Assets and clean-room

An asset is any non-code material the project includes, ships, embeds, generates for publication, or shows in its documentation. Examples: icons, images, screenshots, logos, fonts, binary data files, sounds, video, committed sample collections, protos, OpenAPI files and word lists.

What is forbidden

• Anything taken from a Postman product, installer, website, document or package: icons, images, logos, fonts, brand colours, illustrations, marketing copy, sample collections. This holds even when the material is openly licensed, if it is visual design or content.
• Recreating, tracing or imitating a Postman icon, logo or illustration. Icons come from Lucide. The palette, spacing and layout details are our own. Interaction patterns (sidebar, tabs, request builder, response viewer) are behaviour, not artwork.
• Screenshots of other people's software, stock photos, emoji artwork from Apple, Microsoft or Samsung, system fonts, and "free for personal use" material.
• Screenshots of a real user's collections, tokens or responses.

The only Postman-authored material allowed is non-visual technical data that is openly licensed and needed for file compatibility.

• The closed list is the Postman Collection Format JSON schemas (v2.0.0 and v2.1.0, Apache-2.0), vendored only as test data.
• Each needs an ATTRIBUTION.toml entry with postman_data = true.
• Adding to this list needs the owner's explicit approval.

Allowed licences

Anything whose licence you cannot prove from the original source is forbidden.

Attribution workflow

ATTRIBUTION.toml at the repository root is the single source of truth. It has one entry per asset file:

• [[asset]] for a committed file.
• [[bundled]] for a file bundled through a Cargo dependency, such as egui's default fonts.

Each [[asset]] entry records path, title, author, source (with a version or commit), licence (SPDX), licence_file, kind, usage and sha256.

To add or change an asset:

cargo xtask assets --write   # regenerates ATTRIBUTION.md; never edit that file by hand
cargo xtask assets           # the gate

cargo xtask assets (part of cargo xtask ci) fails if:

• an asset file in the repository has no entry;
• an entry's hash does not match;
• a licence is not on the allowlist;
• a licence file is missing;
• an image, icon or font names Postman as author or source.

NOTICE keeps the licence notices the licences require.

If you find an asset that breaks these rules:

1. Stop.
2. Remove it from the repository and from every output (docs, screenshots, generated files).
3. Tell the owner at once.

Icons

Interface icons are Lucide SVGs (ISC) in assets/icons/, each with an ATTRIBUTION.toml entry. They are compiled into path data:

cargo xtask icons          # regenerate crates/ui-egui/src/icons_gen.rs
cargo xtask icons --check  # fail if it is out of date

Logo

The Postguy mark is contributor-original: assets/logo/postguy.svg. The PNG sizes needed for packaging (16, 32, 64, 128, 256, 512) are rasterised from it:

cargo xtask logo
cargo xtask logo --check

Fonts

Poppins (OFL-1.1) is the one approved embedded font.

• It lives in assets/fonts/, is embedded by crates/ui-egui/src/theme.rs and is listed in ATTRIBUTION.toml.
• Any other font file needs the owner's decision first. Otherwise use the default fonts that ship inside egui.

The desktop app may read one font already installed on the user's machine as a last interface fallback, for characters no embedded face has. That font is never embedded, shipped, committed or copied. It never appears in published screenshots (cargo xtask screenshots sets POSTGUY_SYSTEM_FONTS=0).

Screenshots

Screenshots of Postguy are contributor-original. Everything visible in them must itself be allowed: our UI, Lucide icons, allowed fonts and demo data written for this project. Generate them from the app's own UI:

cargo xtask screenshots --out target/screenshots

The documentation site commits no screenshots and no images other than serving the logo. See Writing the documentation.

Clean-room rules

Postguy implements Postman-compatible file formats and workflows from public information only.

• Never read, decompile, unpack or copy anything inside the Postman app bundle (its app.asar, bundled JavaScript, resources). Names and directory listings only.
• Behaviour comes only from:
  • public specifications and documentation: the Postman Collection Format schema, the public Postman Learning Center, and the RFCs for HTTP, URI, cookies, WebSocket, OAuth, the gRPC protocol and reflection;
  • black-box observation of a real install with synthetic data.
• Do not port or translate another implementation (Newman, postman-sandbox, postman-runtime, postman-code-generators, Insomnia, Bruno, Hoppscotch). They may be permissively licensed, but behaviour comes from documentation, schemas and observation, not from reading their code.
• Never copy GPL, AGPL or LGPL code and never link such a crate. Copyleft tools may run only as external oracle processes in tests (for example curl or grpcurl to cross-check output).
• Observe only with synthetic data. Never capture personal data, account information, tokens, workspaces or history.
• Real-file oracles (collections exported from a real install) stay local and are never committed. Write our own golden files.

Dependencies

• Permissive licences only. cargo xtask deny enforces this against deny.toml.
• Always use default-features = false and enable only what is used.
• No dependency on craft-ui, craft-libs or other storytold-internal repositories.
• Anything outside the allowlist, or anything that adds unrequested network traffic, needs the owner's approval.