ensure the source code is available is your responsibility, and it must be under your control [1]. To comply with the LGPL, you must deliver the source code to your users or provide a written offer with clear instructions on how they can obtain it [1][2]. The source code package you provide must be identical to the version of the library you linked against [2]. If you rely on a link to an external server to fulfill your written offer, you assume the risk that the link may become broken, outdated, or altered, which could place you in non-compliance [3]. Because the LGPL explicitly mandates that you—as the distributor—enable the user to re-link your application against a modified version of the library, hosting the specific, corresponding source code yourself is the most reliable way to meet these obligations and ensure long-term compliance [1][4]. Failure to adhere to these obligations results in the loss of your rights to distribute the software under the LGPL [1][2]. For detailed requirements regarding your specific deployment—such as static vs. dynamic linking or embedded systems—you should consult the full text of the LGPLv3 [5] or seek professional legal counsel [2].
Citations:
- 1: https://www.qt.io/faq/qt-open-source-licensing
- 2: https://www.qt.io/development/open-source-lgpl-obligations
- 3: https://opensource.stackexchange.com/questions/8105/license-for-open-source-application-based-on-qt
- 4: https://stackoverflow.com/questions/25165083/how-to-deploy-qt5-application-on-linux-in-compliance-with-lgpl
- 5: https://doc.qt.io/qt-6.8/lgpl.html
🌐 Web query:
PyPI PySide6 6.11.1 sdist source distribution available
💡 Result:
As of August 5, 2026, the PySide6 6.11.1 source distribution (sdist) is not available on PyPI [1]. While the PySide6 6.11.1 release is available on PyPI as a wheel distribution [2][1], the project does not publish the source distribution (sdist) to PyPI [1]. The source code for PySide6 6.11.1 is, however, publicly available from official Qt download servers [3][4]. You can access the source distribution (labeled as PySide6-6.11.1-src) via the Qt official releases index [3][4].
Citations:
- 1: https://pypi.org/project/PySide6/
- 2: https://pypi.org/project/PySide6/6.11.1/
- 3: https://download.qt.io/official_releases/QtForPython/pyside6/
- 4: https://download.qt.io/official_releases/QtForPython/pyside6/?C=S%3BO%3DA
Provide a CommonPlace-controlled source offer.
An upstream PyPI / Qt-download link is not a valid LGPL source offer. PySide6 6.11.1 does not ship an sdist to PyPI, so add an immutable CommonPlace-hosted source archive or written offer with the exact source revisions, modifications, and user retrieval instructions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md` around lines 21
- 25, Replace the upstream PyPI/Qt source reference in the “Source offer”
section with an immutable CommonPlace-controlled source archive or written offer
for PySide6/Qt 6.11.1, documenting exact source revisions, applied
modifications, and clear user retrieval instructions; retain the existing
wheel-hash reference.
Summary
apps/desktop/sidecars/lemma_pyqtgraph/requirements.lockandQT-LGPL-COMPLIANCE.mdfor the post-core OSS manifest.Test plan
OSS-REUSE.mdpinsSummary by CodeRabbit