Comparatively, how does package.json handle attribution? install.rdf supports specifying creator, developers, localisers, and contributors.