Verify that all asset licenses are accounted for in `CREDITS.md`

[alice-i-cecile]

What problem does this solve or what need does it fill?

As discussed in #4975 (comment), we should verify that all assets are correctly attributed.

What solution would you like?

1. Add a LICENSES.csv file to the assets folder.
2. Record all licenses and source links there.
3. Add a step to CI to verify that there's a one-to-one correspondence.

What alternative(s) have you considered?

Manually verify that these are correct.
This solves the problem for now, but doesn't increase our long-term confidence.

[arnavc52]

For anyone who's willing to work on this:

Information about many of the assets can be found here:

bevy/CREDITS.md

Lines 17 to 27 in 619c30c

	* Generic RPG Pack (CC0 license) by [Bakudas](https://twitter.com/bakudas) and [Gabe Fern](https://twitter.com/_Gabrielfer)
	* Environment maps (`.hdr` files) from [HDRIHaven](https://hdrihaven.com) (CC0 license)
	* Alien from [Kenney's Space Kit](https://www.kenney.nl/assets/space-kit) (CC0 1.0 Universal)
	* Cake from [Kenney's Food Kit](https://www.kenney.nl/assets/food-kit) (CC0 1.0 Universal)
	* Ground tile from [Kenney's Tower Defense Kit](https://www.kenney.nl/assets/tower-defense-kit) (CC0 1.0 Universal)
	* Game icons from [Kenney's Game Icons](https://www.kenney.nl/assets/game-icons) (CC0 1.0 Universal)
	* Space ships from [Kenny's Simple Space Kit](https://www.kenney.nl/assets/simple-space) (CC0 1.0 Universal)
	* glTF animated fox from [glTF Sample Models](https://github.com/KhronosGroup/glTF-Sample-Models/tree/master/2.0/Fox)
	* Low poly fox [by PixelMannen](https://opengameart.org/content/fox-and-shiba) (CC0 1.0 Universal)
	* Rigging and animation [by @tomkranis on Sketchfab](https://sketchfab.com/models/371dea88d7e04a76af5763f2a36866bc) ([CC-BY 4.0](https://creativecommons.org/licenses/by/4.0/))
	* FiraMono by The Mozilla Foundation and Telefonica S.A (SIL Open Font License, Version 1.1: assets/fonts/FiraMono-LICENSE)

However, it's very incomplete:

• The line about the "Generic RPG Pack" didn't mention the source. It's most likely https://bakudas.itch.io/generic-rpg-pack.
• Same for the "FiraMono" font, which is from https://github.com/mozilla/Fira. assets/fonts/FiraSans-bold.ttf is also from the same repository, but it's not mentioned in the credits.
• assets/models/FlightHelmet is from the glTF Sample Models. It was originally made by Microsoft and falls under the CC0 1.0 Universal license.
• assets/models/SimpleSkin is from part 19 of the official glTF tutorial. It falls under the Creative Commons Attribution 4.0 International license.
• assets/models/cube and assets/models/sphere are apparently from commit 870f715, but I couldn't find any attribution or license information. @cart probably knows more about those two.
• Similarly, there's no information about assets/models/monkey, but it also came from one of @cart's commits (1143f16)
• assets/models/Box0.bin is the same story: @cart added it in commit 86a467f
• We're done with the models, but we're not done with mysterious assets from the early days of Bevy. assets/sounds/Windless Slopes.ogg is from commit 3eb3935.
• The source of assets/sounds/breakout_collision.ogg is actually Bevy itself! To be specific, @IceSentry made it for the Breakout example. I'm assuming this falls under the same dual MIT/Apache-2.0 license as Bevy, but double-check with someone else.
• assets/textures/array_texture.png came from Extend the Texture asset type to support 3D data #903. @bonsairobo should know more about its source.

And some words of advice:

I'd highly recommend using SPDX License Identifiers to refer to the licenses in the CSV. Your CI pipeline should confirm that all the licenses are compatible with Bevy's MIT/Apache 2.0 license structure. And once you figure out this mess, please add everything that was missing to CREDITS.md. delete CREDITS.md.

[IceSentry]

The source of assets/sounds/breakout_collision.ogg is actually Bevy itself! To be specific, @IceSentry made it for the Breakout example. I'm assuming this falls under the same dual MIT/Apache-2.0 license as Bevy, but double-check with someone else.

When creating that sound I assumed it would just fall under the bevy license, I didn't give more thoughts than this, but if you need me to agree to any other license I will gladly do what it takes.

[alice-i-cecile]

IMO we should remove CREDITS.md once this is done; we really don't want two sources of truth.

[arnavc52]

IMO we should remove CREDITS.md once this is done; we really don't want two sources of truth.

Perhaps we could generate CREDITS.md from the CSV using an action (similar to the README for the examples). But that would make things more complicated. Deleting it is probably the best solution.

[bonsairobo]

assets/textures/array_texture.png came from #903. @bonsairobo should know more about its source.

I generated that particular image by stacking 4 textures from https://freepbr.com/

I can try to find the original links.

[bonsairobo]

https://freepbr.com/materials/desert-rock1/
https://freepbr.com/materials/snow-drift/
https://freepbr.com/materials/rough-wet-cobble/
https://freepbr.com/materials/stylized-grass1/

[arnavc52]

Thanks! While we do have the usage rights for those 4 textures, the licensing terms are quite vague. Perhaps we could get in touch with Brian (the owner of Free PBR) and ask him to relicense them under something like the Creative Commons Attribution-NonCommercial 4.0 International license, which is pretty similar to what he currently has.