fix(ci): add MIT license and required Zot annotations

.gitea/workflows/publish-docker.yml

@@ -14,15 +14,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Log in to Gitea Container Registry
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Zot Container Registry
         uses: docker/login-action@v3
         with:
           registry: registry.br0tkasten.de
           username: runner
-          # access token of the user triggering this action
+          # Zot credentials for runner, stored in the Gitea Actions secret TOKEN.
-          # in gitea -> user settings -> applications -> new token -> write:packages and write:repositories
+          password: ${{ secrets.TOKEN }}
-          # then in gitea -> user settings -> actions -> secrets -> add new secret named "TOKEN" with the value of the access token.
-          password: ${{ secrets.TOKEN }} 
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
@@ -40,8 +41,11 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: .
-          push: true
+          outputs: type=registry,oci-mediatypes=true
-          # Compatibility workaround for registry manifest rejection with attestations.
+          # Keep a single image manifest with the annotations required by Zot's linter.
           provenance: false
+          annotations: |
+            manifest:org.opencontainers.image.vendor=br0tkasten.de
+            manifest:org.opencontainers.image.licenses=MIT
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

Changelog.md

@@ -30,6 +30,7 @@ This file summarizes the project's git history in short, readable steps.
 
 ## Recent Enhancements
 
+- Added the MIT license for br0tkasten.de, included it in the runtime image, and configured OCI manifest annotations and Buildx for Zot's required vendor and license checks.
 - Disabled default build provenance attestations as a workaround for manifest rejection when publishing to the external Zot registry.
 - `efddb34`: Hid the fullscreen navigation arrows on mobile and kept swipe navigation in chronological order.
 - `99f9f64`: Added a fullscreen download button and changed the light-mode caption color back to `#303030`.

Dockerfile

@@ -10,12 +10,15 @@ RUN npm run build
 
 FROM node:current-alpine AS runtime
 
+LABEL org.opencontainers.image.vendor="br0tkasten.de" \
+      org.opencontainers.image.licenses="MIT"
+
 WORKDIR /app
 ENV NODE_ENV=production
 ENV HOST=0.0.0.0
 ENV PORT=3000
 
-COPY package.json ./
+COPY package.json LICENSE ./
 COPY --from=build /app/dist ./dist
 
 EXPOSE 3000

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 br0tkasten.de
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package-lock.json

@@ -7,6 +7,7 @@
     "": {
       "name": "mapix",
       "version": "0.1.0",
+      "license": "MIT",
       "dependencies": {
         "exifr": "^7.1.3",
         "leaflet": "^1.9.4"

package.json

@@ -2,6 +2,7 @@
   "name": "mapix",
   "private": true,
   "version": "0.1.0",
+  "license": "MIT",
   "type": "module",
   "scripts": {
     "build": "tsc -p tsconfig.json && node dist/shared/copy-vendor-assets.js",