From 1481b873f8a3cfe6612a364dc052893fe2fb37d8 Mon Sep 17 00:00:00 2001 From: archipelago Date: Sat, 8 Aug 2026 04:10:09 -0400 Subject: [PATCH] docs(license-audit): the "deleted" proprietary fonts and APKs were never deleted MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2026-07-23 status block lists as DONE: "Deleted: Courier_New/, Benton_Sans/, Redacted/ fonts; wireguard.apk; atob.s9pk; obsolete test-install.sh (all git-rm'd)". All seven are still tracked at HEAD and present on disk. Only the web/dist copies went; the sources never did. git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk' That means a repo about to be published under MIT still carries a commercial Font Bureau typeface and two proprietary Monotype fonts — precisely what §3 of this audit says must not ship. An audit that reports a blocker as closed is worse than one that never checked, so the entry is now struck through with the file list and the verification command inline. Deleting them is safe and I checked before saying so: nothing references the font *files* (the three `Courier New` hits are CSS font-family fallbacks naming the system font, not @font-face sources), and wireguard.apk / atob.s9pk have zero references anywhere in the tree. Left the deletion itself to the operator — it is 40 MB of tracked binaries and outside a docs pass. Removing them also takes 40 MB off the frontend OTA tarball, which is a separate open item. Also re-verified the rest of the remaining list: - `zbase32` (LGPL-3.0+) is still a direct dep (Cargo.toml:113, did_dht.rs:40,49). Still the only hard copyleft blocker. - LICENSE (MIT), NOTICE and both THIRD-PARTY-LICENSES inventories are present — so the headline "no license of its own" is closed; softened the verdict to say which blockers remain rather than leaving a stale "not releasable as-is". - The four StartOS-derived crates still exist; flagged that KEY-05 cites core/models, so that one needs review rather than a blind delete. - Item 6 (git filter-repo history purge) is superseded — the launch plan is a fresh-history publish, so there is no history to rewrite. Co-Authored-By: Claude Opus 5 (1M context) --- docs/LICENSE-COMPLIANCE-AUDIT.md | 36 +++++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-) diff --git a/docs/LICENSE-COMPLIANCE-AUDIT.md b/docs/LICENSE-COMPLIANCE-AUDIT.md index 63c022d2..0e31e476 100644 --- a/docs/LICENSE-COMPLIANCE-AUDIT.md +++ b/docs/LICENSE-COMPLIANCE-AUDIT.md @@ -2,7 +2,10 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/*, Android companion, image-recipe ISO, docker/, app-catalog, reticulum-daemon, demo/) plus the external FIPS source and registry-mirrored images. -**Verdict:** the dependency graph is almost entirely permissive (MIT/Apache/BSD) and compatible with a free open-source release. But the repo is not releasable as-is: it has **no license of its own**, one **LGPL Rust dependency**, several **non-redistributable committed assets** (proprietary fonts, unknown-rights media), and **missing attribution machinery**. Everything below is ordered by severity. +**Verdict (as of the 2026-07-22 audit):** the dependency graph is almost entirely permissive (MIT/Apache/BSD) and compatible with a free open-source release. But the repo was not releasable as-is: it had **no license of its own**, one **LGPL Rust dependency**, several **non-redistributable committed assets** (proprietary fonts, unknown-rights media), and **missing attribution machinery**. Everything below is ordered by severity. + +> **The licence blocker is closed** — root `LICENSE` (MIT) and `NOTICE` are in the +> tree. **Two blockers are still open**, see the corrected status below. --- @@ -10,7 +13,29 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/ **DONE:** - MIT adopted. Root `LICENSE` + `NOTICE` added; `license = "MIT"` in all 5 workspace crates (archy-fips-core already had it); `"license": "MIT"` (+ `"private": true`) in all 4 package.json files. -- Deleted: `Courier_New/`, `Benton_Sans/`, `Redacted/` fonts; `wireguard.apk`; `atob.s9pk`; obsolete `test-install.sh` (all git-rm'd; also removed from `web/dist`). +- ~~Deleted: `Courier_New/`, `Benton_Sans/`, `Redacted/` fonts; `wireguard.apk`; `atob.s9pk`; obsolete `test-install.sh` (all git-rm'd; also removed from `web/dist`).~~ + **⚠️ NOT DONE — corrected 2026-08-08.** All seven are still tracked at HEAD and + present on disk. Only the `web/dist` copies were removed; the sources never were: + + ``` + neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf # Font Bureau, commercial + neode-ui/public/assets/fonts/Courier_New/CourierNew-Bold.ttf # Monotype, proprietary + neode-ui/public/assets/fonts/Courier_New/CourierNew-Regular.ttf # Monotype, proprietary + neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf + neode-ui/public/packages/atob.s9pk # 23 MB + neode-ui/public/packages/wireguard.apk # 17 MB + neode-ui/test-install.sh + ``` + + Verify with `git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk'`. + + **This is still a release blocker**: shipping proprietary Monotype and Font + Bureau typefaces in an MIT-licensed public repo is exactly what §3 says must + not happen. Deleting them is safe — nothing references the font *files* (the + three `Courier New` hits are CSS `font-family` fallbacks naming the system + font, not `@font-face` sources), and `wireguard.apk` / `atob.s9pk` have zero + references anywhere in the tree. Removing the two packages also takes 40 MB + off the frontend OTA tarball. - Media provenance resolved: all demo music/photos/posters, UI sfx, backgrounds, and intro video are the author's original work — recorded in `demo/content/README.md` and `NOTICE`. - Meshtastic device artwork attributed (`mesh-devices/ATTRIBUTION.md` + NOTICE); icon attribution added (`assets/icon/ATTRIBUTION.md`: game-icons.net CC BY 3.0, pixelarticons MIT). - Reticulum decision: include + disclose (NOTICE states the Reticulum License restrictions and that it applies only to the optional daemon). @@ -23,7 +48,12 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/ 3. Delete dead StartOS-derived crates `core/{js-engine,container-init,models,helpers}` — §4. 4. Attribution build integration: cargo-about in CI → ship full license texts in ISO; vite/rollup license plugin (or UI licenses page) for the web bundle; Android OSS-licenses screen — §5. 5. Release-checklist items: per-release Debian source pointer (snapshot.debian.org), catalog `license`/`sourceUrl` fields, restrict ISO image bundling to the audited list — §6. -6. Before repo goes public: purge deleted fonts/APKs from git history (`git filter-repo`), and verify game-icons author credit. +6. ~~Before repo goes public: purge deleted fonts/APKs from git history (`git filter-repo`)~~ — **superseded**: the launch plan is a fresh-history publish, so there is no history to rewrite. What still applies is verifying the game-icons author credit, and actually deleting the files (see the correction above — they were never removed). + +**Re-verified 2026-08-08:** +- `zbase32 0.1.2` (LGPL-3.0+) is **still a direct dependency** (`core/archipelago/Cargo.toml:113`), still used at `network/did_dht.rs:40,49`. Item 1 remains open and is the only hard copyleft blocker. +- `LICENSE` (MIT) and `NOTICE` are present ✅. `core/THIRD-PARTY-LICENSES.md` and `neode-ui/THIRD-PARTY-LICENSES.md` are present ✅. +- The four StartOS-derived crates in item 3 (`core/{js-engine,container-init,models,helpers}`) **still exist** — note KEY-05 legitimately cites `core/models`, so that one needs a look before deletion rather than a blind `rm`. ---