Files
Modernization-Tool/Docs/BINARY_PROVENANCE.md
T
Dusk c067770961 Harden third-party licensing and provenance
Document project identity, third-party licenses, binary and asset provenance, and move SuperWoW/SuperAPI to upstream-only distribution.
2026-08-31 16:37:10 +02:00

3.9 KiB

Modernization Tool binary provenance

Audit date: 2026-08-31

This document is the human-readable companion to Payload/Fallback/versions.json, which contains machine-readable source, version, SHA-256, and size records for many bundled components.

No remaining payload binary was modified during this provenance pass.

Distribution status

Component Distribution mode after this audit Source / provenance License status
VanillaFixes bundled + install support hannesmann/vanillafixes v1.5.3 MIT verified
DXVK bundled doitsujin/dxvk v2.6.1 x86 zlib/libpng verified
vanilla-tweaks bundled fallback + online update tubtubs/vanilla-tweaks MIT verified
Nampower bundled fallback + online update brues-code/nampower v4.6.1 BSD-style terms verified
VanillaHelpers bundled fallback + online update isfir/VanillaHelpers v1.1.2 GPL/LGPL documents verified
VanillaMultiMonitorFix bundled fallback + online update Mates1500/VanillaMultiMonitorFix 0.2 MIT verified
ClassicAPI bundled fallback + online update brues-code/ClassicAPI GPL v3 verified
AuctionQueryThrottle bundled fallback + online update brues-code/AuctionQueryThrottle GPL v3 verified
SuperWoW upstream-only balakethelock/SuperWoW release redistribution restricted upstream
SuperAPI upstream-only balakethelock/SuperAPI master no bundled copy after this audit
UnitXP_SP3 bundled fallback + online update brues-code/UnitXP_SP3 v90 project-wide license not independently located
Interact bundled fallback + online update lookino/Interact v1.0.4 project-wide license not independently located
No1600x1200 bundled fallback + online update RetroCro/TurtleWoW-Mods project-wide license not independently located
PerfBoost bundled RetroCro/TurtleWoW-Mods backup source project-wide license not independently located
WeirdPerformance bundled Dusk92/WeirdUtils 0.7.3 provenance recorded; license record pending
WeirdUtils modules bundled MarcelineVQ/WeirdUtils releases provenance recorded; license record pending
FishPing bundled fallback + online source notsureawake/FishPing project-wide license not independently located
NoErrorSounds bundled fallback + online source Macumbafeh/NoErrorSounds project-wide license not independently located
Warlock Muted Demons bundled fallback + online source spzilyk/Warlock-Muted-Demons project-wide license not independently located

SuperWoW change

Before this audit the repository contained:

  • Payload/SuperWoWhook.dll
  • SHA-256 recorded in versions.json: bd214b32c878649e94ce654835946bd05e0ce7710e8f01bae10d8ab50a89351d
  • source: balakethelock/SuperWoW release package

That bundled fallback is removed by this audit because the current upstream license restricts redistribution without express written permission.

The installation feature itself is retained: remote_packages.install_superwow already downloads the official upstream release and downloads SuperAPI directly from its upstream repository.

SuperAPI change

The previous bundled fallback under Payload/Interface/Addons/SuperAPI/ is removed together with the SuperWoW fallback. The installer continues to obtain SuperAPI directly from balakethelock/SuperAPI when SuperWoW is installed.

Hash manifest

For components that remain bundled, the canonical machine-readable hashes are kept in Payload/Fallback/versions.json.

When updating a binary:

  1. obtain it from the documented upstream source;
  2. verify the version;
  3. update the SHA-256 and size;
  4. preserve the applicable license/permission;
  5. update this document if the distribution mode changes.

Important boundary

A matching hash proves file identity against the recorded source artifact. It does not by itself prove that redistribution is licensed. License/permission status must be tracked separately.