• doubts about debian/copyrights

    From Fabio Fantoni@21:1/5 to All on Sat Oct 22 16:10:01 2022
    This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------scDVatdIVTlaenjZteIhVC12
    Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64

    SGksIEkgaGFkIGluIHNldmVyYWwgY2FzZXMgd2l0aCBkaWZmaWN1bHRpZXMgd2l0aCBkZWJp YW4vY29weXJpZ2h0IGJ1dCANCmluIG1vc3QgY2FzZXMgd2l0aCB0aGUgaGVscCBvZiBkZWNv cHkgcGx1cyBhbnkgb3RoZXIgbWFudWFsIGNoZWNrcyBhbmQgDQpzZWFyY2hlcywgaW52ZXN0 aW5nIGEgbGl0dGxlIHRpbWUgSSB3YXMgYWJsZSB0byBmaW5kICJ0aGUgc29sdXRpb24iLg0K DQpSZWNlbnRseSBJIGhhZCBtb3JlIGRpZmZpY3VsdCB3aXRoIGxhdGVzdCBwYWNrYWdlcyAo bWludC15LWljb25zIA0KbWludC10aGVtZXMgYW5kIG1pbnQteC1pY29ucykuDQoNClNpbmNl IGRlY29weSBkaWRuJ3Qgc2VlbSBlbm91Z2ggSSB0cmllZCBsaWNlbnNlY2hlY2sgd2hpY2gg c2VlbWVkIHRvIGJlIA0KdGhlIG1vc3QgdXNlZCBpbiBkZWJpYW4gKG9yIGFtIEkgd3Jvbmc/ KSBidXQgaW4gdGhlc2UgY2FzZXMgZ2F2ZSBhIHZlcnkgDQpsb25nIG91dHB1dCAic3RyYW5n ZSIgYW5kIHVudXNhYmxlLCBJIHN1cHBvc2UgZm9yIHVuZXhwZWN0ZWQgY2FzZXMuDQoNCldo aWNoIHdvdWxkIGJlIHRoZSBiZXN0IHRvb2wocykgdG8gZ2V0IGEgZ29vZCBzdGFydGluZyBk ZWJpYW4vY29weXJpZ2h0IA0KYW5kIGRlY3JlYXNlIHRoZSB0aW1lIGl0IHRha2VzIHRvIGNv bXBsZXRlIGFuZCBmaXggaXQ/DQoNCkkgaGF2ZSBvbmUgc3BlY2lmaWMgaXNzdWUgc3RpbGwg bm90IHNvbHZlZCByZWxhdGVkIHRvIG1pbnQteC1pY29uczoNCg0KZGVjb3B5IHNwb3R0ZWQg b25lIGZpbGUgKHVzci9zaGFyZS9pY29ucy9NaW50LVgvYXBwcy85Ni9taXJvLnN2Zykgd2l0 aCANCmxpY2Vuc2UgIkNDLUJZIiwgSSB0cmllZCBhIHNlYXJjaCBmb3IgZm91bmQgdGhlIHNw ZWNpZmljIGxpY2Vuc2UgdXNlZCANCmJ1dCBJIG5vdCBmb3VuZCwgaW4gbWludC10aGVtZSBp bnN0ZWFkIGZvciBleGFtcGxlIGFib3V0IGEgbGljZW5zZSBkb3VidCANCkkgd2VudCB0byBs b29rIGZvciB0aGUgb3JpZ2luIGFuZCBJIGZvdW5kIGl0IGFuZCBzb2x2ZWQgaXQgDQooaHR0 cHM6Ly9zYWxzYS5kZWJpYW4ub3JnL2Npbm5hbW9uLXRlYW0vbWludC10aGVtZXMvLS9jb21t aXQvZGNmNzE5NTFkZjM5ZjMyNmVhOTA1N2QzOTA5NWY3ZTk0OTI2YmYxOSksIA0KcmVnYXJk aW5nIHRoaXMgZmlsZSwgaG93ZXZlciwgdGhlIHNpdGUgbWVudGlvbmVkIGluc2lkZSBubyBs b25nZXIgZXhpc3RzIA0KYW5kIHRoZXJlZm9yZSBJIGhhdmUgbm90IGZvdW5kIGEgY2VydGFp biBhbnN3ZXIuDQoNCnRoZXJlIGFyZSBhbHNvIHNvbWUgb3RoZXIgZmlsZXMgd2l0aCAiY3Jl YXRpdmUgY29tbW9uIiBmb3VuZCBpbnNpZGUgaXQgDQp3aXRoIGEgZ3JlcCBidXQgdGhhdCB3 YXMgbm90IHNwb3R0ZWQgYnkgZGVjb3B5IGFuZCBhbHNvIGluIHRoZXNlIHRoZXJlIA0KYXJl bid0IGRldGFpbHMgb24gdGhlIGV4YWN0IGxpY2Vuc2UNCg0Kd2hhdCBkbyB5b3UgcmVjb21t ZW5kIGFib3V0IGl0Pw0KDQp0aGFua3MgZm9yIGFueSByZXBseQ0KDQo=

    --------------scDVatdIVTlaenjZteIhVC12--

    -----BEGIN PGP SIGNATURE-----

    wsF5BAABCAAjFiEELEHRfLe4S9D5+1GzaAZorpB/EB0FAmNT9yUFAwAAAAAACgkQaAZorpB/EB0v Fg//dpwpJJ2cx2k9+fWkt4rmpBncC58oxRYtMJZnURxlBDOo/a+nx7HOieTdMk7kSRNxwNlaxZtR K3XkZ8Rd3jBk9vMiGVdQWVvv1Ak7fj7oUeQgpMsmVIKashiz7RfPSfwAz1LmUnj3BGw2amhg4HKZ x9UTGMo8kLWiGOTh/VYlY07R9g/PAg7iygXDS7DZW7MpjmKagFNLuT6oEzQITtUfSG3aCOPCTlhD vuxck07RBxOJGFh45U8anIi0I89UA0s8KxxIbr6+dQuPPfP3kIFgghfyzKjls0nClPVzDxNx0uex FStgQwvE4mmFbB3XDFpi0a+s7TRZzqjHYfwAHTqdCKXv4JnHPoZ5B7NoeO2RL4GgfE3FNFFcfbG1 SYeCxqPb3W3oCxiRc9weUSdsnHJGKSuXWgSn84/CWcNpNI8Mapyyu6wosNPn/LeYwrMKtGdTsvPu Kqy5SloX+eo3ImycV0TJJ7DLXeVnkUtqURGD3EQ2yZD4psytOWq9eAgPW+S5vx6rcAzILsHru4SZ H7g6OVVXpoaS7GexJPFhUvzgsmsFq1XZdk03HOw/PVnLJrZ+C8sWIgyp/y3+CXrmCZM/He0Q0uSz G9H+E7cpyDMVq2CffpscaoyHCeBn5VzQ6B0Y0Cgmvx0hBn981ClM3nGalyRqZ3l2ONPCkl9qaFZQ Ihs=
    =KlKj
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andrew M.A. Cater@21:1/5 to Fabio Fantoni on Sat Oct 22 16:30:01 2022
    On Sat, Oct 22, 2022 at 03:59:01PM +0200, Fabio Fantoni wrote:
    Hi, I had in several cases with difficulties with debian/copyright but in most cases with the help of decopy plus any other manual checks and
    searches, investing a little time I was able to find "the solution".

    Recently I had more difficult with latest packages (mint-y-icons mint-themes and mint-x-icons).


    These are the themes and icons from Mint?

    Ask them directly what licenses the files are under - they are "their" files. If they can't find licenses for them, ask them where they got them from and chase back to the original files from wherever they came from.

    A copyright holder can distribute their own work under any combination of license or copyright, obviously, but it might be wise to ask politely. Explain why you're packaging this for Debian - that it will take the load off their mirrors and will also stop people producing mixed systems (FrankenDebian).

    It may also be worth pointing out politely that any license can't be just
    for Debian as other Debian derivates might pick the files up - and any
    license just for Debian automatically goes into Debian non-free.

    Since decopy didn't seem enough I tried licensecheck which seemed to be the most used in debian (or am I wrong?) but in these cases gave a very long output "strange" and unusable, I suppose for unexpected cases.

    Which would be the best tool(s) to get a good starting debian/copyright and decrease the time it takes to complete and fix it?


    licensecheck is probably a fairly good idea anyway.

    I have one specific issue still not solved related to mint-x-icons:

    decopy spotted one file (usr/share/icons/Mint-X/apps/96/miro.svg) with license "CC-BY", I tried a search for found the specific license used but I not found, in mint-theme instead for example about a license doubt I went to look for the origin and I found it and solved it (https://salsa.debian.org/cinnamon-team/mint-themes/-/commit/dcf71951df39f326ea9057d39095f7e94926bf19),
    regarding this file, however, the site mentioned inside no longer exists and therefore I have not found a certain answer.


    Does the site exist on the Wayback Machine / Internet Archive?
    If you can't be sure, then you may be unable to distribute the file. Again,
    ask Mint because they must have packaged it originally.

    there are also some other files with "creative common" found inside it with
    a grep but that was not spotted by decopy and also in these there aren't details on the exact license


    Contact Mint / the original authors. Unfortunately, there's no substitute for the information, I think.

    what do you recommend about it?

    thanks for any reply


    With every good wish, as ever,

    Andy Cater

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul Wise@21:1/5 to Fabio Fantoni on Sun Oct 23 04:10:01 2022
    On Sat, 2022-10-22 at 15:59 +0200, Fabio Fantoni wrote:

    Which would be the best tool(s) to get a good starting debian/copyright
    and decrease the time it takes to complete and fix it?

    Allegedly scancode is the best option for that, but it isn't in Debian.
    I think decopy/licensecheck are the best ones already in Debian.

    https://wiki.debian.org/CopyrightReviewTools https://github.com/nexB/scancode-toolkit/

    Personally I afterwards manually review each file and check all of the
    details, since the Debian archive admins will be doing that anyway.
    I find that a keyboard-driven file manager like mc works for this.

    decopy spotted one file (usr/share/icons/Mint-X/apps/96/miro.svg) with license "CC-BY", I tried a search for found the specific license used
    but I not found, in mint-theme instead for example about a license doubt
    I went to look for the origin and I found it and solved it (https://salsa.debian.org/cinnamon-team/mint-themes/-/commit/dcf71951df39f326ea9057d39095f7e94926bf19),
    regarding this file, however, the site mentioned inside no longer exists
    and therefore I have not found a certain answer.

    All the sites mentioned in that commit work for me:

    https://github.com/shimmerproject/Greybird
    https://shimmerproject.org/

    there are also some other files with "creative common" found inside it
    with a grep but that was not spotted by decopy and also in these there aren't details on the exact license

    Might be worth filing bugs on decopy about these missing detections.

    As Andrew says, best ask upstream about any unclear licenses.

    --
    bye,
    pabs

    https://wiki.debian.org/PaulWise

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEYQsotVz8/kXqG1Y7MRa6Xp/6aaMFAmNUoS8ACgkQMRa6Xp/6 aaNc+Q/8DtMooBfuKK4IIL+GBU3p+k14RR7/2O0aMnHvO0146/eWX2Sc5eyHMlUu XvAqlfs+5SoH7w/vNvXrY23H/4Vr2OJ1HRc6j4DjbRXJJEmu/7GoTc6KMiCyZAQ2 TvdrdULmQjiVz//3gaDLp0siDcaqJd+tzfY7Bvc4pMSikjox01ATDlHeN9+cmv1A XWIXcuUdSmBbn/3DFFsX7kteXqzuO+/7yO+Y7H4haJ62VKjZRbdTLGmwhx1Vm3Wl wW1gvnkbGfD7DOimWTGoQyi+GYZLTouP3IlAQJxNijmCd6M9NjD2TNRKix638ix4 R1nIpEtmg3q30rhH8JQtgloVO9dJmKrCDLmyVNUgZ6/wsyYz0hXY3Blnqslc54nO DN53v7P/spbziVAT+ECLbht8mt6+ynhpEolJf5jXNbvYJcofURlhY0UuhR17N9bq rkWK3Yk4uXB04uMwv8dx/VNH5eyoDkaDye0HubUYVrWunAu+i8HzQDcy3YDwmazl CsEuqKnJdpQHAeByGrhmR1D4Bxso97A0Nz1lbpqsu4QKy3XpnehHQlxbwcYSyj61 KUeOjZ+gzdMVqPTGaJ1eQFCZ0+syrpIvvaZ1gehyCN4Jdou0Ma19ctITKpEOkfuE T3hLfsGEnJqQWLveDCztCMVhskLAXq1PUNtbJ5t6J+0iYbABwxQ=
    =0P2I
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Soren Stoutner@21:1/5 to All on Sat Oct 22 21:24:47 2022
    This is a multi-part message in MIME format.

    --nextPart1871769.UEpP4bBZgo
    Content-Transfer-Encoding: 7Bit
    Content-Type: text/plain; charset="us-ascii"

    On Saturday, October 22, 2022 7:04:37 PM MST Paul Wise wrote:
    Allegedly scancode is the best option for that, but it isn't in Debian.
    I think decopy/licensecheck are the best ones already in Debian.

    I have seen this mentioned several times, but I have not seen any explanation as to
    why. It seems that the large number of dependencies is the reason.

    https://wiki.debian.org/JelmerVernooij/scancode[1]

    --
    Soren Stoutner
    [email protected]

    --------
    [1] https://wiki.debian.org/JelmerVernooij/scancode

    --nextPart1871769.UEpP4bBZgo
    Content-Transfer-Encoding: 7Bit
    Content-Type: text/html; charset="us-ascii"

    <html>
    <head>
    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
    </head>
    <body><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">On Saturday, October 22, 2022 7:04:37 PM MST Paul Wise wrote:</p>
    <p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">&gt; Allegedly scancode is the best option for that, but it isn't in Debian.</p>
    <p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">&gt; I think decopy/licensecheck are the best ones already in Debian.</p>
    <br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">I have seen this mentioned several times, but I have not seen any explanation as to why.&nbsp; It seems that the large number of dependencies is the reason.</p>
    <br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><a href="https://wiki.debian.org/JelmerVernooij/scancode">https://wiki.debian.org/JelmerVernooij/scancode</a></p>
    <br /><p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">-- </p>
    <p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Soren Stoutner</p>
    <p style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">[email protected]</p>
    </body>
    </html>
    --nextPart1871769.UEpP4bBZgo--

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEJKVN2yNUZnlcqOI+wufLJ66wtgMFAmNUwg8ACgkQwufLJ66w tgPyxxAArKCH6Ps2O3N2wY7/oNXCWyk7gBKN7kslYA3nfTHLOCfoZv748SRJ967Q 4jJkboilnWVz8OLXPVv/tZp/kyK31H5rQth9ctxXWYMrqEGFgZxDPA61Y1smx9Ro Z5Djgpt+ESpIJovQLBIgQ+0lMKWV2jCxwHeunA5hcSY+AxHwpD/RxMJ/cokzn6TU ENPccO2QE88hpaakpE9ORg8xLvVXTGwIujA8YL/Nxn9gVIEmIn0rrDRfZwiqW/NT ZTrW/CRYfCu1JvxA4+zU8yjoaKUJ0U+NZWVVFzLoBmeKdZnd9e5EVL54oyklj4Lr E/FAu0dfmYRQiQtEC927w6bSIzyLPlP1laOqrpoIrPG23KW5ZeyTNr1Zp20iluEf 6LB/TB6GNOA364y2Gy+sH4NqP6rV6rB4LFZaqw7IImJMsu3zyN8RzBfdY+7g0C7W yfH9/meLkteut/ZSmN7ZOK7Ii3mqeyClW08JRwIHWqSV5f0f2R2iFIycDctto1Hd 2uWxJinqjtS8xHWu240L0l8imKMWfeAFCinqNDz61dfNHpYCERvbCg/PjaMe4YUz u5XUBPjF5iLflKpjqIdcpMNXYk/xpE10LqeSJimIbGF5agNu1w+oib84VIhpkayF D76BkvmMyXdw7yABTeBf9SqFJDQRtQNvFroT/wj/Us7aiIcKclg=
    =QYBi
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Fabio Fantoni@21:1/5 to All on Sun Oct 23 15:40:04 2022
    To: [email protected] (Paul Wise)

    This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------432gxUIAJRjqxs7g6PmQICWw
    Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64

    SWwgMjMvMTAvMjAyMiAwNDowNCwgUGF1bCBXaXNlIGhhIHNjcml0dG86DQo+IE9uIFNhdCwg MjAyMi0xMC0yMiBhdCAxNTo1OSArMDIwMCwgRmFiaW8gRmFudG9uaSB3cm90ZToNCj4NCj4+ IFdoaWNoIHdvdWxkIGJlIHRoZSBiZXN0IHRvb2wocykgdG8gZ2V0IGEgZ29vZCBzdGFydGlu ZyBkZWJpYW4vY29weXJpZ2h0DQo+PiBhbmQgZGVjcmVhc2UgdGhlIHRpbWUgaXQgdGFrZXMg dG8gY29tcGxldGUgYW5kIGZpeCBpdD8NCj4gQWxsZWdlZGx5IHNjYW5jb2RlIGlzIHRoZSBi ZXN0IG9wdGlvbiBmb3IgdGhhdCwgYnV0IGl0IGlzbid0IGluIERlYmlhbi4NCj4gSSB0aGlu ayBkZWNvcHkvbGljZW5zZWNoZWNrIGFyZSB0aGUgYmVzdCBvbmVzIGFscmVhZHkgaW4gRGVi aWFuLg0KPg0KPiBodHRwczovL3dpa2kuZGViaWFuLm9yZy9Db3B5cmlnaHRSZXZpZXdUb29s cw0KPiBodHRwczovL2dpdGh1Yi5jb20vbmV4Qi9zY2FuY29kZS10b29sa2l0Lw0KPg0KPiBQ ZXJzb25hbGx5IEkgYWZ0ZXJ3YXJkcyBtYW51YWxseSByZXZpZXcgZWFjaCBmaWxlIGFuZCBj aGVjayBhbGwgb2YgdGhlDQo+IGRldGFpbHMsIHNpbmNlIHRoZSBEZWJpYW4gYXJjaGl2ZSBh ZG1pbnMgd2lsbCBiZSBkb2luZyB0aGF0IGFueXdheS4NCj4gSSBmaW5kIHRoYXQgYSBrZXli b2FyZC1kcml2ZW4gZmlsZSBtYW5hZ2VyIGxpa2UgbWMgd29ya3MgZm9yIHRoaXMuDQoNClRo YW5rcyBmb3IgcmVwbHksIHNvbWUgbWFudWFsIGNoZWNrcyBjYW4gYmUgb2ssIGJ1dCB3aGVu IHlvdSBzdGFydCANCmhhdmluZyBkaWZmaWN1bHRpZXMgYW5kIGl0IHRha2VzIG1vcmUgdGlt ZSBmb3IgZGViaWFuL2NvcHlyaWdodCBhbG9uZSANCnRoYW4gYWxsIHRoZSByZXN0IG9mIHRo ZSBwYWNrYWdpbmcgSSB0aGluayBpdCBpcyB1bnBsZWFzYW50IGFuZCANCnVucHJvZHVjdGl2 ZS4NCg0KdGhlbiB3aGVuIHRoZSBmaWxlcyBhcmUgdGhvdXNhbmRzIG9yIG1vcmUgbWFudWFs bHkgY2hlY2tpbmcgZWFjaCBvbmUgDQp3b3VsZCBiZSBpbXBvc3NpYmxlIGFzIHRpbWUNCg0K Pg0KPj4gZGVjb3B5IHNwb3R0ZWQgb25lIGZpbGUgKHVzci9zaGFyZS9pY29ucy9NaW50LVgv YXBwcy85Ni9taXJvLnN2Zykgd2l0aA0KPj4gbGljZW5zZSAiQ0MtQlkiLCBJIHRyaWVkIGEg c2VhcmNoIGZvciBmb3VuZCB0aGUgc3BlY2lmaWMgbGljZW5zZSB1c2VkDQo+PiBidXQgSSBu b3QgZm91bmQsIGluIG1pbnQtdGhlbWUgaW5zdGVhZCBmb3IgZXhhbXBsZSBhYm91dCBhIGxp Y2Vuc2UgZG91YnQNCj4+IEkgd2VudCB0byBsb29rIGZvciB0aGUgb3JpZ2luIGFuZCBJIGZv dW5kIGl0IGFuZCBzb2x2ZWQgaXQNCj4+IChodHRwczovL3NhbHNhLmRlYmlhbi5vcmcvY2lu bmFtb24tdGVhbS9taW50LXRoZW1lcy8tL2NvbW1pdC9kY2Y3MTk1MWRmMzlmMzI2ZWE5MDU3 ZDM5MDk1ZjdlOTQ5MjZiZjE5KSwNCj4+IHJlZ2FyZGluZyB0aGlzIGZpbGUsIGhvd2V2ZXIs IHRoZSBzaXRlIG1lbnRpb25lZCBpbnNpZGUgbm8gbG9uZ2VyIGV4aXN0cw0KPj4gYW5kIHRo ZXJlZm9yZSBJIGhhdmUgbm90IGZvdW5kIGEgY2VydGFpbiBhbnN3ZXIuDQo+IEFsbCB0aGUg c2l0ZXMgbWVudGlvbmVkIGluIHRoYXQgY29tbWl0IHdvcmsgZm9yIG1lOg0KPg0KPiBodHRw czovL2dpdGh1Yi5jb20vc2hpbW1lcnByb2plY3QvR3JleWJpcmQNCj4gaHR0cHM6Ly9zaGlt bWVycHJvamVjdC5vcmcvDQoNCnRoZSBjb21taXQgbGlua2VkIGFib3V0IG1pbnQtdGhlbWUg d2FzIGEgc2VhcmNoIEkgZGlkIHN1Y2Nlc3NmdWxsIChhcyANCmV4YW1wbGUpIGludGVhZCBh Ym91dCBtaW50LXgtaWNvbnMgd2FzIG5vdA0KDQo+DQo+PiB0aGVyZSBhcmUgYWxzbyBzb21l IG90aGVyIGZpbGVzIHdpdGggImNyZWF0aXZlIGNvbW1vbiIgZm91bmQgaW5zaWRlIGl0DQo+ PiB3aXRoIGEgZ3JlcCBidXQgdGhhdCB3YXMgbm90IHNwb3R0ZWQgYnkgZGVjb3B5IGFuZCBh bHNvIGluIHRoZXNlIHRoZXJlDQo+PiBhcmVuJ3QgZGV0YWlscyBvbiB0aGUgZXhhY3QgbGlj ZW5zZQ0KPiBNaWdodCBiZSB3b3J0aCBmaWxpbmcgYnVncyBvbiBkZWNvcHkgYWJvdXQgdGhl c2UgbWlzc2luZyBkZXRlY3Rpb25zLg0KDQpkb25lLCBzZWVtcyB0aGF0IGRlY29weSBzcG90 dGVkIG9ubHkgdGhlIG9uZSBmaWxlIHdpdGg6DQoNCjwhLS0gTGljZW5zZTogY3JlYXRpdmUg Y29tbW9ucyBhdHRyaWJ1dGlvbiAtLT4NCg0KYW5kIG5vdDoNCg0KeG1sbnM6Y2M9Imh0dHA6 Ly9jcmVhdGl2ZWNvbW1vbnMub3JnL25zIyINCg0KdGhhdCB3aXRoIGEgZ3JlcCBzZWVtcyBp biAxODcyIGZpbGVzDQoNCj4NCj4gQXMgQW5kcmV3IHNheXMsIGJlc3QgYXNrIHVwc3RyZWFt IGFib3V0IGFueSB1bmNsZWFyIGxpY2Vuc2VzLg0KPg0KZG9uZQ0KDQo=

    --------------432gxUIAJRjqxs7g6PmQICWw--

    -----BEGIN PGP SIGNATURE-----

    wsF5BAABCAAjFiEELEHRfLe4S9D5+1GzaAZorpB/EB0FAmNVQ/MFAwAAAAAACgkQaAZorpB/EB3N Zw/5AY6y0p5UAyiPaF6Kvety6jMdq/vKauTf3NUzP0whNk7ZvKmATQVJUbRJKozZkKiWN5bq0yRk nCEldXqP29jMjVmEcCZXkCnxmF48aQiEUXI6ESFtMCBFji/T7m8fobXu45PqERaHxrgXQ5kdbT3D Lk2uSwwSSVWmoYPqiHWRQNeUPItLpQwwkqSWFRXg/a5r3g9MGIBa3rYsqtaStEo+jrctxX5T/QET yuzLQy02NrTCaDLI1yEnSEtEoYj80Kd2GYXNXApMX0+PPx0Wz528aI88vY1MIcXYzMv+6zBbbYKv Jv2OJsvuVrUTf8gM/z0PhpF5OiJuCBimLNS74gPCSQb5wKQAvwqizTk8QosP476HL9JYhgmCcH4d /QsP74OO/hVzgdcwcUxkK8KKS+pUUEjzE+WBOuGB6sRHGZuAzi/lNF3tRQ3Y8EaMzE5zkG7yxt8X pobVTxPlWT5Ba7h3z1eMhQtz1P2nd923vmcroILFdZAVT7kCSAYV9VgApAgCEzn0v17ALqn/eTPc pmplNhYJrkF/1oDrTdTkuqBOo3mGigdfP4tcikyUWz9wpZeaFIEF9tqjIXMVSKbP8RnOYtTQayna sLJMdGBAmLSRS/YDMWrIbV+nt1dtZ+lp2uHaQ/wXqO48N55vELgzzq0Mkg9B4L3umA7G2QCEvXTK kf8=
    =l/E0
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ryan Pavlik@21:1/5 to [email protected] on Sun Oct 23 19:10:01 2022
    To be honest, the copyright file always is the most time consuming part of packaging for Debian, at least for me. So that's not really unexpected, dh handles most other issues as long as you don't have to rewrite the upstream build system. (Making a Debian package can be pretty quick. Making a
    package to submit to the Debian project takes a lot longer)

    I figure it's worth it as it makes the packages in Debian higher quality
    and better understood, though I do wish that more projects did things like https://reuse.software (standard for having copyright and license data in
    every file, etc) and that Debian tooling handled this format or spdx data better. (I've written some quick utilities to help with this but they
    aren't very polished).

    Don't get discouraged! Especially since there is an upstream in this case
    who should be fairly easy to find and contact, it's a project and not just
    one person with an outdated email address...

    Ryan

    On Sun, Oct 23, 2022, 8:39 AM Fabio Fantoni <[email protected]> wrote:

    Il 23/10/2022 04:04, Paul Wise ha scritto:
    On Sat, 2022-10-22 at 15:59 +0200, Fabio Fantoni wrote:

    Which would be the best tool(s) to get a good starting debian/copyright
    and decrease the time it takes to complete and fix it?
    Allegedly scancode is the best option for that, but it isn't in Debian.
    I think decopy/licensecheck are the best ones already in Debian.

    https://wiki.debian.org/CopyrightReviewTools https://github.com/nexB/scancode-toolkit/

    Personally I afterwards manually review each file and check all of the details, since the Debian archive admins will be doing that anyway.
    I find that a keyboard-driven file manager like mc works for this.

    Thanks for reply, some manual checks can be ok, but when you start
    having difficulties and it takes more time for debian/copyright alone
    than all the rest of the packaging I think it is unpleasant and
    unproductive.

    then when the files are thousands or more manually checking each one
    would be impossible as time


    decopy spotted one file (usr/share/icons/Mint-X/apps/96/miro.svg) with
    license "CC-BY", I tried a search for found the specific license used
    but I not found, in mint-theme instead for example about a license doubt >> I went to look for the origin and I found it and solved it
    ( https://salsa.debian.org/cinnamon-team/mint-themes/-/commit/dcf71951df39f326ea9057d39095f7e94926bf19
    ),
    regarding this file, however, the site mentioned inside no longer exists >> and therefore I have not found a certain answer.
    All the sites mentioned in that commit work for me:

    https://github.com/shimmerproject/Greybird
    https://shimmerproject.org/

    the commit linked about mint-theme was a search I did successfull (as example) intead about mint-x-icons was not


    there are also some other files with "creative common" found inside it
    with a grep but that was not spotted by decopy and also in these there
    aren't details on the exact license
    Might be worth filing bugs on decopy about these missing detections.

    done, seems that decopy spotted only the one file with:

    <!-- License: creative commons attribution -->

    and not:

    xmlns:cc="http://creativecommons.org/ns#"

    that with a grep seems in 1872 files


    As Andrew says, best ask upstream about any unclear licenses.

    done



    <div dir="auto">To be honest, the copyright file always is the most time consuming part of packaging for Debian, at least for me. So that&#39;s not really unexpected, dh handles most other issues as long as you don&#39;t have to rewrite the upstream
    build system. (Making a Debian package can be pretty quick. Making a package to submit to the Debian project takes a lot longer)<div dir="auto"><br></div><div dir="auto">I figure it&#39;s worth it as it makes the packages in Debian higher quality and
    better understood, though I do wish that more projects did things like <a href="https://reuse.software">https://reuse.software</a> (standard for having copyright and license data in every file, etc) and that Debian tooling handled this format or spdx
    data better. (I&#39;ve written some quick utilities to help with this but they aren&#39;t very polished).</div><div dir="auto"><br></div><div dir="auto">Don&#39;t get discouraged! Especially since there is an upstream in this case who should be fairly
    easy to find and contact, it&#39;s a project and not just one person with an outdated email address...</div><div dir="auto"><br></div><div dir="auto">Ryan</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Oct 23, 2022, 8:
    39 AM Fabio Fantoni &lt;<a href="mailto:[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Il 23/10/2022 04:04, Paul Wise ha
    scritto:<br>
    &gt; On Sat, 2022-10-22 at 15:59 +0200, Fabio Fantoni wrote:<br>
    &gt;<br>
    &gt;&gt; Which would be the best tool(s) to get a good starting debian/copyright<br>
    &gt;&gt; and decrease the time it takes to complete and fix it?<br>
    &gt; Allegedly scancode is the best option for that, but it isn&#39;t in Debian.<br>
    &gt; I think decopy/licensecheck are the best ones already in Debian.<br> &gt;<br>
    &gt; <a href="https://wiki.debian.org/CopyrightReviewTools" rel="noreferrer noreferrer" target="_blank">https://wiki.debian.org/CopyrightReviewTools</a><br>
    &gt; <a href="https://github.com/nexB/scancode-toolkit/" rel="noreferrer noreferrer" target="_blank">https://github.com/nexB/scancode-toolkit/</a><br>
    &gt;<br>
    &gt; Personally I afterwards manually review each file and check all of the<br> &gt; details, since the Debian archive admins will be doing that anyway.<br> &gt; I find that a keyboard-driven file manager like mc works for this.<br>

    Thanks for reply, some manual checks can be ok, but when you start <br>
    having difficulties and it takes more time for debian/copyright alone <br>
    than all the rest of the packaging I think it is unpleasant and <br> unproductive.<br>

    then when the files are thousands or more manually checking each one <br>
    would be impossible as time<br>

    &gt;<br>
    &gt;&gt; decopy spotted one file (usr/share/icons/Mint-X/apps/96/miro.svg) with<br>
    &gt;&gt; license &quot;CC-BY&quot;, I tried a search for found the specific license used<br>
    &gt;&gt; but I not found, in mint-theme instead for example about a license doubt<br>
    &gt;&gt; I went to look for the origin and I found it and solved it<br> &gt;&gt; (<a href="https://salsa.debian.org/cinnamon-team/mint-themes/-/commit/dcf71951df39f326ea9057d39095f7e94926bf19" rel="noreferrer noreferrer" target="_blank">https://salsa.debian.org/cinnamon-team/mint-themes/-/commit/
    dcf71951df39f326ea9057d39095f7e94926bf19</a>),<br>
    &gt;&gt; regarding this file, however, the site mentioned inside no longer exists<br>
    &gt;&gt; and therefore I have not found a certain answer.<br>
    &gt; All the sites mentioned in that commit work for me:<br>
    &gt;<br>
    &gt; <a href="https://github.com/shimmerproject/Greybird" rel="noreferrer noreferrer" target="_blank">https://github.com/shimmerproject/Greybird</a><br>
    &gt; <a href="https://shimmerproject.org/" rel="noreferrer noreferrer" target="_blank">https://shimmerproject.org/</a><br>

    the commit linked about mint-theme was a search I did successfull (as <br> example) intead about mint-x-icons was not<br>

    &gt;<br>
    &gt;&gt; there are also some other files with &quot;creative common&quot; found inside it<br>
    &gt;&gt; with a grep but that was not spotted by decopy and also in these there<br>
    &gt;&gt; aren&#39;t details on the exact license<br>
    &gt; Might be worth filing bugs on decopy about these missing detections.<br>

    done, seems that decopy spotted only the one file with:<br>

    &lt;!-- License: creative commons attribution --&gt;<br>

    and not:<br>

    xmlns:cc=&quot;<a href="http://creativecommons.org/ns#" rel="noreferrer noreferrer" target="_blank">http://creativecommons.org/ns#</a>&quot;<br>

    that with a grep seems in 1872 files<br>

    &gt;<br>
    &gt; As Andrew says, best ask upstream about any unclear licenses.<br>
    &gt;<br>
    done<br>

    </blockquote></div>

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)