Licence audit and an attribution list — before anything is published #208

New issue

Open

opened 2026-08-21 09:40:19 +00:00 by art-bot · 0 comments

art-bot commented

2026-08-21 09:40:19 +00:00

Collaborator

Correction (maintainer, 2026-08-21): this is preparatory, not a live breach.
The original framing below said the map "credits nobody" as though we were out of
compliance. We are not. CC BY's attribution condition triggers on distribution or
communication to the public, and none has happened: the database, the MVT
endpoints and the rendered map are not published — access is the maintainer and
two other people. What is public is the importer source, which carries no map
data. So the work below is what has to be done before anything is published,
not a fire to put out. Nobody should treat this as urgent or act on it out of
hours.

(The importer having no licence of its own is known and deliberate for now.)

The project has a licence rule (R2) and no licence inventory, and the served
map credits nobody. Most of our sources are CC BY 4.0, which — unlike CC0 —
obliges us to attribute once we publish.

The gap that would exist on publication

grep -rniE 'attribution' html/ mapsrv/ returns nothing. No attribution
key on any source in html/style.yaml, no credit line in html/index.html, no
attribution in the tile server. MapLibre renders a source's attribution string
in its control automatically; we set none, so the map would present
Lantmäteriet's, MML's, LMÍ's, GUGiK's, EEA's and Natural Earth's data with no
notice at all the day it goes public.

R2 (docs/country-requirements.md) says "Record the licence of every wired
source in docs/country-<cc>.md" and justifies itself with "every other source
in the project is CC0 or equivalent". That second half is not accurate: Iceland's
IS 50V, Finland's MTK and SYKE CORINE, Greece's road and metro sets and others
are CC BY 4.0. CC BY is permissive and fine for us — it is not share-alike,
so R1/R2's actual concern (ODbL infecting the deliverable) is untouched — but it
carries an attribution condition that CC0 does not, and the repo does not record
the strings that condition would require.

Scope

Audit every wired source and record, per source: provider, product,
licence with a URL to the licence text, the exact attribution string the
licence requires, and whether any extra notice (disclaimer, "modified from")
is obliged.
Build one attribution list — a single file (say docs/attribution.md)
that is the canonical set, with the per-country docs pointing at it rather
than each carrying a fragment.
Surface it in the product (only needed before publication):
attribution on the map source in html/style.yaml (MapLibre shows it in
the attribution control), plus a credits section in html/index.html for the
full text where the control's one-liner is too short.
Tighten R2 to say what it actually needs: record the licence and the
attribution string it requires, and correct the "CC0 or equivalent" claim.
Consider an acceptance-style check that every conf/<cc>/downloads.yaml host
has a corresponding entry in the attribution list, so a new source cannot be
wired without one.

Starting inventory — the hosts we fetch from

Extracted from url: entries across conf/**/*.yaml, plus the credentialed
providers. Licence column is what the repo claims today, not what has been
verified against the licence text:

host	country	provider (claimed)	licence (claimed)
`atlas.lmi.is`	is	LMÍ / Náttúrufræðistofnun, IS 50V	CC BY 4.0
`www.nic.funet.fi`	fi	MML Maastotietokanta, Digiroad	CC BY 4.0
`wwwd3.ymparisto.fi`	fi	SYKE CORINE	CC BY 4.0
`infopalvelut.storage.hsldev.com`	fi	HSL GTFS	CC BY 4.0
`api.lantmateriet.se`, `apimanager.lantmateriet.se`	se	Lantmäteriet Geotorget (Topo 10/50)	unrecorded
Lastkajen (`lastkajen.trafikverket.se`)	se	Trafikverket NVDB/NJDB	unrecorded
`opendata.samtrafiken.se`	se	Trafiklab GTFS Sweden 3	CC0
`mapy.geoportal.gov.pl`, `opendata.geoportal.gov.pl`	pl	GUGiK BDOT10k, PRG	unrecorded
`gtfs.ztm.waw.pl`, `gtfs.ztp.krakow.pl`, `otwarte.miasto.lodz.pl`	pl	municipal GTFS	unrecorded
`data.gov.gr`, `www.statistics.gr`	gr	ΕΓΝΑΤΙΑ ΟΔΟΣ, ΕΛΣΤΑΤ	CC BY 4.0 / portal terms, dataset-level unconfirmed
`gis.cityofathens.gr`	gr	City of Athens metro/tram	CC BY
`gis.floods.ypeka.gr`, `wfdservices.ypeka.gr`	gr	ΥΠΕΝ hydrography	unrecorded
CLMS (credentialed)	gr	Copernicus Land Monitoring CORINE	unrecorded
`naciscdn.org`	all	Natural Earth	public domain
Maki icons (vendored)	—	Mapbox Maki	CC0-1.0
`warszawa-metro` badge	pl	Wikimedia Commons	public domain

Nine of these have no recorded licence. That is the audit.

COP-DEM GLO-30 — checked, and probably disqualifying

Checked against the licence text itself (License-COPDEM-30.pdf, the
COP-DEM-GLO-30-F "Full, Free & Open" instance).

Article 4 grants — non-exclusive, worldwide, unlimited in time:
reproduction; distribution; communication to the general public; adaptation,
modification and combination with other data. Article 5: free of charge.
Deriving contours and spot heights and shipping them is squarely within (d).
Article 9 adds that the Licensor and Provider "will not claim any IPRs … obtained
by the User through his own work" — derived vectors would be our work product.

Article 6 obliges:

(a) distributing the DEM itself:
© DLR e.V. 2010-2014 and © Airbus Defence and Space GmbH 2014-2018 provided under COPERNICUS by the European Union and ESA; all rights reserved.
(b) where adapted or modified — the case here:
produced using Copernicus WorldDEM-30 © DLR e.V. 2010-2014 and © Airbus Defence and Space GmbH 2014-2018 provided under COPERNICUS by the European Union and ESA
(c) a liability disclaimer must travel with it:
The organisations in charge of the Copernicus programme by law or by delegation do not incur any liability for any use of the Copernicus WorldDEM-30.
(d) must not imply official endorsement.
(e) downstream users must be bound by the same obligations.

No share-alike, no non-commercial clause, no restriction on derived products — so
it does not infect the deliverable the way ODbL would. The maintainer's
objection is not share-alike, it is the mandated-wording clause itself: this is
the 4-clause BSD advertising problem. One source demanding its own verbatim
string is mild; thirty of them is a document nobody reads, and the moment one
licence requires its wording be "prominent", being buried in that document stops
satisfying it. Sources that impose bespoke notice text are therefore a mark
against adoption, independent of whether the terms are otherwise permissive.

Status: likely rejected, revisitable only if the Greece result is
exceptional. Any source that mandates specific wording should be flagged in the
audit above as a cost, not just recorded.

Operational, not licensing: from 28 July 2026 the CDSE COP-DEM 30m view
service is restricted to registered Copernicus Contributing Missions users
(CDSE news, 17 July 2026). That is the WMS view service, not the licence and not
the data download — AWS Open Data and CDSE download paths are unaffected — but a
fetch provider built against the view service will break.

Notes

Prompted by the Greece contours/peaks work moving to COP-DEM GLO-30 after its
earlier source turned out to be retired.
Related: #203 (whether DEM-derived peaks are wanted at all). Independent of
that outcome.

**Correction (maintainer, 2026-08-21): this is preparatory, not a live breach.** The original framing below said the map "credits nobody" as though we were out of compliance. We are not. CC BY's attribution condition triggers on distribution or communication to the public, and none has happened: the database, the MVT endpoints and the rendered map are not published — access is the maintainer and two other people. What *is* public is the importer source, which carries no map data. So the work below is what has to be done **before** anything is published, not a fire to put out. Nobody should treat this as urgent or act on it out of hours. (The importer having no licence of its own is known and deliberate for now.) --- The project has a licence *rule* (R2) and no licence *inventory*, and the served map credits nobody. Most of our sources are CC BY 4.0, which — unlike CC0 — obliges us to attribute **once we publish**. ## The gap that would exist on publication `grep -rniE 'attribution' html/ mapsrv/` returns **nothing**. No `attribution` key on any source in `html/style.yaml`, no credit line in `html/index.html`, no attribution in the tile server. MapLibre renders a source's `attribution` string in its control automatically; we set none, so the map would present Lantmäteriet's, MML's, LMÍ's, GUGiK's, EEA's and Natural Earth's data with no notice at all the day it goes public. R2 (`docs/country-requirements.md`) says "Record the licence of every wired source in `docs/country-<cc>.md`" and justifies itself with "every other source in the project is CC0 or equivalent". That second half is not accurate: Iceland's IS 50V, Finland's MTK and SYKE CORINE, Greece's road and metro sets and others are **CC BY 4.0**. CC BY is permissive and fine for us — it is not share-alike, so R1/R2's actual concern (ODbL infecting the deliverable) is untouched — but it carries an attribution condition that CC0 does not, and the repo does not record the strings that condition would require. ## Scope 1. **Audit every wired source** and record, per source: provider, product, licence with a URL to the licence text, the exact attribution string the licence requires, and whether any extra notice (disclaimer, "modified from") is obliged. 2. **Build one attribution list** — a single file (say `docs/attribution.md`) that is the canonical set, with the per-country docs pointing at it rather than each carrying a fragment. 3. **Surface it in the product** *(only needed before publication)*: `attribution` on the `map` source in `html/style.yaml` (MapLibre shows it in the attribution control), plus a credits section in `html/index.html` for the full text where the control's one-liner is too short. 4. **Tighten R2** to say what it actually needs: record the licence *and the attribution string it requires*, and correct the "CC0 or equivalent" claim. Consider an acceptance-style check that every `conf/<cc>/downloads.yaml` host has a corresponding entry in the attribution list, so a new source cannot be wired without one. ## Starting inventory — the hosts we fetch from Extracted from `url:` entries across `conf/**/*.yaml`, plus the credentialed providers. Licence column is what the repo *claims* today, not what has been verified against the licence text: | host | country | provider (claimed) | licence (claimed) | |---|---|---|---| | `atlas.lmi.is` | is | LMÍ / Náttúrufræðistofnun, IS 50V | CC BY 4.0 | | `www.nic.funet.fi` | fi | MML Maastotietokanta, Digiroad | CC BY 4.0 | | `wwwd3.ymparisto.fi` | fi | SYKE CORINE | CC BY 4.0 | | `infopalvelut.storage.hsldev.com` | fi | HSL GTFS | CC BY 4.0 | | `api.lantmateriet.se`, `apimanager.lantmateriet.se` | se | Lantmäteriet Geotorget (Topo 10/50) | **unrecorded** | | Lastkajen (`lastkajen.trafikverket.se`) | se | Trafikverket NVDB/NJDB | **unrecorded** | | `opendata.samtrafiken.se` | se | Trafiklab GTFS Sweden 3 | CC0 | | `mapy.geoportal.gov.pl`, `opendata.geoportal.gov.pl` | pl | GUGiK BDOT10k, PRG | **unrecorded** | | `gtfs.ztm.waw.pl`, `gtfs.ztp.krakow.pl`, `otwarte.miasto.lodz.pl` | pl | municipal GTFS | **unrecorded** | | `data.gov.gr`, `www.statistics.gr` | gr | ΕΓΝΑΤΙΑ ΟΔΟΣ, ΕΛΣΤΑΤ | CC BY 4.0 / portal terms, dataset-level **unconfirmed** | | `gis.cityofathens.gr` | gr | City of Athens metro/tram | CC BY | | `gis.floods.ypeka.gr`, `wfdservices.ypeka.gr` | gr | ΥΠΕΝ hydrography | **unrecorded** | | CLMS (credentialed) | gr | Copernicus Land Monitoring CORINE | **unrecorded** | | `naciscdn.org` | all | Natural Earth | public domain | | Maki icons (vendored) | — | Mapbox Maki | CC0-1.0 | | `warszawa-metro` badge | pl | Wikimedia Commons | public domain | Nine of these have no recorded licence. That is the audit. ## COP-DEM GLO-30 — checked, and probably disqualifying Checked against the licence text itself (`License-COPDEM-30.pdf`, the **COP-DEM-GLO-30-F "Full, Free & Open"** instance). **Article 4 grants** — non-exclusive, worldwide, unlimited in time: reproduction; distribution; communication to the general public; **adaptation, modification and combination with other data**. Article 5: free of charge. Deriving contours and spot heights and shipping them is squarely within (d). Article 9 adds that the Licensor and Provider "will not claim any IPRs … obtained by the User through his own work" — derived vectors would be our work product. **Article 6 obliges**: - (a) distributing the DEM itself: `© DLR e.V. 2010-2014 and © Airbus Defence and Space GmbH 2014-2018 provided under COPERNICUS by the European Union and ESA; all rights reserved.` - (b) **where adapted or modified — the case here**: `produced using Copernicus WorldDEM-30 © DLR e.V. 2010-2014 and © Airbus Defence and Space GmbH 2014-2018 provided under COPERNICUS by the European Union and ESA` - (c) a liability disclaimer must travel with it: `The organisations in charge of the Copernicus programme by law or by delegation do not incur any liability for any use of the Copernicus WorldDEM-30.` - (d) must not imply official endorsement. - (e) downstream users must be bound by the same obligations. No share-alike, no non-commercial clause, no restriction on derived products — so it does not infect the deliverable the way ODbL would. **The maintainer's objection is not share-alike, it is the mandated-wording clause itself**: this is the 4-clause BSD advertising problem. One source demanding its own verbatim string is mild; thirty of them is a document nobody reads, and the moment one licence requires its wording be "prominent", being buried in that document stops satisfying it. Sources that impose bespoke notice text are therefore a mark against adoption, independent of whether the terms are otherwise permissive. **Status: likely rejected**, revisitable only if the Greece result is exceptional. Any source that mandates specific wording should be flagged in the audit above as a cost, not just recorded. Operational, not licensing: from **28 July 2026 the CDSE COP-DEM 30m *view service*** is restricted to registered Copernicus Contributing Missions users (CDSE news, 17 July 2026). That is the WMS view service, not the licence and not the data download — AWS Open Data and CDSE download paths are unaffected — but a fetch provider built against the view service will break. ## Notes - Prompted by the Greece contours/peaks work moving to COP-DEM GLO-30 after its earlier source turned out to be retired. - Related: #203 (whether DEM-derived peaks are wanted at all). Independent of that outcome.

art-bot self-assigned this

2026-08-21 09:40:19 +00:00

art-bot changed title from ~~Licence audit and an attribution list — the map credits nobody, and nine wired sources have no recorded licence~~ to Licence audit and an attribution list — before anything is published

2026-08-21 09:53:02 +00:00