e8ddfc34a6
Both are MIT, which asks for the permission notice to be included with the software. Tabulator's minified .js carried only "(c) Oliver Folkerd 2025" and its .css carried nothing; Vue's banner names @license MIT but omits the permission text. Each now has its upstream LICENSE vendored verbatim beside it -- fetched, not authored, with the URL and sha256 recorded. ★ AND THE ALLOWLIST IS WHY IT WOULD NOT HAVE WORKED. generate-tree stages vendor/ by an explicit PATH LIST, so the licences sat in data/vendor and never reached the tree: staged count 0. Vendoring a notice the staging step drops is not compliance, it is paperwork. Both LICENSE paths are now listed. documentation/THIRD-PARTY.md is the register the sweep produced: every non-original thing dx-maps ships, its source, its licence, whether the licence or attribution actually travels, and the gap. Compiled by inspecting the SHIPPED tree rather than the source lists, because the question is what a recipient receives. Four rows are left OPEN and marked as such. Two are unverified and need a look (world-adm0's provenance, the pplr upstream). Two need a decision, not a fetch: people-groups and the 304 derived tables carry data whose redistribution terms are not established, 36 MB of it. Attaching a licence I have not confirmed would be worse than the gap, so those go to the Driver. geoBoundaries is closable by work rather than judgment -- CC BY needs attribution, and the .meta.json sidecar pattern already exists here for one file of eight.
4.5 KiB
4.5 KiB
Third-party content in the shipped tree
Every non-original thing dx-maps/ ships, what licenses it, and whether the licence or
attribution actually travels with it. Compiled 2026-09-28 by inspecting the SHIPPED tree, not the
source lists -- the question is what a recipient receives.
Notes live HERE and not beside the assets: check:public-hygiene fails on "documentation in a
served folder". The licence travels with the asset; the explanation travels with the repo.
| Item | Source | Licence | Does it travel? | Gap |
|---|---|---|---|---|
| Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | Yes — each LICENSE is the family's own upstream OFL, verbatim, with its real copyright line |
none (closed 2026-09-28) |
vendor/vue/vue.global.prod.js |
vuejs/core | MIT | Partly — the minified banner carries (c) 2018-present Yuxi (Evan) You and @license MIT, but NOT the permission notice MIT asks to include |
closed: upstream LICENSE now vendored beside it |
vendor/tabulator/tabulator.min.js + .min.css |
olifolkerd/tabulator v6.3.1 | MIT | No — the .js had only (c) Oliver Folkerd 2025; the .css had nothing |
closed: upstream LICENSE now vendored beside it |
boundaries/gb-*.geojson (4 files) |
geoBoundaries gbOpen (www.geoboundaries.org) | CC BY — the India ADM1 file records CC BY 2.5 IN, sourced from DataMeet/Election Commission of India | Partly — provenance sits in ONE sidecar, gb-IND-ADM1-full.meta.json (source, boundaryID, licence, fetch URL, processing). The other boundary files have none, and no human-readable attribution ships |
OPEN — CC BY requires attribution to accompany the work |
boundaries/world-adm0*.geojson |
not verified — probably Natural Earth | Natural Earth is public domain | n/a if Natural Earth | OPEN — provenance unconfirmed for this file |
people-groups/* (3 files, 8 MB) |
peoplegroups.org | not established | no terms ship | OPEN, judgment — redistribution terms unknown |
pplr/* (6 files, 16 MB) |
not resolved from plugin-designs/pplr-data-maps/scripts/build-data.mjs |
not established | nothing ships | OPEN, judgment — owner should name the upstream |
tables/* (304 files, 36 MB) |
derived by library/scripts/research/fetch-*.mjs from several upstream APIs |
varies, not established per table | nothing ships; there is no source or licence doc in tables/ |
OPEN, judgment — the largest gap by volume |
images/worldmap.svg |
recorded in images/PROVENANCE |
see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed |
previews/* (378 files) |
our own poster previews | ours | n/a | none |
Natural Earth 1:10m populated places (library/scripts/posters/data/ne-places.json) |
naturalearthdata.com | public domain, no attribution required | n/a | none. Their 1:10m ROADS were deliberately not shipped because of an ODbL attribution obligation |
Provenance records
| Vendored file | Upstream URL | sha256 |
|---|---|---|
data/vendor/tabulator/LICENSE |
https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE |
191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7 |
data/vendor/vue/LICENSE |
https://raw.githubusercontent.com/vuejs/core/main/LICENSE |
49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac |
data/fonts/bebas-neue/LICENSE |
https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt |
see documentation/vendored-fonts.md |
data/fonts/poppins/LICENSE |
https://raw.githubusercontent.com/google/fonts/main/ofl/poppins/OFL.txt |
see documentation/vendored-fonts.md |
What is NOT closed, and why it is not mine to close
Four rows above are marked OPEN. Two are simply unverified and someone should look
(world-adm0 provenance, the pplr upstream). Two need a decision rather than a fetch:
people-groups and the 304 tables carry data whose redistribution terms are not established,
and 36 MB of derived tables is the largest exposure by volume. Attaching a licence I have not
confirmed would be worse than the present gap, so those go to the Driver.
The geoBoundaries row is closable by work rather than judgment: CC BY needs attribution to
accompany the data, and the pattern already exists in this repo -- the .meta.json sidecar. Extending
it to the other boundary files plus one shipped attribution line would close it.