@missing-elements/h5p-offline-player 0.1.1 → 0.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/NOTICE.md +83 -0
  2. package/README.md +16 -2
  3. package/dist/VERSION +1 -1
  4. package/dist/frame-assets/LICENSE.txt +674 -0
  5. package/dist/frame-assets/MANIFEST.json +1 -1
  6. package/dist/frame-assets/NOTICE.txt +30 -0
  7. package/dist/frame-assets/main.bundle.js.LICENSE.txt +1 -0
  8. package/dist/h5p-player.js +1 -1
  9. package/dist/h5p-sw-mount.js +1 -1
  10. package/dist/h5p-sw.js +1 -1
  11. package/licenses/GPL-3.0.txt +674 -0
  12. package/package.json +5 -3
  13. package/types/node/tsconfig.node.tsbuildinfo +1 -1
  14. package/types/shared/constants.d.ts +1 -1
package/NOTICE.md ADDED
@@ -0,0 +1,83 @@
1
+ # Third-party notices
2
+
3
+ `@missing-elements/h5p-offline-player` is published under `(MIT AND GPL-3.0-only)`. The
4
+ parenthesis is deliberate: the player's own code is MIT, and the package also ships code that is
5
+ not. This file says which is which.
6
+
7
+ ## The player's own code — MIT
8
+
9
+ `dist/h5p-player.js`, `dist/h5p-sw.js`, `dist/h5p-sw-mount.js`, `types/` and everything under
10
+ `src/` and `scripts/` in the repository: MIT, see [LICENSE](LICENSE).
11
+
12
+ ## zip.js — BSD-3-Clause
13
+
14
+ The three scripts in `dist/` bundle [zip.js](https://github.com/gildas-lormeau/zip.js) as the
15
+ archive reader. They are minified with legal comments removed, so its notice does not survive
16
+ into the files themselves and is reproduced here instead, as its licence requires:
17
+
18
+ ```
19
+ BSD 3-Clause License
20
+
21
+ Copyright (c) 2023, Gildas Lormeau
22
+
23
+ Redistribution and use in source and binary forms, with or without
24
+ modification, are permitted provided that the following conditions are met:
25
+
26
+ 1. Redistributions of source code must retain the above copyright notice, this
27
+ list of conditions and the following disclaimer.
28
+
29
+ 2. Redistributions in binary form must reproduce the above copyright notice,
30
+ this list of conditions and the following disclaimer in the documentation
31
+ and/or other materials provided with the distribution.
32
+
33
+ 3. Neither the name of the copyright holder nor the names of its
34
+ contributors may be used to endorse or promote products derived from
35
+ this software without specific prior written permission.
36
+
37
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
38
+ AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
39
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
40
+ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
41
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
42
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
43
+ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
44
+ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
45
+ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
46
+ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
47
+ ```
48
+
49
+ ## The H5P runtime in `dist/frame-assets/` — GPL-3.0
50
+
51
+ `dist/frame-assets/` is the runtime the element loads inside its frame, copied unmodified from
52
+ [h5p-standalone](https://github.com/tunapanda/h5p-standalone) 3.8.2. h5p-standalone's own
53
+ code is MIT (Copyright (c) 2015 Tunapanda), but `frame.bundle.js` is built from the H5P core
54
+ scripts in its `vendor/h5p/js/` — `h5p.js`, `h5p-event-dispatcher.js`, `h5p-x-api.js`,
55
+ `h5p-x-api-event.js`, `h5p-content-type.js`, `h5p-confirmation-dialog.js`, `request-queue.js`,
56
+ `h5p-action-bar.js`, `h5p-tooltip.js` — which come from
57
+ [h5p/h5p-php-library](https://github.com/h5p/h5p-php-library), licensed under the
58
+ **GNU General Public License v3.0**. The core stylesheet (`styles/h5p.css`, `styles/h5p-fonts.css`),
59
+ the `h5p-*` icon fonts and `images/` come from the same repository. Upstream confirmed this in
60
+ [tunapanda/h5p-standalone#188](https://github.com/tunapanda/h5p-standalone/issues/188); its npm
61
+ metadata still says MIT.
62
+
63
+ The full licence text is in [licenses/GPL-3.0.txt](licenses/GPL-3.0.txt) and, so that it travels
64
+ with the files, in `dist/frame-assets/LICENSE.txt`; `dist/frame-assets/NOTICE.txt` lists the
65
+ files. Keep both beside the directory when you copy or serve it. Corresponding source:
66
+ <https://github.com/tunapanda/h5p-standalone/tree/v3.8.2> (`src/` and `vendor/h5p/`).
67
+ h5p-standalone does not record which h5p-php-library revision `vendor/h5p/` was taken from.
68
+
69
+ Also inside `dist/frame-assets/`:
70
+
71
+ - jQuery 3.5.1, in `frame.bundle.js` — MIT, Copyright JS Foundation and other contributors,
72
+ <https://jquery.org/license>.
73
+ - regenerator-runtime, in `main.bundle.js` — MIT, see `main.bundle.js.LICENSE.txt`.
74
+ - Inter, `fonts/inter/` — SIL Open Font License 1.1, see `fonts/inter/LICENSE.txt`.
75
+ - Open Sans, `fonts/open-sans/` — SIL Open Font License 1.1, see `fonts/open-sans/OFL.txt`.
76
+
77
+ ## What this means for a site
78
+
79
+ A site that serves `frame-assets/` to browsers is distributing GPL-3.0 code, with what that
80
+ entails for keeping the notices and making the source available; the notice and the tag above
81
+ are what it needs. Whether the copyleft reaches the page around the player is a legal question
82
+ this file does not answer: the element and its workers exchange only messages and HTTP with the
83
+ runtime, while the small boot script runs in the same document and calls its API.
package/README.md CHANGED
@@ -274,5 +274,19 @@ Working on the code? Start with [AGENTS.md](AGENTS.md).
274
274
 
275
275
  ## Licence
276
276
 
277
- MIT. Bundles [h5p-standalone](https://github.com/tunapanda/h5p-standalone) (MIT) as the runtime
278
- and [zip.js](https://github.com/gildas-lormeau/zip.js) (BSD-3-Clause) as the archive reader.
277
+ The player's own code — the element, the two workers, the scripts — is MIT, see
278
+ [LICENSE](LICENSE). The package as published is not MIT alone, and its `license` field says so:
279
+ `(MIT AND GPL-3.0-only)`.
280
+
281
+ - `dist/frame-assets/` is the H5P core runtime, copied unmodified from
282
+ [h5p-standalone](https://github.com/tunapanda/h5p-standalone). h5p-standalone's own code is
283
+ MIT, but its `frame.bundle.js`, stylesheet and icon fonts come from
284
+ [h5p-php-library](https://github.com/h5p/h5p-php-library), which is **GPL-3.0**; upstream
285
+ confirms it in [issue #188](https://github.com/tunapanda/h5p-standalone/issues/188) while
286
+ its npm metadata still says MIT. The directory carries its own `LICENSE.txt` and `NOTICE.txt`.
287
+ Keep them with it when you copy or serve it: a site serving these files is distributing GPL
288
+ code. Whether the copyleft reaches the page around the player is a legal question, not one
289
+ this README answers.
290
+ - The three scripts in `dist/` bundle [zip.js](https://github.com/gildas-lormeau/zip.js)
291
+ (BSD-3-Clause). Minification strips its notice from the files, so
292
+ [NOTICE.md](NOTICE.md) reproduces it.
package/dist/VERSION CHANGED
@@ -1 +1 @@
1
- 0.1.1
1
+ 0.1.2