Debian Bug report logs - #864997
lintian: Please add copyright_check.py at the very least as a contrib

Reply or subscribe to this bug.

Display info messages

Message #5 received at [email protected] (full text, mbox, reply):

From: lkcl <[email protected]>

To: Debian Bug Tracking System <[email protected]>

Subject: lintian: please add copyright_check.py at the very least as a contrib

Date: Sun, 18 Jun 2017 15:07:13 +0100

Package: lintian
Version: 2.5.50.1
Severity: wishlist
Tags: upstream

hi,

i was at one point the maintainer of a package with thousands of files sourced
from several different projects.  the list of contributors grew to over
fifty separate individuals and it became flat-out impossible, on each
release, to manually verify that the files correctly matched the
debian/copyright file.

i looked in lintian to see if it had the features needed to make a TWO WAY
verification, and it did not.  lintian does not have the capability to
check that:

* the regular expressions of debian/copyright match the actual files
* nor can it report the MISSING files that the reg-ex's do not catch

so i wrote a program called copyright_check.py which covers every single
possibility of what is correctly matched, what is incorrectly matched,
and what is missing.

copies of the original program are being made and distributed arbitrarily.
one such copy (which ironically violates copyright) is here:
https://fossies.org/dox/drizzle-7.2.4-alpha/copyright__check_8py_source.html

one version may also be found here:
https://github.com/jaredly/pyjamas/blob/master/contrib/copyright_check.py

i cannot express how much time and effort the use of this program saved.

-- System Information:
Debian Release: 7.4
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-3-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages lintian depends on:
ii  binutils                          2.28-2
ii  bzip2                             1.0.6-8.1
ii  diffstat                          1.58-1
ii  file                              1:5.29-3
ii  gettext                           0.18.3.2-1
ii  intltool-debian                   0.35.0+20060710.1
ii  libapt-pkg-perl                   0.1.29+b6
ii  libarchive-zip-perl               1.57-1
ii  libclass-accessor-perl            0.34-1
ii  libclone-perl                     0.38-2+b1
ii  libdpkg-perl                      1.18.18
ii  libemail-valid-perl               1.202-1
ii  libfile-basedir-perl              0.03-1
ii  libipc-run-perl                   0.94-1
ii  liblist-moreutils-perl            0.416-1+b1
ii  libparse-debianchangelog-perl     1.2.0-8
ii  libperl5.22 [libdigest-sha-perl]  5.22.2-1
ii  libperl5.24 [libdigest-sha-perl]  5.24.1-2
ii  libtext-levenshtein-perl          0.13-1
ii  libtimedate-perl                  1.2000-1
ii  liburi-perl                       1.60-1
ii  libyaml-libyaml-perl              0.63-2
ii  man-db                            2.7.0.2-5
ii  patchutils                        0.3.4-2
ii  perl                              5.24.1-2
ii  t1utils                           1.38-4
ii  xz-utils                          5.1.1alpha+20120614-2

Versions of packages lintian recommends:
ii  dpkg                                 1.18.18
ii  libperlio-gzip-perl                  0.19-1+b2
ii  perl                                 5.24.1-2
ii  perl-modules-5.22 [libautodie-perl]  5.22.2-1
ii  perl-modules-5.24 [libautodie-perl]  5.24.1-2

Versions of packages lintian suggests:
ii  binutils-multiarch     2.28-2
ii  dpkg-dev               1.18.18
ii  libhtml-parser-perl    3.72-2+b1
ii  libtext-template-perl  1.46-1

-- no debconf information

Message #12 received at [email protected] (full text, mbox, reply):

From: Felix Lechner <[email protected]>

To: lkcl <[email protected]>

Cc: [email protected]

Subject: DEP-5 copyright checker

Date: Sat, 14 Dec 2019 12:48:41 -0800

Hi Luke,

> so i wrote a program called copyright_check.py which covers every single
> possibility of what is correctly matched, what is incorrectly matched,
> and what is missing.

That's great! I have been looking for such a tool.

> copies of the original program are being made and distributed arbitrarily.
> one such copy (which ironically violates copyright) is here:
> https://fossies.org/dox/drizzle-7.2.4-alpha/copyright__check_8py_source.html
>
> one version may also be found here:
> https://github.com/jaredly/pyjamas/blob/master/contrib/copyright_check.py

Does it violate your copyright or someone else's? I see an assertion
of your authorship only in the second file. Neither file shows license
terms.

For Debian's benefit, would you please reply with a statement that the
program is solely your work? Please also attach a copy (not a link) or
alternatively, a pointer to a repository under your control. The copy
you send must further include the terms of your DFSG-compliant license
(preferably GPL-2+, which would be like Lintian) or a statement
placing your work in the public ___domain. Thank you!

Two more things: First, Lintian runs on Perl. Did you ever port your
program to any other languages? Second, I plan to rework the copyright
check, which has many open bugs. Please let me know if are interested
in helping:

    https://salsa.debian.org/lintian/lintian/blob/master/checks/debian/copyright.pm
    https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=lintian

Kind regards
Felix Lechner

Message #17 received at [email protected] (full text, mbox, reply):

From: Luke Kenneth Casson Leighton <[email protected]>

To: Felix Lechner <[email protected]>

Cc: [email protected]

Subject: Re: DEP-5 copyright checker

Date: Sat, 14 Dec 2019 22:29:47 +0000

[apologies i can't reply inline, very limited HTML mailer due to
seriously bandwidth/reliability-compromised internet connection]

hi felix,

violates my copyright by not containing my authorship assertion.  in
combination with no license file they should have contacted me for
permission to distribute.  whoops.  they *assumed* that because it was
in some other work that *was* licensed that it was "okay".

ironic, huh?

yes it's my work (entirely), yes, confirmed, GPLv2+ licensed.
("public ___domain" statements are *ineffective* due to the very annoying
Berne Convention).  the only modifications that people have made in
the copies that you can find online are to default paths (something
like that, it's been a while).

there is *one* annoying buglet in copyright_check.py: the search
mechanism i couldn't find a way to get it to go from the "root" level
using wildcards.  consequently, you have to use a copyright file that
specifies matches against files and subdirectories, *even if those are
wildcards*.

this is the primary reason why copyright_check.py doesn't "detect"
anything on lintian itself... because lintian's *own* copyright file
is a one-liner-wildcard-match.

a way to get round that would be to take one-liner-wildcard-match
files, do a sweep of the top-level root directory, and apply the
one-liner-wildcard-match to every single entry... *then* pass that
through to the algorithm.

no, god no, i'll never rewrite it in perl: perl is a "WORN" language -
write-once, read-never :)  i'm dead serious.  the readability is so
bad in perl, and the algorithm itself in copyright_check.py
sufficiently obtuse that it would be a... "inadviseable" combination
:)

those false positives look... err fun.  welcome to
arbitrary-pattern-matching against random human-written text: i used
qgrams to help with that, however, just as with when i was working for
Internet Security Systems and we were doing packet-pattern-recognition
it is *guaranteed* to be a losing battle that will *never* be
"complete" or "successful", please do bear that in mind, ok?

with many apologies, i have so much else going on: if you ping me
regularly and keep me interested in a conversation i will respond with
insights and so on (because i like copyright_check.py and the time it
saves), however i simply don't have time to take "initiative" if you
know what i mean, there.

thanks felix.

l.

On 12/14/19, Felix Lechner <[email protected]> wrote:
> Hi Luke,
>
>> so i wrote a program called copyright_check.py which covers every single
>> possibility of what is correctly matched, what is incorrectly matched,
>> and what is missing.
>
> That's great! I have been looking for such a tool.
>
>> copies of the original program are being made and distributed
>> arbitrarily.
>> one such copy (which ironically violates copyright) is here:
>> https://fossies.org/dox/drizzle-7.2.4-alpha/copyright__check_8py_source.html
>>
>> one version may also be found here:
>> https://github.com/jaredly/pyjamas/blob/master/contrib/copyright_check.py
>
> Does it violate your copyright or someone else's? I see an assertion
> of your authorship only in the second file. Neither file shows license
> terms.
>
> For Debian's benefit, would you please reply with a statement that the
> program is solely your work? Please also attach a copy (not a link) or
> alternatively, a pointer to a repository under your control. The copy
> you send must further include the terms of your DFSG-compliant license
> (preferably GPL-2+, which would be like Lintian) or a statement
> placing your work in the public ___domain. Thank you!
>
> Two more things: First, Lintian runs on Perl. Did you ever port your
> program to any other languages? Second, I plan to rework the copyright
> check, which has many open bugs. Please let me know if are interested
> in helping:
>
>
> https://salsa.debian.org/lintian/lintian/blob/master/checks/debian/copyright.pm
>
> https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=lintian
>
> Kind regards
> Felix Lechner
>

Send a report that this bug log contains spam.