Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow to curate copyrights directly (not via authors) #4519

Open
sschuberth opened this issue Sep 30, 2021 · 5 comments · May be fixed by #5680
Open

Allow to curate copyrights directly (not via authors) #4519

sschuberth opened this issue Sep 30, 2021 · 5 comments · May be fixed by #5680
Labels
enhancement Issues that are considered to be enhancements model About the data model

Comments

@sschuberth
Copy link
Member

adding the Copyright holder statements to the org.ossreviewtoolkit.model.PackageCurationData entity

FYI, I just pushed my local curate-copyrights branch which trivially starts doing that.

@rbieniek do you want to take over that branch of mine?

Originally posted by @sschuberth in #4463 (comment)
@sschuberth sschuberth added enhancement Issues that are considered to be enhancements model About the data model labels Sep 30, 2021
@sschuberth sschuberth mentioned this issue Sep 30, 2021
Merged
@tsteenbe
Copy link
Member

tsteenbe commented Oct 7, 2021 •
edited

Being able to curate copyright holders would be really useful but are you thinking of implementing it in curations.yml or package configurations?

I asking as I have the following case, for Maven:org.apache.activemq:activemq-broker:5.16.2 the root LICENSE e.g. https://github.com/apache/activemq/blob/ff1af27106c74ad930c5bd12e8c0159e522efb70/LICENSE include licenses applicable for other activemq packages but not activemq-broker.

Wanted to fix this via a package configuration instead curations.yml but then I figured out that I can remove non-applicable detected licenses (BSD-3-Clause, CC-BY-2.5, CC-BY-SA-2.5, LicenseRef-scancode-cc-devnations-2.0, LicenseRef-scancode-ekioh, MIT, NOASSERTION) but I can't remove none applicable copyright statements.

I see several ways on how we can handle this case
A) If you remove a detected license by concluding the license (via package configuration or curations.yml) then associated copyright holders for licenses not in concluded will be removed. In this way ,ORT users do not have to make a lot of copyrights curations but can focus on licenses.
B)Above A) does not cover the case where copyrights are not associated to a license so we need a mechanism to other allow add and remove copyrights and/or associate copyrights to a license.

Adding this topic to ORT developer meeting agenda to reach consensus on the best way to implement curating copyright holders.

@sschuberth sschuberth mentioned this issue Dec 16, 2021
Merged
@sschuberth
Copy link
Member Author

@rbieniek do you want to take over that branch of mine?

Ping @porsche-rbieniek and @porsche-rishisaxena as a reminder to move this forward.

porsche-rbieniek added a commit to porsche-rbieniek/ort that referenced this issue May 4, 2022
@porsche-rbieniek
As a solution for oss-review-toolkit#4519, we implemented a seperate …
8b7369b 
…model property carrying curated copyright holders.

The rationale behind this is that the german law makes a distinction between authors and copyright holders.

Signed-off-by: Rainer Bieniek <[email protected]>
@porsche-rbieniek
Copy link

Porsche solution submitted as #5315

@sschuberth
Copy link
Member Author

Porsche solution submitted as #5315

Please associate issues with PRs by using one of the respective keywords in one of the commits in the PR instead of manually adding comments.

@sschuberth sschuberth mentioned this issue Jun 30, 2022
Closed
porsche-rbieniek added a commit to porsche-rbieniek/ort that referenced this issue Jun 30, 2022
@porsche-rbieniek
model: Introduce a new copyright holder field to data model
d2718ff 
In German law, the author and the copyright holder can be two seperate
legal entities and therefore also need to be treated separately.

Introduce a new copyright holder field that is now the primary source
for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty copyright
holders. Filling the copyright holder field is left as an exercise for
future actions. Right now, the only way to add copyright holders is via
curations.

This change resolves oss-review-toolkit#4519

Signed-off-by: Rainer Bieniek <[email protected]>
porsche-rbieniek added a commit to porsche-rbieniek/ort that referenced this issue Jun 30, 2022
@porsche-rbieniek
model: Introduce a new copyright holder field to data model
a896ef5 
In German law, the author and the copyright holder can be two seperate
legal entities and therefore also need to be treated separately.

Introduce a new copyright holder field that is now the primary source
for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty copyright
holders. Filling the copyright holder field is left as an exercise for
future actions. Right now, the only way to add copyright holders is via
curations.

This change resolves oss-review-toolkit#4519.

Signed-off-by: Rainer Bieniek <[email protected]>
porsche-rbieniek added a commit to porsche-rbieniek/ort that referenced this issue Jun 30, 2022
@porsche-rbieniek
model: Introduce a new copyright holder field to data model
cbb331e 
In German law, the author and the copyright holder can be two seperate
legal entities and therefore also need to be treated separately.

Introduce a new copyright holder field that is now the primary source
for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty copyright
holders. Filling the copyright holder field is left as an exercise for
future actions. Right now, the only way to add copyright holders is via
curations.

This change resolves oss-review-toolkit#4519.

Signed-off-by: Rainer Bieniek <[email protected]>
porsche-rbieniek added a commit to porsche-rbieniek/ort that referenced this issue Jul 12, 2022
@porsche-rbieniek
model: Introduce a new copyright holder field to data model
7632134 
In German law, the author and the copyright holder can be two seperate
legal entities and therefore also need to be treated separately.

Introduce a new copyright holder field that is now the primary source
for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty copyright
holders. Filling the copyright holder field is left as an exercise for
future actions. Right now, the only way to add copyright holders is via
curations.

This change resolves oss-review-toolkit#4519.

Signed-off-by: Rainer Bieniek <[email protected]>
porsche-rbieniek added a commit to porsche-rbieniek/ort that referenced this issue Jul 13, 2022
@porsche-rbieniek
model: Introduce a new copyright holder field to data model
86672b1 
In German law, the author and the copyright holder can be two seperate
legal entities and therefore also need to be treated separately.

Introduce a new copyright holder field that is now the primary source
for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty copyright
holders. Filling the copyright holder field is left as an exercise for
future actions. Right now, the only way to add copyright holders is via
curations.

This change resolves oss-review-toolkit#4519.

Signed-off-by: Rainer Bieniek <[email protected]>
@tsteenbe tsteenbe changed the title Allow to curate copyrights directly (not via authors) Allow to curate declared copyrights directly (not via authors) Jul 14, 2022
@tsteenbe
Copy link
Member

Copy-paste from July 14th, 2022 ORT developer meeting minutes in which we had a discussion on how to implement curating declared copyrights

A. Use curations to fix-up curate copyrights

The declared copyrights comes package metadata collected by ORT analyzer which can be fixed up using curations.
Note that a lot of package managers do not have copyrights fields only author, contributors, developers which in some case are "mis-used" to convey copyright information. We could implement a parseCopyrights() to from parseAuthors() find copyright statements e.g. entries starting with "copyright" or "(c)"

Below several ideas for how curating declared licenses in curations.yml could look like.

Remove a declared copyright

declared_copyright_mapping:
   "MIT": ""

Add a declared copyright

declared_copyright_mapping:
   "": "Copyright (C) 2022 John Doe"

Overwrite all declared copyrights with a single one:

declared_copyright_mapping:
   "*": ""
   "": "Copyright (C) 2022 John Doe"

Overwrite all declared copyrights with a more than one:

declared_copyright_mapping:
   "*": ""
   "": "Copyright (C) 2022 John Doe"
   "": "Copyright (C) 2019 Jane Doe"
   "": "Copyright (C) 2012 Example, Inc"

Associate declared licenses with declared copyrights:

declared_license_copyrights_mapping:
   "MIT": "Copyright (C) 2022 John Doe"
   "MIT": "Copyright (C) 2019 Jane Doe"
   "Apache-2.0": "Copyright (C) 2012 Example, Inc"

B. Use package configurations to curate detected copyrights

Introduce a copyright_finding_curation in package configurations to curate detected copyrights:

id: "NPM::ansi-styles:4.2.1"
copyright_finding_curations:
  - path: "README.md"
    start_lines: "3"
    line_count: 11
    detected_copyright: ""
    reason: "INCORRECT"
    comment: "Copyright only written on project website."
    concluded_copyright: "Copyright (C) 2022 John Doe"

d. Associate detected licenses to detected copyrights in a package configuration

id: "NPM::ansi-styles:4.2.1"
license_copyright_finding_curation:
  - license: "MIT"
    copyrights:
       - "Copyright (C) 2022 John Doe"
       - "Copyright (C) 2019 Jane Doe"
       - "Copyright (C) 2012 Example, Inc."

C. Use concluded copyright to overwrite both declared and detected

Introduce the concept of a concluded copyright? Should we introduce this, believe concluded_license should be removed from curations as it applies to both declared and detected licenses

concluded_copyright: "Copyright (C) 2022 John Doe"

sschuberth pushed a commit that referenced this issue Aug 24, 2022
@porsche-rbieniek @sschuberth
model: Introduce a new copyright holder field to data model
e3da798 
In German law, the author and the copyright holder can be two seperate
legal entities and therefore also need to be treated separately.

Introduce a new copyright holder field that is now the primary source
for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty copyright
holders. Filling the copyright holder field is left as an exercise for
future actions. Right now, the only way to add copyright holders is via
curations.

This change resolves #4519.

Signed-off-by: Rainer Bieniek <[email protected]>
@sschuberth sschuberth linked a pull request Aug 24, 2022 that will close this issue
Draft
sschuberth pushed a commit that referenced this issue Aug 24, 2022
@porsche-rbieniek @sschuberth
model: Introduce a new copyright holder field to data model
73cf1b3 
In German law, the author and the copyright holder can be two separate
legal entities and therefore also need to be treated separately.

Introduce a new copyright holder field that is now the primary source
for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty copyright
holders. Filling the copyright holder field is left as an exercise for
future actions. Right now, the only way to add copyright holders is via
curations.

This change resolves #4519.

Signed-off-by: Rainer Bieniek <[email protected]>
Signed-off-by: Sebastian Schuberth <[email protected]>
@sschuberth sschuberth changed the title Allow to curate declared copyrights directly (not via authors) Allow to curate copyrights directly (not via authors) Sep 5, 2022
@sschuberth sschuberth mentioned this issue Sep 7, 2022
Merged
sschuberth pushed a commit that referenced this issue Sep 21, 2022
@porsche-rbieniek @sschuberth
model: Introduce a new declared copyrights field to data model
e4bf624 
In German law, the author and the copyright holder can be two separate
legal entities and therefore also need to be tracked separately.

Introduce a new field for declared copyrights that is now the primary
source for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty declared
copyrights. Filling the declared copyrights is left as a future exercise
(also see [1]). Currently, the only way to add declared copyrights is via
curations.

This change resolves #4519.

[1]: #5504 (comment)

Signed-off-by: Rainer Bieniek <[email protected]>
Signed-off-by: Sebastian Schuberth <[email protected]>
sschuberth pushed a commit that referenced this issue Sep 21, 2022
@porsche-rbieniek @sschuberth
model: Introduce a new declared copyrights field to data model
f2fd86d 
In German law, the author and the copyright holder can be two separate
legal entities and therefore also need to be tracked separately.

Introduce a new field for declared copyrights that is now the primary
source for copyright holder information. Authors are still only used as
copyright holders if the `addAuthorsToCopyrights` option is enabled.

For now, all package manager implementations set empty declared
copyrights. Filling the declared copyrights is left as a future exercise
(also see [1]). Currently, the only way to add declared copyrights is via
curations.

This change resolves #4519.

[1]: #5504 (comment)

Signed-off-by: Rainer Bieniek <[email protected]>
Signed-off-by: Sebastian Schuberth <[email protected]>
sschuberth pushed a commit that referenced this issue Sep 21, 2022
@porsche-rbieniek @sschuberth
model: Introduce a concludedCopyrights field to the data model
b776860 
Similar to the `concludedLicense` field, introduce a `concludedCopyrights`
field that is to be set exclusively via a package curation [1] to
override any detected copyright statements. Note that there is no such
thing as *declared* copyright statements because package managers do not
support them explicitly [1].

The concluded copyrights will get associated to all effective licenses;
there currently is no way to curate a copyright statement for a specific
license only. Behavior-wise this is no change compared to previous
feature of curating authors and enabling the `addAuthorsToCopyrights`
option.

As a bonus, this fixes a subtle bug where previously packages might have
been skipped in the scan if `authors` were set but
`addAuthorsToCopyrights` was disabled.

Resolves #4519.

[1]: #5504 (comment)
[1]: https://github.com/oss-review-toolkit/ort/blob/main/docs/config-file-curations-yml.md

Signed-off-by: Rainer Bieniek <[email protected]>
Signed-off-by: Sebastian Schuberth <[email protected]>
sschuberth pushed a commit that referenced this issue Sep 21, 2022
@porsche-rbieniek @sschuberth
model: Introduce a concludedCopyrights field to package curations
85f99a1 
Similar to the `concludedLicense` field, introduce a `concludedCopyrights`
field that is to be set exclusively via a package curation [1] to
override any detected copyright statements. Note that there is no such
thing as *declared* copyright statements because package managers do not
support them explicitly [1].

The concluded copyrights will get associated to all effective licenses;
there currently is no way to curate a copyright statement for a specific
license only. Behavior-wise this is no change compared to previous
feature of curating authors and enabling the `addAuthorsToCopyrights`
option.

As a bonus, this fixes a subtle bug where previously packages might have
been skipped in the scan if `authors` were set but
`addAuthorsToCopyrights` was disabled.

Resolves #4519.

[1]: #5504 (comment)
[1]: https://github.com/oss-review-toolkit/ort/blob/main/docs/config-file-curations-yml.md

Signed-off-by: Rainer Bieniek <[email protected]>
Signed-off-by: Sebastian Schuberth <[email protected]>
This was referenced Feb 28, 2023
Closed
Merged
@sschuberth sschuberth mentioned this issue Sep 5, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement Issues that are considered to be enhancements model About the data model
Projects
None yet
Milestone
No milestone
3 participants
@sschuberth @tsteenbe @porsche-rbieniek