Clarify that the license key in pyproject.toml should only be set if it is consistent across all distribution files

[brettcannon]

This change is approved at https://discuss.python.org/t/split-from-pep-639-expressing-project-vs-distribution-licenses-post-pep-639-mod-titled/90314/179 .

---

📚 Documentation preview 📚: https://python-packaging-user-guide--1908.org.readthedocs.build/en/1908/

[brettcannon]

The link failure is due to hashicorp.com claiming we are hitting them too hard.

[befeleme]

It matches the agreed clarification.

[rgommers]

This use of "distribution files" seems fairly unclear to me. The key issue to clarify is that license can be specified if wheels built directly from source/sdist with a build frontend (e.g., with python -m build) must have a uniform license expression. However, wheels uploaded to PyPI or other index servers cannot be assumed to have uniform licenses, because they may not have been built by a frontend but further post-processed by a tool like auditwheel, which may change the license.

"distribution files" gives the wrong impression here (to me at least) that it applies to all wheels for a version on an index server.

[brettcannon]

"distribution files" gives the wrong impression here (to me at least) that it applies to all wheels for a version on an index server.

I've tweaked the sentence based on feedback from @pfmoore that hopefully helps.

[rgommers]

This version seems clearer and correct to me, thanks @brettcannon

[brettcannon]

The failure isn't my doing: (tutorials/managing-dependencies: line 29) broken https://www.npmjs.com/ - 403 Client Error: Forbidden for url: https://www.npmjs.com/.

[brettcannon]

@webknjaz is there something you want me to do about the npmjs.com 401 errors to help unblock all of my PRs from failing?

[webknjaz]

I suppose the only way is to add it into linkcheck_ignore. A PR would be welcome.

[brettcannon]

@webknjaz #1928