feat: tool/copyright - #4983

Is there a documentation of what is required?

The additional copyright information seems to be just a duplicate? The individual authors with date can be derived from the commit history.
The potentially useful information is probably only the entity (Association, Anapaya, ETHZ Zurich). If we add all individual committers with dates and individual commits then this would result in a lot of boilerplate copyright headers....

Separately, how about adopting the REUSE recommendation with SPDX identifier: SPDX-FileCopyrightText:
https://reuse.software/tutorial/

Separately, how about adopting the REUSE recommendation with SPDX identifier

Yes, I'm all for it! I think a short:

// SPDX-License-Identifier: Apache-2.0

is better than the entire license boilerplate we have right now in each file:

// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

But I wanted to keep it out of this PR. This change would belong to another PR.

The additional copyright information seems to be just a duplicate? The individual authors with date can be derived from the commit history.

Legally speaking, this PR changes nothing and is not supposed to change anything about licenses and copyright claims. It only adds a new tool that can help automate bumping/updating the copyright claims we have right now. I can just run make copyright-update and bump/add claims in all files I touched in my changes, and CI will also detect and tell me that I didn't, if I'm listed in the affiliations.json config.

The history-rewrite functionality that it provides is not used in this PR yet. We may or may not use it to clean up the entire codebase in a later PR.

Changing the way we do copyright claims, attributions and license disclosure is not in the scope of this PR.

So what do these scripts actually do? To me the example looked like they added author email, date, and commit hash to the copyright?
If they add that I would propose to not add that and instead only replace // Copyright with SPDX-FileCopyrightText: (or add it if there is nothing in the file).

If they do something else then I misunderstood what the scripts are meant to do...

To me the example looked like they added author email, date, and commit hash to the copyright?

No. Nothing changes in that regard.
This is pure automation to keep copyright claims up to date (unless you opt out by not having yourself listed under tools/copyright/affiliations.json).

So what do these scripts actually do?

If I change a bunch of files and I'm listed under affiliations.json:

{
  "name": "Roman Sharkov",
  "emails": ["roman.scharkov@gmail.com", "rsc@scion.org"],
  "affiliation": "SCION Association"
}

then:

1. I can run make copyright-update to bump all years and add where necessary the:

// Copyright 2026 SCION Association

2. CI will tell me I didn't update the copyright notices correctly if I didn't.

What it also can do is rewrite claims in a sub-tree of the repository with:

make copyright-update COPYRIGHT_FLAGS="-history $PWD/tools/copyright/affiliation-history.json"

1. We don't want to do this now, but we can in a later PR.
2. The affiliation history file should not be in git though since it may expose information that is currently not public and that cannot be easily derived from git history.

FYI: REUSE and tools/copyright are compatible. If we ever decide to introduce REUSE they will not conflict.