[CaroFernando]

What changes were proposed in this PR?

Binary files can't carry a license header, so nothing in the repository records where its images and media files came from (see #8800). This PR adds PROVENANCE.yaml at the repository root, with one entry for each of the 236 image and media files tracked in git:

• path
• origin: project-made, third-party or unknown
• source and license, for third-party files
• notes: the evidence for the entry, or what still has to happen

Entries were filled from:

• the commit that wrote each file's current content. This matters because several icons were replaced after they were first added, for example the UDF icons in chore(frontend): refresh UDF operator icons #5686;
• embedded metadata (exiftool);
• the description and comments of the PR that added each file;
• a visual review.

Summary:

Origin	Files
project-made	31
third-party	15 (8 already in LICENSE; 7 need follow-up, listed in #8984)
unknown	190 (13 are the vendor logos replaced by #8999)

The unknown entries are the remaining audit work for #8984. If the release goes the DISCLAIMER-WIP route agreed in #8800, they are the list the disclaimer can point to. The format follows the manifest proposed in #8985, so that issue's CI check can read this file.

This PR only records provenance. It does not replace any image or edit LICENSE; that follow-up work is tracked in #8984.

Any related issues, documentation, discussions?

Part of #8984. Related: #8800, #8985, #8982 / #8999. Audit status and plan: #8984 (comment)

Interaction with #8999: the 13 vendor-logo entries are currently unknown and noted as being replaced under #8982. If #8999 merges first, I'll regenerate those entries here as project-made; if this PR merges first, #8999 (or a small follow-up) should update them.

How was this PR tested?

Documentation-only change, no code. Checks run:

# every tracked image/media file has exactly one entry, and the file parses
python3 -c "import yaml,subprocess; d=yaml.safe_load(open('PROVENANCE.yaml'))['files']; \
  t={p for p in subprocess.check_output(['git','ls-files']).decode().split() \
     if p.lower().endswith(('.png','.jpg','.jpeg','.gif','.ico','.svg','.webp','.bmp','.mp4','.wav','.mp3','.webm','.ogg'))}; \
  m={f['path'] for f in d}; print(len(d), t==m, len(m)==len(d))"
# license header check, same as check-header.yml
license-eye -c .licenserc.yaml header check

Output: 236 True True, and invalid: 0 from the header check.

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-opus-5-5)

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• No candidates found from git blame history.

[CaroFernando]

/request-review @mengw15 @parshimers

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

• To reduce future merge conflicts and make lookups easier, it would be better to enforce a… · New
• The license field is likely to be consumed by CI/tools (per the manifest format described in the… · New
• The filename Tutor_Intro_Drag_Srouce.gif appears to contain a typo (Srouce vs Source). If… · New

What changed in this PR

Adds a repository-wide provenance manifest for all bundled image/media assets so their source and licensing information is recorded outside of binary files (per #8800 / #8984), in a format intended to be machine-checked (per #8985).

Changes:

• Introduces PROVENANCE.yaml with an entry for each tracked image/media file (236 total).
• Records origin, and where applicable, source, license, and evidence/next steps in notes.
• Includes guidance comments for maintaining the manifest going forward.

File	Description
PROVENANCE.yaml	New provenance manifest covering all tracked image/media assets, including origin classification and licensing metadata.

_{Review effort: Lite}

[mengw15]

Thanks for putting this together! I'm wondering whether we should keep PROVENANCE.yaml as a permanent file. I haven't seen this approach in other Apache projects, where third-party assets are typically documented in LICENSE.

@parshimers, is this an acceptable or standard practice for ASF releases, or should we use this file only for auditing and keep the final attribution in LICENSE?

[parshimers]

I think we should just have it for this process. LICENSE/NOTICE is the final product. However as a tool I really like it.

[CaroFernando]

Makes sense, thanks both. I'll treat PROVENANCE.yaml as the audit's working list rather than a permanent file: keep it on my fork (linked from #8984) and update it as replacements land, while the actual attribution goes into LICENSE / LICENSE-binary. I'll leave this PR open until the question below is settled, then close it.

One follow-up: #8985 proposes a permanent manifest plus a CI check. If we're not keeping the manifest, should #8985 instead check that every image is either listed in LICENSE or added by a PR that states it is project-made, or should it be dropped?