odin/docs/research/speedometer-license-audit.md

Speedometer 3.1 pinned pack: redistribution audit

Decision

Do not redistribute the complete pinned archive yet. The top-level BSD-style license permits redistribution of Speedometer's own work when its notice, conditions, and disclaimer travel with it. It does not establish rights for every embedded work. The pinned archive contains identifiable third-party material whose grant or compliance path is not yet established. This is a source audit, not a legal opinion or a benchmark run.

Source: WebKit/Speedometer commit 1386415be8fef2f6b6bbdbe1828872471c5d802a, root license.

Exact inventory

The companion per-file manifest records every relative path, byte count, SHA-256, and review group in the full GitHub commit archive: 1,118 files; 61,022,359 uncompressed bytes. Its SHA-256 is 78edcd45649128fbd4c8659c1d054a2b9bb76a184b58ce59b37895c19f2bdfb6. The archive download SHA-256 was cfefa818d7789ed2f2b9f3f1bf608cc35e4e8241489eef47049296ce92791313. Review groups flag provenance work; they are not license determinations. The complete source archive is a conservative candidate pack, not a selected minimum runtime file set.

Reproduce the manifest from that commit's GitHub .tar.gz: strip its single leading directory; sort regular-file paths by UTF-8 path; for each file write path, decimal byte count, lowercase SHA-256, and review group as tab-separated fields. Group rules: exact notice names and *.LICENSE.txt/3rdpartylicenses.txt first; then Gutenberg HTML, chart datasets, all news-site files, Adobe icon SVGs, then TodoMVC, React Stockcharts, charts, editors, and remainder in that order. The manifest itself is not an upstream artifact.

Nine separate notice files appear in the archive: LICENSE; resources/todomvc/license.md; resources/react-stockcharts/build/static/js/2.8e539c84.chunk.js.LICENSE.txt; Angular and Angular Complex dist/3rdpartylicenses.txt; and React, React Complex, React Redux, React Redux Complex dist/app.bundle.js.LICENSE.txt. Exact paths and hashes are in the manifest. Inline notices in JavaScript, CSS, HTML, SVG, and source maps also need preservation. A filename scan cannot prove all component notices were extracted.

Established obligations and specific gaps

Material	Evidence and current finding	Required action before shipping
Speedometer-owned source	Root license requires retention of copyright, conditions, and disclaimer for source; reproduction in documentation or other materials for binary form.	Include root LICENSE in pack and distribution materials; keep original headers.
TodoMVC implementations	TodoMVC subtree license says MIT unless otherwise specified. Generated React and Angular notices identify further components.	Carry subtree license and all bundled notices. Audit each runtime bundle against its dependency versions; fill missing texts/attributions.
Angular bundles	Both 3rdpartylicenses.txt files include MIT, Apache-2.0, and CC-BY-4.0 material.	Keep both files with their matching bundles; map each named component to bundle; satisfy Apache notice/change rules and CC attribution requirements as applicable.
React Stockcharts	Its README claims MIT and points to upstream; bundle notice lists dependencies.	Include upstream MIT text plus bundled notice; verify the actual bundled versions.
News-site template and CSS	Both Next README and Nuxt README credit flashdesignory/news-site-template. Its repository has no visible license file, and its package metadata declares none. Pinned news-site-css metadata says ISC but does not provide that license text. The source and exported dist include adapted template material. No redistribution grant established for the template.	Get written permission or a verifiable applicable license from its rights holder, or remove/replace the NewsSite suites and all dependent files. Obtain and carry correct ISC text/notice for news-site-css. Reassess suite set and scoring if suites removed.
Chart datasets	Dataset README identifies two CSVs copied from an older D3 path. It does not state their data source or rights. airports.csv, flights-airports.csv, and the README are the three manifest paths. Generated resources/charts/dist/assets/flights-airports-9a9e6422.js embeds data.	Trace dataset origin and grant, then include required attribution. Otherwise replace with licensed/synthetic data and rebuild the affected chart assets, or omit that workload.
Adobe Spectrum icons and CSS	Big DOM README says static shell uses Adobe @spectrum-css. Its source contains 22 Smock_*.svg icons plus three other SVGs, with no per-file notice. Generated dist and complex TodoMVC pages may embed this material. TodoMVC's MIT default alone cannot establish rights over Adobe assets.	Identify exact Adobe package/source and applicable icon/CSS license, preserve its notice, and verify built copies. If unavailable, replace assets and rebuild/verify affected pages.
Editor text	longtext.html is Project Gutenberg eBook 2650 per asset README. It includes Gutenberg branding and full license. Gutenberg terms impose access, notice, format, fee, and territorial conditions while branding remains.	Preserve full embedded license and prominent notice; assess distribution geography and price. Simpler path: replace with separately cleared text of equivalent workload shape.
Other generated bundles and imagery	Charts, Editors, NewsSite, TodoMVC, React Stockcharts, images, maps, and CSS are generated or embedded works. Package lock entries identify dependencies but do not themselves provide all license texts; absence of a notice file is not proof of permission.	Build a component-to-file bill of materials from pinned locks/source maps and licenses. Review all shipped binaries/images individually; acquire missing grants or exclude/rebuild.

Pack gate

1. Define exact runtime file set; leave development files out only after proving every enabled suite resolves locally. Record each shipped file in a final manifest, with source commit and byte hash. The full-archive manifest here remains comparison baseline.
2. Map every final file to originating project or generated bundle components. Record SPDX identifier, copyright holder, evidence URL, required notice text, and fulfillment location. Mark unknown explicitly; no implicit root-license inheritance for third-party work.
3. Resolve the specific gaps above. Carry all nine existing notice files when their associated files ship; carry missing upstream notices and keep inline notices. Build a top-level THIRD_PARTY_NOTICES index with bundled texts or direct accompanying files.
4. Recheck after any exclusion, replacement, or rebuild. Any changed byte needs a new manifest digest and runtime validation. License clearance and offline functional validation are separate gates.

The earlier offline pack research established static-path plausibility and proposed blocked-network validation; it did not clear redistribution rights. No benchmark, browser installation, or host change was made here.