docs: a "Shipping to stores" guide (CC-BY anti-DRM, copyleft vs stores, LGPL on consoles)

New docs/shipping.md, rendered at /guide/shipping/. Each claim quotes the
licence with the date it was read:
- CC BY 3.0 s4(a) and 4.0 s2(a)(5)(B) anti-DRM text, and the 4.0
  s2(a)(4) circumvention waiver that 3.0 lacks
- OpenGameArt's FAQ on GPL, LGPL, CC-BY-SA and CC-BY against Apple's terms
- LGPL 2.1 s6 and 3.0 s4(d) relinking terms, and why a console that runs
  only signed code cannot meet them
- a pointer to the Steam AI disclosure in the AI guide

licenses.md links it from the CC-BY-3.0, CC-BY-4.0, GPL and LGPL rows, and
every CC-BY or copyleft entry page links it beside "what it means" (56
pages). README lists it.

Closes #181

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LpkeXRUqm7oDedPDk3QWtK

Author: TMHSDigital

README.md

@@ -253,6 +253,7 @@ Read these before you mix packs into a commercial build.
 | [`docs/unreal.md`](docs/unreal.md) | Fab and Epic content, UE-only licences, and what the Unreal EULA forbids combining |
 | [`docs/provenance.md`](docs/provenance.md) | Judging a supplier, and keeping a paper trail |
 | [`docs/high-risk.md`](docs/high-risk.md) | Sources to avoid entirely |
+| [`docs/shipping.md`](docs/shipping.md) | Steam, consoles and app stores: CC-BY anti-DRM, copyleft vs store terms, LGPL on consoles |
 | [`docs/ai-assets.md`](docs/ai-assets.md) | AI-generated assets |
 | [`docs/fivem.md`](docs/fivem.md) | GTA-format and FiveM assets |
 | [`docs/for-publishers.md`](docs/for-publishers.md) | What the catalog records about a source, and how its publisher corrects it or opts out of a preview |
@@ -383,7 +384,7 @@ npm run serve    # preview at http://127.0.0.1:3000 (node site/serve.mjs, no dow
 │                               one .md per source, plus a README index
 ├── docs/
 │   ├── licenses.md fonts.md geodata.md game-vs-video-licensing.md
-│   ├── provenance.md high-risk.md ai-assets.md fivem.md trust-score.md
+│   ├── provenance.md high-risk.md shipping.md ai-assets.md fivem.md trust-score.md
 │   ├── godot-budget-stack.md unreal.md
 │   ├── data.md                 the JSON, CSV and feed exports
 │   ├── for-publishers.md       what is recorded about a publisher, and how to correct it

docs/licenses.md

@@ -9,8 +9,8 @@ Quick reference for assets you might list or use. **Always re-check the source p
 | License | Commercial use | Attribution | Notes |
 | --- | --- | --- | --- |
 | **CC0** | Yes | Not required | Safest default for closed-source games. Can embed in DRM builds. |
-| **CC-BY-4.0** | Yes | Required | Credit the author; a credits-screen link to the source usually satisfies. Keep a notices file. |
-| **CC-BY-3.0** | Yes | Required | Same commercial grant; some projects expect the **author named** (not only a site URL). Example: Game-Icons.net wants `Icons made by {author}. Available on https://game-icons.net`. |
+| **CC-BY-4.0** | Yes | Required | Credit the author; a credits-screen link to the source usually satisfies. Keep a notices file. DRM-wrapped store builds: see [shipping](shipping.md). |
+| **CC-BY-3.0** | Yes | Required | Same commercial grant; some projects expect the **author named** (not only a site URL). Example: Game-Icons.net wants `Icons made by {author}. Available on https://game-icons.net`. Its anti-DRM clause has no 4.0-style waiver, so check it before a console or iOS build; see [shipping](shipping.md). |
 | **CC-BY-SA** | Yes, **except Unreal** | Required | Share-alike applies to **derivatives of the asset**, not your whole game as code. Prefer shipping SA assets in extractable bundles (`.pck`, loose folders) rather than encrypted into the binary. The Unreal Engine EULA names CC-BY-SA (and GPL/LGPL) as licences you may not combine with the engine; see [unreal.md](unreal.md). |
 | **CC-BY-NC** | No | Required | Fine for prototypes / jam games; **reject for commercial catalogs** unless clearly marked non-commercial. |
 | **CC-BY-ND** | Yes | Required | No derivatives — **reject for games**. Interactive sync / remix is generally treated as a derivative; ND music and art are unsafe. |
@@ -61,8 +61,8 @@ Most `tools/` entries and many libraries carry one of these. They all allow comm
 
 | License | Commercial use | Notes |
 | --- | --- | --- |
-| **GPL-2.0-only**, **GPL-2.0-or-later**, **GPL-3.0-only**, **GPL-3.0-or-later** | Yes | Strong copyleft on the program. Linking GPL code into your game makes the game GPL. Using a GPL editor does not, as the section below explains. The bare **GPL-2.0** and **GPL-3.0** values mean the project did not say "only" or "or later". |
-| **LGPL-3.0** | Yes | You may link the library from closed code if users can replace it, which in practice means dynamic linking. Changes to the library itself stay LGPL. The Unreal Engine EULA forbids combining LGPL code with the engine; see [unreal.md](unreal.md). |
+| **GPL-2.0-only**, **GPL-2.0-or-later**, **GPL-3.0-only**, **GPL-3.0-or-later** | Yes | Strong copyleft on the program. Linking GPL code into your game makes the game GPL. Using a GPL editor does not, as the section below explains. The bare **GPL-2.0** and **GPL-3.0** values mean the project did not say "only" or "or later". App stores and consoles: see [shipping](shipping.md). |
+| **LGPL-3.0** | Yes | You may link the library from closed code if users can replace it, which in practice means dynamic linking. Changes to the library itself stay LGPL. The Unreal Engine EULA forbids combining LGPL code with the engine; see [unreal.md](unreal.md). Consoles that allow no relinking cannot meet this; see [shipping](shipping.md). |
 
 ## How to read a `custom`, `varies` or `unknown` entry
 

docs/shipping.md

@@ -0,0 +1,99 @@
+# Shipping to Steam, consoles and app stores
+
+Most free-asset licences were written for files you hand to someone else, not for a
+game sold through a store that wraps it in DRM, signs it, and forbids users from
+changing it. Three clauses cause most of the trouble at release time: the CC-BY
+anti-DRM clause, copyleft terms against app-store terms, and LGPL's relinking rule on
+platforms that allow no dynamic linking. Steam also asks you to disclose AI content.
+Each section quotes the licence text it relies on, with the date it was read. This is
+the catalog's reading, not legal advice.
+
+## The CC-BY anti-DRM clause
+
+The Creative Commons licences with conditions (CC BY and its variants; not CC0) forbid
+you to use technical measures to stop others from using the work as the licence allows.
+
+- **CC BY 3.0**, Section 4(a), read 2026-11-03: "When You Distribute or Publicly Perform
+  the Work, You may not impose any effective technological measures on the Work that
+  restrict the ability of a recipient of the Work from You to exercise the rights
+  granted to that recipient under the terms of the License."
+- **CC BY 4.0**, Section 2(a)(5)(B), read 2026-11-03: "You may not offer or impose any
+  additional or different terms or conditions on, or apply any Effective Technological
+  Measures to, the Licensed Material if doing so restricts exercise of the Licensed
+  Rights by any recipient of the Licensed Material."
+
+4.0 adds a release valve that 3.0 does not have. Section 2(a)(4), read 2026-11-03: the
+licensor "waives and/or agrees not to assert any right or authority to forbid You from
+making technical modifications necessary to exercise the Licensed Rights, including
+technical modifications necessary to circumvent Effective Technological Measures."
+Under 4.0, a recipient may lawfully get the work out of your DRM-wrapped build, which
+is the usual argument that a 4.0 asset can ship in a Steam, console or mobile build.
+The no-DRM sentence is still in 4.0, though, so CC0 remains the only choice with no
+question at all. Under 3.0 the restriction stands with no such waiver, so a CC BY 3.0
+asset inside an encrypted or signed package is the riskier case.
+
+What to do:
+
+- Prefer CC0 or CC BY 4.0 for anything that ships inside a protected build. The
+  [LPC Revised Basics](../catalog/2d/lpc-revised-basics.md) entry takes the OGA-BY
+  versions of its sprites for exactly this reason: OGA-BY 3.0 is CC-BY without the
+  anti-DRM clause.
+- For a CC BY 3.0 asset you need, ask the author for a waiver or a 4.0 or OGA-BY
+  licence, or ship the file where players can reach it (a loose file beside the
+  executable rather than inside an encrypted package).
+- Share-alike (CC-BY-SA) licences carry the same clause, as well as their copyleft.
+
+## App stores and copyleft
+
+Store terms of use can restrict copying and changing what a customer downloads, which
+sits badly with licences that require every recipient to be free to do both. The
+[OpenGameArt](../catalog/2d/opengameart.md) FAQ, read 2026-09-26, answers the question of
+using its art on the Apple App Store with "Not necessarily": Apple's terms "conflict
+with the terms of the GNU GPL, the GNU LGPL, CC-BY-SA, and CC-BY". The catalog's advice
+for an App Store build is to prefer CC0, OGA-BY or a permissive code licence (MIT, BSD,
+Apache-2.0), or to get the author's written consent first.
+
+The same reasoning applies to GPL code you link into the game: a store build is a
+distribution, and you cannot meet the GPL's terms if the store forbids what the GPL
+grants. GPL tools you only use to make assets, such as an editor, are a different case;
+see [the licence guide](licenses.md).
+
+## LGPL on consoles and closed platforms
+
+LGPL lets you ship a closed-source game that uses the library only if users can swap in
+a modified copy of the library.
+
+- **LGPL 2.1**, Section 6, read 2026-11-03: you may "combine or link a 'work that uses the
+  Library' with the Library to produce a work containing portions of the Library, and
+  distribute that work under terms of your choice, provided that the terms permit
+  modification of the work for the customer's own use and reverse engineering for
+  debugging such modifications."
+- **LGPL 3.0**, Section 4(d), read 2026-11-03: you must either convey the source and
+  application code "in a form suitable for, and under terms that permit, the user to
+  recombine or relink the Application with a modified version of the Linked Version",
+  or "Use a suitable shared library mechanism for linking with the Library. A suitable
+  mechanism is one that (a) uses at run time a copy of the Library already present on
+  the user's computer system, and (b) will operate properly with a modified version of
+  the Library".
+
+On a console or other platform that only runs signed code and allows no user-supplied
+libraries, the user can neither relink nor drop in a modified library, so neither
+option can be met in practice, so an LGPL library is not a safe choice there. On desktop, a dynamically
+linked LGPL library (a `.dll`, `.so` or `.dylib` beside the game) is the normal way to
+comply. The Unreal Engine EULA forbids combining the engine with GPL or LGPL code
+altogether; see [the Unreal guide](unreal.md).
+
+## Steam's AI disclosure
+
+Steam's Content Survey asks about AI-made content that ships with your game. The quote,
+and what it means for an entry tagged `ai-generated`, are in
+[the AI assets guide](ai-assets.md).
+
+## Before you submit
+
+1. List every third-party asset and library in the build, with its licence.
+2. CC BY 3.0, CC-BY-SA, GPL or LGPL in a console, iOS or other locked-down build: replace
+   it, get the author's consent, or keep it out of that build.
+3. LGPL on desktop: link it dynamically and ship its licence and source offer.
+4. Ship your credits and licence notices; see [the licence guide](licenses.md).
+5. AI-made content: fill in the Content Survey's AI section.

site/config.json

@@ -46,6 +46,7 @@
     { "id": "for-publishers", "title": "For publishers", "path": "docs/for-publishers.md" },
     { "id": "provenance", "title": "Provenance", "path": "docs/provenance.md" },
     { "id": "high-risk", "title": "Not safe to ship", "path": "docs/high-risk.md" },
+    { "id": "shipping", "title": "Shipping to stores", "path": "docs/shipping.md" },
     { "id": "ai-assets", "title": "AI assets", "path": "docs/ai-assets.md" },
     { "id": "game-vs-video", "title": "Games vs video licensing", "path": "docs/game-vs-video-licensing.md" },
     { "id": "unreal", "title": "Unreal Engine licensing", "path": "docs/unreal.md" },

site/lib/entry-page.mjs

@@ -59,6 +59,9 @@ export function engineScope(entry) {
   return native.length === 1 ? ENGINES[native[0]].label : null;
 }
 
+/** Licence families with a store-build caveat (docs/shipping.md): CC-BY's anti-DRM clause, copyleft. */
+const SHIPPING_FAMILIES = new Set(["cc-by", "copyleft"]);
+
 function credit(entry) {
   if (entry.attribution_required === true && entry.attribution_string) {
     const fill = fillInNote(entry.attribution_string);
@@ -99,7 +102,7 @@ export function entryPageHtml({ entry, leadHtml, restHtml, deprecatedReasonHtml,
     entry.engine_lock ? ["Engine lock", esc(ENGINE_LOCK_NOTES[entry.engine_lock] || entry.engine_lock)] : null,
     !entry.engine_lock && scope ? ["Engine", `Made for ${esc(scope)}: it only opens there.`] : null,
     entry.limits ? ["Limits", esc(entry.limits)] : null,
-    ["Licence", `${esc(licence)} <a class="facts-guide" href="../../guide/licenses/">what it means</a>`],
+    ["Licence", `${esc(licence)} <a class="facts-guide" href="../../guide/licenses/">what it means</a>${SHIPPING_FAMILIES.has(entry.licenseFamily) ? ' <a class="facts-guide" href="../../guide/shipping/">shipping to stores</a>' : ""}`],
     ["Commercial use", esc(commercialLabel(entry.commercial))],
     ["Credit", esc(c.value)],
     ["Status", `${esc(entry.status)}: ${esc(STATUS_NOTES[entry.status] || "")}`],