From 407b0a0d79edac6e34db20b976ed6a28b77ee974 Mon Sep 17 00:00:00 2001 From: clawbot Date: Mon, 10 Aug 2026 12:31:30 +0000 Subject: [PATCH] Add the MIT LICENSE and state it in the README (closes #10) The repo had no LICENSE, which REPO_POLICIES.md lists as a mandatory minimum file, and the README's License section said "Content is provided as-is for community use." That granted nothing explicitly and matched no committed file. The repo is public, verified on the Gitea API rather than assumed, so the standing policy applies: MIT on any public repo lacking a license. LICENSE is byte-identical to the canonical sneak/homoicon copy (same git blob, 3274443) and its body is word-for-word the SPDX MIT text, with only the line wrapping differing. The README License section now reads "MIT. See LICENSE.", and says explicitly that the licence covers content/ as well as the code: this repo carries both a Hugo site and its community content, while MIT's own text speaks only of "the Software". The Description first line gains the licence, which the README requirements call for and which was the one field it was missing. Nothing published contradicts the choice. The built public/ tree carries no copyright, all-rights-reserved or terms-of-use string in index.html, css/style.css, index.xml or sitemap.xml; the rendered footer names @sneak and links the repo but reserves no rights, and the RSS carries no copyright element. The content is factual mesh channel data asserting no licence of its own. LICENSE needed no .prettierignore entry, measured rather than assumed: script/fmt passes prettier the explicit globs '**/*.md' and '**/*.css', and an extensionless root file matches neither. A script/fmt run leaves the file's hash unchanged, and a counterfactual LICENSE.md copy was reflowed by that same run, which is the direct evidence that the extension is what excludes it and not an ignore rule. Per-file licence headers and SPDX identifiers are deliberately omitted; no org standard mandates them. Nothing on the deploy path is touched. --- LICENSE | 21 +++++++++++++++++++++ README.md | 9 ++++++--- TODO.md | 51 +++++++++++++++++++++++++++++++++++++-------------- 3 files changed, 64 insertions(+), 17 deletions(-) create mode 100644 LICENSE diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..3274443 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Jeffrey Paul + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index 8e0318b..0b38186 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,8 @@ # lora.vegas -`lora.vegas` is the website of the Las Vegas Meshtastic and LoRa community: a -single-page static site, built with Hugo, by [@sneak](https://sneak.berlin). +`lora.vegas` is the website of the Las Vegas Meshtastic and LoRa community: an +MIT-licensed single-page static site, built with Hugo, by +[@sneak](https://sneak.berlin). It publishes what the local mesh needs in one linkable place: @@ -109,7 +110,9 @@ The live task list is in [TODO.md](TODO.md). ## License -Content is provided as-is for community use. +MIT. See [LICENSE](LICENSE). This covers everything in the repository — the Hugo +configuration, the `script/` entrypoints, the vendored `themes/loravega/` +templates and CSS, and the site content in `content/`. ## Author diff --git a/TODO.md b/TODO.md index 1401839..b00c00e 100644 --- a/TODO.md +++ b/TODO.md @@ -13,23 +13,49 @@ pre-1.0 No git tags. The site is live and now has the scripts-to-rule-them-all scaffold -(`Makefile`, `script/`, `Dockerfile`, `check.yml`) and the canonical policy -dotfiles; `LICENSE` is the only mandated file still missing. Every external -reference in the repo is now pinned by cryptographic hash (or, for the wrangler -CLI install, an exact version), and the Hugo that builds the published site is a -deliberate pinned version rather than whatever the base image's package repo -serves. The site now ships a Cloudflare Pages `_headers` file, so its response -security headers are declared in the repo instead of being whatever the edge -defaults to — unverified in production until the next deploy. +(`Makefile`, `script/`, `Dockerfile`, `check.yml`), the canonical policy +dotfiles and `LICENSE`, so the mandated minimum file list is complete. Every +external reference in the repo is now pinned by cryptographic hash (or, for the +wrangler CLI install, an exact version), and the Hugo that builds the published +site is a deliberate pinned version rather than whatever the base image's +package repo serves. The site now ships a Cloudflare Pages `_headers` file, so +its response security headers are declared in the repo instead of being whatever +the edge defaults to — unverified in production until the next deploy. # Next Step -Add `LICENSE` (#10) and replace the README's "content is provided as-is" note -with the committed license. Blocked on the owner's choice of license — the -remaining policy scaffold is otherwise complete. +Move the artifact actions in `.gitea/workflows/deploy.yml` to v4 once this Gitea +Actions instance serves the v4 artifact protocol; they are pinned on the +deprecated v3 line because v4 fails here (#20). This touches the live deploy +path, so it needs a real workflow run to verify rather than a local check. # Completed Steps +- 2026-08-10: added the `LICENSE` file and made the README say what it says + (closes #10). The repo is public (`private: false` on the Gitea API, verified + rather than assumed), so the owner's standing policy — MIT on any public repo + lacking a license — applies. `LICENSE` is byte-identical to the canonical + `sneak/homoicon` copy, confirmed by git blob hash rather than by eye + (`3274443`), and its body is word-for-word the SPDX MIT text with only the + line wrapping differing. The README's "Content is provided as-is for community + use." — which granted nothing and matched no committed file — is replaced by + `MIT. See [LICENSE](LICENSE).` plus an explicit statement that the licence + covers the content in `content/` as well as the code, since this repo carries + both and MIT names only "the Software". The Description first line now carries + the licence, which `REPO_POLICIES.md` requires and which was the one field it + was missing. Nothing published contradicts the choice: the built `public/` + tree carries no copyright, all-rights-reserved or terms-of-use string + anywhere, in `index.html`, `css/style.css`, `index.xml` or `sitemap.xml` — the + footer `baseof.html` renders names `@sneak` and links the repo but asserts no + reservation of rights, and the content is factual mesh channel data with no + licence claim of its own. The fmt gate cannot reach `LICENSE` and needed no + `.prettierignore` entry: `script/fmt` passes prettier the explicit globs + `'**/*.md'` and `'**/*.css'`, and an extensionless root file matches neither. + Measured, not assumed — a `script/fmt` run leaves the file's hash unchanged, + and a counterfactual `LICENSE.md` copy was reflowed by the same run, which is + the direct evidence that it is the extension and not an ignore rule doing the + excluding. Deliberately not done, per the issue: per-file licence headers and + SPDX identifiers, which no org standard mandates - 2026-08-09: added `static/_headers` so Cloudflare Pages serves baseline response security headers (closes #14). Hugo copies `static/` verbatim into `public/`, which is the deploy root Pages reads the file from; this is the @@ -200,9 +226,6 @@ remaining policy scaffold is otherwise complete. # Future Steps -- Move the artifact actions to v4 once this Gitea Actions instance serves the v4 - artifact protocol; they are pinned on the deprecated v3 line because v4 fails - here (#20) - Move the deploy container to a pinned node 22 so the wrangler pin can advance past 4.86.0 (#21) - After the next deploy, confirm the `_headers` file actually took effect, on