Making packages for Debian requires quite a lot of attention to
details. And one of the details is the content of the
debian/copyright file, which should list all relevant licenses used by
the code in the package in question, preferably in
machine
readable DEP5 format.
For large packages with lots of contributors it is hard to write
and update this file manually, and if you get some detail wrong, the
package is normally rejected by the ftpmasters. So getting it right
the first time around get the package into Debian faster, and save
both you and the ftpmasters some work.. Today, while trying to figure
out what was wrong with
the
zfsonlinux copyright file, I decided to spend some time on
figuring out the options for doing this job automatically, or at least
semi-automatically.
Lucikly, there are at least two tools available for generating the
file based on the code in the source package,
debmake
and cme. I'm
not sure which one of them came first, but both seem to be able to
create a sensible draft file. As far as I can tell, none of them can
be trusted to get the result just right, so the content need to be
polished a bit before the file is OK to upload. I found the debmake
option in
a
blog posts from 2014.
To generate using debmake, use the -cc option:
debmake -cc > debian/copyright
Note there are some problems with python and non-ASCII names, so
this might not be the best option.
The cme option is based on a config parsing library, and I found
this approach in
a
blog post from 2015. To generate using cme, use the 'update
dpkg-copyright' option:
cme update dpkg-copyright
This will create or update debian/copyright. The cme tool seem to
handle UTF-8 names better than debmake.
When the copyright file is created, I would also like some help to
check if the file is correct. For this I found two good options,
debmake -k and license-reconcile. The former seem
to focus on license types and file matching, and is able to detect
ineffective blocks in the copyright file. The latter reports missing
copyright holders and years, but was confused by inconsistent license
names (like CDDL vs. CDDL-1.0). I suspect it is good to use both and
fix all issues reported by them before uploading. But I do not know
if the tools and the ftpmasters agree on what is important to fix in a
copyright file, so the package might still be rejected.
The devscripts tool licensecheck deserve mentioning. It
will read through the source and try to find all copyright statements.
It is not comparing the result to the content of debian/copyright, but
can be useful when verifying the content of the copyright file.
Are you aware of better tools in Debian to create and update
debian/copyright file. Please let me know, or blog about it on
planet.debian.org.
As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.
Update 2016-02-20: I got a tip from Mike Gabriel
on how to use licensecheck and cdbs to create a draft copyright file
licensecheck --copyright -r `find * -type f` | \
/usr/lib/cdbs/licensecheck2dep5 > debian/copyright.auto
He mentioned that he normally check the generated file into the
version control system to make it easier to discover license and
copyright changes in the upstream source. I will try to do the same
with my packages in the future.
Update 2016-02-21: The cme author recommended
against using -quiet for new users, so I removed it from the proposed
command line.
