Poor copyright statements

[xenoterracide]

So we are copying a piece of code from the latest version since we can't upgrade yet. To be removed later. However the copyright file says the original authors and the readme only has the license. In other words it's really hard to say who the actual copyright holder is. We're adding a link to our source code but it feels like this is something that should be remediated somehow. Even if it's just adding the actual copyright holder to the license. Maybe there's a reason that doesn't work but this doesn't feel like a particularly great scenario when you do have to fork code.

[bclozel]

Authors are listed on the hit commit history for that file and substantive contributions are listed as authors in the class javadoc.

It shouldn't matter really as long as you respect the terms of the license.

I am not a lawyer but we are not going to change license headers on the entire Spring portfolio unless there is a very good legal reason to do so. Did you consult with an IP lawyer and got some specific concerns about this header?

[xenoterracide]

Nope, absolutely not. I would be surprised if an IP lawyer liked that header though... I wonder how it stands up in court. 🤷🏻‍♂️ The problem of course is that when you copy a file you don't know where it comes from with headers like that. I actually had to tell my developer to put the freaking license back in place though... No dude you are not allowed to copy that without keeping the license intact. Seriously though think about how it goes into our code if we don't touch the file after that. It just says the original authors and then all commit history is lost. I guess we're the original authors now 😉. Anyways you can close this if you want I just thought I'd mention it.

[bclozel]

I tend to trust our legal department more than vague intuitions from developers.

Maybe consult with your company's legal if you want some advice for forking this codebase.

[xenoterracide]

Eh, I tend to trust the legal advice of places like FSF and organizations like the one that manages spdx... To be honest though things like owned by the authors is actually kind of hard to put in a copyright statement. Because you're relying on git but then you're not pointing to git, or anywhere else to get said list of authors... Technically it's legally enforceable but practically it makes copying awkward. I'm actually not sure if spdx has a standard around where to put it. I should investigate that someday. 🤷🏻‍♂️ I'm kind of surprised it's not owned by spring via contributor agreement though but then that's changed hands so many times...