From 2a692021c0d9fce3c99f49b5309bb17a3f7feff6 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Mon, 28 Sep 2026 01:42:41 +0000 Subject: [PATCH] Boundary attribution travels with the boundaries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The India ADM1 boundary is Creative Commons Attribution (CC BY 2.5 IN, sourced from DataMeet and the Election Commission of India), so the credit has to reach whoever receives the data. It did not: 6.1 MB of boundary GeoJSON shipped with no human-readable attribution, and a sidecar for one file of eight. data/boundaries/ATTRIBUTION now ships beside the data. Every licence value in it is verbatim from the geoBoundaries API, queried per boundary -- CC BY 2.5 IN for India, Public Domain for China. No licence wording is ours. ★ IT TOOK TWO ALLOWLIST EDITS, and the first one silently did nothing. The boundary staging is TWO-STAGE: a pair list gathers into the build pool, and a separate path list decides what reaches the tree. I added the file to the pair list, rebuilt, and it still did not ship. An entry in one stage of a two-stage pipeline is not an entry. WORLD-ADM0 IS CORRECTED, not closed. This register first guessed Natural Earth, public domain. It is geoBoundaries gbOpen assembled per country: its features carry geoBoundaries' own iso3/shapeGroup/shapeName, and the plugin's data/adm0/PROVENANCE.json names the source and endpoint. That file also states the real problem -- gbOpen passes each country's UPSTREAM licence through, so one file carries up to 162 licences and up to 162 attribution duties -- and its licences table is EMPTY. Which of the 162 are CC BY is unestablished. Stated in ATTRIBUTION as an undischarged duty rather than papered over. pplr's row is exp-shepherd's evidence: the PPLR ArcGIS org aggregating IMB, Joshua Project, ROP and WCD identifiers, publishing no licence at all, and WCD is a proprietary Brill database. --- data/boundaries/ATTRIBUTION | 41 ++++++++++++++++++++++++++++++++++++ documentation/THIRD-PARTY.md | 8 ++++--- internal/generate-tree.mjs | 9 ++++++++ 3 files changed, 55 insertions(+), 3 deletions(-) create mode 100644 data/boundaries/ATTRIBUTION diff --git a/data/boundaries/ATTRIBUTION b/data/boundaries/ATTRIBUTION new file mode 100644 index 000000000..cd25dfe1d --- /dev/null +++ b/data/boundaries/ATTRIBUTION @@ -0,0 +1,41 @@ +BOUNDARY DATA — SOURCES AND ATTRIBUTION +======================================= + +The .geojson files in this folder are third-party boundary data. Every value below is taken +VERBATIM from the upstream metadata (the geoBoundaries API, https://www.geoboundaries.org/api/current/gbOpen///). +Nothing here is our own wording about a licence. + +gb-IND-ADM1-full.geojson, gb-IND-ADM1-full-web.geojson + source geoBoundaries gbOpen (www.geoboundaries.org) + boundaryID IND-ADM1-1811400 + licence Creative Commons Attribution 2.5 India (CC BY 2.5 IN) + licenceSource github.com/datameet/maps + year 2011 + ATTRIBUTION IS REQUIRED for this file: it is Creative Commons Attribution, so a work that + redistributes or displays it must credit the source above. + +gb-IND-ADM1.geojson, gb-IND-ADM1-web.geojson + The same India ADM1 boundary as above, curated to the UPG-100 list's partition. + Same source, same boundaryID, same licence, same attribution duty. + +gb-CHN-ADM1.geojson + source geoBoundaries gbOpen (www.geoboundaries.org) + boundaryID CHN-ADM1-43563684 + licence Public Domain + licenceSource commons.wikimedia.org/wiki/File + year 2019 + No attribution duty: upstream records this boundary as Public Domain. + +world-adm0.geojson, world-adm0-web.geojson + source geoBoundaries gbOpen (www.geoboundaries.org), assembled per country + features 162 countries + licence MIXED, AND NOT YET RECORDED PER COUNTRY. + gbOpen passes each country's UPSTREAM licence through, so this one file carries up to 162 + different licences and therefore up to 162 separate attribution duties. The collection's own + provenance record (the plugin's data/adm0/PROVENANCE.json) states that principle but its + licences table is EMPTY, so which of the 162 are Creative Commons and which are public domain + is not established here. Establishing it means querying the endpoint above once per country. + UNTIL THEN, TREAT THIS FILE AS CARRYING ATTRIBUTION DUTIES THAT ARE NOT YET DISCHARGED. + One known gap in that record: CCK (Cocos Islands) returned HTTP 404 for its metadata. + +See documentation/THIRD-PARTY.md for the whole shipped tree. diff --git a/documentation/THIRD-PARTY.md b/documentation/THIRD-PARTY.md index bcfe354fb..6f9c3ba19 100644 --- a/documentation/THIRD-PARTY.md +++ b/documentation/THIRD-PARTY.md @@ -12,10 +12,11 @@ served folder". The licence travels with the asset; the explanation travels with | Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | **Yes** — each `LICENSE` is the family's own upstream OFL, verbatim, with its real copyright line | none (closed 2026-09-28) | | `vendor/vue/vue.global.prod.js` | vuejs/core | MIT | **Partly** — the minified banner carries `(c) 2018-present Yuxi (Evan) You` and `@license MIT`, but NOT the permission notice MIT asks to include | closed: upstream `LICENSE` now vendored beside it | | `vendor/tabulator/tabulator.min.js` + `.min.css` | olifolkerd/tabulator v6.3.1 | MIT | **No** — the `.js` had only `(c) Oliver Folkerd 2025`; the `.css` had nothing | closed: upstream `LICENSE` now vendored beside it | -| `boundaries/gb-*.geojson` (4 files) | geoBoundaries gbOpen (www.geoboundaries.org) | CC BY — the India ADM1 file records **CC BY 2.5 IN**, sourced from DataMeet/Election Commission of India | **Partly** — provenance sits in ONE sidecar, `gb-IND-ADM1-full.meta.json` (source, boundaryID, licence, fetch URL, processing). The other boundary files have none, and no human-readable attribution ships | **OPEN** — CC BY requires attribution to accompany the work | -| `boundaries/world-adm0*.geojson` | not verified — probably Natural Earth | Natural Earth is public domain | n/a if Natural Earth | **OPEN** — provenance unconfirmed for this file | +| `boundaries/gb-IND-ADM1*.geojson` (4 files) | geoBoundaries gbOpen, boundaryID `IND-ADM1-1811400` | **CC BY 2.5 IN**, licenceSource `github.com/datameet/maps`, year 2011 — fetched verbatim from the geoBoundaries API | **Yes** — `boundaries/ATTRIBUTION` now ships beside the data, plus the existing `.meta.json` sidecar | none (closed 2026-09-28) | +| `boundaries/gb-CHN-ADM1.geojson` | geoBoundaries gbOpen, boundaryID `CHN-ADM1-43563684` | **Public Domain**, licenceSource `commons.wikimedia.org`, year 2019 | recorded in `boundaries/ATTRIBUTION` | none — upstream records no attribution duty | +| `boundaries/world-adm0*.geojson` (2 files, 162 countries) | **geoBoundaries gbOpen, assembled per country** — corrected: its features carry geoBoundaries' own `iso3`/`shapeGroup`/`shapeName` properties, and the plugin's `data/adm0/PROVENANCE.json` names the source and endpoint. NOT Natural Earth, as this register first guessed | **MIXED — up to 162 different upstream licences.** gbOpen passes each country's own licence through | the principle is stated in `boundaries/ATTRIBUTION`; the per-country licences are **not** | **OPEN** — that PROVENANCE.json's `licences` table is EMPTY, so which of the 162 are CC BY is unestablished. Closing it means one API query per country. upg100-plugin's data; routed to them | | `people-groups/*` (3 files, 8 MB) | peoplegroups.org | **not established** | no terms ship | **OPEN, judgment** — redistribution terms unknown | -| `pplr/*` (6 files, 16 MB) | not resolved from `plugin-designs/pplr-data-maps/scripts/build-data.mjs` | **not established** | nothing ships | **OPEN, judgment** — owner should name the upstream | +| `pplr/*` (6 files, 16 MB) | **PPLR ArcGIS Online org** `services2.arcgis.com/S4ydGgujXcif36k3`, aggregating IMB (peoplegroups.org), Joshua Project, the ROP registry, and carrying WCD (World Christian Database) IDs. Built from a local 78 MB extract not present in this repo — evidence from exp-shepherd | **UNRESOLVED.** `aCountry` and `aIMBPeople` publish no `copyrightText`, description or licence (queried `f=json`) | nothing ships | **OPEN, judgment** — redistribution not established. WCD is a proprietary Brill database, so even the IDs need a check | | `tables/*` (304 files, 36 MB) | derived by `library/scripts/research/fetch-*.mjs` from several upstream APIs | **varies, not established per table** | nothing ships; there is no source or licence doc in `tables/` | **OPEN, judgment** — the largest gap by volume | | `images/worldmap.svg` | recorded in `images/PROVENANCE` | see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed | | `previews/*` (378 files) | our own poster previews | ours | n/a | none | @@ -25,6 +26,7 @@ served folder". The licence travels with the asset; the explanation travels with | Vendored file | Upstream URL | sha256 | |---|---|---| +| `data/boundaries/ATTRIBUTION` | geoBoundaries API, per boundary (values verbatim) | see the file | | `data/vendor/tabulator/LICENSE` | `https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE` | `191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7` | | `data/vendor/vue/LICENSE` | `https://raw.githubusercontent.com/vuejs/core/main/LICENSE` | `49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac` | | `data/fonts/bebas-neue/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt` | see `documentation/vendored-fonts.md` | diff --git a/internal/generate-tree.mjs b/internal/generate-tree.mjs index bcb4408e7..bd71621a3 100644 --- a/internal/generate-tree.mjs +++ b/internal/generate-tree.mjs @@ -1551,6 +1551,10 @@ function main() { // COMPLETE India ADM1 (36 units, geoBoundaries gbOpen, CC BY 2.5 IN; source + licence in its meta), // for maps that colour every state. The curated file above is UPG-100's 34-unit partition. [resolve(__dirname, '..', 'data', 'boundaries', 'gb-IND-ADM1-full.geojson'), 'gb-IND-ADM1-full.geojson'], + // ★ AND THE ATTRIBUTION, because this pair list is what decides whether it TRAVELS. The India + // ADM1 boundary is Creative Commons Attribution, so the credit has to reach the recipient with + // the data; a file left in data/boundaries would never ship. Same trap as vendor/*/LICENSE. + [resolve(__dirname, '..', 'data', 'boundaries', 'ATTRIBUTION'), 'ATTRIBUTION'], [resolve(__dirname, '..', 'data', 'boundaries', 'gb-IND-ADM1-full.meta.json'), 'gb-IND-ADM1-full.meta.json'], // WEB copies (library/scripts/boundaries/build-web-boundaries.mjs): every feature and island kept, about // a fifth of the bytes. The interactive maps fetch these; posters, print and build-time point-in-polygon @@ -1618,6 +1622,11 @@ function main() { 'boundaries/gb-CHN-ADM1.geojson', 'boundaries/gb-IND-ADM1-full.geojson', // all 36 states (Cities with Internet's NFHS layer) 'boundaries/gb-IND-ADM1-full.meta.json', // its source and licence, served beside it + // ★ SECOND STAGE. The pair list above only gathers into the build POOL; THIS list decides what + // reaches the tree. I added ATTRIBUTION to the pair list, ran the build, and it still did not ship + // — a two-stage pipeline needs the entry in both. The India ADM1 boundary is Creative Commons + // Attribution, so the credit must travel with the data. + 'boundaries/ATTRIBUTION', 'boundaries/world-adm0-web.geojson', // the web copies the interactive maps fetch 'boundaries/gb-IND-ADM1-web.geojson', 'boundaries/gb-IND-ADM1-full-web.geojson',