Document project identity and third-party provenance

2026-08-31 16:18:32 +02:00
parent 917e5c1c18
commit a8bc80e9a0
10 changed files with 1036 additions and 19 deletions
@@ -0,0 +1,71 @@
+# ShaguTweaks-Extras-ClassicAPI asset provenance manifest
+
+Audit date: 2026-08-31
+
+This manifest records the currently known provenance of binary artwork and
+screenshots shipped by ShaguTweaks-Extras-ClassicAPI. No artwork or screenshot
+was modified, converted, replaced, or removed during this documentation pass.
+
+A project-level software license does not by itself establish that an upstream
+project owned or could independently relicense every third-party or game-derived
+visual it distributed. This manifest therefore records what can be verified
+without making broader ownership claims.
+
+## Status meanings
+
+- **exact-upstream-git-blob-match** — the file has the same Git blob SHA-1 as
+  the corresponding file in `paokkerkir/ShaguTweaks-extras`.
+- **unresolved** — origin has not been established well enough to make a more
+  specific claim.
+
+Git blob SHA-1 values below are repository object identifiers used to establish
+byte-identical upstream matches. They are provenance identifiers, not security
+hashes.
+
+## Artwork manifest
+
+| ShaguTweaks-Extras-ClassicAPI asset | Status | Provenance/reference | Git blob SHA-1 |
+| --- | --- | --- | --- |
+| `img/df-gryphon-beta.tga` | exact-upstream-git-blob-match | `paokkerkir/ShaguTweaks-extras: img/df-gryphon-beta.tga` | `bb4262fe7bf811fa7fff958f7f29269b69038280` |
+| `img/df-gryphon.tga` | exact-upstream-git-blob-match | `paokkerkir/ShaguTweaks-extras: img/df-gryphon.tga` | `6c7e965613222b0313dc1d56d9aa81414a828eef` |
+| `img/df-wyvern.tga` | exact-upstream-git-blob-match | `paokkerkir/ShaguTweaks-extras: img/df-wyvern.tga` | `4414fedcec732ea3096c30598ba7ada25a6af585` |
+| `img/xpbar.tga` | exact-upstream-git-blob-match | `paokkerkir/ShaguTweaks-extras: img/xpbar.tga` | `de80c16875cd7d9fa96baf99bd6ae2e1514595f7` |
+
+The complete `img/` directory also had the same Git tree SHA
+(`efa75faf660ac2e603e0100e1e1839a5df38e128`) in both repositories at the
+time of this audit.
+
+## Screenshot manifest
+
+| Screenshot | Status | Provenance/reference | Git blob SHA-1 |
+| --- | --- | --- | --- |
+| `screenshots/actionbar.gif` | exact-upstream-git-blob-match | `paokkerkir/ShaguTweaks-extras: screenshots/actionbar.gif` | `18a460d87742ad7674bf5edf834c4957d320c46a` |
+| `screenshots/raid.jpg` | exact-upstream-git-blob-match | `paokkerkir/ShaguTweaks-extras: screenshots/raid.jpg` | `5722324e6d649f9ce91606a5bf84acf94cca13fc` |
+
+The complete `screenshots/` directory also had the same Git tree SHA
+(`c283f36c02bfdbb91bec8443d950a5251729f541`) in both repositories at the
+time of this audit.
+
+These screenshots may depict World of Warcraft user-interface elements and
+other game assets. Recording an exact upstream match does not assert ownership
+of the underlying game content or grant additional rights in it.
+
+## Important licensing boundary
+
+The exact upstream match establishes that these files were inherited from the
+ShaguTweaks-extras source tree rather than newly introduced by this fork.
+
+It does **not**, by itself, establish whether every visual element was wholly
+created by the upstream project, derived from game assets, or otherwise subject
+to separate third-party rights. The files are therefore preserved with
+provenance attribution and without any additional relicensing claim beyond
+rights actually held by the applicable rights holders.
+
+## Maintenance
+
+When artwork or screenshots are added, removed, or replaced:
+
+1. Record the source or creation history.
+2. Record an exact upstream match when one can be verified.
+3. Do not guess unresolved provenance.
+4. Keep historical attribution when an asset is replaced.