dicom3tools 20260901__tar.gz

dicom3tools-20260901/.git_archival.txt

@@ -0,0 +1,4 @@
+node: $Format:%H$
+node-date: $Format:%cI$
+describe-name: $Format:%(describe:tags=true,match=*[0-9]*)$
+ref-names: $Format:%D$

dicom3tools-20260901/.gitattributes

@@ -0,0 +1 @@
+.git_archival.txt  export-subst

dicom3tools-20260901/.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns:
+          - "*"

dicom3tools-20260901/.github/scripts/verify_pins.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""
+Verify that every archive pinned in ``dicom3toolsUrls.cmake`` is still downloadable and still
+has the checksum recorded for it.
+
+This guards the seam between the two layers. The pins point at GitHub release assets, and a
+release can be re-cut with new assets under the same tag. When that happens every wheel job
+fails deep inside CMake with an opaque hash mismatch. Failing here instead says plainly which
+archive moved and what to do about it.
+
+The dicom3tools assets carry no version in their filenames -- every release publishes
+``dicom3tools-linux-x86_64.tar.gz`` and friends -- so the tag is the only thing that says which
+release a pin refers to. That makes two extra checks worth doing here, both of which a
+checksum mismatch would only report as "wrong bytes":
+
+* the tag still parses as ``dicom3tools.<snapshot>[.postN]``, and
+* the snapshot and version recorded alongside the checksums agree with it.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+import sys
+from pathlib import Path
+from urllib.error import HTTPError, URLError
+from urllib.request import urlopen
+
+CMAKE_FILE = Path(__file__).parents[2] / "dicom3toolsUrls.cmake"
+PLATFORMS = ("linux_x86_64", "linux_aarch64", "macos_arm64", "macos_x86_64", "win64")
+TAG_RE = re.compile(r"^dicom3tools\.(?P<snapshot>\d{14})(?:\.post\d+)?$")
+CHUNK = 1 << 20
+
+
+def _scalar(text: str, name: str) -> str:
+    """Read a set(<name> "<literal>") value, ignoring lines that reference variables."""
+    match = re.search(rf'^set\({re.escape(name)}\s+"([^"$]*)"', text, re.MULTILINE)
+    if match is None:
+        msg = f"Could not find a literal value for '{name}' in {CMAKE_FILE.name}"
+        raise SystemExit(msg)
+    return match.group(1)
+
+
+def _check_provenance(text: str, tag: str) -> int:
+    """Confirm the recorded snapshot and version were derived from the pinned tag."""
+    match = TAG_RE.match(tag)
+    if match is None:
+        print(
+            f"::error::pinned tag '{tag}' is not a dicom3tools release tag "
+            "(expected dicom3tools.<14-digit snapshot>[.postN])"
+        )
+        return 1
+
+    snapshot = match.group("snapshot")
+    expected = {
+        "dicom3tools_snapshot": snapshot,
+        "dicom3tools_version": snapshot[:8],
+    }
+
+    failures = 0
+    for name, want in expected.items():
+        got = _scalar(text, name)
+        if got != want:
+            print(f"::error::{name} is '{got}', but tag '{tag}' implies '{want}'")
+            failures += 1
+    return failures
+
+
+def main() -> int:
+    text = CMAKE_FILE.read_text(encoding="utf-8")
+
+    repo = _scalar(text, "DICOM3TOOLS_BINARIES_REPO")
+    tag = _scalar(text, "DICOM3TOOLS_BINARIES_TAG")
+    base = f"https://github.com/{repo}/releases/download/{tag}"
+    print(f"checking pinned archives in {repo}@{tag}\n")
+
+    failures = _check_provenance(text, tag)
+
+    for platform in PLATFORMS:
+        filename = _scalar(text, f"{platform}_filename")
+        expected = _scalar(text, f"{platform}_sha256")
+        url = f"{base}/{filename}"
+        print(f"--- {platform}: {filename}")
+
+        digest = hashlib.sha256()
+        try:
+            with urlopen(url) as response:
+                while chunk := response.read(CHUNK):
+                    digest.update(chunk)
+        except (HTTPError, URLError) as exc:
+            print(f"::error::{filename} could not be downloaded from {base}: {exc}")
+            failures += 1
+            continue
+
+        actual = digest.hexdigest()
+        if actual == expected:
+            print("    ok")
+        else:
+            print(
+                f"::error::{filename} checksum mismatch: pinned {expected}, got {actual}"
+            )
+            failures += 1
+
+    if failures:
+        print(
+            f"\n{failures} problem(s) with the pins. If the release was intentionally "
+            "re-cut, or the pins should move to a newer snapshot, refresh them with:\n"
+            f"    python scripts/update_dicom3tools_urls.py --repo {repo} --tag <tag>"
+        )
+        return 1
+
+    print("\nall pins verified")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

dicom3tools-20260901/.github/workflows/cd.yml

@@ -0,0 +1,171 @@
+name: wheels
+
+# Builds the platform wheels and publishes them to PyPI on release.
+#
+# This workflow does no compiling: it downloads the prebuilt dicom3tools archives pinned in
+# dicom3toolsUrls.cmake and packages them, which is why it finishes in minutes rather than the
+# hours the binaries themselves take. The archives are produced by the build workflows in
+# ImagingDataCommons/dicom3tools and attached to a release there.
+
+on:
+  workflow_dispatch:
+  release:
+    types:
+      - published
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_COLOR: 3
+
+jobs:
+  make_sdist:
+    name: Make SDist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Build SDist
+        run: pipx run build --sdist
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: cibw-sdist
+          path: dist/*.tar.gz
+
+  build_wheels:
+    name: Wheel on ${{ matrix.os }} (${{ matrix.arch }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # One runner per target architecture -- see the note in ci.yml.
+          - os: ubuntu-latest
+            arch: x86_64
+          - os: ubuntu-24.04-arm
+            arch: aarch64
+          - os: macos-15
+            arch: arm64
+          - os: macos-15-intel
+            arch: x86_64
+          - os: windows-latest
+            arch: AMD64
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: pypa/cibuildwheel@v4.2.0
+        env:
+          CIBW_ARCHS: ${{ matrix.arch }}
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@v7
+        with:
+          name: cibw-wheels-${{ matrix.os }}-${{ matrix.arch }}
+          path: wheelhouse/*.whl
+
+  test_sdist:
+    name: Test SDist with python ${{ matrix.python }}
+    needs: [make_sdist]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.10", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python }}
+
+      - uses: actions/download-artifact@v8
+        with:
+          name: cibw-sdist
+          path: dist
+
+      - name: Install SDist and test dependencies
+        run: |
+          pip install pytest pytest-cov
+          pip install dist/*.tar.gz
+          rm -rf dist
+
+      - name: Test installed SDist
+        run: pytest ./tests
+
+  check_dist:
+    name: Check dist
+    needs: [build_wheels, make_sdist, test_sdist]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          path: all
+
+      - run: pipx run twine check --strict all/*/*
+
+      - name: Show wheel tags
+        run: ls -la all/*/*
+
+  # Where a release goes is decided by two things, both read off the GitHub release itself.
+  #
+  # The tag prefix picks out releases *of this package*. Only v-prefixed tags publish, matching
+  # the tag_regex setuptools_scm reads versions from, so any other tag namespace this
+  # repository grows -- and the dicom3tools.<snapshot> tags that name the archives it wraps --
+  # cannot trigger an upload.
+  #
+  # The prerelease flag then picks the index. Mark the release a pre-release (and tag it
+  # v<version>rc<n>) to rehearse on TestPyPI; a full release publishes to PyPI. Nothing goes to
+  # both, so a rehearsal cannot consume the real version number -- which matters because
+  # neither index ever lets a version be reused, even after deletion.
+
+  upload_testpypi:
+    name: Publish to TestPyPI
+    needs: [check_dist]
+    environment: testpypi
+    permissions:
+      id-token: write
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'release' && github.event.action == 'published'
+      && startsWith(github.event.release.tag_name, 'v')
+      && github.event.release.prerelease
+
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: cibw-*
+          path: dist
+          merge-multiple: true
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  upload_pypi:
+    name: Publish to PyPI
+    needs: [check_dist]
+    environment: pypi
+    permissions:
+      id-token: write
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'release' && github.event.action == 'published'
+      && startsWith(github.event.release.tag_name, 'v')
+      && !github.event.release.prerelease
+
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: cibw-*
+          path: dist
+          merge-multiple: true
+
+      - uses: pypa/gh-action-pypi-publish@release/v1

dicom3tools-20260901/.github/workflows/ci.yml

@@ -0,0 +1,83 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_COLOR: 3
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - run: pipx run ruff check --output-format=github .
+      - run: pipx run ruff format --check --diff .
+
+  wheels:
+    name: Wheel on ${{ matrix.os }} (${{ matrix.arch }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # One runner per target architecture: the wheels wrap prebuilt single-architecture
+          # binaries, so there is nothing to cross-compile -- dicom3toolsUrls.cmake picks the
+          # archive from the host processor.
+          - os: ubuntu-latest
+            arch: x86_64
+          # Native arm64 Linux, free for public repositories, and the same runner the binaries
+          # themselves are built on in ImagingDataCommons/dicom3tools.
+          - os: ubuntu-24.04-arm
+            arch: aarch64
+          - os: macos-15
+            arch: arm64
+          - os: macos-15-intel
+            arch: x86_64
+          - os: windows-latest
+            arch: AMD64
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      # Builds the wheel, then runs tests/ against the installed wheel inside cibuildwheel's
+      # test environment (test-command in pyproject.toml). That covers the DICOM round-trip,
+      # so a broken archive pin, a missing tool or a binary that cannot read DICOM fails here
+      # rather than after publishing.
+      - uses: pypa/cibuildwheel@v4.2.0
+        env:
+          CIBW_ARCHS: ${{ matrix.arch }}
+
+      - name: Report wheel tag
+        shell: bash
+        run: ls -la wheelhouse/
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: wheel-${{ matrix.os }}-${{ matrix.arch }}
+          path: wheelhouse/*.whl
+
+  # Guards the seam: confirms the archives named in dicom3toolsUrls.cmake still exist at the
+  # pinned URLs with the pinned checksums, and that the version recorded next to them still
+  # matches the pinned release tag. If the release hosting them is re-cut, this fails with a
+  # clear message instead of every wheel job failing on a hash mismatch.
+  verify_pins:
+    name: Verify archive pins
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Check every pinned archive
+        run: python .github/scripts/verify_pins.py

dicom3tools-20260901/.github/workflows/update-pins.yml

@@ -0,0 +1,143 @@
+name: Update binary pins
+
+# Tracks new dicom3tools releases and opens a PR moving the pins in dicom3toolsUrls.cmake to
+# them.
+#
+# Upstream publishes a snapshot roughly monthly and ImagingDataCommons/dicom3tools cuts a
+# release from it; without something watching, the pins here quietly age and the wheels keep
+# shipping binaries from whenever someone last remembered. This does the mechanical half --
+# checksums, tag, version -- and leaves the judgement (does CI still pass on all five
+# platforms?) to the PR.
+#
+# The PR is deliberately not auto-merged: a new snapshot can add, rename or drop tools, and
+# CMakeLists.txt fails the build if anything in binaries.txt has disappeared. That failure
+# should be read by a person.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "dicom3tools release tag to pin (default: the latest release)"
+        required: false
+        type: string
+  schedule:
+    # Mondays, 06:17 UTC. Off the hour, because scheduled workflows on the hour are the ones
+    # GitHub delays most.
+    - cron: "17 6 * * 1"
+
+permissions:
+  # Enough to push the branch and open the PR. Note that this also needs "Allow GitHub Actions
+  # to create and approve pull requests" enabled in the repository's Actions settings.
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+env:
+  BINARIES_REPO: ImagingDataCommons/dicom3tools
+
+jobs:
+  update:
+    name: Refresh pins
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Work out which release to pin
+        id: target
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REQUESTED_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+
+          if [ -n "$REQUESTED_TAG" ]; then
+            tag="$REQUESTED_TAG"
+          else
+            tag="$(gh api "repos/$BINARIES_REPO/releases/latest" --jq .tag_name)"
+          fi
+          echo "latest release: $tag"
+
+          pinned="$(grep -oP '(?<=^set\(DICOM3TOOLS_BINARIES_TAG ")[^"]*' dicom3toolsUrls.cmake)"
+          echo "currently pinned: $pinned"
+
+          if [ "$tag" = "$pinned" ]; then
+            echo "pins are already at $tag"
+            echo "proceed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # A release exists from the moment the first build workflow finishes, so it can be
+          # seen here with only some of its archives attached. Pinning then is not a failure
+          # worth alerting on -- the next run picks it up complete.
+          missing=""
+          assets="$(gh api "repos/$BINARIES_REPO/releases/tags/$tag" --jq '.assets[].name')"
+          for asset in \
+            dicom3tools-linux-x86_64.tar.gz \
+            dicom3tools-linux-aarch64.tar.gz \
+            dicom3tools-macos-arm64.tar.gz \
+            dicom3tools-macos-x86_64.tar.gz \
+            dicom3tools-windows-x86_64.zip
+          do
+            grep -qxF "$asset" <<<"$assets" || missing="$missing $asset"
+          done
+
+          if [ -n "$missing" ]; then
+            echo "::notice::release $tag is missing$missing -- its build workflows have not all finished. Skipping."
+            echo "proceed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "pinned=$pinned" >> "$GITHUB_OUTPUT"
+          echo "proceed=true" >> "$GITHUB_OUTPUT"
+
+      - name: Rewrite the pins
+        if: steps.target.outputs.proceed == 'true'
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          python scripts/update_dicom3tools_urls.py \
+            --repo "$BINARIES_REPO" --tag "${{ steps.target.outputs.tag }}"
+
+      - name: Confirm the new pins download and match
+        if: steps.target.outputs.proceed == 'true'
+        run: python .github/scripts/verify_pins.py
+
+      - name: Read the new wheel version
+        if: steps.target.outputs.proceed == 'true'
+        id: version
+        run: |
+          set -euo pipefail
+          version="$(grep -oP '(?<=^set\(dicom3tools_version  ")[^"]*' dicom3toolsUrls.cmake)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Open a pull request
+        if: steps.target.outputs.proceed == 'true'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          branch: update-pins
+          base: main
+          add-paths: dicom3toolsUrls.cmake
+          commit-message: "Pin dicom3tools ${{ steps.target.outputs.tag }}"
+          title: "Pin dicom3tools ${{ steps.target.outputs.tag }}"
+          delete-branch: true
+          body: |
+            Moves the binary pins from `${{ steps.target.outputs.pinned }}` to
+            [`${{ steps.target.outputs.tag }}`](https://github.com/${{ env.BINARIES_REPO }}/releases/tag/${{ steps.target.outputs.tag }}).
+
+            Wheels built from this would be version `${{ steps.target.outputs.version }}`.
+
+            Opened automatically by `.github/workflows/update-pins.yml`. Merging it does not
+            publish anything -- releasing is a separate, deliberate step (see the README).
+
+            **What to check before merging:** that CI builds and tests all five wheels. A new
+            upstream snapshot can add, rename or drop programs; if one named in `binaries.txt`
+            is gone, the build fails at configure time with a clear message, and the fix is to
+            update `binaries.txt` and `[project.scripts]` together.

dicom3tools-20260901/.gitignore

@@ -0,0 +1,9 @@
+build/
+dist/
+wheelhouse/
+*.egg-info/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.venv/
+src/dicom3tools/_version.py

dicom3tools-20260901/CMakeLists.txt

@@ -0,0 +1,135 @@
+# Wheel layer: download a prebuilt dicom3tools archive and install its programs into the
+# Python package. No compiling happens here -- the archives are built by the workflows in
+# ImagingDataCommons/dicom3tools and attached to its releases.
+#
+# Structured after the plastimatch, dcmqi and s5cmd python distributions:
+# https://github.com/ImagingDataCommons/plastimatch-python-distributions/blob/main/CMakeLists.txt
+
+cmake_minimum_required(VERSION 3.15...3.26)
+project(${SKBUILD_PROJECT_NAME} LANGUAGES NONE)
+
+# Sets in the current scope:
+# - dicom3tools_archive_url
+# - dicom3tools_archive_sha256
+# - dicom3tools_archive_filename
+# - dicom3tools_snapshot
+# - dicom3tools_version
+include(${CMAKE_CURRENT_SOURCE_DIR}/dicom3toolsUrls.cmake)
+
+message(STATUS "dicom3tools snapshot: ${dicom3tools_snapshot} (version ${dicom3tools_version})")
+message(STATUS "dicom3tools archive: ${dicom3tools_archive_filename}")
+message(STATUS "dicom3tools archive url: ${dicom3tools_archive_url}")
+
+#
+# Download & extract archive
+#
+# The dicom3tools archives are flat: `make install` puts everything in bin/<platform>/ and the
+# build workflows tar that directory's *contents*, so there is no bin/ and no top-level
+# directory inside the archive. Every program lands directly in extract_dir.
+#
+set(download_dir "${PROJECT_BINARY_DIR}")
+set(extract_dir "${PROJECT_BINARY_DIR}/dicom3tools-binary-distribution")
+include(FetchContent)
+FetchContent_Populate(dicom3tools
+  URL ${dicom3tools_archive_url}
+  URL_HASH SHA256=${dicom3tools_archive_sha256}
+  DOWNLOAD_DIR ${download_dir}
+  SOURCE_DIR "${extract_dir}"
+  )
+
+#
+# Install programs
+#
+
+set(_permissions PERMISSIONS
+  OWNER_READ OWNER_WRITE OWNER_EXECUTE
+  GROUP_READ GROUP_EXECUTE
+  WORLD_READ WORLD_EXECUTE
+  )
+
+# Files that are documentation rather than tools. The build workflows copy these in from the
+# source tree so that the license travels with the binaries it covers and the wheel can record
+# which upstream snapshot it wraps.
+set(_documents COPYRIGHT VERSION.txt)
+
+file(GLOB _entries LIST_DIRECTORIES false "${extract_dir}/*")
+
+set(_programs "")
+set(_installed_documents "")
+foreach(_entry IN LISTS _entries)
+  get_filename_component(_name "${_entry}" NAME)
+  if(_name IN_LIST _documents)
+    list(APPEND _installed_documents "${_entry}")
+    continue()
+  endif()
+  # `make install` leaves himrunid behind as a zero byte file -- it is generated from a
+  # template that produces nothing without a site UID. Shipping it would put an unrunnable
+  # file in bin/ for the Python wrapper layer to discover and offer as a callable.
+  file(SIZE "${_entry}" _size)
+  if(_size EQUAL 0)
+    message(STATUS "Skipping empty file: ${_name}")
+    continue()
+  endif()
+  list(APPEND _programs "${_entry}")
+endforeach()
+
+list(LENGTH _programs _program_count)
+if(_program_count EQUAL 0)
+  message(FATAL_ERROR
+    "No programs found in ${dicom3tools_archive_filename}. The archive layout changed: it is "
+    "expected to be flat, with every program at the archive root.")
+endif()
+message(STATUS "Installing ${_program_count} dicom3tools programs")
+
+# The Windows archive carries the Cygwin runtime DLLs the .exe files need alongside them, and
+# they are picked up by the same glob. They have to travel into the wheel in the same directory
+# as the executables or nothing runs on a machine without Cygwin installed.
+install(PROGRAMS ${_programs} DESTINATION "dicom3tools/bin" ${_permissions})
+
+#
+# Check that every program promised a console script is actually here
+#
+# Fail at configure time with a useful message rather than leaving pyproject.toml's
+# [project.scripts] pointing at something the wheel does not contain -- that failure would
+# otherwise surface as a launcher on the user's PATH that raises FileNotFoundError.
+#
+file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/binaries.txt" _wanted REGEX "^[^#]")
+
+set(_missing "")
+foreach(_binary IN LISTS _wanted)
+  string(STRIP "${_binary}" _binary)
+  if(_binary STREQUAL "")
+    continue()
+  endif()
+  # Checked with and without .exe rather than through CMAKE_EXECUTABLE_SUFFIX, which is empty
+  # for a LANGUAGES NONE project: on Windows most tools are .exe, but a few (dcanon, dccmp,
+  # dcdiff) are installed shell scripts and carry no suffix even there.
+  if(NOT EXISTS "${extract_dir}/${_binary}" AND NOT EXISTS "${extract_dir}/${_binary}.exe")
+    list(APPEND _missing "${_binary}")
+  endif()
+endforeach()
+
+if(_missing)
+  string(REPLACE ";" " " _missing_pretty "${_missing}")
+  message(FATAL_ERROR
+    "Programs listed in binaries.txt are not present in ${dicom3tools_archive_filename}: "
+    "${_missing_pretty}. Either the archive is incomplete -- a dicom3tools build that loses "
+    "its awk-generated headers silently drops whole converters -- or the tool was renamed "
+    "upstream and binaries.txt needs updating.")
+endif()
+
+#
+# Install upstream license and provenance
+#
+# dicom3tools is distributed under David Clunie's BSD-style license, which the wheel has to
+# reproduce because it redistributes the binaries in binary form. VERSION.txt records the
+# upstream snapshot the binaries were built from.
+#
+if(_installed_documents)
+  install(FILES ${_installed_documents} DESTINATION "dicom3tools/share")
+else()
+  message(WARNING
+    "Neither COPYRIGHT nor VERSION.txt is present in ${dicom3tools_archive_filename}. Releases "
+    "cut before the build workflows started copying them in do not have them; the wheel will "
+    "be built without the upstream license text.")
+endif()