[Pkg-xen-devel] Bug#1089621: xen: Invalid copyright years "2022-present"

[Hans van Kranenburg]

Hi,

On 12/10/24 03:51, Sean Whitton wrote:
> Source: xen
> Version: 4.17.3+36-g54dacb5c02-1
> Severity: serious
> Justification: Policy 2.3, 4.5, 12.5
> X-Debbugs-CC: ftpmaster at debian.org
> 
> Dear maintainer,
> 
>     Copyright 2022-present Keir Fraser and/or many others"
> 
> is not a valid copyright claim.  Copyright is always time-limited, so it
> simply does not make sense to say "-present".
> 
> Also, our copyright format is already implicitly "and/or" for names
> under a given stanza, so it should be just "and", I think.
> 
> If you're reproducing this from the upstream sources because that's
> what they typed and the GPL requires you to reproduce copyright claims,
> then please take this up with them.
> 
> If this is something that someone came up with for Debian purposes,
> please use
> 
>     Copyright: 2002-2024  Keir Fraser and many others

Yes, this needs some more improvement indeed.

The upstream Copyright situation is quite mad:
https://salsa.debian.org/xen-team/debian-xen/-/blob/experimental/COPYING

If I had to summarize this in two words, it would be "Good Luck!". :)
  "Most files in this repository are licensed" jadija and there are tons
of exceptions scattered around everywhere, have fun discovering them.

There's not even a Copyright statement in COPYING, by the way. Also not
in xen/COPYING. So, this is all a bit confusing for me.

Almost two years ago, I tried to rewrite d/copyright from scratch,
because the previous version was even more incorrect:

https://salsa.debian.org/xen-team/debian-xen/-/commit/72298af566e256afc26a569f39d778b42d68277e

I learned a few things from doing that, but it was also pretty mind
numbing. Apparently, in the end, the text "Copyright: 2002-present Keir
Fraser and/or many others" is something I came up with myself, as some
sort of ultimate summary of all the things I had encountered. And,
probably because I thought the field was mandatory to have... :O

A few days ago, I have been looking around at existing tooling to help
analyzing the upstream source tree. I ended up trying cme /
scan-copyrights which on first try results in a ~3750 line file with 761
different entries...:

https://salsa.debian.org/xen-team/debian-xen/-/commit/dfaea02db1f014ee4c821d3ae9422b410d45fb03

It also shows "Copyright: no-info-found", so maybe that's the answer to
what should be mentioned instead?

Also, if anyone has tips about this... or the best helper tools to
use... appreciated. Or if you know someone who works on one of those
tools... Just point them to src:xen as the ultimate terror test package. :)

.oO(Well, all jokes aside... It's clear that if we want a fully correct
d/copyright file, which can also still be maintained over time, there is
probably no other sane way to do that than having something automated
that can help.)

Hans