Preserve the source license when signing a payload package

Signing replaces the publisher identity, and promotion copied the target's
empty license fields over the source package's recorded license. The resulting
package loaded without a license disclosure. Carry the source license name and
link unless the target publisher supplies one.

Promotion metadata changes only; payloads, executable bytes, and execution
contracts are unchanged.

Validation: 4 conversion promotion tests; 22 native publication and production
signing tests.

Fixes #81
Reported by @mark-yong in #81.

Co-Authored-By: ds41 <noreply@invalid>
Claude-Session: https://claude.com/claude-code/session/01U9WUEevf9AtdEw2XXLGZYY
Design-Signed-Off-By: ds41; design-review=babb

Author: original-el8

docs/signing.md

@@ -106,7 +106,9 @@ with `--development-publisher PATH`. The development private key is unnecessary.
 Signing a payload-format package verifies its source signatures and stored
 payloads, then signs its deployments and ranks under the production identity
 with a fresh package ID. Weight bytes and prepared execution contracts are
-preserved. Executable resources are authenticated, decoded, and re-encoded as
+preserved. The source package's recorded license name and link are preserved;
+signing changes the publisher identity, not the checkpoint's license terms.
+Executable resources are authenticated, decoded, and re-encoded as
 independent zstd level-3 frames; decoded bytes remain exact, while compressed
 frame bytes may change.
 

helios/src/package/conversion.rs

@@ -3206,12 +3206,32 @@ pub fn combine(request: &CombineRequest<'_>) -> Result<crate::package::export::P
         package.payloads.clear();
         package.deployments.clear();
         if let Some(target) = request.target_publisher {
+            // The license describes the checkpoint, not the publisher. A promoted
+            // package keeps the source license unless the target names another.
+            let (source_license_name, source_license_link) = package
+                .publisher
+                .as_ref()
+                .map(|publisher| {
+                    (
+                        publisher.license_name.clone(),
+                        publisher.license_link.clone(),
+                    )
+                })
+                .unwrap_or_default();
             package.publisher = Some(wire::PublisherMetadata {
                 namespace: target.namespace.clone(),
                 official_source: target.official_source.clone(),
                 development: target.development,
-                license_name: target.license_name.clone(),
-                license_link: target.license_link.clone(),
+                license_name: if target.license_name.is_empty() {
+                    source_license_name
+                } else {
+                    target.license_name.clone()
+                },
+                license_link: if target.license_link.is_empty() {
+                    source_license_link
+                } else {
+                    target.license_link.clone()
+                },
                 ranks: 0,
             });
         }
@@ -5049,6 +5069,7 @@ mod tests {
                 namespace: publisher.namespace.clone(),
                 official_source: "https://huggingface.co/example/model".into(),
                 license_name: "Example".into(),
+                license_link: "https://huggingface.co/example/model/LICENSE".into(),
                 ..Default::default()
             }),
             frontend: Some(Default::default()),
@@ -7494,6 +7515,61 @@ mod tests {
         payloads.verify().unwrap();
     }
 
+    #[test]
+    fn promotion_inherits_the_source_license_when_the_target_omits_it() {
+        let scratch = Scratch::new("license-inherit");
+        let rng = SystemRandom::new();
+        let pkcs8 = signature::Ed25519KeyPair::generate_pkcs8(&rng).unwrap();
+        let key = signature::Ed25519KeyPair::from_pkcs8(pkcs8.as_ref()).unwrap();
+        let public_key: [u8; 32] = key.public_key().as_ref().try_into().unwrap();
+        let publisher = Publisher {
+            name: "Example".into(),
+            namespace: "example".into(),
+            public_key,
+            development: false,
+        };
+        let matrix: Vec<u8> = (10..18).collect();
+        let full: Vec<u8> = (0..8).collect();
+        let source = publish_source(
+            &scratch,
+            "license-source",
+            1,
+            &[full.as_slice()],
+            &[matrix.as_slice()],
+            &key,
+            &publisher,
+            "model",
+            false,
+        );
+        let output = scratch.join("license-promoted");
+        let target = TargetPublisher {
+            namespace: "example".into(),
+            official_source: "https://huggingface.co/example/other".into(),
+            development: false,
+            license_name: String::new(),
+            license_link: String::new(),
+        };
+        promote(
+            &source,
+            &output,
+            std::slice::from_ref(&publisher),
+            "example",
+            "example",
+            Some(&target),
+            &key,
+        )
+        .unwrap();
+        let metadata = Metadata::open(&output).unwrap();
+        let envelope = protect::envelope(&metadata.envelope).unwrap();
+        let package = wire::PackageBody::decode(envelope.package_body.as_slice()).unwrap();
+        let publisher = package.publisher.unwrap();
+        assert_eq!(publisher.license_name, "Example");
+        assert_eq!(
+            publisher.license_link,
+            "https://huggingface.co/example/model/LICENSE"
+        );
+    }
+
     #[test]
     fn normalized_relative_falls_back_when_schema_rejects_container_paths() {
         let identity = PayloadId::of(b"normalized-relative");

tests/preparation/test_native_publication.py

@@ -86,6 +86,29 @@ def test_payload_promotion_preserves_rank_and_rebuild_metadata(tmp_path):
     assert after_deployment.rebuild.SerializeToString(deterministic=True) == index.rebuild.SerializeToString(deterministic=True)
 
 
+def test_payload_promotion_preserves_the_source_license(tmp_path):
+    from dataclasses import replace
+    from ignition.preparation.protection import License
+
+    link = 'https://huggingface.co/flare-tests/fixture/blob/main/LICENSE'
+    source_signer = replace(publisher(), license=License('apache-2.0', link))
+    source = publish(tmp_path, source_signer)
+    target = publisher()
+    promoted = tmp_path / 'promoted'
+    payload_promote(
+        source, promoted, publisher=target,
+        profiles=[{'namespace': source_signer.namespace, 'development': False,
+                   'public_key': list(source_signer.public_key)}],
+        accepted=source_signer.namespace, target_accepted=target.namespace,
+        target_publisher=dict(namespace=target.namespace,
+                              official_source=target.official_source,
+                              development=False, license_name='', license_link=''))
+    envelope = verify_signatures(promoted, Ed25519PublicKey.from_public_bytes(target.public_key))
+    package = schema()('PackageBody').FromString(envelope.package_body)
+    assert package.publisher.license_name == 'apache-2.0'
+    assert package.publisher.license_link == link
+
+
 @pytest.mark.parametrize('operation', ['convert', 'sign'])
 def test_cli_rejects_legacy_publication_without_creating_output(tmp_path, operation):
     from types import SimpleNamespace