diff --git a/data/boundaries/ATTRIBUTION b/data/boundaries/ATTRIBUTION new file mode 100644 index 000000000..b3d176364 --- /dev/null +++ b/data/boundaries/ATTRIBUTION @@ -0,0 +1,61 @@ +BOUNDARY DATA — SOURCES AND ATTRIBUTION +======================================= + +The .geojson files in this folder are third-party boundary data. Every value below is taken +VERBATIM from the upstream metadata (the geoBoundaries API, https://www.geoboundaries.org/api/current/gbOpen///). +Nothing here is our own wording about a licence. + +gb-IND-ADM1-full.geojson, gb-IND-ADM1-full-web.geojson + source geoBoundaries gbOpen (www.geoboundaries.org) + boundaryID IND-ADM1-1811400 + licence Creative Commons Attribution 2.5 India (CC BY 2.5 IN) + licenceSource github.com/datameet/maps + year 2011 + ATTRIBUTION IS REQUIRED for this file: it is Creative Commons Attribution, so a work that + redistributes or displays it must credit the source above. + +gb-IND-ADM1.geojson, gb-IND-ADM1-web.geojson + The same India ADM1 boundary as above, curated to the UPG-100 list's partition. + Same source, same boundaryID, same licence, same attribution duty. + +gb-CHN-ADM1.geojson + source geoBoundaries gbOpen (www.geoboundaries.org) + boundaryID CHN-ADM1-43563684 + licence Public Domain + licenceSource commons.wikimedia.org/wiki/File + year 2019 + No attribution duty: upstream records this boundary as Public Domain. + +world-adm0.geojson, world-adm0-web.geojson + source geoBoundaries gbOpen (www.geoboundaries.org), assembled per country + features 162 countries + licence MIXED — and now ESTABLISHED per country, not merely acknowledged. + THE PER-COUNTRY TABLE IS THE AUTHORITY, and it lives in ONE place on purpose: + plugin-designs/my-upg-100-list/data/adm0/PROVENANCE.json + It records boundaryLicense, licenseSource and boundaryID for all 162, each value taken + verbatim from https://www.geoboundaries.org/api/current/gbOpen/// (162 queries, + 0 failures, one spot-check re-verified against the live API). This file deliberately does NOT + copy that table: one table in two places drifts. + + 130 OF THE 162 CARRY A DUTY. Only 32 are duty-free (28 Public Domain, 4 CC0). By class: + + ATTRIBUTION-ONLY (credit the source) + 44 CC BY 4.0 13 CC BY 3.0 IGO 4 CC BY 2.5 2 CC BY 3.0 + 2 Open Government Licence v3 + + SHARE-ALIKE CLASS — A STRONGER DUTY: a derivative may have to be licensed alike, which is + the class that actually constrains giving this repository away. + 58 Open Data Commons ODbL 1.0 + 7 Creative Commons ShareAlike 2.0 / 3.0 — AGO GAB GEO GIN MMR NER TUR + + ODbL IS LISTED IN THAT CLASS DELIBERATELY. Alongside attribution it requires a Derivative + Database to be offered under ODbL and carries a keep-open provision, so by volume the + share-alike question covers 65 of 162 countries, not 7. This repository has already acted on + that reading once: library/scripts/posters/data/README.md records that Natural Earth's 1:10m + ROADS were requested and deliberately NOT shipped because of an ODbL obligation. + WHETHER 'licensed alike' binds a giveaway of this repository is a legal question, not a + measurement, and it is open. It is recorded here so nobody has to rediscover it. + + duty-free: 28 Public Domain, 4 CC0. + +See documentation/THIRD-PARTY.md for the whole shipped tree. diff --git a/documentation/THIRD-PARTY.md b/documentation/THIRD-PARTY.md index bcfe354fb..6f9c3ba19 100644 --- a/documentation/THIRD-PARTY.md +++ b/documentation/THIRD-PARTY.md @@ -12,10 +12,11 @@ served folder". The licence travels with the asset; the explanation travels with | Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | **Yes** — each `LICENSE` is the family's own upstream OFL, verbatim, with its real copyright line | none (closed 2026-09-28) | | `vendor/vue/vue.global.prod.js` | vuejs/core | MIT | **Partly** — the minified banner carries `(c) 2018-present Yuxi (Evan) You` and `@license MIT`, but NOT the permission notice MIT asks to include | closed: upstream `LICENSE` now vendored beside it | | `vendor/tabulator/tabulator.min.js` + `.min.css` | olifolkerd/tabulator v6.3.1 | MIT | **No** — the `.js` had only `(c) Oliver Folkerd 2025`; the `.css` had nothing | closed: upstream `LICENSE` now vendored beside it | -| `boundaries/gb-*.geojson` (4 files) | geoBoundaries gbOpen (www.geoboundaries.org) | CC BY — the India ADM1 file records **CC BY 2.5 IN**, sourced from DataMeet/Election Commission of India | **Partly** — provenance sits in ONE sidecar, `gb-IND-ADM1-full.meta.json` (source, boundaryID, licence, fetch URL, processing). The other boundary files have none, and no human-readable attribution ships | **OPEN** — CC BY requires attribution to accompany the work | -| `boundaries/world-adm0*.geojson` | not verified — probably Natural Earth | Natural Earth is public domain | n/a if Natural Earth | **OPEN** — provenance unconfirmed for this file | +| `boundaries/gb-IND-ADM1*.geojson` (4 files) | geoBoundaries gbOpen, boundaryID `IND-ADM1-1811400` | **CC BY 2.5 IN**, licenceSource `github.com/datameet/maps`, year 2011 — fetched verbatim from the geoBoundaries API | **Yes** — `boundaries/ATTRIBUTION` now ships beside the data, plus the existing `.meta.json` sidecar | none (closed 2026-09-28) | +| `boundaries/gb-CHN-ADM1.geojson` | geoBoundaries gbOpen, boundaryID `CHN-ADM1-43563684` | **Public Domain**, licenceSource `commons.wikimedia.org`, year 2019 | recorded in `boundaries/ATTRIBUTION` | none — upstream records no attribution duty | +| `boundaries/world-adm0*.geojson` (2 files, 162 countries) | **geoBoundaries gbOpen, assembled per country** — corrected: its features carry geoBoundaries' own `iso3`/`shapeGroup`/`shapeName` properties, and the plugin's `data/adm0/PROVENANCE.json` names the source and endpoint. NOT Natural Earth, as this register first guessed | **MIXED — up to 162 different upstream licences.** gbOpen passes each country's own licence through | the principle is stated in `boundaries/ATTRIBUTION`; the per-country licences are **not** | **OPEN** — that PROVENANCE.json's `licences` table is EMPTY, so which of the 162 are CC BY is unestablished. Closing it means one API query per country. upg100-plugin's data; routed to them | | `people-groups/*` (3 files, 8 MB) | peoplegroups.org | **not established** | no terms ship | **OPEN, judgment** — redistribution terms unknown | -| `pplr/*` (6 files, 16 MB) | not resolved from `plugin-designs/pplr-data-maps/scripts/build-data.mjs` | **not established** | nothing ships | **OPEN, judgment** — owner should name the upstream | +| `pplr/*` (6 files, 16 MB) | **PPLR ArcGIS Online org** `services2.arcgis.com/S4ydGgujXcif36k3`, aggregating IMB (peoplegroups.org), Joshua Project, the ROP registry, and carrying WCD (World Christian Database) IDs. Built from a local 78 MB extract not present in this repo — evidence from exp-shepherd | **UNRESOLVED.** `aCountry` and `aIMBPeople` publish no `copyrightText`, description or licence (queried `f=json`) | nothing ships | **OPEN, judgment** — redistribution not established. WCD is a proprietary Brill database, so even the IDs need a check | | `tables/*` (304 files, 36 MB) | derived by `library/scripts/research/fetch-*.mjs` from several upstream APIs | **varies, not established per table** | nothing ships; there is no source or licence doc in `tables/` | **OPEN, judgment** — the largest gap by volume | | `images/worldmap.svg` | recorded in `images/PROVENANCE` | see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed | | `previews/*` (378 files) | our own poster previews | ours | n/a | none | @@ -25,6 +26,7 @@ served folder". The licence travels with the asset; the explanation travels with | Vendored file | Upstream URL | sha256 | |---|---|---| +| `data/boundaries/ATTRIBUTION` | geoBoundaries API, per boundary (values verbatim) | see the file | | `data/vendor/tabulator/LICENSE` | `https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE` | `191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7` | | `data/vendor/vue/LICENSE` | `https://raw.githubusercontent.com/vuejs/core/main/LICENSE` | `49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac` | | `data/fonts/bebas-neue/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt` | see `documentation/vendored-fonts.md` | diff --git a/internal/generate-tree.mjs b/internal/generate-tree.mjs index bcb4408e7..bd71621a3 100644 --- a/internal/generate-tree.mjs +++ b/internal/generate-tree.mjs @@ -1551,6 +1551,10 @@ function main() { // COMPLETE India ADM1 (36 units, geoBoundaries gbOpen, CC BY 2.5 IN; source + licence in its meta), // for maps that colour every state. The curated file above is UPG-100's 34-unit partition. [resolve(__dirname, '..', 'data', 'boundaries', 'gb-IND-ADM1-full.geojson'), 'gb-IND-ADM1-full.geojson'], + // ★ AND THE ATTRIBUTION, because this pair list is what decides whether it TRAVELS. The India + // ADM1 boundary is Creative Commons Attribution, so the credit has to reach the recipient with + // the data; a file left in data/boundaries would never ship. Same trap as vendor/*/LICENSE. + [resolve(__dirname, '..', 'data', 'boundaries', 'ATTRIBUTION'), 'ATTRIBUTION'], [resolve(__dirname, '..', 'data', 'boundaries', 'gb-IND-ADM1-full.meta.json'), 'gb-IND-ADM1-full.meta.json'], // WEB copies (library/scripts/boundaries/build-web-boundaries.mjs): every feature and island kept, about // a fifth of the bytes. The interactive maps fetch these; posters, print and build-time point-in-polygon @@ -1618,6 +1622,11 @@ function main() { 'boundaries/gb-CHN-ADM1.geojson', 'boundaries/gb-IND-ADM1-full.geojson', // all 36 states (Cities with Internet's NFHS layer) 'boundaries/gb-IND-ADM1-full.meta.json', // its source and licence, served beside it + // ★ SECOND STAGE. The pair list above only gathers into the build POOL; THIS list decides what + // reaches the tree. I added ATTRIBUTION to the pair list, ran the build, and it still did not ship + // — a two-stage pipeline needs the entry in both. The India ADM1 boundary is Creative Commons + // Attribution, so the credit must travel with the data. + 'boundaries/ATTRIBUTION', 'boundaries/world-adm0-web.geojson', // the web copies the interactive maps fetch 'boundaries/gb-IND-ADM1-web.geojson', 'boundaries/gb-IND-ADM1-full-web.geojson',