e8ddfc34a6
Both are MIT, which asks for the permission notice to be included with the software. Tabulator's minified .js carried only "(c) Oliver Folkerd 2025" and its .css carried nothing; Vue's banner names @license MIT but omits the permission text. Each now has its upstream LICENSE vendored verbatim beside it -- fetched, not authored, with the URL and sha256 recorded. ★ AND THE ALLOWLIST IS WHY IT WOULD NOT HAVE WORKED. generate-tree stages vendor/ by an explicit PATH LIST, so the licences sat in data/vendor and never reached the tree: staged count 0. Vendoring a notice the staging step drops is not compliance, it is paperwork. Both LICENSE paths are now listed. documentation/THIRD-PARTY.md is the register the sweep produced: every non-original thing dx-maps ships, its source, its licence, whether the licence or attribution actually travels, and the gap. Compiled by inspecting the SHIPPED tree rather than the source lists, because the question is what a recipient receives. Four rows are left OPEN and marked as such. Two are unverified and need a look (world-adm0's provenance, the pplr upstream). Two need a decision, not a fetch: people-groups and the 304 derived tables carry data whose redistribution terms are not established, 36 MB of it. Attaching a licence I have not confirmed would be worse than the gap, so those go to the Driver. geoBoundaries is closable by work rather than judgment -- CC BY needs attribution, and the .meta.json sidecar pattern already exists here for one file of eight.
44 lines
4.5 KiB
Markdown
44 lines
4.5 KiB
Markdown
# Third-party content in the shipped tree
|
|
|
|
Every non-original thing `dx-maps/` ships, what licenses it, and whether the licence or
|
|
attribution actually travels with it. Compiled 2026-09-28 by inspecting the SHIPPED tree, not the
|
|
source lists -- the question is what a recipient receives.
|
|
|
|
Notes live HERE and not beside the assets: `check:public-hygiene` fails on "documentation in a
|
|
served folder". The licence travels with the asset; the explanation travels with the repo.
|
|
|
|
| Item | Source | Licence | Does it travel? | Gap |
|
|
|---|---|---|---|---|
|
|
| Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | **Yes** — each `LICENSE` is the family's own upstream OFL, verbatim, with its real copyright line | none (closed 2026-09-28) |
|
|
| `vendor/vue/vue.global.prod.js` | vuejs/core | MIT | **Partly** — the minified banner carries `(c) 2018-present Yuxi (Evan) You` and `@license MIT`, but NOT the permission notice MIT asks to include | closed: upstream `LICENSE` now vendored beside it |
|
|
| `vendor/tabulator/tabulator.min.js` + `.min.css` | olifolkerd/tabulator v6.3.1 | MIT | **No** — the `.js` had only `(c) Oliver Folkerd 2025`; the `.css` had nothing | closed: upstream `LICENSE` now vendored beside it |
|
|
| `boundaries/gb-*.geojson` (4 files) | geoBoundaries gbOpen (www.geoboundaries.org) | CC BY — the India ADM1 file records **CC BY 2.5 IN**, sourced from DataMeet/Election Commission of India | **Partly** — provenance sits in ONE sidecar, `gb-IND-ADM1-full.meta.json` (source, boundaryID, licence, fetch URL, processing). The other boundary files have none, and no human-readable attribution ships | **OPEN** — CC BY requires attribution to accompany the work |
|
|
| `boundaries/world-adm0*.geojson` | not verified — probably Natural Earth | Natural Earth is public domain | n/a if Natural Earth | **OPEN** — provenance unconfirmed for this file |
|
|
| `people-groups/*` (3 files, 8 MB) | peoplegroups.org | **not established** | no terms ship | **OPEN, judgment** — redistribution terms unknown |
|
|
| `pplr/*` (6 files, 16 MB) | not resolved from `plugin-designs/pplr-data-maps/scripts/build-data.mjs` | **not established** | nothing ships | **OPEN, judgment** — owner should name the upstream |
|
|
| `tables/*` (304 files, 36 MB) | derived by `library/scripts/research/fetch-*.mjs` from several upstream APIs | **varies, not established per table** | nothing ships; there is no source or licence doc in `tables/` | **OPEN, judgment** — the largest gap by volume |
|
|
| `images/worldmap.svg` | recorded in `images/PROVENANCE` | see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed |
|
|
| `previews/*` (378 files) | our own poster previews | ours | n/a | none |
|
|
| Natural Earth 1:10m populated places (`library/scripts/posters/data/ne-places.json`) | naturalearthdata.com | **public domain**, no attribution required | n/a | none. Their 1:10m ROADS were deliberately not shipped because of an ODbL attribution obligation |
|
|
|
|
## Provenance records
|
|
|
|
| Vendored file | Upstream URL | sha256 |
|
|
|---|---|---|
|
|
| `data/vendor/tabulator/LICENSE` | `https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE` | `191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7` |
|
|
| `data/vendor/vue/LICENSE` | `https://raw.githubusercontent.com/vuejs/core/main/LICENSE` | `49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac` |
|
|
| `data/fonts/bebas-neue/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt` | see `documentation/vendored-fonts.md` |
|
|
| `data/fonts/poppins/LICENSE` | `https://raw.githubusercontent.com/google/fonts/main/ofl/poppins/OFL.txt` | see `documentation/vendored-fonts.md` |
|
|
|
|
## What is NOT closed, and why it is not mine to close
|
|
|
|
Four rows above are marked OPEN. Two are simply unverified and someone should look
|
|
(`world-adm0` provenance, the `pplr` upstream). Two need a decision rather than a fetch:
|
|
**people-groups** and the 304 **tables** carry data whose redistribution terms are not established,
|
|
and 36 MB of derived tables is the largest exposure by volume. Attaching a licence I have not
|
|
confirmed would be worse than the present gap, so those go to the Driver.
|
|
|
|
The geoBoundaries row is closable by work rather than judgment: CC BY needs attribution to
|
|
accompany the data, and the pattern already exists in this repo -- the `.meta.json` sidecar. Extending
|
|
it to the other boundary files plus one shipped attribution line would close it.
|
|
|