Thanks Rafael for moving this forward.
For documentation purposes, I will reference this commit: https://github.com/anchore/syft/commit/c2ea35ef328795647cfaabaf33e2ce74032f6e07 So we can use it when packaging such packages. It adds a COPYRIGHT file with "Copyright (c) Anchore, Inc." to syft, stereoscope, clio, fangs, bubbly and go-logger. One detail that I will do in packaging that might be useful for you, I share just in case: the file is only in main. v1.54.1 and every earlier tag return 404 for it, so a tarball made from a current tag still needs the holder stated in debian/copyright, with a Comment pointing at that commit. The first release after 12 October will carry the file itself. Regarding go-rpmdb package: this one is not covered and does not need to be. It is a fork of knqyf263/go-rpmdb and its LICENSE is MIT, Copyright (c) 2019 Teppei Fukuda. Best, Juan
