Subject: DEP-5 copyright checker

From: Felix Lechner <[email-masked]>
Date: Sat, 14 Dec 2019 12:48:41 -0800

Hi Luke,

> so i wrote a program called copyright_check.py which covers every single
> possibility of what is correctly matched, what is incorrectly matched,
> and what is missing.

That's great! I have been looking for such a tool.

> copies of the original program are being made and distributed arbitrarily.
> one such copy (which ironically violates copyright) is here:
> https://fossies.org/dox/drizzle-7.2.4-alpha/copyright__check_8py_source.html
>
> one version may also be found here:
> https://github.com/jaredly/pyjamas/blob/master/contrib/copyright_check.py

Does it violate your copyright or someone else's? I see an assertion
of your authorship only in the second file. Neither file shows license
terms.

For Debian's benefit, would you please reply with a statement that the
program is solely your work? Please also attach a copy (not a link) or
alternatively, a pointer to a repository under your control. The copy
you send must further include the terms of your DFSG-compliant license
(preferably GPL-2+, which would be like Lintian) or a statement
placing your work in the public domain. Thank you!

Two more things: First, Lintian runs on Perl. Did you ever port your
program to any other languages? Second, I plan to rework the copyright
check, which has many open bugs. Please let me know if are interested
in helping:

    https://salsa.debian.org/lintian/lintian/blob/master/checks/debian/copyright.pm
    https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=lintian

Kind regards
Felix Lechner

---

From: Luke Kenneth Casson Leighton <[email-masked]>
Date: Sat, 14 Dec 2019 22:29:47 +0000

[apologies i can't reply inline, very limited HTML mailer due to
seriously bandwidth/reliability-compromised internet connection]

hi felix,

violates my copyright by not containing my authorship assertion.  in
combination with no license file they should have contacted me for
permission to distribute.  whoops.  they *assumed* that because it was
in some other work that *was* licensed that it was "okay".

ironic, huh?

yes it's my work (entirely), yes, confirmed, GPLv2+ licensed.
("public domain" statements are *ineffective* due to the very annoying
Berne Convention).  the only modifications that people have made in
the copies that you can find online are to default paths (something
like that, it's been a while).

there is *one* annoying buglet in copyright_check.py: the search
mechanism i couldn't find a way to get it to go from the "root" level
using wildcards.  consequently, you have to use a copyright file that
specifies matches against files and subdirectories, *even if those are
wildcards*.

this is the primary reason why copyright_check.py doesn't "detect"
anything on lintian itself... because lintian's *own* copyright file
is a one-liner-wildcard-match.

a way to get round that would be to take one-liner-wildcard-match
files, do a sweep of the top-level root directory, and apply the
one-liner-wildcard-match to every single entry... *then* pass that
through to the algorithm.

no, god no, i'll never rewrite it in perl: perl is a "WORN" language -
write-once, read-never :)  i'm dead serious.  the readability is so
bad in perl, and the algorithm itself in copyright_check.py
sufficiently obtuse that it would be a... "inadviseable" combination
:)

those false positives look... err fun.  welcome to
arbitrary-pattern-matching against random human-written text: i used
qgrams to help with that, however, just as with when i was working for
Internet Security Systems and we were doing packet-pattern-recognition
it is *guaranteed* to be a losing battle that will *never* be
"complete" or "successful", please do bear that in mind, ok?

with many apologies, i have so much else going on: if you ping me
regularly and keep me interested in a conversation i will respond with
insights and so on (because i like copyright_check.py and the time it
saves), however i simply don't have time to take "initiative" if you
know what i mean, there.

thanks felix.

l.