From 89532ee48e44d18fbbf9d9f73e6aa1e8f35aceb8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sun, 2 Aug 2026 16:45:51 +0200 Subject: [PATCH] docs(about): state the GeoLite2 licence in full MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The credits page named CC BY-SA 4.0 alone. MaxMind stopped distributing GeoLite2 under that licence by itself: the databases ship under the GeoLite End User License Agreement, which incorporates CC BY-SA 4.0 by reference and controls wherever the two disagree. Name both, in that order, and link the EULA. The attribution string was already there and is unchanged; the e2e page check now asserts both licences rather than the one that no longer stands alone. Reconcile the self-hosting guide with the same wording, point it at the current EULA URL, and say why the `/about` page must stay reachable — it is where an operator's own attribution lives. Correct the project licence line while on the page: it still claimed AGPL-3.0, which the page's own footer contradicts. The trunk has been PolyForm Noncommercial 1.0.0 since v1.15.19. --- docs/self-hosting/geolite2.md | 13 ++++++++++--- e2e/v1427-public-pages.spec.ts | 6 ++++++ src/app/about/page.tsx | 28 +++++++++++++++++++++------- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/docs/self-hosting/geolite2.md b/docs/self-hosting/geolite2.md index 8de132921..b9dacd0a0 100644 --- a/docs/self-hosting/geolite2.md +++ b/docs/self-hosting/geolite2.md @@ -100,9 +100,16 @@ not immediately. A weekly `geoipupdate` followed by The databases are downloaded under your own MaxMind account, so their terms are between you and MaxMind — read what your account agrees to at -. HealthLog's own attribution -("this product includes GeoLite2 data created by MaxMind") is already on -the `/about` page and covers an instance that uses them. +. That agreement, the GeoLite +End User License Agreement, incorporates CC BY-SA 4.0 by reference and +controls wherever the two disagree; both require you to attribute the +data to MaxMind if you make it available to anyone else. + +HealthLog's own attribution ("This product includes GeoLite2 data +created by MaxMind, available from https://www.maxmind.com") is already +on the `/about` page and covers an instance that uses them. Keep that +page reachable — it is what carries the attribution for your deployment, +and it is served without a session for exactly that reason. ## Troubleshooting diff --git a/e2e/v1427-public-pages.spec.ts b/e2e/v1427-public-pages.spec.ts index 8fbb313fa..a9e62b753 100644 --- a/e2e/v1427-public-pages.spec.ts +++ b/e2e/v1427-public-pages.spec.ts @@ -41,6 +41,12 @@ test.describe("v1.4.27 — public pages", () => { // GeoLite2 attribution is the load-bearing reason this page exists. await expect(page.getByText(/GeoLite2/).first()).toBeVisible(); await expect(page.getByText(/MaxMind/).first()).toBeVisible(); + // Both licences, because naming only the Creative Commons one understates + // the terms: the GeoLite EULA is what governs and CC BY-SA 4.0 rides + // inside it. + await expect( + page.getByText(/GeoLite End User License Agreement/i), + ).toBeVisible(); await expect(page.getByText(/Attribution-ShareAlike 4\.0/i)).toBeVisible(); }); diff --git a/src/app/about/page.tsx b/src/app/about/page.tsx index 0c499ef03..45d3e0e4e 100644 --- a/src/app/about/page.tsx +++ b/src/app/about/page.tsx @@ -8,9 +8,11 @@ import Link from "next/link"; * * 1. The runtime image bundles MaxMind GeoLite2-City and * GeoLite2-ASN databases for offline IP-to-location and - * IP-to-ASN lookups. The CC BY-SA 4.0 licence requires the - * attribution to be reachable from the running application, - * not just the source repository. + * IP-to-ASN lookups. They ship under the GeoLite End User + * License Agreement, which incorporates CC BY-SA 4.0 by + * reference and controls over it; both want the attribution + * reachable from the running application, not just from the + * source repository. * 2. A general home for open-source credits as the project * accumulates more third-party data sources (already true for * the upcoming ICD-10 reference table in the iOS Health import @@ -35,7 +37,7 @@ import Link from "next/link"; // weakening the CSP with `unsafe-inline`. export const dynamic = "force-dynamic"; -const LAST_UPDATED = "2026-05-15"; +const LAST_UPDATED = "2026-08-02"; export const metadata: Metadata = { title: "About — HealthLog", @@ -119,7 +121,9 @@ export default function AboutPage() { > github.com/MBombeck/HealthLog {" "} - and is licensed under the GNU Affero General Public License v3.0. + and is licensed under the PolyForm Noncommercial License 1.0.0. + Releases up to and including v1.15.18 were published under AGPL-3.0 + and stay available under it.

@@ -156,6 +160,15 @@ export default function AboutPage() { ) power the offline IP-to-location and IP-to-carrier lookups that decorate the admin login-overview audit table. They are distributed under the{" "} + + GeoLite End User License Agreement + + , which incorporates the{" "} Creative Commons Attribution-ShareAlike 4.0 International License - - . + {" "} + by reference and controls wherever the two disagree. The attribution + above is what that licence asks for.