fix: correct third-party license inventory

[mckornfield]

Summary

Corrects the published third-party license inventory so the checked-in JSONL matches the reviewed license data for the packages called out by OSRB review. The stale bare LGPL/MIT entries are replaced with the reviewed MPL, UPL, LGPL exception, and composite license expressions.

Changes

• Updates tools/nemo-platform-sdk-tools/src/nemo_platform_sdk_tools/license/overrides.yaml with reviewed license data for certifi, pathspec, psycopg2-binary, tqdm, langchain-oci, greenlet, and regex.
• Regenerates third_party/licenses.jsonl from the updated override data.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with documentation updates
• Documentation only
• Contributor tooling or automation
• CI, build, or test infrastructure

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification: final diff updates reviewed license metadata and the generated inventory only.
• Documentation updated for user-visible behavior
• Documentation not applicable — justification: license inventory metadata only; no user-facing docs changed.

Verification

• Pull request title follows the repository's Conventional Commit format
• Every commit includes an appropriate Signed-off-by: trailer
• uv run pre-commit run -a passes, or any blocked checks are identified below
• Targeted tests pass, or tests are marked not applicable above
• No secrets, API keys, or credentials are included

Targeted validation:

• PYTHONPATH=tools/nemo-platform-sdk-tools/src uv run --no-project --with pyyaml --with requests --with packaging --with typer --with rich python - <<'PY' ... format_licenses(...) ... PY — regenerated third_party/licenses.jsonl from checked-in OSV data and updated overrides.
• jq -r 'select(.name|IN("certifi","pathspec","psycopg2-binary","tqdm","langchain-oci","greenlet","regex")) | @json' third_party/licenses.jsonl — verified corrected rows for all reviewed packages.
• jq -r 'select(.license == "LGPL") | @json' third_party/licenses.jsonl — no output; no bare LGPL rows remain.
• PYTHONPATH=tools/nemo-platform-sdk-tools/src uv run --no-project --with pyyaml --with requests --with packaging --with typer --with rich python - <<'PY' ... find_missing_licenses() ... PY — passed; total packages needing overrides: 0.
• PYTHONPATH=tools/nemo-platform-sdk-tools/src uv run --no-project --with pyyaml python - <<'PY' ... yaml.safe_load(overrides.yaml) ... PY — passed; loaded 190 overrides.
• git diff --check origin/main...HEAD — passed.
• DCO audit over origin/main..HEAD — passed for both commits.
• make update-licenses — blocked before license generation by local Flox/uv sync rebuilding nemo-fabric-runtime; Cargo 1.75.0 cannot parse Rust edition 2024.
• uv run --no-project --with pre-commit pre-commit run -a — blocked during hook environment setup by GitHub returning 503 for https://github.com/norwoodj/helm-docs/ on two attempts.

Summary by CodeRabbit

• Chores
  • Updated recorded licensing information for several third-party dependencies.
  • Refined license classifications using more precise SPDX expressions.
  • Added licensing coverage for an additional dependency.
  • All affected licenses remain marked as compatible.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b4b09ebb-bf50-47eb-bc9b-29c719cc9b2c

📥 Commits

Reviewing files that changed from the base of the PR and between 86336f4 and 67a976b.

📒 Files selected for processing (2)

• third_party/licenses.jsonl
• tools/nemo-platform-sdk-tools/src/nemo_platform_sdk_tools/license/overrides.yaml

---

📝 Walkthrough

Walkthrough

The pull request updates SPDX license expressions for seven dependencies in the license override configuration and recorded license inventory. All affected entries remain marked compatible.

Changes

License metadata

Layer / File(s)	Summary
SPDX override updates tools/nemo-platform-sdk-tools/src/nemo_platform_sdk_tools/license/overrides.yaml	Updates license overrides for certifi, greenlet, langchain-oci, pathspec, psycopg2-binary, regex, and tqdm.
Recorded license updates third_party/licenses.jsonl	Synchronizes the recorded licenses with the updated SPDX expressions, including compound licenses and the OpenSSL exception.

Suggested reviewers: a2bondar

Mergeability Score: ⚪ Minimal · up to 67a97

This change corrects reviewed third-party license metadata and the generated inventory without altering runtime behavior; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the corrected third-party license inventory, which is the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch third-party-lic-nonsense/mck

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	33116/41824	79.2%	63.9%
Integration Tests	N/A	N/A	N/A

[mckornfield]

covered by #1266