chore(license): actually delete the proprietary fonts and unused packages · 6d33fea157 - archy

lfg2025/archy

chore(license): actually delete the proprietary fonts and unused packages

Demo images / Build & push demo images (push) Successful in 3m38s

Details

The audit has claimed since 2026-07-23 that these were git-rm'd. They weren't —
only the web/dist copies went, and all of them were still tracked at HEAD nearly
three weeks later, in a repo about to be published under MIT.

Deleted (~40.7 MB):
  neode-ui/public/assets/fonts/Courier_New/{CourierNew-Bold,CourierNew-Regular}.ttf
  neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf
  neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf
  neode-ui/public/packages/wireguard.apk   (17 MB)
  neode-ui/public/packages/atob.s9pk       (23 MB)

Courier New is Monotype proprietary and Benton Sans is a commercial Font Bureau
typeface — neither is redistributable. wireguard.apk carries GPL-2.0 libwg
components, so shipping it triggers a source offer. atob.s9pk is a Start9
package of unknown license. Redacted's upstream is OFL-1.1 but no license text
was shipped; deleting was cheaper than sourcing it, since it was unused.

Verified unreferenced before deleting, not after:
- Every @font-face rule in the tree (2 in src/style.css, 2 in
  public/entropy/index.html) loads Montserrat. None of these files was ever
  loaded by CSS.
- The three `Courier New` hits (tailwind.config.js `mono`, two public HTML
  font-family lists) name the *system* font as a fallback — they are not
  @font-face sources, so rendering is unchanged.
- wireguard.apk and atob.s9pk have zero references in any tracked file.
- These live under neode-ui/public/, which Vite copies verbatim rather than
  resolving, so their absence cannot break a build.

Deliberately kept: neode-ui/public/packages/archipelago-companion.apk, which IS
live (staged by .githooks/pre-push, the Android release flow, and the in-app
pairing QR); Montserrat (OFL.txt) and Open Sans (LICENSE.txt), both properly
licensed; and neode-ui/test-install.sh, which the same audit line listed but
which is not a licensing concern.

Audit updated: §1 and §3's font/package items marked closed, the false DONE
entry rewritten as a history note rather than deleted — a DONE line here is a
claim and should be re-verified with git ls-tree, which is exactly the lesson.
§2 (zbase32, LGPL-3.0+) is now the last hard blocker.

Side effect: ~40 MB off the frontend OTA tarball.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

This commit is contained in: