ConformalLabpp/doc/reviewer/dependency-license-audit-2026-05-31.md

# Dependency & License-Compatibility Audit — ConformalLabpp

**Date:** 2026-05-31
**Auditor:** External reviewer (Claude Opus 4.8)
**Scope:** Vendored/auto-fetched dependencies, their license compatibility, and the
provenance/license of bundled **data assets** (test meshes).
**Focus:** Is the dependency + data licensing coherent — especially in light of the
unresolved provenance/license blocker (CGAL audit **G0/G1**)?

Status legend: 🔴 Critical · 🟡 Important · 🔵 Polish

> **Good news up front:** a `code/deps/THIRD-PARTY-LICENSES.md` already exists and is
> a genuinely good per-dependency compatibility matrix (CGAL, Eigen, libigl, GLFW,
> nlohmann/json). This audit does **not** redo that work. It flags two things that
> matrix cannot see: (D1) it is built on the MIT premise that G0 undermines, and
> (D2) the bundled **test meshes have no provenance or license at all**.

---

## Summary table

| ID | Sev | Title | Location |
|----|-----|-------|----------|
| D1 | 🔴 | The dependency-license matrix is predicated on "conformallab++ is MIT" — a premise CGAL-audit G0 shows is unfounded; the whole compatibility conclusion is conditional on the unresolved license decision | `code/deps/THIRD-PARTY-LICENSES.md` |
| D2 | 🔴 | Bundled test meshes (`cathead.obj`, `brezel*.obj`, torus OFFs) have **no provenance and no license** — likely third-party / Varylab-origin, redistributed without attribution | `code/data/` |
| D3 | 🟡 | No per-dependency license *files* under most vendored trees (only GLFW ships one); the matrix is the only record | `code/deps/*/` |
| D4 | 🔵 | Vendored-tarball integrity is asserted ("bit-for-bit identical") but not checksum-verified in-repo | `code/deps/tarballs/` |

---

## D1 — 🔴 License matrix is conditional on the unresolved MIT premise

### Evidence
`code/deps/THIRD-PARTY-LICENSES.md` opens its analysis with:
> *"## conformallab++ itself … **MIT** … Every C++ source file carries
> `SPDX-License-Identifier: MIT`"*

and every dependency row evaluates "**Compatibility with MIT distribution**".

### Problem
The matrix's central column — and therefore its conclusion that everything is
distributable — assumes conformallab++ *is* MIT-licensed and *may* be distributed as
MIT. CGAL-audit **G0** establishes that this premise is unfounded: the code is a
documented port (derivative work) of the unlicensed Varylab/TU-Berlin project, so the
MIT grant itself is on shaky ground. Two consequences cascade:

1. If porting rights are **not** granted, there is no valid MIT (or any) license to
   be "compatible with" — the matrix evaluates compatibility against a license the
   project may not be entitled to use.
2. If the project relicenses to **GPLv3+** for CGAL submission (G1), the entire
   "compatible with MIT distribution" analysis must be **redone against GPLv3+**
   (e.g. the CGAL LGPL/GPL split, Eigen's MPL-2.0, libigl's MPL-2.0 are all
   GPL-compatible — but that needs stating, not assuming).

### Fix
- Resolve G0/G1 first (owner-level).
- Then re-run the matrix against the *actual* outbound license. Add a column
  "compatibility with GPLv3+ distribution" if the CGAL path is taken.
- Until resolved, annotate `THIRD-PARTY-LICENSES.md` with a banner that its
  conclusions are conditional on the pending G0/G1 decision.

### Acceptance criteria
- The matrix's outbound-license assumption matches the resolved G0/G1 outcome and is
  re-evaluated against it.

---

## D2 — 🔴 Bundled test meshes have no provenance or license

### Evidence
```
code/data/obj:  brezel.obj  brezel2.obj  cathead.obj  tetraflat.obj
code/data/off:  simple_cupe.off  torus_4x4.off  torus_8x8.off  torus_hex_6x6.off  torus_skewed_4x4.off
```
`find code/data -iname '*readme*' -o -iname '*licen*' -o -iname '*source*'` → **nothing.**

### Problem
These meshes are committed and redistributed with the project, used by the smoke and
parity tests (`test_scalability_smoke.cpp`, `test_geometry_utils.cpp` references
`brezel2.obj`, etc.). But:

- `cathead.obj` is a **well-known third-party mesh** that circulates in graphics
  courses/datasets — it is almost certainly not original to this project and carries
  whoever's terms.
- `brezel.obj` / `brezel2.obj` ("Brezel" = pretzel; genus-1/genus-2) are the exact
  example surfaces used in the **Varylab/TU-Berlin** discrete-conformal work — i.e.
  likely the *same* upstream as the G0 code-provenance problem.

Redistributing third-party data assets without attribution or a license is the same
class of issue as the code port (G0), and CGAL submission would flag it: CGAL example
data must have clear redistribution rights.

### Fix
- Establish each mesh's origin and license. For `cathead.obj`, identify the standard
  source and its terms. For the `brezel*` meshes, this is part of the **same
  conversation with the Varylab/TU-Berlin authors** as G0.
- Add `code/data/PROVENANCE.md` listing each file: source, author, license, URL.
- Replace any mesh whose redistribution rights cannot be confirmed with a
  cleanly-licensed or self-generated equivalent (the torus OFFs look procedurally
  generated — confirm and document that, which would make them safe).

### Acceptance criteria
- Every file under `code/data/` has documented provenance + redistribution rights;
  unconfirmed assets are replaced.

---

## D3 — 🟡 Most vendored trees ship no license file

### Evidence
```
eigen-3.4.0:  NONE FOUND        CGAL-6.1.1: NONE FOUND
libigl-2.6.0: NONE FOUND        glfw-3.4:   LICENSE.md  ✓
```
Only GLFW retains its upstream license file; the others rely solely on the central
`THIRD-PARTY-LICENSES.md`.

### Problem
When vendoring source trees, the upstream LICENSE/COPYING file should travel with the
code (it is usually a license *requirement* — MPL-2.0 and LGPL both require preserving
license notices). A central summary is good practice but does not substitute for the
upstream notice files inside each tree.

### Fix
Restore each upstream license file into its vendored tree (`eigen-3.4.0/COPYING.*`,
`CGAL-6.1.1/LICENSE*`, `libigl-2.6.0/LICENSE*`). They were likely stripped during
trimming of the vendored copies.

### Acceptance criteria
- Each vendored dependency tree contains its upstream license notice file.

---

## D4 — 🔵 Vendored tarball integrity not checksum-verified

### Evidence
`THIRD-PARTY-LICENSES.md` states the cached tarballs are "bit-for-bit identical to the
upstream releases", but no checksum manifest is committed.

### Problem
The reproducibility claim (the stated rationale for vendoring) rests on an unverified
assertion. A corrupted or substituted tarball would not be detected.

### Fix
Commit a `code/deps/tarballs/SHA256SUMS` and verify it in the extraction step of the
CMake/deps logic.

---

## What is already good

- `THIRD-PARTY-LICENSES.md` is a thorough, honest per-dependency matrix with real
  compatibility reasoning (the CGAL LGPL/GPL split, Eigen's NonMPL2 gating, the
  viewer-only scope of libigl/GLFW) — excellent practice, just built on a premise
  (D1) that G0 destabilizes.
- The dependency choices themselves are clean: Eigen (MPL-2.0), libigl (MPL-2.0),
  GLFW (zlib), nlohmann/json (MIT) are all permissive; only CGAL carries copyleft, and
  its header-only LGPL consumption is correctly reasoned.
- Vendoring at fixed versions for build reproducibility is a defensible choice and is
  documented.

## Suggested order
1. **D2** (data provenance) — couple with the G0 conversation; CGAL-blocking and the
   most clearly missing piece.
2. **D1** (re-base the matrix on the resolved license) — after G0/G1.
3. **D3** (restore upstream license files) — quick, and likely a license requirement.
4. **D4** (checksum manifest) — polish.