Mexico (MX) — internal licensing notes

Source research, 2026-08-27 — sellability + reproducibility audit

Two independently licence-clean sources exist. Both verified downloadable on this date; both CC BY 4.0, which permits commercial redistribution on attribution alone.

Source 1 — GeoNames MX (base: names + admin tiers)

https://download.geonames.org/export/zip/MX.zip      # 2.0 MB, 144,655 rows

Licence: CC-BY-4.0. Verified against export/zip/readme.txt on 2026-08-27 — that readme flags per-country restrictions for GB, CL, CN, IE, MT, AR and BR only. Mexico carries no caveat.

accuracy scale is documented in the same readme: 1 = estimated, 4 = geonameid, 6 = centroid of addresses or shape.

Source 2 — SEPOMEX "Códigos postales por entidad federativa" (authority)

Publisher: Servicio Postal Mexicano, via datos.gob.mx. Licence CC-BY-4.0. Last updated 2026-01-29 (data vintage 2025).

Discover the resource URLs via the CKAN API — do not hardcode them:

https://www.datos.gob.mx/api/3/action/package_show?id=codigos_postales_entidad_federativa
  -> 32 resources, one per entidad federativa, format SHP
  -> https://repodatos.atdt.gob.mx/api_update/sepomex/codigos_postales_entidad_federativa/CP_{ST}.zip

Total download ~110 MB. Each shapefile has exactly one attribute, d_cp (5-char postal code), plus polygon geometry. So it is an authoritative code list plus boundaries and carries no names — it must be joined to GeoNames for place_name / admin_name*.

Value it adds over GeoNames alone: the definitive code list, and real POSTAL_CODE-accuracy centroids derived from official polygons rather than GeoNames' estimated points.

The old tabular SEPOMEX catalogue is dead. Both correosdemexico.gob.mx/SSLServicios/ConsultaCP/CodigoPostal_Exportar.aspx and the datosabiertos/cp/cpdescarga.txt path returned nothing at all (no response, not a 404) on 2026-08-27. datos.gob.mx/busca/dataset/ catalogo-nacional-de-codigos-postales returns 404. Do not build against them.

Download trap — parallel fetch truncates silently

Fetching the 32 archives with xargs -n1 -P8 curl -s -O exited 0 and produced 32 files of plausible size, but 8 were silently truncated (CP_BCS, CP_CDMX, CP_Camp, CP_Chih, CP_Mich, CP_NL, CP_Pue, CP_Tab). The failure surfaced only as BadZipFile at parse time. Re-fetching those 8 serially with --retry 3 produced files 2–7× larger.

Any build script MUST run unzip -tqq over every archive and re-fetch failures serially before parsing.

Cross-check against what is currently sold (2026-08-27)

Compared the SEPOMEX code list against the live mx/mx.csv on R2:

Defects in the currently-published file

mx/mx.csv on R2 is a GeoNames re-export (row count matches MX.zip exactly: 144,655) that was round-tripped through pandas and corrupted:

• Leading zeros stripped from admin codes — GeoNames admin_code1=01 → published 1; admin_code2=001 → 1.
• Integer codes written as floats — admin_code3=01 → 1.0.
• admin_code1 is the GeoNames numeric scheme (01…32), not ISO 3166-2:MX (AGU, BCN, …).

Fix by rebuilding with dtype=str throughout and deriving real ISO 3166-2 codes.

Attribution is currently absent from the sold product. R2 carries only mx/mx.csv — no README.md, no datapackage.json, no ATTRIBUTION.txt, no mx.zip. The repo datapackage.yml lists sources: [{title: "Multiple sources"}] with no licenses[]. CC BY 4.0 attribution is a licence condition, so this is a live breach on a paid product — same failure class as datahub-next#941.

Also: datapackage.yml sets is_premium: true with no premium_tier and no premium_source_key, and there is no zip in R2 for a key to point at. A buyer pays and receives nothing.

licence_status (proposed — needs human sign-off before shipping)

{
  "channel": "postal-codes-r2",
  "components": [
    {
      "field_group": "place_name, admin_name*, latitude, longitude, accuracy",
      "source_url": "https://download.geonames.org/export/zip/MX.zip",
      "licence_id": "CC-BY-4.0",
      "collected_at": "2026-08-27",
      "decision": "compatible",
      "decided_by": "claude-opus-5 (source research)",
      "decided_at": "2026-08-27"
    },
    {
      "field_group": "postal_code (authoritative list), coordinates at POSTAL_CODE accuracy",
      "source_url": "https://www.datos.gob.mx/dataset/codigos_postales_entidad_federativa",
      "licence_id": "CC-BY-4.0",
      "collected_at": "2026-08-27",
      "decision": "compatible",
      "decided_by": "claude-opus-5 (source research)",
      "decided_at": "2026-08-27"
    }
  ]
}

Both licences are unambiguous CC BY 4.0 and verified from the publishers' own statements, but no human has signed these off yet — treat decision as provisional until they do.

Proposed tier

A ($99). Two authoritative sources consolidated onto each other (GeoNames names + SEPOMEX official code list and geometry), and the consolidation demonstrably recovers 5,817 codes the single-source build misses. Same shape as CA.

Build — 2026-08-28 (local only, not published)

Built via datasets/mx/scripts/fetch_sepomex.py + build_postal_codes_product.py.

Reconfirmed the download trap from the first pass on a fresh fetch: even fetching all 32 archives strictly serially with --retry 3, one archive (CP_Gro.zip) still came back truncated (4.83 MB) and failed unzip -tqq; a single re-fetch produced a valid 6.09 MB file. Confirms this is not purely a parallelism artifact — every archive must be verified with unzip -tqq regardless of fetch strategy, not just when fetching in parallel.

Results, verified directly against the built file (not assumed from the pre-build estimate):

Recovered rows carry a verified state (unambiguous — one shapefile per state) and an official polygon centroid, but no place_name/admin_name2/ admin_name3 — SEPOMEX's shapefiles carry only d_cp and geometry, no names. Disclosed in data/README.md and data/ATTRIBUTION.txt, not papered over.

admin_code1 derived to ISO 3166-2:MX via a verified crosswalk (Wikipedia, checked 2026-08-28), replacing GeoNames' bare INEGI numbering (01-32). "Distrito Federal" (GeoNames' pre-2016 name) normalised to "Ciudad de México" on output — disclosed correction.

Frictionless validation: valid: True.

Status: built and validated locally only. Nothing published to R2, nothing committed to git.