Re: Review pkg gmqcc (dependency for Xonotic)

[Simon McVittie <smcv@debian.org>]

On 22/10/13 10:49, Anton Balashov wrote:
> 10/22/13 5:38 AM, David Bate wrote:
>> 1. Should debian/copyright be an exact representation of the
>> copyright information contained within the headder of a file, or
>> is the general license given by upstream sufficient?

The ftp-masters have the final say on whether a package enters Debian;
anything anyone else says about copyright-file requirements (or even
anything Policy says about copyright-file requirements) is, at best,
only advice.

The ftp-masters' requirements are somewhat vague[1], and it's unclear
how much is legally necessary. My understanding is that the copyright
file has multiple purposes: it tells the user what the license terms
are, it reproduces notices that are required to be reproduced in
documentation (e.g. by the BSD license), and the act of constructing the
copyright file forces the packager to review the source files and check
that everything is *actually* DFSG-compliant (e.g. finding non-free
files that were included in a tarball claiming to be GPL'd).

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462996

If the source package identifies copyright holders, then
debian/copyright needs to list all those copyright holders. It's OK to
merge multiple copyright statements: for instance if you have

    src/foo.c: © 2011-2013 Homer Simpson, © 2010-2012 Ned Flanders
    src/bar.c: © 2006-2012 Homer Simpson

then it's considered OK to summarize that as

    Files: src/*.c
    Copyright:
        © 2006-2013 Homer Simpson
        © 2010-2012 Ned Flanders

If a file doesn't explicitly list copyright holders, debian/copyright
should contain some reasonable attempt (probably by including that file
in "Files: *" if you're using machine-readable debian/copyright). As far
as I understand it, you aren't required to use VCS history or other
out-of-band mechanisms to find contributors who didn't add themselves to
the copyright notices, although if you do happen to know that particular
files have additional copyright holders who are not listed, you can
add them. The assumption seems to be that listing more copyright
holders/years than the correct values is OK, but listing fewer is not.

Similarly, for files that have a specific license given,
my understanding is that debian/copyright must list that license. For
files with no licensing information, it's a matter of judgement: if
the file appears to have been written specifically for this project,
it's probably reasonable to assume it's under the project's general
"top-level" license, whereas if it looks as though it came from
elsewhere, you do need to do a bit of research to check that it's
actually OK to distribute under the same license as the rest of the
package.

    S