Skip to content

Scaffold Lemma pyqtgraph LGPL pin stubs (PG-07) #189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Travis-Gilbert wants to merge 1 commit into
base: main
Choose a base branch
from
+47 −0
Open

Scaffold Lemma pyqtgraph LGPL pin stubs (PG-07) #189

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# Qt / PySide6 LGPL-3.0 Compliance — Lemma sidecar

CommonPlace selects the **LGPL-3.0-only** dynamic-distribution path for PySide6
`6.11.1` used by the Lemma pyqtgraph helper. GPL and commercial Qt alternatives
are out of scope unless a later Plan decision changes the boundary.

## Notices

- Qt and PySide6 are copyright The Qt Company Ltd. and/or its subsidiaries.
- Distribution must retain LGPL-3.0 notices with the Lemma helper package.
- Users may replace the dynamically linked PySide6 libraries with a compatible
LGPL build; relink instructions: install an alternate PySide6 6.11.1 wheel set
into the sidecar virtualenv and restart the Lemma helper process.
Comment on lines +11 to +13

## Dynamic linking boundary

- Theorem supplies only versioned DatasetVersion / Arrow Flight contracts.
- The Lemma helper is a separately packaged Python process under CommonPlace
desktop ownership; it must not statically link Qt into Theorem MIT crates.

## Source offer

- Corresponding PySide6 / Qt source for the pinned wheels is available from the
upstream PyPI / Qt Company release channels for version `6.11.1`.
- Exact wheel hashes for completed platforms live in `requirements.lock`.
Comment on lines +21 to +25

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate compliance doc =="
fd -a 'QT-LGPL-COMPLIANCE.md|requirements.lock|pyproject.toml' . | sed 's#^\./##'

echo
echo "== target file =="
if [ -f apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md ]; then
  cat -n apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md
fi

echo
echo "== relevant lock lines =="
if [ -f apps/desktop/sidecars/lemma_pyqtgraph/requirements.lock ]; then
  rg -n "PySide6|QT-LGPL|license|sha|hash|pyside6|PySide" apps/desktop/sidecars/lemma_pyqtgraph/requirements.lock -C 3 || true
fi

echo
echo "== any source offer mentions =="
rg -n "source offer|source archive|written offer|Corresponding|PYPI|PyPI|Qt Company|source distribution|qsource|pyside6" . -g 'MD' -g '*.md' -g '*.txt' -g 'requirements*.lock' || true

Repository: Travis-Gilbert/CommonPlace

Length of output: 3377

🌐 Web query:

Qt LGPL source offer distributor must provide source or written offer upstream link insufficient official Qt open source licensing

💡 Result:

Under the terms of the GNU Lesser General Public License (LGPL), which governs the use of Qt in open-source applications, you are required to provide the complete corresponding source code of the Qt libraries used, including any modifications you may have made [1][2]. According to official Qt guidance, simply providing a link to the upstream Qt Project or The Qt Company source code repositories is insufficient [1][2]. The obligation to ensure the source code is available is your responsibility, and it must be under your control [1]. To comply with the LGPL, you must deliver the source code to your users or provide a written offer with clear instructions on how they can obtain it [1][2]. The source code package you provide must be identical to the version of the library you linked against [2]. If you rely on a link to an external server to fulfill your written offer, you assume the risk that the link may become broken, outdated, or altered, which could place you in non-compliance [3]. Because the LGPL explicitly mandates that you—as the distributor—enable the user to re-link your application against a modified version of the library, hosting the specific, corresponding source code yourself is the most reliable way to meet these obligations and ensure long-term compliance [1][4]. Failure to adhere to these obligations results in the loss of your rights to distribute the software under the LGPL [1][2]. For detailed requirements regarding your specific deployment—such as static vs. dynamic linking or embedded systems—you should consult the full text of the LGPLv3 [5] or seek professional legal counsel [2].

Citations:

🌐 Web query:

PyPI PySide6 6.11.1 sdist source distribution available

💡 Result:

As of August 5, 2026, the PySide6 6.11.1 source distribution (sdist) is not available on PyPI [1]. While the PySide6 6.11.1 release is available on PyPI as a wheel distribution [2][1], the project does not publish the source distribution (sdist) to PyPI [1]. The source code for PySide6 6.11.1 is, however, publicly available from official Qt download servers [3][4]. You can access the source distribution (labeled as PySide6-6.11.1-src) via the Qt official releases index [3][4].

Citations:

Provide a CommonPlace-controlled source offer.

An upstream PyPI / Qt-download link is not a valid LGPL source offer. PySide6 6.11.1 does not ship an sdist to PyPI, so add an immutable CommonPlace-hosted source archive or written offer with the exact source revisions, modifications, and user retrieval instructions.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/desktop/sidecars/lemma_pyqtgraph/QT-LGPL-COMPLIANCE.md` around lines 21
- 25, Replace the upstream PyPI/Qt source reference in the “Source offer”
section with an immutable CommonPlace-controlled source archive or written offer
for PySide6/Qt 6.11.1, documenting exact source revisions, applied
modifications, and clear user retrieval instructions; retain the existing
wheel-hash reference.


## Matrix status

- macOS universal PySide6 meta-wheel: verified
`sha256:537682c3b7530817203e667c1f5a2f00486b37bf52c52eeab438544c7a0917f6`
- Linux / Windows (and Addons/Essentials/shiboken6 per-arch hashes): **incomplete**
— PG-07 cannot close until every declared release target is listed.
15 changes: 15 additions & 0 deletions apps/desktop/sidecars/lemma_pyqtgraph/requirements.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# Lemma pyqtgraph helper — pinned requirements (incomplete matrix)

# Package pins from post-core OSS-REUSE / PG-07.
# Full OS/arch hash matrix must be completed before PG-07 claims PySide6 closure.

pyqtgraph==0.14.0 \
--hash=sha256:7abb7c3e17362add64f8711b474dffac5e7b0e9245abdf992e9a44119b7aa4f5

# PySide6 6.11.1 — verified macOS universal meta-wheel only so far.
# TODO(PG-07): add linux/windows (and arch-specific) hashes for:
# PySide6, PySide6_Addons, PySide6_Essentials, shiboken6
PySide6==6.11.1 \
--hash=sha256:537682c3b7530817203e667c1f5a2f00486b37bf52c52eeab438544c7a0917f6

# Incomplete: addons/essentials/shiboken6 platform hashes not yet enumerated.
Loading