Copyright information missing for packages if not in package metadata

[pombredanne]

If I run a docker pipeline on this image: docker pull redis && docker save redis > redis.tar && gzip redis.tar I am not getting much copyright detected.
Since we only report copyright on file-level detection we are missing out getting them on system and application packages. We should instead be able to get these reported for packages too. The pipeline would need to be updated for that.

[mjherzog]

We currently seem to have copyright notices for packages (based on a recent Docker image Scan), but we we missing copyright holders in the .json output for packages. "Summarizing" copyright holders from notices is as important for packages as it is for files.
Moved this to Issue #631

[pombredanne]

@mjherzog @DennisClark how would you see this done? Should we aggregate the copyrights found in the files of a package to the package record itself? what about some notion of primary vs. secondary which is a ScanCode summary concept and SCIO package scan concept but that is not yet a package-only thing in ScanCode Toolkit and may be necessary here?

[DennisClark]

I prefer the notion of a primary copyright, if it can be determined from one of the "key" files, and a secondary copyright, which would be a combined and normalized collection of copyright holders in the various files of a package.

[DennisClark]

and if copyrights are simply not there (yes, that happens even when the project is declared to be under some open source license) I like the idea of "Copyright (c) project-name contributors" where we substitute the name of the project. That works for me.

[mjherzog]

First I am just looking for the transformation of copyright notice data to copyright holder data - moved this to Issue #631.

[mjherzog]

Created Issue #631 to cover the specific gap of not providing copyright holder data in the JSON and XLSX Download files for Packages. Keeping this Issue for discussion of how to get copyright data from a package when that data in not provided in the package metadata.