From c43aa399f7046daa98675a7bae0746cc9f8718fa Mon Sep 17 00:00:00 2001 From: doxa-maps-88655c70 <88627970+doxa-maps-88655c70@users.noreply.github.com> Date: Thu, 24 Sep 2026 09:25:20 +0000 Subject: [PATCH] Record worldmap.svg's provenance, after auditing the licence obligation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Applying the same question as the last three ticks to the standing rule with real-world weight — "vendored bytes small and LICENSED". Two gaps, one of them mine. I vendored worldmap.svg silently: 311KB copied from their repo with no note of where it came from or why no licence accompanies it. The judgement was left implicit, which is exactly what a provenance question should not be. Checked properly now. A full-file scan for copyright, licence, attribution, author, creator, , <desc>, <metadata>, rdf:/dc: nodes and the usual stock-library names — Natural Earth, simplemaps, amCharts, Freepik, Shutterstock, OSM, Mapbox — returns nothing. It is a plain vector: 394 <path>, three <g>, zero <image>, zero <text>, with design-tool export ids (Group_345, data-name="Group 345"), so it was authored by their designer rather than downloaded with embedded credits. DX-life keeps no licence beside public/assets/images/ either; they treat that folder as their own artwork. So this is internal reuse of a first-party asset within the same organisation, not redistribution of a third-party one. public/assets/images/PROVENANCE records that reasoning, the exact source path, the measured live values, and the contrast with the typefaces — which ARE third-party and therefore carry their OFL text in the folder that serves them. Extensionless, following the LICENSE precedent, since check:public-hygiene refuses a *.txt in a served folder; hygiene stays clean at 0 findings and the note is staged into the tree beside the asset it describes. The second gap needed no source change and lands in the probe suite: OFL compliance rested on a one-time manual act with nothing checking it, so a merge that dropped a LICENSE, or a future bundle vendoring a face without one, would have shipped unlicensed bytes with every gate green. A new suite walks public/assets for woff2/ttf/otf/eot, asserts a licence sits beside the fonts, asserts it is real text rather than a stub, asserts it is not a *.txt, and then repeats the audit inside the generated tree — because a licence that never reaches the tree does not travel with what a reader downloads. It immediately covered a third vendored face I did not know existed, noto-serif-devanagari, already compliant. Negative-tested twice: a removed licence fails, and a two-byte stub fails on the real-text assertion. --- public/assets/images/PROVENANCE | 36 +++++++++++++++++++++++ public/doxa-maps/assets/images/PROVENANCE | 36 +++++++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 public/assets/images/PROVENANCE create mode 100644 public/doxa-maps/assets/images/PROVENANCE diff --git a/public/assets/images/PROVENANCE b/public/assets/images/PROVENANCE new file mode 100644 index 000000000..18a4c1413 --- /dev/null +++ b/public/assets/images/PROVENANCE @@ -0,0 +1,36 @@ +worldmap.svg — provenance +========================= + +WHAT IT IS + The faint world-map watermark DX-life paints behind its people-group list. Their + UupgsList sets it inline on the list root (app/components/public/UupgsList.vue:451): + background-image: url(/assets/images/worldmap.svg), background-size 60%, + background-position top, min-height 400px. Measured on their live + /regions/cameroon: HTTP 200, 62,740 bytes over the wire, computed background-size + 60% / position 50% 0% / repeat no-repeat. + +WHERE IT CAME FROM + Copied byte-for-byte from the DX-life repository: + doxa-life/public/assets/images/worldmap.svg + Same organisation, copied so the regions clone matches their page. 311 KB on disk; + small against this tree's other assets, which run 644 KB to 42 MB. + +WHY THERE IS NO LICENCE FILE BESIDE IT + Checked, rather than assumed. A full-file scan for copyright, licence, attribution, + author, creator, <title>, <desc>, <metadata>, rdf:/dc: nodes and the usual stock-library + names (Natural Earth, simplemaps, amCharts, Freepik, Shutterstock, OSM, Mapbox) returns + NOTHING. The file is a plain vector — 394 <path> elements, three groups, no <image> and + no <text> — and its ids are design-tool export names (Group_345, + data-name="Group 345"), i.e. authored by their designer rather than downloaded with + embedded credits. DX-life keeps no licence file alongside public/assets/images/ either; + they treat that folder as their own artwork. + So this is internal reuse of a first-party asset, not redistribution of a third-party + one. Recorded here because the alternative was leaving the judgement implicit. + + Contrast with the vendored typefaces, which ARE third-party and therefore carry their + licence in the folder that serves them: public/assets/fonts/bebas-neue/LICENSE and + .../poppins/LICENSE, both the SIL Open Font License 1.1, as the OFL requires. + +NOTE ON THE FILENAME + Extensionless on purpose. check:public-hygiene refuses a *.txt in a served folder, and + the font LICENSE files set that precedent. diff --git a/public/doxa-maps/assets/images/PROVENANCE b/public/doxa-maps/assets/images/PROVENANCE new file mode 100644 index 000000000..18a4c1413 --- /dev/null +++ b/public/doxa-maps/assets/images/PROVENANCE @@ -0,0 +1,36 @@ +worldmap.svg — provenance +========================= + +WHAT IT IS + The faint world-map watermark DX-life paints behind its people-group list. Their + UupgsList sets it inline on the list root (app/components/public/UupgsList.vue:451): + background-image: url(/assets/images/worldmap.svg), background-size 60%, + background-position top, min-height 400px. Measured on their live + /regions/cameroon: HTTP 200, 62,740 bytes over the wire, computed background-size + 60% / position 50% 0% / repeat no-repeat. + +WHERE IT CAME FROM + Copied byte-for-byte from the DX-life repository: + doxa-life/public/assets/images/worldmap.svg + Same organisation, copied so the regions clone matches their page. 311 KB on disk; + small against this tree's other assets, which run 644 KB to 42 MB. + +WHY THERE IS NO LICENCE FILE BESIDE IT + Checked, rather than assumed. A full-file scan for copyright, licence, attribution, + author, creator, <title>, <desc>, <metadata>, rdf:/dc: nodes and the usual stock-library + names (Natural Earth, simplemaps, amCharts, Freepik, Shutterstock, OSM, Mapbox) returns + NOTHING. The file is a plain vector — 394 <path> elements, three groups, no <image> and + no <text> — and its ids are design-tool export names (Group_345, + data-name="Group 345"), i.e. authored by their designer rather than downloaded with + embedded credits. DX-life keeps no licence file alongside public/assets/images/ either; + they treat that folder as their own artwork. + So this is internal reuse of a first-party asset, not redistribution of a third-party + one. Recorded here because the alternative was leaving the judgement implicit. + + Contrast with the vendored typefaces, which ARE third-party and therefore carry their + licence in the folder that serves them: public/assets/fonts/bebas-neue/LICENSE and + .../poppins/LICENSE, both the SIL Open Font License 1.1, as the OFL requires. + +NOTE ON THE FILENAME + Extensionless on purpose. check:public-hygiene refuses a *.txt in a served folder, and + the font LICENSE files set that precedent.