Where CONTRIBUTORS.txt Ends Up
For years I carried a one-line version of this story: because of distutils2, my name is technically in Android phones and some Cisco stuff. It is the kind of sentence you say once and then repeat for a decade without checking. I finally followed the files. The Cisco part had a concrete answer; the Android part was harder to establish.
The vehicle was distlib
Start with the name in the sentence. The recovered public distutils2 surfaces contain no commit, issue, or mention under my name. The surviving chain leads somewhere else.
The actual vehicle was distlib, which grew out of the distutils2 effort—almost certainly where my memory picked up the wrong name. I filed a run of issues against it, sent a pull request while the project still lived on Bitbucket—my own build tool’s commit log preserves the link, bitbucket.org/pypa/distlib/pull-request/13/—and landed a metadata patch. The result is one line in the record: my name in CONTRIBUTORS.txt.
The issues came out of a static single-file Python build system that used distlib as its resolver and metadata engine.
The Cisco half: confirmed
Cisco publishes license-compliance documents for its products, and one of them is titled “Open Source Used In collectorless_hpna 2.0.1”. It is a long PDF of licenses and attribution text for everything the product bundles. - C. Anthony Risinger appears in it four times, across three bundled versions of distlib.
CONTRIBUTORS.txt travels inside the distlib source distribution, and the Cisco notice retains it across three bundled versions. That accounts for the repeated name.
The Android route I checked
The Android theory was always the better story, and it was plausible. In 2012 I landed two patches in WebKit: a GTK build fix, reviewed by Philippe Normand, and a GObject IDL parser change reviewed by Kentaro Hara. Android’s WebView really was WebKit at the time. Code in WebKit ships in billions of devices. Therefore: my name is in Android phones.
That leap needed evidence. The Android jb-mr2-release tree I checked has a WebCore ChangeLog ending in 2011, before those patches. It contains older copies of the GTK tooling, so finding a familiar filename there does not establish that my changes entered an Android build. The two patches themselves concern GTK build and binding machinery.
I could follow the credit into WebKitGTK ChangeLogs. I did not establish the corresponding route into an Android phone. That leaves the Android memory unconfirmed.
Code and credit travel differently
pip vendors distlib without CONTRIBUTORS.txt. Its vendoring process carries the code and leaves the name behind.
The Cisco notice kept the source distribution’s credits; pip’s vendored copy kept the code without them. A source contribution and a shipped attribution are different things to trace.
I had remembered Android phones and some Cisco equipment. The Cisco part held up; the Android part remains unconfirmed, and the library was distlib rather than distutils2.