Harden third-party licensing and provenance

2026-08-31 16:34:46 +02:00
parent 560e5823c6
commit bc2c1b22ec
36 changed files with 2073 additions and 16674 deletions
@@ -0,0 +1,64 @@
+# Modernization Tool asset provenance
+
+Audit date: 2026-08-31
+
+This document tracks project branding and game-facing non-binary assets that
+need provenance separate from software DLL/EXE licensing.
+
+## Project icon
+
+### `PurpleWowLogo.ico`
+
+- Git blob SHA-1:
+  `7285e997cb6d635101d0d000867af75878894719`
+- Current use: PyInstaller application icon and bundled application resource
+- Provenance status: **unresolved-project-branding-asset**
+
+The file name suggests World of Warcraft-themed branding, but this audit did
+not establish its original creator or source license. No claim is made that
+Modernization Tool owns any Blizzard logo, trademark, or underlying game art
+that may be represented by the icon.
+
+Until provenance is confirmed, the project should avoid representing the icon
+as an official Blizzard asset or as evidence of Blizzard affiliation.
+
+## AutoLogin GlueXML files
+
+Source reference:
+
+- https://github.com/MarcelineVQ/turtle-autologin
+
+Current comparison:
+
+| File | Status | Current Git blob SHA-1 |
+| --- | --- | --- |
+| `Payload/Data/Interface/GlueXML/AutoLogin.xml` | exact upstream Git blob match | `65c7d0c08ba62ad9b1630aae6faa0046f96295d1` |
+| `Payload/Data/Interface/GlueXML/GlueXML.toc` | exact upstream Git blob match | `11ab97c6dc64385c2c8d717d0182fbee538484ff` |
+| `Payload/Data/Interface/GlueXML/AutoLogin.lua` | modified upstream-derived variant | `1de856864a16399977e6220714bd1249da0dcefe` |
+
+The upstream `AutoLogin.lua` Git blob observed during the audit was
+`979af097982379ca14e4266dfea41f65452a9561`. The Modernization Tool variant
+contains additional secure-default behavior and therefore is not byte-identical.
+
+The source repository did not expose a project-wide license file during this
+audit, so this provenance record does not itself establish redistribution
+permission.
+
+## Audio and visual mods
+
+The tool may bundle or download visual/audio replacements from community
+projects. Their source URLs and many exact file hashes are recorded in
+`Payload/Fallback/versions.json`.
+
+Game-facing media can have rights separate from the software that installs it.
+Do not infer that an MIT/GPL/BSD license covering installer code automatically
+covers Blizzard artwork, sounds, or other game assets.
+
+## Trademark boundary
+
+World of Warcraft, Warcraft, Blizzard Entertainment, and associated logos,
+names, artwork, audio, client files, and game assets remain the property of
+their respective rights holders.
+
+Modernization Tool is an independent community project and does not claim
+official status or endorsement.
@@ -0,0 +1,76 @@
+# Modernization Tool binary provenance
+
+Audit date: 2026-08-31
+
+This document is the human-readable companion to
+`Payload/Fallback/versions.json`, which contains machine-readable source,
+version, SHA-256, and size records for many bundled components.
+
+No remaining payload binary was modified during this provenance pass.
+
+## Distribution status
+
+| Component | Distribution mode after this audit | Source / provenance | License status |
+| --- | --- | --- | --- |
+| VanillaFixes | bundled + install support | hannesmann/vanillafixes v1.5.3 | MIT verified |
+| DXVK | bundled | doitsujin/dxvk v2.6.1 x86 | zlib/libpng verified |
+| vanilla-tweaks | bundled fallback + online update | tubtubs/vanilla-tweaks | MIT verified |
+| Nampower | bundled fallback + online update | brues-code/nampower v4.6.1 | BSD-style terms verified |
+| VanillaHelpers | bundled fallback + online update | isfir/VanillaHelpers v1.1.2 | GPL/LGPL documents verified |
+| VanillaMultiMonitorFix | bundled fallback + online update | Mates1500/VanillaMultiMonitorFix 0.2 | MIT verified |
+| ClassicAPI | bundled fallback + online update | brues-code/ClassicAPI | GPL v3 verified |
+| AuctionQueryThrottle | bundled fallback + online update | brues-code/AuctionQueryThrottle | GPL v3 verified |
+| SuperWoW | **upstream-only** | balakethelock/SuperWoW release | redistribution restricted upstream |
+| SuperAPI | **upstream-only** | balakethelock/SuperAPI master | no bundled copy after this audit |
+| UnitXP_SP3 | bundled fallback + online update | brues-code/UnitXP_SP3 v90 | project-wide license not independently located |
+| Interact | bundled fallback + online update | lookino/Interact v1.0.4 | project-wide license not independently located |
+| No1600x1200 | bundled fallback + online update | RetroCro/TurtleWoW-Mods | project-wide license not independently located |
+| PerfBoost | bundled | RetroCro/TurtleWoW-Mods backup source | project-wide license not independently located |
+| WeirdPerformance | bundled | Dusk92/WeirdUtils 0.7.3 | provenance recorded; license record pending |
+| WeirdUtils modules | bundled | MarcelineVQ/WeirdUtils releases | provenance recorded; license record pending |
+| FishPing | bundled fallback + online source | notsureawake/FishPing | project-wide license not independently located |
+| NoErrorSounds | bundled fallback + online source | Macumbafeh/NoErrorSounds | project-wide license not independently located |
+| Warlock Muted Demons | bundled fallback + online source | spzilyk/Warlock-Muted-Demons | project-wide license not independently located |
+
+## SuperWoW change
+
+Before this audit the repository contained:
+
+- `Payload/SuperWoWhook.dll`
+- SHA-256 recorded in `versions.json`:
+  `bd214b32c878649e94ce654835946bd05e0ce7710e8f01bae10d8ab50a89351d`
+- source:
+  `balakethelock/SuperWoW` release package
+
+That bundled fallback is removed by this audit because the current upstream
+license restricts redistribution without express written permission.
+
+The installation feature itself is retained: `remote_packages.install_superwow`
+already downloads the official upstream release and downloads SuperAPI directly
+from its upstream repository.
+
+## SuperAPI change
+
+The previous bundled fallback under
+`Payload/Interface/Addons/SuperAPI/` is removed together with the SuperWoW
+fallback. The installer continues to obtain SuperAPI directly from
+`balakethelock/SuperAPI` when SuperWoW is installed.
+
+## Hash manifest
+
+For components that remain bundled, the canonical machine-readable hashes are
+kept in `Payload/Fallback/versions.json`.
+
+When updating a binary:
+
+1. obtain it from the documented upstream source;
+2. verify the version;
+3. update the SHA-256 and size;
+4. preserve the applicable license/permission;
+5. update this document if the distribution mode changes.
+
+## Important boundary
+
+A matching hash proves file identity against the recorded source artifact. It
+does not by itself prove that redistribution is licensed. License/permission
+status must be tracked separately.