feat: tool/copyright

[romshark]

A task I long wanted to automate, assisted with Claude Code (Opus 5)

It makes copyright claims easier to maintain.
This PR does not change any copyright claims, it only begins to enforce them starting with attributions.json since 2026-09-01. I kept history changes out of this PR to avoid blowing the scope. We can do a general cleanup in a later PR.

Adds make copyright-check and make copyright-update:

private/storage/trust/dbtest/dbtest.go
    - // Copyright 2020 Anapaya Systems
    + // Copyright 2024 Anapaya Systems    (hitz@anapaya.net, 2024-03-31 25e37a002)
    + // Copyright 2024 SCION Association  (matzf@scion.org, 2024-07-09 68bd2bcae)
private/storage/trust/fspersister/db.go
    - // Copyright 2020 Anapaya Systems
    + // Copyright 2022 Anapaya Systems  (roos@anapaya.net, 2022-03-12 15d455f11)
private/storage/trust/fspersister/db_test.go
    - // Copyright 2020 Anapaya Systems
    + // Copyright 2025 Anapaya Systems    (roos@anapaya.net, 2025-09-30 38e79c43f)
    + // Copyright 2025 SCION Association  (roman.scharkov@gmail.com, 2025-01-30 29ef0b75c)
private/storage/trust/metrics/db.go
    - // Copyright 2020 Anapaya Systems
    + // Copyright 2022 Anapaya Systems  (roos@anapaya.net, 2022-03-12 15d455f11)

• attributes uncommitted work to configured git user.email
• enforces order of copyright claims (most recent at the top)
• allows copyright claims to be rewritten across the entire project according to attribution settings (including by attribution date).
• allows CI to tell people they didn't run copyright-update, making it harder to miss.

Alternatives Analysis

I haven't found an off the shelf tool that does what we need.

DISCLAIMER: I did use Claude Code (Opus 5) to generate this table so keep in mind that there can be mistakes even though I tried to check some of them manually:

Tool	Purpose	Writes headers	Holder from git	Holder = org	Dated affiliation	Multi-holder/file	Never retracts	Excludes by
tools/copyright	Credit the organizations behind a file	✅	✅	✅	✅	✅	✅	the file's own header
REUSE	License compliance	✅	❌	✅	❌	✅	✅	REUSE.toml
hashicorp/copywrite	Company-wide header stamping	✅	❌	✅	❌	❌	❌	path globs
google/addlicense	Add missing license headers	✅	❌	✅	❌	❌	✅	path args
shybyte/copyright-header	Keep header years current	✅	❌	✅	❌	❌	❌	path globs
Eclipse Oomph UpdateCopyrightsAction	Keep header years current	✅	❌	✅	❌	❌	❌	Eclipse project config
Poettering's copyright.py	Credit authors of a file	❌	✅	❌	❌	✅	❌	n/a
klange/generate-copyright	Credit authors of a file	❌	✅	❌	❌	✅	❌	n/a
cncf/gitdm	Contribution statistics per employer	❌	✅	✅	✅	❌	❌	n/a
goheader (in .golangci.yml)	Enforce header shape	❌	❌	❌	❌	✅	✅	lint config

[tzaeschke]

Is there a documentation of what is required?

The additional copyright information seems to be just a duplicate? The individual authors with date can be derived from the commit history.
The potentially useful information is probably only the entity (Association, Anapaya, ETHZ Zurich). If we add all individual committers with dates and individual commits then this would result in a lot of boilerplate copyright headers....

Separately, how about adopting the REUSE recommendation with SPDX identifier: SPDX-FileCopyrightText:
https://reuse.software/tutorial/

[romshark]

Separately, how about adopting the REUSE recommendation with SPDX identifier

Yes, I'm all for it! I think a short:

// SPDX-License-Identifier: Apache-2.0

is better than the entire license boilerplate we have right now in each file:

// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

But I wanted to keep it out of this PR. This change would belong to another PR.

[romshark]

The additional copyright information seems to be just a duplicate? The individual authors with date can be derived from the commit history.

Legally speaking, this PR changes nothing and is not supposed to change anything about licenses and copyright claims. It only adds a new tool that can help automate bumping/updating the copyright claims we have right now. I can just run make copyright-update and bump/add claims in all files I touched in my changes, and CI will also detect and tell me that I didn't, if I'm listed in the affiliations.json config.

The history-rewrite functionality that it provides is not used in this PR yet. We may or may not use it to clean up the entire codebase in a later PR.

Changing the way we do copyright claims, attributions and license disclosure is not in the scope of this PR.

[tzaeschke]

So what do these scripts actually do? To me the example looked like they added author email, date, and commit hash to the copyright?
If they add that I would propose to not add that and instead only replace // Copyright with SPDX-FileCopyrightText: (or add it if there is nothing in the file).

If they do something else then I misunderstood what the scripts are meant to do...

[romshark]

To me the example looked like they added author email, date, and commit hash to the copyright?

No. Nothing changes in that regard.
This is pure automation to keep copyright claims up to date (unless you opt out by not having yourself listed under tools/copyright/affiliations.json).

So what do these scripts actually do?

If I change a bunch of files and I'm listed under affiliations.json:

{
  "name": "Roman Sharkov",
  "emails": ["roman.scharkov@gmail.com", "rsc@scion.org"],
  "affiliation": "SCION Association"
}

then:

1. I can run make copyright-update to bump all years and add where necessary the:

// Copyright 2026 SCION Association

2. CI will tell me I didn't update the copyright notices correctly if I didn't.

---

What it also can do is rewrite claims in a sub-tree of the repository with:

make copyright-update COPYRIGHT_FLAGS="-history $PWD/tools/copyright/affiliation-history.json"

1. We don't want to do this now, but we can in a later PR.
2. The affiliation history file should not be in git though since it may expose information that is currently not public and that cannot be easily derived from git history.

[romshark]

FYI: REUSE and tools/copyright are compatible. If we ever decide to introduce REUSE they will not conflict.