hi,

i was at one point the maintainer of a package with thousands of files sourced
from several different projects.  the list of contributors grew to over
fifty separate individuals and it became flat-out impossible, on each
release, to manually verify that the files correctly matched the
debian/copyright file.

i looked in lintian to see if it had the features needed to make a TWO WAY
verification, and it did not.  lintian does not have the capability to
check that:

* the regular expressions of debian/copyright match the actual files
* nor can it report the MISSING files that the reg-ex's do not catch

so i wrote a program called copyright_check.py which covers every single
possibility of what is correctly matched, what is incorrectly matched,
and what is missing.

copies of the original program are being made and distributed arbitrarily.
one such copy (which ironically violates copyright) is here:
https://fossies.org/dox/drizzle-7.2.4-alpha/copyright__check_8py_source.html

one version may also be found here:
https://github.com/jaredly/pyjamas/blob/master/contrib/copyright_check.py

i cannot express how much time and effort the use of this program saved.

Hi Luke,

That's great! I have been looking for such a tool.
of your authorship only in the second file. Neither file shows license
terms.

For Debian's benefit, would you please reply with a statement that the
program is solely your work? Please also attach a copy (not a link) or
alternatively, a pointer to a repository under your control. The copy
you send must further include the terms of your DFSG-compliant license
(preferably GPL-2+, which would be like Lintian) or a statement
placing your work in the public domain. Thank you!

Two more things: First, Lintian runs on Perl. Did you ever port your
program to any other languages? Second, I plan to rework the copyright
check, which has many open bugs. Please let me know if are interested
in helping:

https://salsa.debian.org/lintian/lintian/blob/master/checks/debian/copyright.pm
https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=lintian

Kind regards
Felix Lechner

[apologies i can't reply inline, very limited HTML mailer due to
seriously bandwidth/reliability-compromised internet connection]

hi felix,

violates my copyright by not containing my authorship assertion.  in
combination with no license file they should have contacted me for
permission to distribute.  whoops.  they *assumed* that because it was
in some other work that *was* licensed that it was "okay".

ironic, huh?

yes it's my work (entirely), yes, confirmed, GPLv2+ licensed.
("public domain" statements are *ineffective* due to the very annoying
Berne Convention).  the only modifications that people have made in
the copies that you can find online are to default paths (something
like that, it's been a while).

there is *one* annoying buglet in copyright_check.py: the search
mechanism i couldn't find a way to get it to go from the "root" level
using wildcards.  consequently, you have to use a copyright file that
specifies matches against files and subdirectories, *even if those are
wildcards*.

this is the primary reason why copyright_check.py doesn't "detect"
anything on lintian itself... because lintian's *own* copyright file
is a one-liner-wildcard-match.

a way to get round that would be to take one-liner-wildcard-match
files, do a sweep of the top-level root directory, and apply the
one-liner-wildcard-match to every single entry... *then* pass that
through to the algorithm.

no, god no, i'll never rewrite it in perl: perl is a "WORN" language -
write-once, read-never :)  i'm dead serious.  the readability is so
bad in perl, and the algorithm itself in copyright_check.py
sufficiently obtuse that it would be a... "inadviseable" combination
:)

those false positives look... err fun.  welcome to
arbitrary-pattern-matching against random human-written text: i used
qgrams to help with that, however, just as with when i was working for
Internet Security Systems and we were doing packet-pattern-recognition
it is *guaranteed* to be a losing battle that will *never* be
"complete" or "successful", please do bear that in mind, ok?

with many apologies, i have so much else going on: if you ping me
regularly and keep me interested in a conversation i will respond with
insights and so on (because i like copyright_check.py and the time it
saves), however i simply don't have time to take "initiative" if you
know what i mean, there.

thanks felix.

l.