Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Outdated copyright notes in "About" dialog #5569

Closed
nekr0z opened this issue Mar 1, 2019 · 8 comments

Comments

Projects
None yet
3 participants
@nekr0z
Copy link
Contributor

commented Mar 1, 2019

Wouldn't it be logical if along with translations, man and authors our scripts updated copyright years in gui/default/syncthing/core/aboutModalView.html based on last commit date? And maybe even for dependencies, too?

@AudriusButkevicius

This comment has been minimized.

Copy link
Member

commented Mar 1, 2019

Copy right year is the year from which you hold the copyright, not the current year.

@nekr0z

This comment has been minimized.

Copy link
Contributor Author

commented Mar 2, 2019

True. And according to international laws that I'm aware of, you can not hold copyright for things you have not yet authored (well, to be really fair, published). That's exactly why if you published a book in 2002 and then rewrote a chapter for second reprint in 2010, you should put ©2002, 2010 in your copyright notice: you hold copyright for most of the text since 2002, but there are parts of the text that were not published before 2010, and for those you only hold copyright since 2010.

In software, it is common to keep developing throught years, and that produces constructs like ©2002-2010, 2012, 2015-2018 (this one would mean there was active development since 2002 till 2010, then there wasn't a single line of code written in 2011, some bugfixes in 2012, then the piece of software became abandoned until someone picked up development in 2015 and published new version at least once a year ever since, with the most current version published in 2018).

Now, for our 1.0.1 release we have ©2014-2017 which would be correct only if no new code had been added since 2017 (and judging by commit history it is plainly false). Even worse, we give false copyright notices for our dependencies: the line The Go Programming Language, Copyright © 2012 The Go Authors. would hold truth only if we used version 1 of go, but I don't think syncthing would even compile on that.

@calmh

This comment has been minimized.

Copy link
Member

commented Mar 2, 2019

We should update the range to 2019 for us, to be clear and correct, because we already have a range and it looks nice to have the current year in it. We can probably view the range as a summary of all the individual components, as files are created with new copyright dates etc... Otherwise it seems copyright is typically from the date of first publication and doesn't need updating. This is how we do it per source files as well.

As for all contributing software components, when I added the notes I took them from the corresponding license files or similar. For Go, that currently says

Copyright (c) 2009 The Go Authors. All rights reserved.

The last commit on that file changed it from 2012 which is what it was when I copied it... So I don't think it's anything wrong with how we have it now, other than we should change it to 2009 really, nor obvious in any way that we need to try to keep the years up to date. Which is also a fools errand... And they clearly subscribe to the idea of "date of first publication".

The list is probably out of date though and could use an update from our current dependencies, whenever someone goes in there for an update.

@nekr0z

This comment has been minimized.

Copy link
Contributor Author

commented Mar 2, 2019

I'm looking at go.mod in current master... Are there some rules about whether to include a particular dependency in aboutModalView.html, or is it just that it hasn't been updated for a really long time?

@calmh

This comment has been minimized.

Copy link
Member

commented Mar 2, 2019

It hasn't been updated in a really long time. go.mod won't have all the truth either, you probably need to lock at the go.sum to see all dependencies of dependencies etc. But then that will be too much - we don't actually use or include things like testing frameworks used by dependencies, but they'll show up in go.sum.

I suspect there's some go list invocation that could be used to find all dependencies as they are actually linked into our binary... But not all of them end up in the syncthing binary, some like database drivers and geoip stuff are only used in the discovery or relay servers etc.

@nekr0z

This comment has been minimized.

Copy link
Contributor Author

commented Mar 2, 2019

Go list complains about build constraints and gives up.

If it were up to me, I wouldn't include indirect dependencies either, my point being it is our direct dependencies maintainers' job to credit their dependencies.

I've skimmed through the repo and what looks to be as a sane enough approach is add all the gui/default/vendor staff, things in go.mod excluding indirect ones, the Go language itself and the font.

And I can't think of the way to script that. :(

@calmh

This comment has been minimized.

Copy link
Member

commented Mar 2, 2019

@nekr0z

This comment has been minimized.

Copy link
Contributor Author

commented Mar 3, 2019

I'm having second thoughts on indirect dependencies; perhaps, we should mention all those that are pulled via go mod vendor since they are obviously included in build process. WIP on PR underway.

@calmh calmh closed this in e2e8f6e Mar 3, 2019

@calmh calmh added this to the v1.1.1 milestone Mar 5, 2019

@calmh calmh added the enhancement label Mar 5, 2019

@calmh calmh changed the title Outdated copyright notes in aboutModalView.html Outdated copyright notes in "About" dialog Mar 28, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.