Open source and data rights: separate the permissions in a reproduction kit

Access and permission answer different questions

Being able to download a file establishes access, not the scope of permission to reuse it. A reference calculation can combine original source code, a third-party numerical package, an invented fixture and a separately sourced dataset. Each component may have different terms. Inventory those components before assembling a reproduction kit, and distinguish internal use, redistribution and public display. This guide offers an editorial evidence checklist, not a legal opinion about a particular agreement. When permission is unclear, record the uncertainty and keep the disputed component out of the distributable bundle rather than filling the gap with an assumption.

Keep the original-code boundary visible

The library's stated first-edition policy is MIT for its original code and synthetic fixtures, with vendored code retaining its own licence. The MIT text permits broad reuse subject to retaining its copyright and permission notices in copies or substantial portions. That statement does not relicense every file placed beside the original implementation. Identify authorship and licence scope at the component level, especially when a small helper is copied from another project. A locally modified dependency remains traceable to its upstream source. Retaining notices is part of keeping the artifact intelligible, not a substitute for identifying which code was actually reused.

Inspect data terms at the source level

A well-known data portal may host material from multiple rights holders. FRED's legal notices distinguish series with different copyright conditions and direct readers to series-level information. Therefore a general description such as government website is not an adequate rights record for every downloadable series. Capture the exact series or file identifier, provider, terms location and access date when evaluating an external input. Also distinguish permission to retrieve data from permission to redistribute a copy. The first edition does not redistribute third-party price history; links and descriptions of an optional source should not imply that the data accompanies the calculation.

Read attribution conditions, not just licence names

Creative Commons Attribution 4.0 provides a concrete example of conditions that accompany reuse. Its legal code addresses retained attribution information, a licence reference and indications of modifications when material is shared. It also makes clear that the licence grants only rights the licensor can grant and does not imply endorsement. A short label such as CC BY is consequently not a complete provenance record. Preserve the specific version and the source's supplied attribution details. Do not apply that label to unrelated assets in the same folder or assume that it resolves trademarks, personal information or every other possible restriction.

Use genuinely synthetic fixtures

A synthetic fixture should be constructed to illustrate arithmetic, not copied from a restricted dataset and renamed. For example, inventing returns of 0.10, -0.10 and 0.05 yields a compact, transparent compounding test without distributing observed price history. Record that construction and keep the fixture free of customer identifiers, account exports or access tokens. Rounding or normalizing actual observations does not automatically establish redistribution permission for the transformed result. If a test needs the shape of a real problem, create values with that shape independently and state the intended mathematical property, such as a singular matrix or a known correlation.

Review a hypothetical bundle component by component

The table is a hypothetical packaging review, not a clearance decision for a real vendor. Original MIT code and an invented fixture can be included under the stated licence with the relevant notices. A vendored MIT helper retains upstream attribution. An externally supplied file with no identifiable licence is held out because the evidence is insufficient, not because this guide has determined its legal status. A file whose hypothetical agreement expressly forbids redistribution is also excluded. These decisions test the supplied facts independently: availability, authorship and a permission statement are different inputs, and none can be inferred from a convenient filename.

Deliver a useful rights record

Attach a component inventory that maps each included file to its source, applicable licence and preserved notices. Keep optional external-data requirements separate from files actually shipped. A retrieval instruction can explain that readers need their own authorized access without embedding credentials or promising that access is free. Date the review because online terms and source locations can change, and retain the evidence used for the publication decision where permitted. A rights record should also identify excluded material, so an apparently complete archive is not mistaken for a complete empirical dataset. Transparent limits improve reproducibility without overstating what the bundle grants its recipient.

Primary references

These sources support methods and conventions. The example values are original constructions, not observations extracted from these documents.

• Open Source Initiative: MIT licence text
• Creative Commons: Attribution 4.0 International legal code
• Federal Reserve Bank of St. Louis: FRED legal notices and data restrictions

Related investigations