d/copyright years when upstream does not use years?

Hello,

(please keep me Cc'ed, not subscribed to the list)

TL;DR: copyright years are a mess, do we really want to force copyright
years using a lintian tag and force debian maintainers to update their
d/copyright for d/* each year? I propose we rework these lintian tags, I
can do the work but wanted to discuss it on -devel first.

long message below:

I am working on a case where upstream has a copyright statement that
seems valid to me but does not have an effective copyright year in the
statement (my current employer):

> Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.

I have been able to find some documentation online about copyright
statements without years like this one from the curl project:

https://daniel.haxx.se/blog/2023/01/08/copyright-without-years/

The curl project effectively removed copyright years in 2023, which can
be seen by inspecting a random upstream file (Makefile.am here):

> # Copyright (C) Daniel Stenberg, <[email protected]>, et al.

However the debian/copyright file of the curl package seems to still
have years inside which does not match upstream:

https://salsa.debian.org/debian/curl/-/blob/debian/unstable/debian/copyright?ref_type=heads

This is not to blame the curl packaging but to explain why such issues
might start to appear if we consider upstream’s intent to remove
copyright years and their rationale about it.

I have been looking at the Debian Policy and found no obligation to have
a year for copyright statement:

https://www.debian.org/doc/debian-policy/ch-docs.html#copyright-information
https://www.debian.org/doc/debian-policy/ch-archive.html#s-pkgcopyright

However the current lintian checks and tags we have really want to have
a year in the copyright statement. The regex that checks it in
lintian.git/lib/Lintian/Check/Debian/Copyright.pm:

> # Other flaws in the copyright phrasing or contents.
> if ($found && !$linked) {
>     $self->hint('copyright-without-copyright-notice')
>         unless $contents
>         =~ m{(?:Copyright|Copr\.|\N{COPYRIGHT SIGN})(?:.*|[\(C\):\s]+)\b\d{4}\b
>             |\bpublic(?:\s+|-)domain\b}xi;
> }

The regex really wants a four-digit year otherwise it will trigger.

The tag content at lintian.git/tags/c/copyright-without-copyright-notice.tag
also says that a copyright notice MUST consist of a year:

> Explanation: The copyright file for this package does not appear to contain a
>  copyright notice. You should copy the copyright notice from the upstream
>  source (or add one of your own for a native package). A copyright notice
>  must consist of Copyright, Copr., or the Unicode symbol of C in a circle
>  followed by the years and the copyright holder. A copyright notice is
>  not required for a work to be copyrighted, but Debian requires the
>  copyright file include the authors and years of copyright, and including
>  a valid copyright notice is the best way to do that. Examples:
>  .
>    Copyright YYYY Firstname Lastname &lt;[email protected]&gt;
>    Copr. YYYY-YYYY Firstname Lastname &lt;[email protected]&gt;
>    © YYYY,YYYY Firstname Lastname &lt;[email protected]&gt;
>  .
>  If the package is in the public domain rather than copyrighted, be sure
>  to mention "public domain" in the copyright file. Please be aware that
>  this is very rare and not the same as a DFSG-free license. True public
>  domain software is generally limited to such special cases as a work
>  product of a United States government agency.

My proposal is to rework the lintian tags to:

1. not show an error if there are no copyright years as the copyright
notices are still valid
2. rework the wording of the lintian tag to no imply that a valid
copyright notice MUST have a year
3. probably remove the lintian tag that asks debian maintainers to
update their copyright year for debian/* files in debian/copyright

Thanks for your feedback