License / attribution clarification for @pdf-lib/fontkit 1.1.1

[aclothes]

Hi,

I’m preparing a commercial distribution of an application that uses:

@pdf-lib/fontkit@1.1.1

The npm package metadata declares MIT, and pdf-lib documentation identifies
@pdf-lib/fontkit as its sister module.

I’m trying to build an accurate THIRD_PARTY_NOTICES file and avoid inventing
copyright or attribution text.

Could you please clarify the intended license / attribution information for
the exact npm artifact @pdf-lib/fontkit@1.1.1?

1. What exact copyright notice should accompany redistribution of
   @pdf-lib/fontkit@1.1.1?

2. Is the following attribution correct, or should it be different?

   “Andrew Dillon, Devon Govett, and contributors”

3. Because @pdf-lib/fontkit is a fork of foliojs/fontkit, are there any
   additional embedded third-party components, copyright notices, license
   texts, or attribution requirements that must accompany redistribution of
   version 1.1.1?

4. Could you provide or link to the complete license and notice set
   applicable to the exact npm artifact @pdf-lib/fontkit@1.1.1, including
   any notices required for bundled third-party code or data?

I’m not asking for legal advice—only the intended upstream license and notice
information for this exact package/version so I can reproduce it accurately.

Thank you.

[Vituartzz]

I checked the exact artifact (npm pack @pdf-lib/fontkit@1.1.1) and rebuilt it, since the answer depends on what's inside dist/.

1–2. Copyright notice for the package itself

There isn't one to copy. The tarball has no LICENSE file. package.json declares "license": "MIT", "author": "Andrew Dillon" and "contributors": ["Devon Govett"], and the README only says MIT. Upstream is the same: neither Hopding/fontkit nor foliojs/fontkit has a LICENSE file. So your attribution matches the metadata. When a project declares MIT without a notice, the usual approach is to pair the standard MIT text with a line built from that metadata, e.g. Copyright (c) Devon Govett, Andrew Dillon and contributors.

One detail: the fork's package.json on GitHub says 1.1.0, so 1.1.1 was published from a state that isn't in the repo. The tarball is the only authoritative source for that version.

3. Bundled third-party code (the part "MIT" doesn't cover)

dist/fontkit.umd.js and dist/fontkit.es.js are Rollup bundles. rollup.config.js inlines every dependency (only pako stays external, and only in the ES build), which is why the runtime libraries sit in devDependencies.

I rebuilt it from the fork's last commit (72b8e42) with yarn --frozen-lockfile plus rollup-plugin-license. Both rebuilt files are identical to the published ones apart from line endings, so the list below is exact. 30 packages end up inside. These are the ones that change your notice file:

• @pdf-lib/brotli@0.0.0 declares MIT, but its decoder sources kept the original Copyright 2013 Google Inc. … Licensed under the Apache License, Version 2.0 headers, and those headers are in the dist you redistribute. Google relicensed brotli to MIT on 2015-11-27 (google/brotli 55e9768b). Whether you list it as Apache-2.0, MIT or both is your call, but the Apache text is physically in the file.
• ieee754@1.1.13: BSD-3-Clause (pulled in by the buffer polyfill).
• pako@1.0.11: MIT AND Zlib, UMD builds only. The ES build imports it, so there it comes from your own dependency tree.
• rollup-plugin-node-builtins@2.1.2: ISC (the events/stream polyfills), plus string_decoder@0.10.31, which carries the Copyright Joyent, Inc. and other Node contributors header.
• Everything else is MIT: @pdf-lib/restructure, @pdf-lib/unicode-properties, unicode-trie, tiny-inflate, dfa, clone, deep-equal (and its dependencies define-properties, es-abstract, function-bind, has, has-symbols, is-arguments, is-date-object, is-regex, object-is, object-keys, regexp.prototype.flags), base64-arraybuffer, base64-js, buffer, iconv-lite, safer-buffer, process-es6 and rollup-plugin-node-globals.

Seven of them (@pdf-lib/brotli, @pdf-lib/restructure, dfa, tiny-inflate, unicode-trie, rollup-plugin-node-builtins, rollup-plugin-node-globals) ship no license file either, the same situation as fontkit itself.

4. Full notice set

Here is the generated file: every bundled package with its version, declared license, author/repo, and the license text where the package ships one.
https://gist.github.com/Vituartzz/9bb8cb17b2e05cfe8e836b05311e16e4

The config that produced it is in the same gist, so you can regenerate it and diff it yourself:

git clone https://github.com/Hopding/fontkit && cd fontkit    # last commit 72b8e42
npx yarn@1 install --frozen-lockfile --ignore-scripts
npx yarn@1 add -D rollup-plugin-license@2.9.1 --ignore-scripts
for s in generate-data gen-use gen-indic; do MODULE_TYPE=commonjs npx babel-node src/opentype/shapers/$s.js; done
# copy rollup.notices.config.js from the gist into the repo root
MODULE_TYPE=umd OUT=THIRD_PARTY_NOTICES.txt npx rollup -c rollup.notices.config.js -o fontkit.umd.js

Not legal advice, as you said. This is only what is physically in the artifact.

[aclothes]

Thank you — this was very helpful. I independently reproduced the exact
@pdf-lib/fontkit@1.1.1 bundle and confirmed the published/rebuilt bundles
match byte-for-byte.

I have now resolved 27 of the 32 embedded version/notice records.

Five provenance/notice questions remain before I can complete an accurate
THIRD_PARTY_NOTICES file:

1. Brotli

The embedded decoder/dictionary code still contains Google Apache-2.0
headers, while the @pdf-lib/brotli wrapper package declares MIT.

Is there a known intended notice for the additional wrapper/fork code,
beyond preserving the embedded Google/Apache notices?

2. @pdf-lib/restructure

Do you know the exact license/copyright grant intended for the fork changes
included in the version bundled by @pdf-lib/fontkit@1.1.1?

3. dfa

The exact package/source declares MIT, but I have not found a complete
historical copyright/license notice corresponding to the bundled version.

Is there an authoritative notice for that version?

4. iconv-lite

Most generated DBCS tables can be reproduced, but the provenance of
gbk-added.json and some SBCS generated data is still unclear.

Is there a documented source/license chain for those embedded tables?

5. rollup-plugin-node-globals

The package license is known, but I have not found a complete notice
corresponding to the embedded global-object selector code.

Is there an authoritative source/copyright notice for that embedded code?

I am not asking for legal advice. I am only trying to reproduce the exact
upstream/source notices for the bytes distributed inside
@pdf-lib/fontkit@1.1.1.

If you know the intended upstream source or notice for any of these five
items, that would help complete the artifact-level notice inventory.

Thank you again.