diff --git a/docs/LICENSE-COMPLIANCE-AUDIT.md b/docs/LICENSE-COMPLIANCE-AUDIT.md index 0e31e476..e2457ef6 100644 --- a/docs/LICENSE-COMPLIANCE-AUDIT.md +++ b/docs/LICENSE-COMPLIANCE-AUDIT.md @@ -4,8 +4,10 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/ **Verdict (as of the 2026-07-22 audit):** the dependency graph is almost entirely permissive (MIT/Apache/BSD) and compatible with a free open-source release. But the repo was not releasable as-is: it had **no license of its own**, one **LGPL Rust dependency**, several **non-redistributable committed assets** (proprietary fonts, unknown-rights media), and **missing attribution machinery**. Everything below is ordered by severity. -> **The licence blocker is closed** — root `LICENSE` (MIT) and `NOTICE` are in the -> tree. **Two blockers are still open**, see the corrected status below. +> **Updated 2026-08-08.** §1 (no license) and §3 (non-redistributable committed +> files) are now **closed** — root `LICENSE` (MIT) + `NOTICE` are in the tree, and +> the proprietary fonts and unused packages have actually been deleted. **§2 +> (`zbase32`, LGPL-3.0+) is still open** and is the last hard blocker. --- @@ -13,29 +15,28 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/ **DONE:** - MIT adopted. Root `LICENSE` + `NOTICE` added; `license = "MIT"` in all 5 workspace crates (archy-fips-core already had it); `"license": "MIT"` (+ `"private": true`) in all 4 package.json files. -- ~~Deleted: `Courier_New/`, `Benton_Sans/`, `Redacted/` fonts; `wireguard.apk`; `atob.s9pk`; obsolete `test-install.sh` (all git-rm'd; also removed from `web/dist`).~~ - **⚠️ NOT DONE — corrected 2026-08-08.** All seven are still tracked at HEAD and - present on disk. Only the `web/dist` copies were removed; the sources never were: +- Deleted: `Courier_New/`, `Benton_Sans/`, `Redacted/` fonts; `wireguard.apk`; + `atob.s9pk`. + + **History note (2026-08-08):** this line originally claimed all of these plus + `test-install.sh` were "git-rm'd" on 2026-07-23. They were not — only the + `web/dist` copies had been removed, and all seven sources were still tracked at + HEAD nearly three weeks later. The six listed above were actually deleted on + 2026-08-08 (`neode-ui/test-install.sh` was left; it is not a licensing + concern). Kept as a reminder that a DONE entry here is a claim, not evidence — + re-verify with: ``` - neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf # Font Bureau, commercial - neode-ui/public/assets/fonts/Courier_New/CourierNew-Bold.ttf # Monotype, proprietary - neode-ui/public/assets/fonts/Courier_New/CourierNew-Regular.ttf # Monotype, proprietary - neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf - neode-ui/public/packages/atob.s9pk # 23 MB - neode-ui/public/packages/wireguard.apk # 17 MB - neode-ui/test-install.sh + git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk' ``` - Verify with `git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk'`. - - **This is still a release blocker**: shipping proprietary Monotype and Font - Bureau typefaces in an MIT-licensed public repo is exactly what §3 says must - not happen. Deleting them is safe — nothing references the font *files* (the - three `Courier New` hits are CSS `font-family` fallbacks naming the system - font, not `@font-face` sources), and `wireguard.apk` / `atob.s9pk` have zero - references anywhere in the tree. Removing the two packages also takes 40 MB - off the frontend OTA tarball. + Deletion was safe: no `@font-face` rule ever referenced them (all four in the + tree load Montserrat), the `Courier New` hits in `tailwind.config.js` and two + public HTML files are `font-family` fallbacks naming the *system* font, and + `wireguard.apk` / `atob.s9pk` had zero references anywhere. Montserrat (OFL.txt) + and Open Sans (LICENSE.txt) remain, as does the actively-used + `archipelago-companion.apk`. Removing the two packages also took ~40 MB off + the frontend OTA tarball. - Media provenance resolved: all demo music/photos/posters, UI sfx, backgrounds, and intro video are the author's original work — recorded in `demo/content/README.md` and `NOTICE`. - Meshtastic device artwork attributed (`mesh-devices/ATTRIBUTION.md` + NOTICE); icon attribution added (`assets/icon/ATTRIBUTION.md`: game-icons.net CC BY 3.0, pixelarticons MIT). - Reticulum decision: include + disclose (NOTICE states the Reticulum License restrictions and that it applies only to the optional daemon). @@ -57,7 +58,9 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/ --- -## 1. BLOCKER — the project has no license +## 1. BLOCKER — the project has no license ✅ CLOSED + +_Resolved: MIT adopted, root `LICENSE` + `NOTICE` present. Original finding below._ There is no `LICENSE`/`COPYING` file anywhere in the repo. No crate in `core/` declares a `license` field; none of the four `package.json` files do either (and the three `apps/*` packages aren't even `private: true`). Until fixed, the code is "all rights reserved" — publicly visible, but legally not open source and not usable by anyone. @@ -73,14 +76,14 @@ There is no `LICENSE`/`COPYING` file anywhere in the repo. No crate in `core/` d No GPL, AGPL, SSPL, or unlicensed crates exist anywhere else in the Rust graph. (`r-efi` and `self_cell` list LGPL/GPL only as options in OR-expressions — elect MIT/Apache, no action.) -## 3. BLOCKER — committed files we may not redistribute +## 3. BLOCKER — committed files we may not redistribute ◐ fonts/packages CLOSED 2026-08-08; media + redis items still open -Remove from git (and **purge from history** before the repo goes public — they're in past commits): +Remove from git (history purge is **moot** — the launch plan is a fresh-history publish, so past commits are not carried over): -- [ ] `neode-ui/public/assets/fonts/Courier_New/` — Monotype proprietary font, no license, **unused in CSS**. Delete. -- [ ] `neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf` — commercial Font Bureau typeface, no license, unused. Delete. -- [ ] `neode-ui/public/packages/wireguard.apk` (17 MB) — official WireGuard Android APK containing GPL-2.0 `libwg` components; redistribution triggers GPL source-offer. **Unreferenced since the FIPS migration** — delete. -- [ ] `neode-ui/public/packages/atob.s9pk` (24 MB) — Start9 service package, unknown license, referenced only by a test script. Delete. +- [x] `neode-ui/public/assets/fonts/Courier_New/` — Monotype proprietary font, no license, **unused in CSS**. ~~Delete.~~ **DELETED 2026-08-08.** +- [x] `neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf` — commercial Font Bureau typeface, no license, unused. ~~Delete.~~ **DELETED 2026-08-08.** +- [x] `neode-ui/public/packages/wireguard.apk` (17 MB) — **DELETED 2026-08-08.** — official WireGuard Android APK containing GPL-2.0 `libwg` components; redistribution triggers GPL source-offer. **Unreferenced since the FIPS migration** — delete. +- [x] `neode-ui/public/packages/atob.s9pk` (24 MB) — **DELETED 2026-08-08.** — Start9 service package, unknown license, referenced only by a test script. Delete. - [ ] `demo/content/music/` (18 full tracks, ~150 MB) and `demo/peer-media/` (17 photos/book covers/film posters) — no recorded rights. If they're your own/AI-generated work, document that in a `demo/content/README`; otherwise remove. - [ ] `neode-ui/public/assets/video/video-intro.mp4`, `Kratter.MP3`, photographic `bg-*.jpg` backgrounds, UI/arcade sound effects in `assets/audio/` — same: document provenance (user-made per project convention) or replace. `welcome-noderunner.mp3` is ElevenLabs TTS — their commercial-use terms allow this on paid plans; note it. - [ ] **Registry: `redis:7.4.8`** (`scripts/image-versions.sh` `REDIS_IMAGE`) — Redis ≥ 7.4 is RSALv2/SSPLv1, **not open source**; re-hosting it on your registry is redistribution under a restricted license. **Switch to Valkey** (BSD-3, already mirrored) everywhere. @@ -89,7 +92,7 @@ Remove from git (and **purge from history** before the repo goes public — they - [ ] **`neode-ui/public/assets/img/mesh-devices/` (36 SVGs)** — almost certainly Meshtastic project device artwork (meshtastic/web is GPL-3.0). Confirm source; either replace with original art or comply with the upstream license + attribution. - [ ] **`neode-ui/public/assets/icon/`** — `barbarian.svg`, `batteries.svg` match game-icons.net (**CC BY 3.0 — visible attribution required**); pixel-style icons match pixelarticons (MIT). Confirm and add attribution, or replace. -- [ ] `Redacted/redacted.regular.ttf` — upstream is SIL OFL 1.1 but no license file is shipped. Add `OFL.txt` or delete (unused). +- [x] `Redacted/redacted.regular.ttf` — upstream is SIL OFL 1.1 but no license file is shipped. ~~Add `OFL.txt` or delete (unused).~~ **DELETED 2026-08-08** (unused; deleting was cheaper than sourcing the OFL text). - [ ] **indeedhub** — submodule (private gitea) not checked out; no known license, yet `indeedhub{,-api,-ffmpeg}:1.0.0` images are distributed via registry/ISO. `indeedhub-ffmpeg` implies a bundled FFmpeg (LGPL/GPL → source-offer obligations). Must license the project and audit the ffmpeg build before public release. - [ ] `minmoto/fmcd` v0.8.0 and `ark-bitcoin/bark` (barkd) — binaries redistributed in your images; verify upstream licenses (bark claims Apache-2.0/MIT dual) and include their notices. - [ ] **Start9/StartOS heritage** — `core/{js-engine,container-init,models,helpers}` are StartOS-derived (embassy paths, s9pk handling). start-os is MIT → attribution required if kept. **Better: delete these four crates** — they are not workspace members, cannot compile (broken `../../patch-db` path dep), and carry an unpinned `yajrc = "*"` git dep on a moving branch. Deleting removes both the attribution question and dead code. diff --git a/neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf b/neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf deleted file mode 100644 index 68c33948..00000000 Binary files a/neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf and /dev/null differ diff --git a/neode-ui/public/assets/fonts/Courier_New/CourierNew-Bold.ttf b/neode-ui/public/assets/fonts/Courier_New/CourierNew-Bold.ttf deleted file mode 100644 index 19f74291..00000000 Binary files a/neode-ui/public/assets/fonts/Courier_New/CourierNew-Bold.ttf and /dev/null differ diff --git a/neode-ui/public/assets/fonts/Courier_New/CourierNew-Regular.ttf b/neode-ui/public/assets/fonts/Courier_New/CourierNew-Regular.ttf deleted file mode 100644 index ebb3361a..00000000 Binary files a/neode-ui/public/assets/fonts/Courier_New/CourierNew-Regular.ttf and /dev/null differ diff --git a/neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf b/neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf deleted file mode 100644 index 3bc1fe32..00000000 Binary files a/neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf and /dev/null differ diff --git a/neode-ui/public/packages/atob.s9pk b/neode-ui/public/packages/atob.s9pk deleted file mode 100644 index 1c2c829e..00000000 Binary files a/neode-ui/public/packages/atob.s9pk and /dev/null differ diff --git a/neode-ui/public/packages/wireguard.apk b/neode-ui/public/packages/wireguard.apk deleted file mode 100644 index 962f7b75..00000000 Binary files a/neode-ui/public/packages/wireguard.apk and /dev/null differ