lfg2025/archy
1
0
Fork 0
Code Issues 25 Pull Requests 4 Actions Packages Projects Releases 74 Wiki Activity
Files
1481b873f8a3cfe6612a364dc052893fe2fb37d8
archy/docs/LICENSE-COMPLIANCE-AUDIT.md
T
archipelagoandClaude Opus 5 1481b873f8 docs(license-audit): the "deleted" proprietary fonts and APKs were never deleted 
The 2026-07-23 status block lists as DONE: "Deleted: Courier_New/, Benton_Sans/,
Redacted/ fonts; wireguard.apk; atob.s9pk; obsolete test-install.sh (all
git-rm'd)". All seven are still tracked at HEAD and present on disk. Only the
web/dist copies went; the sources never did.

    git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk'

That means a repo about to be published under MIT still carries a commercial
Font Bureau typeface and two proprietary Monotype fonts — precisely what §3 of
this audit says must not ship. An audit that reports a blocker as closed is
worse than one that never checked, so the entry is now struck through with the
file list and the verification command inline.

Deleting them is safe and I checked before saying so: nothing references the
font *files* (the three `Courier New` hits are CSS font-family fallbacks naming
the system font, not @font-face sources), and wireguard.apk / atob.s9pk have
zero references anywhere in the tree. Left the deletion itself to the operator —
it is 40 MB of tracked binaries and outside a docs pass. Removing them also
takes 40 MB off the frontend OTA tarball, which is a separate open item.

Also re-verified the rest of the remaining list:
- `zbase32` (LGPL-3.0+) is still a direct dep (Cargo.toml:113, did_dht.rs:40,49).
  Still the only hard copyleft blocker.
- LICENSE (MIT), NOTICE and both THIRD-PARTY-LICENSES inventories are present —
  so the headline "no license of its own" is closed; softened the verdict to say
  which blockers remain rather than leaving a stale "not releasable as-is".
- The four StartOS-derived crates still exist; flagged that KEY-05 cites
  core/models, so that one needs review rather than a blind delete.
- Item 6 (git filter-repo history purge) is superseded — the launch plan is a
  fresh-history publish, so there is no history to rewrite.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-08 04:10:09 -04:00

16 KiB
Raw Blame History

License Compliance Audit — Open-Source Release

Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/*, Android companion, image-recipe ISO, docker/, app-catalog, reticulum-daemon, demo/) plus the external FIPS source and registry-mirrored images.

Verdict (as of the 2026-07-22 audit): the dependency graph is almost entirely permissive (MIT/Apache/BSD) and compatible with a free open-source release. But the repo was not releasable as-is: it had no license of its own, one LGPL Rust dependency, several non-redistributable committed assets (proprietary fonts, unknown-rights media), and missing attribution machinery. Everything below is ordered by severity.

The licence blocker is closed — root LICENSE (MIT) and NOTICE are in the tree. Two blockers are still open, see the corrected status below.

STATUS UPDATE — 2026-07-23

DONE:

  • MIT adopted. Root LICENSE + NOTICE added; license = "MIT" in all 5 workspace crates (archy-fips-core already had it); "license": "MIT" (+ "private": true) in all 4 package.json files.

  • Deleted: Courier_New/, Benton_Sans/, Redacted/ fonts; wireguard.apk; atob.s9pk; obsolete test-install.sh (all git-rm'd; also removed from web/dist). ⚠️ NOT DONE — corrected 2026-08-08. All seven are still tracked at HEAD and present on disk. Only the web/dist copies were removed; the sources never were:

    neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf   # Font Bureau, commercial
neode-ui/public/assets/fonts/Courier_New/CourierNew-Bold.ttf      # Monotype, proprietary
neode-ui/public/assets/fonts/Courier_New/CourierNew-Regular.ttf   # Monotype, proprietary
neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf
neode-ui/public/packages/atob.s9pk                                # 23 MB
neode-ui/public/packages/wireguard.apk                            # 17 MB
neode-ui/test-install.sh

    Verify with git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk'.

    This is still a release blocker: shipping proprietary Monotype and Font Bureau typefaces in an MIT-licensed public repo is exactly what §3 says must not happen. Deleting them is safe — nothing references the font files (the three Courier New hits are CSS font-family fallbacks naming the system font, not @font-face sources), and wireguard.apk / atob.s9pk have zero references anywhere in the tree. Removing the two packages also takes 40 MB off the frontend OTA tarball.

  • Media provenance resolved: all demo music/photos/posters, UI sfx, backgrounds, and intro video are the author's original work — recorded in demo/content/README.md and NOTICE.

  • Meshtastic device artwork attributed (mesh-devices/ATTRIBUTION.md + NOTICE); icon attribution added (assets/icon/ATTRIBUTION.md: game-icons.net CC BY 3.0, pixelarticons MIT).

  • Reticulum decision: include + disclose (NOTICE states the Reticulum License restrictions and that it applies only to the optional daemon).

  • indeedhub: deferred — partnership in place; license the submodule before/at public release.

  • License inventories generated: core/THIRD-PARTY-LICENSES.md (649 crates) and neode-ui/THIRD-PARTY-LICENSES.md (runtime deps + fonts + vendored).

REMAINING (code changes, awaiting review — see sections below for detail):

  1. Replace zbase32 (LGPL-3.0+) with z32 or original impl — §2.
  2. Swap redis:7.4.8 → Valkey in scripts/image-versions.sh and deploys — §3.
  3. Delete dead StartOS-derived crates core/{js-engine,container-init,models,helpers} — §4.
  4. Attribution build integration: cargo-about in CI → ship full license texts in ISO; vite/rollup license plugin (or UI licenses page) for the web bundle; Android OSS-licenses screen — §5.
  5. Release-checklist items: per-release Debian source pointer (snapshot.debian.org), catalog license/sourceUrl fields, restrict ISO image bundling to the audited list — §6.
  6. Before repo goes public: purge deleted fonts/APKs from git history (git filter-repo) — superseded: the launch plan is a fresh-history publish, so there is no history to rewrite. What still applies is verifying the game-icons author credit, and actually deleting the files (see the correction above — they were never removed).

Re-verified 2026-08-08:

  • zbase32 0.1.2 (LGPL-3.0+) is still a direct dependency (core/archipelago/Cargo.toml:113), still used at network/did_dht.rs:40,49. Item 1 remains open and is the only hard copyleft blocker.
  • LICENSE (MIT) and NOTICE are present ✅. core/THIRD-PARTY-LICENSES.md and neode-ui/THIRD-PARTY-LICENSES.md are present ✅.
  • The four StartOS-derived crates in item 3 (core/{js-engine,container-init,models,helpers}) still exist — note KEY-05 legitimately cites core/models, so that one needs a look before deletion rather than a blind rm.

1. BLOCKER — the project has no license

There is no LICENSE/COPYING file anywhere in the repo. No crate in core/ declares a license field; none of the four package.json files do either (and the three apps/* packages aren't even private: true). Until fixed, the code is "all rights reserved" — publicly visible, but legally not open source and not usable by anyone.

Do:

  • Choose a license. Recommendation: MIT — the Bitcoin-ecosystem norm (Bitcoin Core, LND are MIT), maximally compatible with everything found in the graph. (Alternatives: Apache-2.0 adds a patent grant; GPLv3 if copyleft is desired — nothing in the deps prevents any of these.)
  • Add LICENSE at repo root with the year and copyright holder.
  • Add license = "MIT" to all five workspace member Cargo.tomls (archipelago, container, openwrt, performance, security) and Android/rust/archy-fips-core (declares MIT but ships no license file — add one).
  • Add "license": "MIT" to neode-ui/package.json and apps/{morphos-server,router,did-wallet}/package.json.

2. BLOCKER — copyleft dependency that must be replaced

  • zbase32 0.1.2 — LGPL-3.0+ — the only hard copyleft blocker in all 649 resolved Rust crates. Direct dep of archipelago, used in core/archipelago/src/network/did_dht.rs for did:dht z-base-32 encoding. LGPL statically linked into a Rust binary requires shipping relinkable objects/source — impractical. Replace with the MIT z32 crate or a ~30-line original alphabet-substitution implementation.

No GPL, AGPL, SSPL, or unlicensed crates exist anywhere else in the Rust graph. (r-efi and self_cell list LGPL/GPL only as options in OR-expressions — elect MIT/Apache, no action.)

3. BLOCKER — committed files we may not redistribute

Remove from git (and purge from history before the repo goes public — they're in past commits):

  • neode-ui/public/assets/fonts/Courier_New/ — Monotype proprietary font, no license, unused in CSS. Delete.
  • neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf — commercial Font Bureau typeface, no license, unused. Delete.
  • neode-ui/public/packages/wireguard.apk (17 MB) — official WireGuard Android APK containing GPL-2.0 libwg components; redistribution triggers GPL source-offer. Unreferenced since the FIPS migration — delete.
  • neode-ui/public/packages/atob.s9pk (24 MB) — Start9 service package, unknown license, referenced only by a test script. Delete.
  • demo/content/music/ (18 full tracks, ~150 MB) and demo/peer-media/ (17 photos/book covers/film posters) — no recorded rights. If they're your own/AI-generated work, document that in a demo/content/README; otherwise remove.
  • neode-ui/public/assets/video/video-intro.mp4, Kratter.MP3, photographic bg-*.jpg backgrounds, UI/arcade sound effects in assets/audio/ — same: document provenance (user-made per project convention) or replace. welcome-noderunner.mp3 is ElevenLabs TTS — their commercial-use terms allow this on paid plans; note it.
  • Registry: redis:7.4.8 (scripts/image-versions.sh REDIS_IMAGE) — Redis ≥ 7.4 is RSALv2/SSPLv1, not open source; re-hosting it on your registry is redistribution under a restricted license. Switch to Valkey (BSD-3, already mirrored) everywhere.

4. VERIFY — unknown/third-party provenance

  • neode-ui/public/assets/img/mesh-devices/ (36 SVGs) — almost certainly Meshtastic project device artwork (meshtastic/web is GPL-3.0). Confirm source; either replace with original art or comply with the upstream license + attribution.
  • neode-ui/public/assets/icon/ — barbarian.svg, batteries.svg match game-icons.net (CC BY 3.0 — visible attribution required); pixel-style icons match pixelarticons (MIT). Confirm and add attribution, or replace.
  • Redacted/redacted.regular.ttf — upstream is SIL OFL 1.1 but no license file is shipped. Add OFL.txt or delete (unused).
  • indeedhub — submodule (private gitea) not checked out; no known license, yet indeedhub{,-api,-ffmpeg}:1.0.0 images are distributed via registry/ISO. indeedhub-ffmpeg implies a bundled FFmpeg (LGPL/GPL → source-offer obligations). Must license the project and audit the ffmpeg build before public release.
  • minmoto/fmcd v0.8.0 and ark-bitcoin/bark (barkd) — binaries redistributed in your images; verify upstream licenses (bark claims Apache-2.0/MIT dual) and include their notices.
  • Start9/StartOS heritage — core/{js-engine,container-init,models,helpers} are StartOS-derived (embassy paths, s9pk handling). start-os is MIT → attribution required if kept. Better: delete these four crates — they are not workspace members, cannot compile (broken ../../patch-db path dep), and carry an unpinned yajrc = "*" git dep on a moving branch. Deleting removes both the attribution question and dead code.
  • Reticulum (RNS 1.3.5 + LXMF) — verified: custom "Reticulum License" — MIT-style plus field-of-use restrictions (no systems designed to harm humans; no AI/ML training-dataset use). Redistribution is permitted, so shipping the PyInstaller archy-reticulum-daemon binary is fine if the license text is included with it — but the OS cannot claim to be 100 % OSI-open-source while bundling it. Options: include + disclose (recommended, matches "plan for decentralization" honesty), or make the daemon an optional download.

5. REQUIRED — attribution / notice machinery (currently absent)

Nearly every permissive license (MIT/BSD/ISC/Apache) requires reproducing copyright + license text in distributed binaries — and right now every distribution channel strips them:

  • Rust binaries (649 crates, ~85 % MIT/Apache dual): generate THIRD-PARTY-LICENSES with cargo-about (or cargo-license) in CI; ship it in the ISO at e.g. /usr/share/doc/archipelago/. Include ring's three license files (LICENSE, LICENSE-BoringSSL, LICENSE-other-bits) and note the system OpenSSL (Apache-2.0) linked via ssh2.
  • Web bundle: Vite/esbuild strips all @license comments from web/dist. Add rollup-plugin-license/vite-plugin-license to emit a third-party attribution file, or add an "Open-source licenses" page in the UI. Runtime deps needing notices: vue/vue-router/pinia/vue-i18n (MIT), d3 (ISC), leaflet (BSD-2), dompurify (elect Apache-2.0 of its MPL/Apache dual), fuse.js (Apache-2.0), qrcode/qr-scanner/qrloop/buffer/fast-json-patch (MIT).
  • Android APK: packaging.excludes strips META-INF license texts and there is no licenses screen. Add an OSS-licenses screen or bundled licenses.txt covering AndroidX/Compose/OkHttp/ZXing (Apache-2.0), fips © 2026 Johnathan Corgan (MIT — the core of the VPN feature), tokio/tracing (MIT), subtle (BSD-3), tun (WTFPL — permissive, just list it), secp256k1 family (CC0). Generate the Rust side from the committed Cargo.lock with cargo-about.
  • AIUI demo bundle (demo/aiui/ — committed minified build): bundles Mermaid, Cytoscape, KaTeX, D3, Lodash, Workbox (all MIT/BSD). Add a THIRD-PARTY-LICENSES file next to it (or rebuild with a license plugin).
  • Keep the intact MIT headers in the two vendored qrcode.js copies (docker/lnd-ui, docker/electrs-ui) — already compliant, don't minify them.
  • Fonts kept: Montserrat (OFL.txt present ✓), Open Sans (Apache LICENSE.txt present ✓) — keep license files adjacent to the font files in dist.

6. REQUIRED — distribution-level obligations (ISO & registry)

The ISO redistributes a full Debian (trixie) system plus ~29 container image tarballs; the private registry re-hosts upstream images. Re-hosting = redistribution, same obligations as bundling.

  • GPL source offer for the ISO — kernel, GRUB, busybox/live-boot, coreutils, nftables, cryptsetup, wireguard-tools, SYSLINUX isohdpfx.bin, etc. Easiest compliance: keep /usr/share/doc/*/copyright (the build already does ✓) and publish, per release, either a mirror of the exact Debian source packages (apt-get source snapshot / snapshot.debian.org pointer) or a written offer in the docs. Add this to the release checklist.
  • AGPLv3 images redistributed (mempool, Grafana, Vaultwarden, SearXNG, PhotoPrism, Nextcloud, Immich, CryptPad, MinIO): AGPL compliance = make corresponding source available. You ship a modified mempool-frontend (docker/mempool-frontend entrypoint patch) — the patch is in-repo, so compliance is met once the repo is public; state this in docs. For unmodified images, link upstream sources in the app catalog.
  • GPLv2/GPLv3 images (MariaDB, Jellyfin, AdGuard Home, strfry): unmodified redistribution → provide license text + upstream source links (a license + sourceUrl field per app-catalog/catalog.json entry solves this catalog-wide).
  • Non-free firmware (firmware-realtek/iwlwifi/misc/linux-nonfree, intel/amd microcode): redistributable but proprietary — disclose in docs ("includes non-free firmware for hardware support"), like Debian's own non-free-firmware ISOs do.
  • The ISO build's live-server image capture (podman save of whatever matches on the dev server) is a compliance hazard — bundle only from the audited image list.
  • FIPS daemon (jmcorgan/fips v0.4.1, MIT ✓) and nostr-rs-relay binary (MIT ✓): include their license texts in the notices bundle.

7. Housekeeping (supports compliance)

  • Add lockfiles + pinned versions in apps/* (currently floating ^ ranges, violating the project's own pinning rule) — reproducibility is also what makes license audits stay true.
  • Android fips dep is pinned to a personal fork rev (9qeklajc/fips-native@46494a74) — mirror or vendor it so outside contributors can build.
  • Move @types/dompurify to devDeps; refresh stale neode-ui/node_modules.
  • Add a NOTICE file at root naming: fips (Johnathan Corgan, MIT), Start9 start-os (if any derived code remains), Kazuhiko Arase qrcode.js, font licenses, icon attributions.
  • Consider CI license gating: cargo-deny (Rust) + license-checker (npm) with an allowlist, so new copyleft deps are caught at PR time.

Quick reference: what's already clean

  • All 649 Rust crates except zbase32: permissive or dual-licensed.
  • All 833 npm packages in neode-ui: no GPL/AGPL anywhere; only dev-tool LGPL (sharp's libvips, never distributed).
  • Android Gradle deps: 100 % Apache-2.0, all pinned, no Play Services/telemetry.
  • FIPS mesh: MIT (© 2026 Johnathan Corgan) — keep notice.
  • js-engine binds deno_core (MIT) as a crate, nothing vendored — moot if dead crates are deleted.
  • reticulum-daemon Python is original code; obligations attach only to the PyInstaller binary (see §4).
  • Bitcoin Core/Knots, LND, BTCPay, Electrs, Fedimint, core-lightning, Gitea, Home Assistant, Tailscale, Portainer, Uptime-Kuma, filebrowser, ollama, penpot: MIT/Apache/BSD/Zlib/MPL — link + notice is enough.
Reference in New Issue View Git Blame Copy Permalink