From aecbecce676fa736803a8ccbea78fc7c318dc968 Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Wed, 12 Aug 2026 16:07:19 +0200
Subject: [PATCH] fix(packaging): canonical SPDX license expression and PEP 639
 build floor

- license = "GPL-3.0-only" instead of the deprecated "GPL-3.0" SPDX
  identifier. Same license, canonical machine-readable spelling; setuptools
  warns on deprecated identifiers and PyPI validates them.
- Build requirement raised to setuptools>=77, the first release implementing
  PEP 639 (a string license holding an SPDX expression, plus license-files).
  setuptools>=68 allowed versions that reject a string license value, so a
  clean-environment build could resolve a setuptools too old for this
  metadata.

Version bumped to 0.2.1 with the matching CHANGELOG section and comparison
links. Verified: 88 tests pass, ruff clean.
---
 CHANGELOG.md             | 17 ++++++++++++++++-
 fileanalyzer/__init__.py |  2 +-
 pyproject.toml           |  6 +++---
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index eb25075..9f48602 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1] — 2026-08-12
+
+### Changed
+- `pyproject.toml`: `license` is now the canonical SPDX expression
+  `GPL-3.0-only` instead of the deprecated `GPL-3.0` identifier. The license
+  itself is unchanged — only its machine-readable spelling.
+- `pyproject.toml`: the build requirement is now `setuptools>=77`, the first
+  release implementing PEP 639 (a string `license` holding an SPDX expression,
+  plus `license-files`). The previous `setuptools>=68` allowed versions that
+  reject a string `license` value, so a build in a clean environment could
+  resolve a setuptools too old to understand this metadata.
+
+---
+
 ## [0.2.0] — 2026-08-04
 
 ### Changed
@@ -62,7 +76,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Test suite: 80 tests, 100% coverage, all network I/O mocked at the
   `hashlookup_utils` / `pandora_utils` boundaries.
 
-[Unreleased]: https://github.com/NC3-TestingPlatform/fileanalyzer/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/NC3-TestingPlatform/fileanalyzer/compare/v0.2.1...HEAD
+[0.2.1]: https://github.com/NC3-TestingPlatform/fileanalyzer/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/NC3-TestingPlatform/fileanalyzer/compare/v0.1.1...v0.2.0
 [0.1.1]: https://github.com/NC3-TestingPlatform/fileanalyzer/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/NC3-TestingPlatform/fileanalyzer/releases/tag/v0.1.0
diff --git a/fileanalyzer/__init__.py b/fileanalyzer/__init__.py
index b3b9c8d..b02d77e 100644
--- a/fileanalyzer/__init__.py
+++ b/fileanalyzer/__init__.py
@@ -8,7 +8,7 @@
 try:
     __version__ = version("fileanalyzer")
 except PackageNotFoundError:  # pragma: no cover
-    __version__ = "0.2.0"
+    __version__ = "0.2.1"
 
 _logging.getLogger("fileanalyzer").addHandler(_logging.NullHandler())
 del _logging
diff --git a/pyproject.toml b/pyproject.toml
index 89b0ed8..b402782 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,14 +1,14 @@
 [build-system]
-requires = ["setuptools>=68", "wheel"]
+requires = ["setuptools>=77", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "fileanalyzer"
-version = "0.2.0"
+version = "0.2.1"
 description = "File analysis — CIRCL hashlookup known-file triage + Pandora deep behavioural analysis"
 readme = "README.md"
 requires-python = ">=3.11"
-license = "GPL-3.0"
+license = "GPL-3.0-only"
 license-files = ["LICENSE"]
 authors = [{ name = "NC3 Luxembourg" }]
 keywords = [