fix: close the #11 attribution audit gaps (OFL, sprites MIT, Open-Meteo link, third-party notices, ODbL) by DocGerd · Pull Request #40 · DocGerd/sail_command

DocGerd · 2026-07-16T15:10:43Z

Closes the audit half of #11 (the Apache-2.0 license half merged in PR #30). A full attribution/license audit of every data source and shipped third-party asset found five gaps; this PR closes all of them.

Closes #11

Gaps closed

Noto glyph fonts (OFL 1.1) — the shipped .pbf glyph ranges are font software, but the license text was dropped when the pipeline copied only the font subdirectories from upstream. app/public/basemap-assets/fonts/OFL.txt now ships (verbatim upstream copy, diff-verified), and the pipeline's documented copy step includes it.
Basemap sprites — derived from MIT-licensed tangrams/icons (© 2017 Mapzen), previously mislabeled BSD-3-Clause in the docs and shipped without a notice. sprites/LICENSE.txt added (verbatim upstream, diff-verified); both READMEs corrected, keeping the styles-library-vs-sprite-assets distinction.
Open-Meteo — their licence requires a linked "Weather data by Open-Meteo.com". The map-corner attribution now carries proper anchors for OSM / Protomaps / EMODnet / Open-Meteo, and the About dialog wording matches in both languages.
Third-party notices — the deployed JS bundle redistributes BSD-3/MIT/ISC packages with no notices file. A deterministic generator (app/scripts/gen-third-party-notices.mjs, npm run notices, no new deps) emits app/public/THIRD-PARTY-NOTICES.txt (11 runtime packages; canonical license texts inlined for the two packages whose tarballs ship none, with copyright holders verified against upstream LICENSE files). Byte-stable across runs; throws rather than silently degrading for future deps.
ODbL derived database — the mask is a Derivative Database of OSM data; the required statement now appears in the README, the About dialog (new about.sources.osmMask, both dicts), and the pipeline source so the next mask regeneration carries it in mask.meta.json (the committed artifact was deliberately not hand-edited; a code comment documents the future dedupe).

Plus: EMODnet CC-BY licence link + changes-indicated note (README), stale "no license file yet" sentence removed.

Deliberately out of scope

v0.1.0 release-notes correction (public artifact — pending user approval; will otherwise be noted in v0.1.1).
ORC polars extra credit (audit judged current framing adequate; user default kept).

Offline/precache invariants

.txt is not in the precache globPatterns: all three license files deploy with the site but stay out of the SW precache — proven by grep -c 'OFL.txt\|LICENSE.txt\|THIRD-PARTY' dist/sw.js = 0 with precache unchanged at 791 entries (this branch predates the #27/#28 font change).

Verification

typecheck / lint clean; AboutDialog 10 passed; layout e2e sanity green; fixture restored.
Real-browser: map-corner attribution renders all four links (DOM-verified hrefs); About dialog shows the new/reworded lines in DE and EN (language-toggle screenshots).
Per-PR reviewer: round 1 Approve (OFL/MIT upstream diffs identical, notices rerun byte-stable, mask.meta.json untouched); round 2 Approve on the fix commit (canonical BSD-3 templates + upstream-verified copyright-holder overrides — the npm author field would have misattributed pmtiles).

🤖 Generated with Claude Code

- Ship SIL OFL 1.1 text for the self-hosted Noto Sans glyph PBFs (app/public/basemap-assets/fonts/OFL.txt, verbatim from protomaps/basemaps-assets) and add it to the documented copy step. - Ship MIT license for the sprite sheet (derived from tangrams/icons, (c) 2017 Mapzen) and correct the pipeline README's BSD-3-Clause mislabel — BSD-3 covers the @protomaps/basemaps styles library, not the sprite assets. - Hyperlink EMODnet Bathymetry and Open-Meteo in the map-corner attribution ("Weather data by Open-Meteo.com", as their licence requires). - Add app/scripts/gen-third-party-notices.mjs (npm run notices) and the generated app/public/THIRD-PARTY-NOTICES.txt covering the bundled runtime deps; deploys with the site, stays out of the SW precache (.txt is not in globPatterns). - State that mask.bin is an ODbL Derivative Database of OSM data in the README and in build_mask.py's mask.meta.json sources (committed artifact catches up at next mask regeneration). - README: link CC-BY 4.0 for EMODnet, indicate the data was processed (reprojected/quantized), point the License section at THIRD-PARTY-NOTICES.txt, drop the stale "no license file yet" note. - i18n: reword about.sources.openMeteo, add about.sources.osmMask (de+en) and render it in the About dialog sources list. Refs #11 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

M1: gen-third-party-notices.mjs now reproduces the canonical BSD-3-Clause/ MIT text (with the package's copyright holder) for packages that declare a license but ship no text in their npm tarball, instead of a bare declared-license note; unknown licenses without a bundled text now fail the run. Holders for pmtiles ("2021 Protomaps LLC") and @protomaps/basemaps ("2019-2023 Protomaps LLC, Kelso Cartography") are verified against the upstream LICENSE files via an explicit override map, since their package.json author fields ("Brandon Liu" / "The Protomaps Authors") differ from the upstream copyright lines. Regenerated THIRD-PARTY-NOTICES.txt; output is byte-stable across runs. M2: comment in build_mask.py at the new ODbL sources entry — once the mask is regenerated and mask.meta.json carries this string, the static about.sources.osmMask i18n item must be removed/deduped in AboutDialog to avoid rendering the ODbL statement twice. Refs #11 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- ci.yml app job: after build, run `npm run notices` and `git diff --exit-code public/THIRD-PARTY-NOTICES.txt` so a dep bump that forgets to regenerate the committed notices fails CI. Pathspec is relative to the job's working-directory (app/) — the repo-root form `app/public/...` would fatal from that cwd. - gen-third-party-notices.mjs: document findLicenseFile's first-match-wins and files-only assumptions (dual licenses / a licenses/ dir need a re-check); note that @protomaps/basemaps' upstream LICENSE.md is a compound file (also MIT sections for Mapzen 2015-2018 / Linux Foundation 2019) and the generated block reproduces the canonical BSD-3 per the declared npm license. Comments only — generated output verified byte-identical. - README: bathymetry processing reworded to "resampled onto the app's ~46 m grid and depth-quantized" (same-CRS resample, not a reprojection); ODbL in the Derivative Database statement now links to opendatacommons.org/licenses/odbl/1.0/. - build_mask.py: new ODbL source string uses "(c)" like its siblings. Refs #11 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Patrick Kuhn and others added 2 commits July 16, 2026 16:56