Scroll to navigation

DFSG-AUTHOR-CHECK(1) User Commands DFSG-AUTHOR-CHECK(1)

NAME

dfsg-author-check - find copyright holders missing from debian/copyright

SYNOPSIS

dfsg-author-check [options] [directory]

DESCRIPTION

dfsg-author-check finds the authors and copyright holders named in the files of an unpacked Debian source package that its debian/copyright does not name.

It walks the tree (the directory given, or the current one), leaving out debian/, version control and caches, and picks out the copyright attributions in its text files: “Copyright”, “(c)” or “©” with a year, and “SPDX-FileCopyrightText”. It cleans them of years, comment markers and licence prose, and compares them with the Copyright fields of debian/copyright and any debian/<package>.copyright, allowing for differences of spelling, encoding and form. In licence files, and files in a directory named for licences, the copyright lines of the licence texts themselves (the FSF's in a copy of the GPL) are passed over.

A REUSE.toml (REUSE 3.2) gives the holders of the files its [[annotations]] name in path, and the report names those files with the line of REUSE.toml. Under the closest precedence, REUSE's default, an annotation is not for a file with a notice of its own. A holder whose annotations match no file in the tree, as when Files-Excluded took them out, is not missing. Every file is still read for its own notices.

A holder that shares a distinctive part of its name with a declared one is listed separately, as possibly the same.

A holder found only in files that debian/copyright-scan-patterns.yml tells cme(1) to ignore is not counted as missing: it is listed apart, for a reviewer to see what was set aside. The file's ignore section is read as cme reads it, its suffixes and its pattern regular expressions; a pattern Go cannot read is left out, with a warning. See FILES below.

For the files that hold a holder debian/copyright does not name, the report ends with Files paragraphs to paste at the end of it. Each names every holder found in its files, with the years their copyright lines give, and the License of the paragraph that covers them now. Pasted after that paragraph it takes its place for those files, so it names their declared holders as well as the missing ones. Check the License, and whether the files' holders are all there: one a file names only in prose, or in a form the check passes over, is not.

The package is only read: no symbolic link is followed out of it and nothing in it is run. Text from the package is printed with control characters and the characters that reorder text on a terminal replaced by “?”.

OPTIONS

Scan file for copyright lines as well; the holders found there count as declared. May be given more than once.
A list of holders, one a line (“#” for a comment), that count as declared. May be given more than once.
Also list the holders debian/copyright names.
Show at most n files for each holder (default 5; 0 for all).
Print the result as JSON: every holder found, with all its files, in “missing”, “possible”, “known” and “ignored”.
Print only the Files paragraphs for debian/copyright that would name the missing holders.
Print the report as Markdown, for a note on the package (as from dnq prepare).
Print nothing if every holder found is named in debian/copyright and none is only possibly named there, but for those in files cme ignores. It may not be given with -all or -json, which always print.
Show a summary of the options and exit.

Only one of -json, -dep5 and -markdown may be given.

EXIT STATUS

0
Every holder found is named in debian/copyright.
1
Some holders are not.
2
The package could not be checked, or the options were wrong.

FILES

The files cme(1) leaves out of its copyright scan, which this program sets aside too. It suits a file that names holders of code the package does not have, as a list of third-party notices kept after the code it was for was repacked out:

ignore:


  suffixes:


    - png


  pattern:


    - ^\./build/monaco/ThirdPartyNotices\.txt$
A suffix is the end of a file's name, without its dot. A pattern is a regular expression matched against ./ and the file's path from the top of the tree, and is not anchored: /test/ sets aside every file under a directory named test. What else the file holds is passed over. A pattern Go cannot read is left out, and a file that cannot be read sets nothing aside; each is a warning.

EXAMPLES

Check the package in the current directory:

cd hello-2.10 && dfsg-author-check

Check a package elsewhere, showing every file each holder is found in:

dfsg-author-check -max-files 0 path/to/hello-2.10

Add the suggested paragraphs to debian/copyright, to edit afterwards:

dfsg-author-check -dep5 >> debian/copyright

NOTES

Anyone running dfsg-author-check on an untrusted package in an automated setting should still run it in a sandbox.

SEE ALSO

cme(1), Dpkg::Copyright::Scanner(3pm), Machine-readable debian/copyright file format, dfsg-author-check on Salsa

AUTHOR

Andrew McMillan <andrew@mcmillan.net.nz>

October 2026 dfsg-author-check