5.6 KiB
Third-party content in the shipped tree
Every non-original thing dx-maps/ ships, what licenses it, and whether the licence or
attribution actually travels with it. Compiled 2026-09-28 by inspecting the SHIPPED tree, not the
source lists -- the question is what a recipient receives.
Notes live HERE and not beside the assets: check:public-hygiene fails on "documentation in a
served folder". The licence travels with the asset; the explanation travels with the repo.
| Item | Source | Licence | Does it travel? | Gap |
|---|---|---|---|---|
| Fonts: bebas-neue, figtree, noto-serif-devanagari, oswald, poppins | Google Fonts / foundry repos | OFL-1.1 | Yes — each LICENSE is the family's own upstream OFL, verbatim, with its real copyright line |
none (closed 2026-09-28) |
vendor/vue/vue.global.prod.js |
vuejs/core | MIT | Partly — the minified banner carries (c) 2018-present Yuxi (Evan) You and @license MIT, but NOT the permission notice MIT asks to include |
closed: upstream LICENSE now vendored beside it |
vendor/tabulator/tabulator.min.js + .min.css |
olifolkerd/tabulator v6.3.1 | MIT | No — the .js had only (c) Oliver Folkerd 2025; the .css had nothing |
closed: upstream LICENSE now vendored beside it |
boundaries/gb-IND-ADM1*.geojson (4 files) |
geoBoundaries gbOpen, boundaryID IND-ADM1-1811400 |
CC BY 2.5 IN, licenceSource github.com/datameet/maps, year 2011 — fetched verbatim from the geoBoundaries API |
Yes — boundaries/ATTRIBUTION now ships beside the data, plus the existing .meta.json sidecar |
none (closed 2026-09-28) |
boundaries/gb-CHN-ADM1.geojson |
geoBoundaries gbOpen, boundaryID CHN-ADM1-43563684 |
Public Domain, licenceSource commons.wikimedia.org, year 2019 |
recorded in boundaries/ATTRIBUTION |
none — upstream records no attribution duty |
boundaries/world-adm0*.geojson (2 files, 162 countries) |
geoBoundaries gbOpen, assembled per country — corrected: its features carry geoBoundaries' own iso3/shapeGroup/shapeName properties, and the plugin's data/adm0/PROVENANCE.json names the source and endpoint. NOT Natural Earth, as this register first guessed |
MIXED — up to 162 different upstream licences. gbOpen passes each country's own licence through | the principle is stated in boundaries/ATTRIBUTION; the per-country licences are not |
OPEN — that PROVENANCE.json's licences table is EMPTY, so which of the 162 are CC BY is unestablished. Closing it means one API query per country. upg100-plugin's data; routed to them |
people-groups/* (3 files, 8 MB) |
peoplegroups.org | not established | no terms ship | OPEN, judgment — redistribution terms unknown |
pplr/* (6 files, 16 MB) |
PPLR ArcGIS Online org services2.arcgis.com/S4ydGgujXcif36k3, aggregating IMB (peoplegroups.org), Joshua Project, the ROP registry, and carrying WCD (World Christian Database) IDs. Built from a local 78 MB extract not present in this repo — evidence from exp-shepherd |
UNRESOLVED. aCountry and aIMBPeople publish no copyrightText, description or licence (queried f=json) |
nothing ships | OPEN, judgment — redistribution not established. WCD is a proprietary Brill database, so even the IDs need a check |
tables/* (304 files, 36 MB) |
derived by library/scripts/research/fetch-*.mjs from several upstream APIs |
varies, not established per table | nothing ships; there is no source or licence doc in tables/ |
OPEN, judgment — the largest gap by volume |
images/worldmap.svg |
recorded in images/PROVENANCE |
see that file | the PROVENANCE file ships and explains why no licence file sits beside it | none claimed; reasoning recorded rather than assumed |
previews/* (378 files) |
our own poster previews | ours | n/a | none |
Natural Earth 1:10m populated places (library/scripts/posters/data/ne-places.json) |
naturalearthdata.com | public domain, no attribution required | n/a | none. Their 1:10m ROADS were deliberately not shipped because of an ODbL attribution obligation |
Provenance records
| Vendored file | Upstream URL | sha256 |
|---|---|---|
data/boundaries/ATTRIBUTION |
geoBoundaries API, per boundary (values verbatim) | see the file |
data/vendor/tabulator/LICENSE |
https://raw.githubusercontent.com/olifolkerd/tabulator/master/LICENSE |
191a2ee554684e1064c897b432f0e1bc6dfa714ca045d3f6ea2cf692cbd398b7 |
data/vendor/vue/LICENSE |
https://raw.githubusercontent.com/vuejs/core/main/LICENSE |
49190d1f742dd61e47fe816df4963e5186a2a62100d9122f9883a60ea32973ac |
data/fonts/bebas-neue/LICENSE |
https://raw.githubusercontent.com/google/fonts/main/ofl/bebasneue/OFL.txt |
see documentation/vendored-fonts.md |
data/fonts/poppins/LICENSE |
https://raw.githubusercontent.com/google/fonts/main/ofl/poppins/OFL.txt |
see documentation/vendored-fonts.md |
What is NOT closed, and why it is not mine to close
Four rows above are marked OPEN. Two are simply unverified and someone should look
(world-adm0 provenance, the pplr upstream). Two need a decision rather than a fetch:
people-groups and the 304 tables carry data whose redistribution terms are not established,
and 36 MB of derived tables is the largest exposure by volume. Attaching a licence I have not
confirmed would be worse than the present gap, so those go to the agent.
The geoBoundaries row is closable by work rather than judgment: CC BY needs attribution to
accompany the data, and the pattern already exists in this repo -- the .meta.json sidecar. Extending
it to the other boundary files plus one shipped attribution line would close it.