mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-14 14:23:14 -06:00
94a81b6896
An audit of what actually reaches customers turned up three things. None is copyleft — there is no GPL or AGPL anywhere in the product — but two of them are the kind of detail that undermines a claim to track licences at all. org.json WAS BEING PACKAGED INTO THE APK. socket.io-client pulls org.json:json:20090211 transitively, and it was landing in the dex in full: 19 classes, including CDL, XML, JSONML and the library's own Test class. That release carries the JSON Licence, whose "shall be used for Good, not Evil" clause is not OSI-approved, is treated as non-free by Debian and Fedora, and is Category X at Apache. Excluded now, and nothing is lost: Android has provided org.json in the platform since API 1 and minSdk is 24. Verified rather than assumed. The whole surface used — by socket.io/engine.io and by our own Kotlin — is JSONObject, JSONArray and JSONTokener, via get/getString/getLong/getJSONArray/ getJSONObject/has/keys/length/isNull/put/NULL, the opt* family, and JSONTokener.nextValue. Every one is platform API. The rebuilt APK defines 0 org.json classes (was 19) while still referencing all three, so they now resolve against the platform; it is 25KB smaller and the v1 JAR signature is intact. Then it was installed on a real panel, which registered over the socket, paired, and parsed a playlist with no NoSuchMethodError — the failure mode that would only ever appear at runtime. REDOC SHIPPED WITH NO LICENCE NOTICE. frontend/vendor/redoc.standalone.js is in the release tarball, minified with every header stripped, and the vendor README recorded version and source but not licence. MIT requires the notice to travel with the software. Added as redoc.LICENSE, with a note in the README that anything vendored here ships and therefore needs one. The server manifest declared no licence at all, though the repo is MIT — tooling and auditors read package.json, not just the root LICENSE. Set, and the lockfile synced so `npm ci` cannot disagree. Audited against production's own installed tree rather than a developer checkout: 365 packages, `COPYLEFT — none`. 1676/1676 server tests, Android build + unit tests, `npm ci` clean.
42 lines
1.1 KiB
JSON
42 lines
1.1 KiB
JSON
{
|
|
"name": "screentinker",
|
|
"version": "1.9.36",
|
|
"license": "MIT",
|
|
"description": "ScreenTinker - Digital Signage Management Server",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node --env-file-if-exists=.env server.js",
|
|
"dev": "node --watch --env-file-if-exists=.env server.js",
|
|
"test": "node --test --test-concurrency=2",
|
|
"smoke": "node smoke-ui.js"
|
|
},
|
|
"dependencies": {
|
|
"@azure/msal-node": "^5.2.1",
|
|
"@jsquash/avif": "^1.3.0",
|
|
"@jsquash/webp": "^1.5.0",
|
|
"archiver": "^7.0.1",
|
|
"bcryptjs": "^3.0.3",
|
|
"better-sqlite3": "12.9.0",
|
|
"cors": "^2.8.5",
|
|
"express": "^4.18.2",
|
|
"express-rate-limit": "^8.3.1",
|
|
"helmet": "^8.1.0",
|
|
"jimp": "^1.6.1",
|
|
"jsonwebtoken": "^9.0.3",
|
|
"multer": "^1.4.5-lts.1",
|
|
"nodemailer": "^9.0.5",
|
|
"otplib": "^12.0.1",
|
|
"qrcode": "^1.5.4",
|
|
"socket.io": "^4.7.2",
|
|
"stripe": "^20.4.1",
|
|
"unzipper": "^0.12.3",
|
|
"uuid": "^14.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"js-yaml": "^4.2.0",
|
|
"puppeteer-core": "^24.43.1",
|
|
"sharp": "^0.35.3",
|
|
"socket.io-client": "^4.8.3"
|
|
}
|
|
}
|