Avoid '../' when writing license paths to wheel/metadata

Author: abravalheri

setuptools/_core_metadata.py

@@ -207,7 +207,8 @@ def write_field(key, value):
     if self.long_description_content_type:
         write_field('Description-Content-Type', self.long_description_content_type)
 
-    self._write_list(file, 'License-File', self.license_files or [])
+    safe_license_files = map(_safe_license_file, self.license_files or [])
+    self._write_list(file, 'License-File', safe_license_files)
     _write_requirements(self, file)
 
     for field, attr in _POSSIBLE_DYNAMIC_FIELDS.items():
@@ -293,6 +294,14 @@ def _distribution_fullname(name: str, version: str) -> str:
     )
 
 
+def _safe_license_file(file):
+    # XXX: Do we need this after the deprecation discussed in #4892??
+    normalized = os.path.normpath(file).replace(os.sep, "/")
+    if "../" in normalized:
+        return os.path.basename(normalized)  # Temporarily restore pre PEP639 behaviour
+    return normalized
+
+
 _POSSIBLE_DYNAMIC_FIELDS = {
     # Core Metadata Field x related Distribution attribute
     "author": "author",

setuptools/command/bdist_wheel.py

@@ -23,6 +23,7 @@
 from wheel.wheelfile import WheelFile
 
 from .. import Command, __version__, _shutil
+from .._core_metadata import _safe_license_file
 from .._normalization import safer_name
 from ..warnings import SetuptoolsDeprecationWarning
 from .egg_info import egg_info as egg_info_cls
@@ -582,7 +583,8 @@ def adios(p: str) -> None:
 
         licenses_folder_path = os.path.join(distinfo_path, "licenses")
         for license_path in self.license_paths:
-            dist_info_license_path = os.path.join(licenses_folder_path, license_path)
+            safe_path = _safe_license_file(license_path)
+            dist_info_license_path = os.path.join(licenses_folder_path, safe_path)
             os.makedirs(os.path.dirname(dist_info_license_path), exist_ok=True)
             shutil.copy(license_path, dist_info_license_path)