No copyrights recognised in "AUTHORS.txt"

[tgodau]

Description

I recently scanned the "jquery-3.6.0" package (https://github.com/jquery/jquery/archive/refs/tags/3.6.0.zip).
Unfortunately not a single copyright entry (name + e-mail address) from the very obvious file "AUTHORS.txt" was recognised.

How To Reproduce

• Download the jquery package from the link above and unzip it.
• scancode -clip jquery-3.6.0/ --json-pp jquery-3.6.0.json

System configuration

• What OS are you running on? Xubuntu Linux 20.04.2 LTS
• What version of scancode-toolkit was used to generate the scan file? 21.3.31
• What installation method was used to install/run scancode? (pip/source download/other) pip3 install scancode-toolkit[full], runing in a venv as suggested in the installation instructions

[pombredanne]

@tgodau thank you for the report. There are a few things to consider:

1. a mere list of emails is not detected as authors in general
2. the --email option will return emails and get you something such as:

 "files": [
    {
      "path": "AUTHORS.txt",
      "type": "file",
      "emails": [
        {
          "email": "jeresig@gmail.com",
          "start_line": 1,
          "end_line": 1
        },
        {
          "email": "gilles0181@gmail.com",
          "start_line": 2,
          "end_line": 2
        },
...

with that said I think there are many opportunities to make this better:

1. in a file named AUTHORS* the expectation should be that these are all authors anyway, even though they are not marked as such in the file

2. with the --email option (and/or with an improved detection of AUTHOR* files), we could return not only the email but the name too such as here:

 "files": [
    {
      "path": "AUTHORS.txt",
      "type": "file",
      "emails": [
        {
          "email": "jeresig@gmail.com",
          "name": "John Resig",
          "start_line": 1,
          "end_line": 1
        },
        {
          "email": "gilles0181@gmail.com",
          "name": "Gilles van den Hoven",
          "start_line": 2,
          "end_line": 2
        },
...

[tgodau]

Thank you very much for the reply and clarification :-)

[pombredanne]

@tgodau re:

in a file named AUTHORS* the expectation should be that these are all authors anyway, even though they are not marked as such in the file

Do you think we should do this?

[tgodau]

Hmmm...

If someone leaves his name or e-mail-address in an open-source package, I would say he/she/it basically claims that he/she/it contributed something to that package.

If more specific, he/she/it claims it as a copyright notice (e.g. "Copyright (c) YYYY, rights owner, author"). If less specific he/she/it puts the name somewhere in the package (e.g. in "AUTHORS*").

In case of legal issues, a contributor possibly has to declare/proof his specific contribution and the "level of creation". The more specific and prominent a copyright notice is, the easier this could be.
If there is a real copyright and a legally high "level of creation" on a contribution can not be detected or decided by scancode, I would say.

Most of the open-source licenses obligate to preserve the copyright owners namely.
Because of the above circumstances I would assume, that someone listed in AUTHORS* should be preserverd in a list of copyright owners.

Maybe I am totally wrong, maybe there are strict rules about AUTHORS* I don't know.
So I would appreciate to read other opinions...

Regards, Thorsten

[mjherzog]

There are no rules about the contents of a AUTHORS* file as far as I know. For SCTK we need to report the data as found so Copyright if there is some form of a copyright statement and otherwise just authors. In some ecosystems such as npm the pattern seems to be that you usually find one or more Collaborators listed on the main page, but rarely find a copyright notice in the code. So you or your organization could decide to treat Collaborators as Copyright Holders but it does not make sense for SCTK to apply that interpretation in Scan results. You could create a post-Scan plugin to apply such a policy.