How would you feel about adding such additional steps to ensure that the proper version-strings are being set/included for these two packages -- or would you consider the lack-of-version-strings-in-archives to be better addressed upstream for the Tahoe-LAFS and ZKAPAuthorizer projects (rather than here)? In any case, what do you think is the best way to resolve this?

I think doing additional step here generate version numbers in the upstream projects would add a bunch of complexity. For example, we couldn't generate the pinned dependencies by just point pip-compile at the zkapauthorizer tarball[1], so we'd either need to post-process the generated dependencies, or install package twice, once with the pinned dependencies, and then again to overwrite it with one that has version information.

[1] pip doesn't support hashes for git repositories, for example

Needless to say, without accurate version information, it can be difficult for users/devs to determine which version of tahoe is in use and can therefore impede future debugging efforts, etc.

Given that we pin zkapauthorizer here, and pin tahoe-lafs in zkapauthorizer, the version of gridsync is enough to recover the version of zkapauthorizer used, or we could include the pinned version of zkapauthorizer (which is now in an easily parsable format) as data in gridsync.

Also (this is totally minor but I'm curious if there's a deeper reason for this) why Tahoe-LAFS is installing from a zipfile, while ZKAPAuthorizer is installing from a tarball?

No deep reason, zkapauthorizer explicitly depends on a zip (here) but this PR depends explicitly on a tarball.

---

Previously, when building Tahoe-LAFS, I would have to call a python setup.py update_version in order to to force Versioneer to generate its version-string. In the case of ZKAPAuthorizer (which, as far as I can tell, also uses Versioneer) no such additional step was required (however, I see that, even so, the version-string isn't being produced when pip installing from a tarball).

Note that tahoe-lafs is not using versioneer to generate its version, but something similar, hence the difference in behaviour.