From d3abe349ba2e3aae62e060e0fb3674201691a8b2 Mon Sep 17 00:00:00 2001 From: Jintao Date: Mon, 27 Jul 2026 08:19:24 +0800 Subject: [PATCH] Pin BusyBox od and hexdump notices --- CHANGELOG.en.md | 11 ++- CHANGELOG.md | 11 ++- Compliance/RootFS/v0.3.3/EVIDENCE.json | 6 +- .../RootFS/v0.3.3/LICENSE-INVENTORY.json | 6 +- .../v0.3.3/LICENSE-NOTICE-CANDIDATES.json | 9 +- .../v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json | 11 +-- .../RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json | 25 +++++- Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json | 53 ++++++++++++ Compliance/RootFS/v0.3.3/NOTICE.md | 6 +- Compliance/RootFS/v0.3.3/README.md | 82 ++++++++++++++----- Compliance/RootFS/v0.3.3/SHA256SUMS | 14 ++-- Docs/ReleaseCompliance.md | 10 +-- Docs/Roadmap.md | 2 +- Docs/RootFS.md | 8 +- Docs/en/ReleaseCompliance.md | 10 +-- Docs/en/Roadmap.md | 2 +- Docs/en/RootFS.md | 8 +- README.md | 2 +- Scripts/rootfs-license-notice-candidates.rb | 2 +- .../rootfs-license-notice-review-results.rb | 2 +- .../RootFSLicenseNoticeCandidatesTests.rb | 61 +++++++++++++- .../RootFSLicenseNoticeReviewResultsTests.rb | 38 +++++++-- .../RootFSLicenseReviewResultsTests.rb | 2 +- 23 files changed, 296 insertions(+), 85 deletions(-) diff --git a/CHANGELOG.en.md b/CHANGELOG.en.md index 73d08a0..52852b1 100644 --- a/CHANGELOG.en.md +++ b/CHANGELOG.en.md @@ -32,17 +32,17 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit declared-license/attribution inventories, and default `apk`, repository, and DNS configuration; complete LICENSE/NOTICE and corresponding-source bundles remain distribution blockers. -- A checksum-bound `LICENSE-REVIEW-RESULTS.json` and strict validator. All 28 +- A checksum-bound `LICENSE-REVIEW-RESULTS.json` and strict validator. All 32 pinned RootFS license/NOTICE candidates have engineering review results; eight source origins retain package-level open items, and legal and redistribution gates remain closed. - A checksum-bound `LICENSE-NOTICE-CANDIDATES.json`, strict validator, and outside-repository atomic materializer for the eight remaining RootFS source origins. It indexes 13 remote license/attribution payloads, 47 aports files, - and the 28 existing evidence files for complete re-verification without + and the 32 existing evidence files for complete re-verification without committing payloads or opening engineering, legal, or redistribution gates. - `LICENSE-NOTICE-REVIEW-RESULTS.json` and a strict external payload-tree - verifier. All 88 candidate payloads now have checksum-bound engineering + verifier. All 92 candidate payloads now have checksum-bound engineering review. The pinned upstream `alpine-keys` GPL-to-MIT license-decision commit is included while its package-level copyright notice remains open. The `ca-certificates` generator is byte-identical to curl commit `3fdc4bdb`, and @@ -55,7 +55,10 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit `util-linux/cal.c`, respectively, while `ping` and `ping6` share `networking/ping.c`, and `traceroute` and `traceroute6` share `networking/traceroute.c`; each retains its complete BSD notice, including - the original BSD/LBL notice for traceroute. Other inline notices stay open; + the original BSD/LBL notice for traceroute. The desktop `od` build includes + `coreutils/od.c` and `coreutils/od_bloaty.c`, while `hexdump` and `hd` share + `util-linux/hexdump.c` and use `libbb/dump.c`, covering the complete Regents + BSD terms, FSF attribution, and GPL declarations. Other inline notices stay open; `apk-tools`, `openssl`, and `pax-utils` have no remaining candidate-material engineering items, five origins still need package-specific material, and diff --git a/CHANGELOG.md b/CHANGELOG.md index 8372924..bf61738 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,15 +30,15 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se 10 个 source origin、SPDX 2.3 JSON SBOM、许可证声明/attribution inventory 和 `apk`、repository、DNS 默认配置快照；完整 LICENSE/NOTICE 与对应源码 bundle 仍保持发行阻塞。 -- 加入 checksum-bound `LICENSE-REVIEW-RESULTS.json` 和严格验证器；28/28 个固定 +- 加入 checksum-bound `LICENSE-REVIEW-RESULTS.json` 和严格验证器；32/32 个固定 RootFS license/NOTICE 候选已完成工程复核，8 个 source origin 仍有包级未决项， 法律与再分发门禁保持关闭。 - 为剩余 8 个 RootFS source origin 加入 checksum-bound `LICENSE-NOTICE-CANDIDATES.json`、严格验证器和仓库外原子 materializer；索引 - 13 份远端许可证/attribution 材料、47 份 aports 文件与 28 份既有证据，支持完整 + 13 份远端许可证/attribution 材料、47 份 aports 文件与 32 份既有证据，支持完整 复验，但不提交 payload，也不解除工程、法律或再分发门禁。 - 加入 `LICENSE-NOTICE-REVIEW-RESULTS.json` 和严格外置 payload-tree 复验器； - 88/88 个候选 payload 已完成 checksum-bound 工程复核；新增固定 + 92/92 个候选 payload 已完成 checksum-bound 工程复核；新增固定 `alpine-keys` GPL→MIT 上游许可判定提交，但仍保留包级版权声明缺口； `ca-certificates` 生成脚本与 curl 提交 `3fdc4bdb` 字节一致并固定该精确 revision 的 curl 授权文本，trust-store 审查仍保持未决； @@ -48,7 +48,10 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se `coreutils/env.c`、`coreutils/echo.c`、`sysklogd/logger.c` 与 `util-linux/cal.c`，`ping` 与 `ping6` 共同链入 `networking/ping.c`， `traceroute` 与 `traceroute6` 共同链入保留完整原始 BSD/LBL notice 的 - `networking/traceroute.c`；其他内联第三方 notices 继续保持未决； + `networking/traceroute.c`；`od` 的 desktop 构建链入 `coreutils/od.c` 与 + `coreutils/od_bloaty.c`，`hexdump`/`hd` 共同链入 `util-linux/hexdump.c` + 并使用 `libbb/dump.c`，覆盖完整 Regents BSD 条款、FSF attribution 与 GPL + 声明；其他内联第三方 notices 继续保持未决； `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项关闭，另外 5 个 origin 仍需补逐包材料，法律和再分发门禁保持关闭。 - RootFS source-review materializer 新增严格仓库外下载缓存输入；缓存只替代网络 diff --git a/Compliance/RootFS/v0.3.3/EVIDENCE.json b/Compliance/RootFS/v0.3.3/EVIDENCE.json index e3d5034..184c1db 100644 --- a/Compliance/RootFS/v0.3.3/EVIDENCE.json +++ b/Compliance/RootFS/v0.3.3/EVIDENCE.json @@ -39,13 +39,13 @@ "sourceOrigins": 10, "declaredLicenseExpressions": 7, "licenseOrNoticeFilesInGuestTemplate": 0, - "indexedExternalLicenseReviewCandidates": 28, - "engineeringReviewedLicenseCandidates": 28, + "indexedExternalLicenseReviewCandidates": 32, + "engineeringReviewedLicenseCandidates": 32, "sourceOriginsWithRemainingLicenseReviewItems": 8, "indexedLicenseNoticeCandidateOrigins": 8, "pinnedRemoteLicenseNoticePayloads": 13, "supplementalAportsCandidateFiles": 47, - "engineeringReviewedLicenseNoticeCandidatePayloads": 88, + "engineeringReviewedLicenseNoticeCandidatePayloads": 92, "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5 }, "engineeringStatus": { diff --git a/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json b/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json index bd5cd97..e886667 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json @@ -26,14 +26,14 @@ "licenseOrNoticeFilesFoundInGuestTemplate": [ ], - "indexedExternalReviewCandidates": 28, - "engineeringReviewedCandidates": 28, + "indexedExternalReviewCandidates": 32, + "engineeringReviewedCandidates": 32, "sourceOriginsWithOpenReviewItems": 10, "sourceOriginsWithRemainingReviewItems": 8, "indexedOpenSourceOrigins": 8, "pinnedRemoteReferencePayloads": 13, "supplementalAportsFiles": 47, - "engineeringReviewedCandidatePayloads": 88, + "engineeringReviewedCandidatePayloads": 92, "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5, "candidateBundleIndexComplete": true, "candidatePayloadCommitted": false, diff --git a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json index 5fcd706..aeebb53 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json @@ -4,7 +4,7 @@ "version": "v0.3.3", "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4" }, - "licenseReviewResultsSha256": "3429e1b5bc26cdad403ba93b41b3dcab2f5f2f35237ed1facea4cb08e53add35", + "licenseReviewResultsSha256": "e3ad43e944b822f46cfe74a6769b5bd70ea774d2010bb4b3be85d567e63f590e", "status": "candidate-bundle-indexed-engineering-review-required", "candidateBundleIndexComplete": true, "candidatePayloadCommitted": false, @@ -252,7 +252,11 @@ "evidence/busybox/sysklogd-logger.c", "evidence/busybox/util-linux-cal.c", "evidence/busybox/networking-ping.c", - "evidence/busybox/networking-traceroute.c" + "evidence/busybox/networking-traceroute.c", + "evidence/busybox/coreutils-od.c", + "evidence/busybox/coreutils-od_bloaty.c", + "evidence/busybox/util-linux-hexdump.c", + "evidence/busybox/libbb-dump.c" ], "referenceLicensePaths": [ "licenses/GPL-2.0.txt" @@ -306,6 +310,7 @@ "confirm-enabled-cal-license-and-attribution-coverage", "confirm-enabled-ping-and-ping6-license-and-attribution-coverage", "confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage", + "confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage", "review-other-bundled-third-party-license-and-attribution-coverage", "confirm-aports-patch-notices" ], diff --git a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json index 2622c1c..b666fec 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json @@ -4,7 +4,7 @@ "version": "v0.3.3", "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4" }, - "candidateManifestSha256": "510ce077842f2b0aa9c8c4cba3a9f1081a9e1fbc8737e1f925edb450a07aedd5", + "candidateManifestSha256": "7fd00f5f3e980fc8590100ee27ed122c65fec0dd1102d0f18268cfe27ccc852b", "status": "candidate-payloads-engineering-reviewed-open-release-gates", "engineeringReviewCompleted": true, "allIndexedCandidatePayloadsReviewed": true, @@ -13,8 +13,8 @@ "legalReviewApproved": false, "redistributionApproved": false, "candidatePayloadTreeFormat": "sha256-path-lines-v1", - "candidatePayloadTreeSha256": "2ae03e59319bc9519212ab6505793882c08f9223c097cfe5d9f040244b6b5eef", - "reviewedPayloadFileCount": 88, + "candidatePayloadTreeSha256": "80c88a9327ce6df178fb3d9dc0c6def2b80a27b270b83c93b2861bd13cb558e5", + "reviewedPayloadFileCount": 92, "reviewedClosedOriginEvidenceCount": 4, "sourceOriginsWithRemainingReviewItems": 5, "sources": [ @@ -82,7 +82,7 @@ "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open", "licenseTextCoverage": "partial", "attributionCoverage": "partial", - "reviewedExistingEvidenceCount": 10, + "reviewedExistingEvidenceCount": 14, "reviewedReferenceLicenseCount": 1, "reviewedSupplementalAportsCount": 37, "reviewedRemoteEvidenceCount": 0, @@ -95,7 +95,8 @@ "confirm-enabled-logger-license-and-attribution-coverage", "confirm-enabled-cal-license-and-attribution-coverage", "confirm-enabled-ping-and-ping6-license-and-attribution-coverage", - "confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage" + "confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage", + "confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage" ], "remainingReviewItems": [ "review-other-bundled-third-party-license-and-attribution-coverage" diff --git a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json index b0588f0..5fdeb21 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json @@ -4,11 +4,11 @@ "version": "v0.3.3", "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4" }, - "licenseReviewManifestSha256": "0e8f1a98d638a87d01116c3323b293bdc8a2f31c9e06be251793041e4f24fcce", + "licenseReviewManifestSha256": "bf7ddbfae242c3a5fc5de1dfc735ef8a0cf732f251fa63aabd6c9ebc8be35547", "status": "engineering-reviewed-open-release-gates", "engineeringReviewCompleted": true, "allCandidateDigestsVerified": true, - "reviewedCandidateCount": 28, + "reviewedCandidateCount": 32, "sourceOriginsWithRemainingReviewItems": 8, "completeLicenseTextBundlePresent": false, "completePackageNoticeSetPresent": false, @@ -139,6 +139,26 @@ "outputPath": "evidence/busybox/networking-traceroute.c", "sha256": "c75965e8ad6670e92ed1c4c116141a51cb78d77e3e47286e4527514bf8b1c229", "conclusion": "inline-license-and-attribution-notice" + }, + { + "outputPath": "evidence/busybox/coreutils-od.c", + "sha256": "8536f85598a87c49db70a583d9c40004719e64b4939e1d58bcbe30e1e8c5417a", + "conclusion": "inline-license-and-attribution-notice" + }, + { + "outputPath": "evidence/busybox/coreutils-od_bloaty.c", + "sha256": "eb4ae669c359554eac9dcbac2f7625fb5413b34a76ded366a1ec13e47a729b62", + "conclusion": "license-header-and-attribution" + }, + { + "outputPath": "evidence/busybox/util-linux-hexdump.c", + "sha256": "97e49fc1c02560fd65443a7eafbcfbeab44267f3146e0efa1738ae902d69de84", + "conclusion": "license-header-and-attribution" + }, + { + "outputPath": "evidence/busybox/libbb-dump.c", + "sha256": "a1c705a48bd6eb43b4cb9cfb74d61f47f8500b601ebd9d3502906093f7c8ddfe", + "conclusion": "inline-license-and-attribution-notice" } ], "resolvedReviewItems": [], @@ -151,6 +171,7 @@ "confirm-enabled-cal-license-and-attribution-coverage", "confirm-enabled-ping-and-ping6-license-and-attribution-coverage", "confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage", + "confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage", "review-other-bundled-third-party-license-and-attribution-coverage", "confirm-aports-patch-notices" ] diff --git a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json index f3d9da9..f146d6c 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json @@ -243,6 +243,58 @@ "attribution" ], "reviewState": "unreviewed-candidate" + }, + { + "sourceKind": "distfile-member", + "distfile": "busybox-1.36.1.tar.bz2", + "member": "busybox-1.36.1/coreutils/od.c", + "outputPath": "evidence/busybox/coreutils-od.c", + "byteCount": 6634, + "sha256": "8536f85598a87c49db70a583d9c40004719e64b4939e1d58bcbe30e1e8c5417a", + "evidenceKinds": [ + "inline-license-notice", + "attribution" + ], + "reviewState": "unreviewed-candidate" + }, + { + "sourceKind": "distfile-member", + "distfile": "busybox-1.36.1.tar.bz2", + "member": "busybox-1.36.1/coreutils/od_bloaty.c", + "outputPath": "evidence/busybox/coreutils-od_bloaty.c", + "byteCount": 37473, + "sha256": "eb4ae669c359554eac9dcbac2f7625fb5413b34a76ded366a1ec13e47a729b62", + "evidenceKinds": [ + "license-declaration", + "attribution" + ], + "reviewState": "unreviewed-candidate" + }, + { + "sourceKind": "distfile-member", + "distfile": "busybox-1.36.1.tar.bz2", + "member": "busybox-1.36.1/util-linux/hexdump.c", + "outputPath": "evidence/busybox/util-linux-hexdump.c", + "byteCount": 4392, + "sha256": "97e49fc1c02560fd65443a7eafbcfbeab44267f3146e0efa1738ae902d69de84", + "evidenceKinds": [ + "license-declaration", + "attribution" + ], + "reviewState": "unreviewed-candidate" + }, + { + "sourceKind": "distfile-member", + "distfile": "busybox-1.36.1.tar.bz2", + "member": "busybox-1.36.1/libbb/dump.c", + "outputPath": "evidence/busybox/libbb-dump.c", + "byteCount": 22017, + "sha256": "a1c705a48bd6eb43b4cb9cfb74d61f47f8500b601ebd9d3502906093f7c8ddfe", + "evidenceKinds": [ + "inline-license-notice", + "attribution" + ], + "reviewState": "unreviewed-candidate" } ], "openReviewItems": [ @@ -254,6 +306,7 @@ "confirm-enabled-cal-license-and-attribution-coverage", "confirm-enabled-ping-and-ping6-license-and-attribution-coverage", "confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage", + "confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage", "review-other-bundled-third-party-license-and-attribution-coverage", "confirm-aports-patch-notices" ] diff --git a/Compliance/RootFS/v0.3.3/NOTICE.md b/Compliance/RootFS/v0.3.3/NOTICE.md index 9939029..d799ea6 100644 --- a/Compliance/RootFS/v0.3.3/NOTICE.md +++ b/Compliance/RootFS/v0.3.3/NOTICE.md @@ -33,12 +33,12 @@ Generated from the exact `v0.3.3` archive with SHA-256 No file whose path identifies it as LICENSE, COPYING, NOTICE, or a license-directory member was found in the guest template. Declared identifiers and expressions are recorded in -`LICENSE-INVENTORY.json`. `LICENSE-REVIEW.json` pins 28 +`LICENSE-INVENTORY.json`. `LICENSE-REVIEW.json` pins 32 candidate license, attribution, declaration, and inline-notice files across all 10 source origins. The external review tool extracts and verifies those candidates from the pinned source-review bundle. `LICENSE-REVIEW-RESULTS.json` records the checksum-bound engineering review -of all 28 candidates. All indexed review items are resolved +of all 32 candidates. All indexed review items are resolved for `libc-dev`, `zlib`. 8 source origins still have package-specific open items, so this is not a complete or legally approved license/NOTICE bundle. @@ -49,7 +49,7 @@ reference/attribution payloads and files, together with all checksum-bound reviewed evidence. The repository tool can materialize and re-verify that bundle outside the repository. `LICENSE-NOTICE-REVIEW-RESULTS.json` records checksum-bound engineering -review of all 88 indexed +review of all 92 indexed payload files. 3 origins have no remaining candidate-material engineering items; 5 origins still require package-specific material. Legal review and redistribution diff --git a/Compliance/RootFS/v0.3.3/README.md b/Compliance/RootFS/v0.3.3/README.md index 2a197ef..dfe1ba3 100644 --- a/Compliance/RootFS/v0.3.3/README.md +++ b/Compliance/RootFS/v0.3.3/README.md @@ -16,14 +16,14 @@ pinned RootFS archive. It does not store the RootFS payload. SHA-256； - `LICENSE-INVENTORY.json`：声明的许可证表达式、标识符和 archive 内 license/notice 文件检查结果； -- `LICENSE-REVIEW.json`：覆盖 10 个 source origin 的 28 个候选许可证文本、 +- `LICENSE-REVIEW.json`：覆盖 10 个 source origin 的 32 个候选许可证文本、 attribution、声明与内联 notice 的路径、大小、SHA-256 和逐包未决审查项； -- `LICENSE-REVIEW-RESULTS.json`：对全部 28 个候选的 checksum-bound 工程复核 +- `LICENSE-REVIEW-RESULTS.json`：对全部 32 个候选的 checksum-bound 工程复核 结论、coverage 和未决项处置；不表示法律或再分发批准； - `LICENSE-NOTICE-CANDIDATES.json`：为剩余 8 个 source origin 固定 13 份远端 - 许可证/attribution 材料、47 份 aports 补充文件及现有 28 份复核证据的外置候选包； + 许可证/attribution 材料、47 份 aports 补充文件及现有 32 份复核证据的外置候选包； payload 不提交，工程、法律和再分发门禁保持关闭； -- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 88 个 payload 文件树的 +- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 92 个 payload 文件树的 工程复核结果；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，法律和 再分发门禁保持关闭； - `RUNTIME-CONFIGURATION.json`：guest、`apk`、repository、world 和 DNS 默认配置； @@ -34,15 +34,15 @@ pinned RootFS archive. It does not store the RootFS payload. `SOURCE-ACQUISITION.json` pins the aports snapshots and upstream distfiles needed to assemble an external source-review directory. It is an acquisition manifest, not a committed source archive or redistribution grant. -`LICENSE-REVIEW.json` pins 28 unreviewed candidate evidence files across all +`LICENSE-REVIEW.json` pins 32 unreviewed candidate evidence files across all 10 source origins; it is an engineering review index, not legal approval. -`LICENSE-REVIEW-RESULTS.json` records the engineering review of all 28 pinned +`LICENSE-REVIEW-RESULTS.json` records the engineering review of all 32 pinned candidates. Two source origins have no remaining indexed review items; eight still have package-specific open items. `LICENSE-NOTICE-CANDIDATES.json` indexes an external candidate bundle for those eight origins: 13 pinned remote license/attribution payloads, 47 supplemental aports files, and the existing -28 reviewed evidence files. `LICENSE-NOTICE-REVIEW-RESULTS.json` binds the -engineering review to the exact 88-file payload tree. Three origins have no +32 reviewed evidence files. `LICENSE-NOTICE-REVIEW-RESULTS.json` binds the +engineering review to the exact 92-file payload tree. Three origins have no remaining candidate-material engineering items; five still require package-specific material. Legal and redistribution approval remain open. @@ -82,7 +82,8 @@ change. `CONFIG_LOGGER=y`、`CONFIG_CAL=y`、`CONFIG_PING=y`、`CONFIG_PING6=y`、 `CONFIG_FEATURE_FANCY_PING=y`、`CONFIG_TRACEROUTE=y`、 `CONFIG_TRACEROUTE6=y`、`CONFIG_FEATURE_TRACEROUTE_VERBOSE=y` 和 -`CONFIG_FEATURE_TRACEROUTE_USE_ICMP=y`；BusyBox +`CONFIG_FEATURE_TRACEROUTE_USE_ICMP=y`，以及 `CONFIG_DESKTOP=y`、 +`CONFIG_OD=y`、`CONFIG_HEXDUMP=y` 和 `CONFIG_HD=y`；BusyBox `shell/Kbuild.src` 在该配置下把 `math.o` 链入构建，`coreutils/env.c` 与 `coreutils/echo.c` 则分别通过 `lib-$(CONFIG_ENV) += env.o` 和 `lib-$(CONFIG_ECHO) += echo.o` 链入，`sysklogd/logger.c` 通过 @@ -92,7 +93,11 @@ change. 链入，`networking/traceroute.c` 同时通过 `lib-$(CONFIG_TRACEROUTE) += traceroute.o` 与 `lib-$(CONFIG_TRACEROUTE6) += traceroute.o` -链入。外置候选树现同时绑定该 +链入；`coreutils/od.c` 通过 `lib-$(CONFIG_OD) += od.o` 链入，并在 +`ENABLE_DESKTOP` 分支直接包含 `coreutils/od_bloaty.c`； +`util-linux/hexdump.c` 通过 `CONFIG_HEXDUMP` 与 `CONFIG_HD` 两条规则链入， +并调用由 `libbb/Kbuild.src` 的 `lib-y += dump.o` 提供的 `libbb/dump.c`。 +外置候选树现同时绑定该 配置与固定 BusyBox 1.36.1 源包中的 1,999 字节 `archival/libarchive/bz/LICENSE`（SHA-256 @@ -141,6 +146,23 @@ payload 树中；它只修改 socket/runtime 代码，不触及文件头或文 工程层关闭 `confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage`。 这只是证据完备性结论，不判断 advertising 条款与产品发行方案的法律兼容性。 +同时绑定 6,634 字节 `coreutils/od.c`（SHA-256 +`8536f85598a87c49db70a583d9c40004719e64b4939e1d58bcbe30e1e8c5417a`）、 +37,473 字节 `coreutils/od_bloaty.c`（SHA-256 +`eb4ae669c359554eac9dcbac2f7625fb5413b34a76ded366a1ec13e47a729b62`）、 +4,392 字节 `util-linux/hexdump.c`（SHA-256 +`97e49fc1c02560fd65443a7eafbcfbeab44267f3146e0efa1738ae902d69de84`）和 +22,017 字节 `libbb/dump.c`（SHA-256 +`a1c705a48bd6eb43b4cb9cfb74d61f47f8500b601ebd9d3502906093f7c8ddfe`）。 +`od.c` 与 `dump.c` 保留完整 Regents BSD-3-Clause 条款， +`od_bloaty.c` 保留 FSF 版权、GPLv2-or-later 声明与免责声明， +`hexdump.c` 保留 Regents attribution 和 GPLv2-or-later 声明。固定 aports +补丁集没有修改这四个文件；固定 RootFS 主树与 guest 模板树中的 +`/usr/bin/od`、`/usr/bin/hexdump` 和 `/usr/bin/hd` 均指向 +`/bin/busybox`，因此在工程层关闭 +`confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage`。 +这只确认精确源码与 notice 证据完整，不判断 GPL 版本选择、组合或发行方案的 +法律兼容性。 BusyBox 其他已启用 组件的内联第三方 notice 尚未形成完整集合，因此 license-text 与 attribution coverage 均保持 partial， @@ -157,7 +179,8 @@ It explicitly enables `CONFIG_BZIP2=y`, `CONFIG_BZIP2_SMALL=8`, `CONFIG_CAL=y`, `CONFIG_PING=y`, `CONFIG_PING6=y`, `CONFIG_FEATURE_FANCY_PING=y`, `CONFIG_TRACEROUTE=y`, `CONFIG_TRACEROUTE6=y`, `CONFIG_FEATURE_TRACEROUTE_VERBOSE=y`, and -`CONFIG_FEATURE_TRACEROUTE_USE_ICMP=y`; BusyBox +`CONFIG_FEATURE_TRACEROUTE_USE_ICMP=y`, plus `CONFIG_DESKTOP=y`, +`CONFIG_OD=y`, `CONFIG_HEXDUMP=y`, and `CONFIG_HD=y`; BusyBox `shell/Kbuild.src` links `math.o` under that configuration, while `coreutils/env.c` and `coreutils/echo.c` are linked by `lib-$(CONFIG_ENV) += env.o` and `lib-$(CONFIG_ECHO) += echo.o`, @@ -167,7 +190,11 @@ linked through `lib-$(CONFIG_CAL) += cal.o`; `networking/ping.c` is linked through both `lib-$(CONFIG_PING) += ping.o` and `lib-$(CONFIG_PING6) += ping.o`; `networking/traceroute.c` is linked through both `lib-$(CONFIG_TRACEROUTE) += traceroute.o` and -`lib-$(CONFIG_TRACEROUTE6) += traceroute.o`. The external candidate tree +`lib-$(CONFIG_TRACEROUTE6) += traceroute.o`; `coreutils/od.c` is linked by +`lib-$(CONFIG_OD) += od.o` and directly includes `coreutils/od_bloaty.c` under +`ENABLE_DESKTOP`; `util-linux/hexdump.c` is linked by both `CONFIG_HEXDUMP` +and `CONFIG_HD` and calls the `libbb/dump.c` implementation supplied by +`lib-y += dump.o` in `libbb/Kbuild.src`. The external candidate tree now binds that configuration to the 1,999-byte `archival/libarchive/bz/LICENSE` in the pinned BusyBox 1.36.1 source archive, @@ -223,7 +250,24 @@ RootFS trees map `/usr/bin/traceroute` and `/usr/bin/traceroute6` to `confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage` at the engineering level. This is an evidence-completeness conclusion, not a legal compatibility determination for the advertising condition or product -distribution plan. A complete set of inline third-party notices for BusyBox's other +distribution plan. It also binds the 6,634-byte `coreutils/od.c` with SHA-256 +`8536f85598a87c49db70a583d9c40004719e64b4939e1d58bcbe30e1e8c5417a`, +the 37,473-byte `coreutils/od_bloaty.c` with SHA-256 +`eb4ae669c359554eac9dcbac2f7625fb5413b34a76ded366a1ec13e47a729b62`, +the 4,392-byte `util-linux/hexdump.c` with SHA-256 +`97e49fc1c02560fd65443a7eafbcfbeab44267f3146e0efa1738ae902d69de84`, +and the 22,017-byte `libbb/dump.c` with SHA-256 +`a1c705a48bd6eb43b4cb9cfb74d61f47f8500b601ebd9d3502906093f7c8ddfe`. +`od.c` and `dump.c` retain complete Regents BSD-3-Clause terms; +`od_bloaty.c` retains the FSF copyright, GPLv2-or-later declaration, and +disclaimer; `hexdump.c` retains the Regents attribution and GPLv2-or-later +declaration. The pinned aports patch set does not modify these four files, and +both the main and guest-template RootFS trees map `/usr/bin/od`, +`/usr/bin/hexdump`, and `/usr/bin/hd` to `/bin/busybox`, closing +`confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage` at the +engineering level. This confirms exact source and notice evidence only; it +does not determine the legal compatibility of GPL version selection, +combination, or the distribution plan. A complete set of inline third-party notices for BusyBox's other enabled components is still missing, so license-text and attribution coverage remain partial, `review-other-bundled-third-party-license-and-attribution-coverage` remains @@ -402,13 +446,13 @@ ruby Scripts/rootfs-license-review-results.rb ``` 工具只提取 `LICENSE-REVIEW.json` 固定的候选文件，并再次核对大小、SHA-256、 -路径全集、无符号链接/特殊节点边界。结果清单证明 28 个候选已完成工程复核； +路径全集、无符号链接/特殊节点边界。结果清单证明 32 个候选已完成工程复核； 外置输出仍不是可直接随产品发行的 NOTICE bundle。 The tool extracts only candidates pinned by `LICENSE-REVIEW.json`, then rechecks byte counts, SHA-256 digests, the exact path set, and the no-symlink/ special-node boundary. The results manifest proves engineering review of all -28 candidates; the external output is still not a product-ready NOTICE bundle. +32 candidates; the external output is still not a product-ready NOTICE bundle. 剩余 8 个 source origin 的材料可继续组装为外置候选包。先校验清单；实际物化 必须同时提供已经通过 `--verify` 的 source-review 和 license-review 目录，以及 @@ -452,8 +496,8 @@ advice, or redistribution approval. 这些文件不构成完整第三方 LICENSE/NOTICE bundle、经审查的 copyleft corresponding-source 交付、法律意见或再分发授权。源码获取清单已完整覆盖固定 -inventory，28 个候选也都有工程复核结果；`libc-dev`、`zlib` 已关闭索引项，另外 -8 个 source origin 的 88 个新候选 payload 已完成 checksum-bound 工程复核； +inventory，32 个候选也都有工程复核结果；`libc-dev`、`zlib` 已关闭索引项，另外 +8 个 source origin 的 92 个新候选 payload 已完成 checksum-bound 工程复核； `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个 origin 仍需补逐包版权/notice 材料。修改说明、构建完整性、源码提供方式、法律 审查、App Store 2.5.2 产品策略和负责人批准仍是发行阻塞项。 @@ -461,8 +505,8 @@ origin 仍需补逐包版权/notice 材料。修改说明、构建完整性、 These files are not a complete third-party LICENSE/NOTICE bundle, reviewed copyleft corresponding-source delivery, legal advice, or redistribution approval. The acquisition manifest completely covers the pinned inventory and -all 28 indexed candidates have engineering review results. `libc-dev` and -`zlib` have no remaining indexed items. All 88 newly indexed payloads have a +all 32 indexed candidates have engineering review results. `libc-dev` and +`zlib` have no remaining indexed items. All 92 newly indexed payloads have a checksum-bound engineering review; `apk-tools`, `openssl`, and `pax-utils` have no remaining candidate-material engineering items, while five origins still need package-specific copyright/notice material. Modification, build diff --git a/Compliance/RootFS/v0.3.3/SHA256SUMS b/Compliance/RootFS/v0.3.3/SHA256SUMS index a752361..9f29395 100644 --- a/Compliance/RootFS/v0.3.3/SHA256SUMS +++ b/Compliance/RootFS/v0.3.3/SHA256SUMS @@ -1,10 +1,10 @@ -41e7fd212775fbd0e76a4f054f46e255b7edb38cfeed3c1e989b033cc14069da EVIDENCE.json -d0be3aaf5d16d0854fbf0898f7d035f5d891089c887aef2a3b2fa4a94aa81a0a LICENSE-INVENTORY.json -510ce077842f2b0aa9c8c4cba3a9f1081a9e1fbc8737e1f925edb450a07aedd5 LICENSE-NOTICE-CANDIDATES.json -1d7b7d86ddb727b07bd33c516263e16fb2fdd4b78ee6b08de351a53bea6c750b LICENSE-NOTICE-REVIEW-RESULTS.json -3429e1b5bc26cdad403ba93b41b3dcab2f5f2f35237ed1facea4cb08e53add35 LICENSE-REVIEW-RESULTS.json -0e8f1a98d638a87d01116c3323b293bdc8a2f31c9e06be251793041e4f24fcce LICENSE-REVIEW.json -207c957bd1065fdcbf6bda2c1cd759929209590dc01a8c583b9b979e4d3098b3 NOTICE.md +29db1a51a7971e98ba3c4f14552eadcd5b1ef14e5b57234d2a315f8604ec25d4 EVIDENCE.json +49d5db8a83e90b71cc3458a16967c89ae6551c9215f07d37f317c45be9068565 LICENSE-INVENTORY.json +7fd00f5f3e980fc8590100ee27ed122c65fec0dd1102d0f18268cfe27ccc852b LICENSE-NOTICE-CANDIDATES.json +095fcfb99e1083c64922f04f98286223363d0f33566cf284abae7c6ae2a484ac LICENSE-NOTICE-REVIEW-RESULTS.json +e3ad43e944b822f46cfe74a6769b5bd70ea774d2010bb4b3be85d567e63f590e LICENSE-REVIEW-RESULTS.json +bf7ddbfae242c3a5fc5de1dfc735ef8a0cf732f251fa63aabd6c9ebc8be35547 LICENSE-REVIEW.json +6211466dab0490f3b9ee7d3c4703fe0dfca7eac33c5628df2d330c0c09a92a29 NOTICE.md 4f7f7626f3d0891a29717e4b7932c36004ecc9aac25a4aa104c300aae979e3e1 PACKAGE-INVENTORY.tsv dbca9b285015a0d8b1d339a894b4594c9e335cbc2d7f9d5212a41095ae4bd1e1 RUNTIME-CONFIGURATION.json 8e021cb8c4160c934a0202609691d7a94526cd016f4394a47da6e7a5ab41d0ea SBOM.spdx.json diff --git a/Docs/ReleaseCompliance.md b/Docs/ReleaseCompliance.md index 439e988..61451ec 100644 --- a/Docs/ReleaseCompliance.md +++ b/Docs/ReleaseCompliance.md @@ -72,12 +72,12 @@ machine-readable SBOM。仓库现在从固定 archive 可复现生成 15 个已 `apk`、repository、DNS 默认配置快照。archive 内没有发现可识别的 LICENSE/COPYING/NOTICE 文件。仓库另有与 inventory 一一对应、固定 checksum 的 aports snapshot/upstream distfile 获取清单和仓库外 materializer，并固定了覆盖 -全部 10 个 source origin 的 28 个 license、attribution、声明与内联 notice 候选。 +全部 10 个 source origin 的 32 个 license、attribution、声明与内联 notice 候选。 第二个仓库外工具从已验证 source-review 目录提取这些候选；固定结果清单记录 -28/28 个候选均已工程复核，`libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source +32/32 个候选均已工程复核，`libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source origin 仍有逐包未决项。仓库现已为这 8 个 origin 固定外置候选包：13 份远端 许可证/attribution 材料、47 份 aports 补充文件和全部既有复核证据；工具可在 -仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 88 文件 payload +仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 92 文件 payload tree；`apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个 origin 仍需补逐包材料。修改与构建完整性、源码提供方式和法律审查仍未完成， 不能视为完整 NOTICE 或已批准的对应源码交付。 @@ -176,10 +176,10 @@ Alpine `apk` 可以下载、安装和执行新增代码。即使初始 RootFS - [x] 从固定 APK database 生成完整 package inventory。 - [x] 生成并通过 SPDX 2.3 JSON schema 校验的 machine-readable SBOM。 -- [x] 对固定的 28 个 license/NOTICE 候选完成 checksum-bound 工程复核。 +- [x] 对固定的 32 个 license/NOTICE 候选完成 checksum-bound 工程复核。 - [x] 为剩余 8 个 source origin 建立 checksum-bound 外置候选包索引与可复验 materializer；payload 不提交且批准门禁保持关闭。 -- [x] 对外置候选包的 88 个 payload 完成 checksum-bound 工程复核并固定结果； +- [x] 对外置候选包的 92 个 payload 完成 checksum-bound 工程复核并固定结果； 3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料。 - [ ] 收集 license text 和 NOTICE。 - [ ] 建立 copyleft corresponding source bundle。 diff --git a/Docs/Roadmap.md b/Docs/Roadmap.md index 6503c5e..ddf7838 100644 --- a/Docs/Roadmap.md +++ b/Docs/Roadmap.md @@ -103,7 +103,7 @@ | 最低 Xcode 16 原生兼容 | 已通过 | Xcode 16.0 / iOS 18.0 SDK 完成 RootFS install、Simulator/device final-link 和 17 项 native smoke | | App lifecycle 与内存 | 进行中 | Simulator 与 Jack iPhone 均有 256 MiB `ru_maxrss` 门禁；真机 process suspend/resume、UIKit foreground/background、强制终止后数据恢复和有界 App delegate memory-warning 回调恢复已通过；补真实 memory pressure/jetsam | | RootFS ENOSPC/掉电 | 进行中 | 峰值空间预检、全 ENOSPC、七点持久化屏障、确定性掉电切点和 Jack iPhone 受限容量/ENOSPC 清理恢复已覆盖；补真实 storage pressure/强制断电 | -| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、28/28 初始候选和 88/88 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 | +| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、32/32 初始候选和 92/92 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 | | App Store 2.5.2 | 阻塞 | guest download/execute policy 有书面结论 | ### 后续 runtime 执行顺序 diff --git a/Docs/RootFS.md b/Docs/RootFS.md index e8a75e2..ba1921a 100644 --- a/Docs/RootFS.md +++ b/Docs/RootFS.md @@ -5,7 +5,7 @@ RootFS 是 PocketRoot 的外部供应链输入，不是普通测试 fixture。仓库提交的是不可变清单、校验和安全安装代码，不提交、镜像或默认打包 RootFS 二进制。 > [!WARNING] -> 固定 v0.3.3 归档已有可复现 package inventory、SPDX SBOM、默认配置证据、完整覆盖 inventory 的源码获取清单，以及 28 个初始候选和 88 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核结果；3 个 origin 的候选材料工程项已关闭，5 个仍需补逐包材料。完整 NOTICE、法律复核、对应源码交付审查与发行批准尚未闭环。以下 URL 与命令用于审计和本地开发，不构成公开再分发授权。应用必须先完成自己的法律与发行审查。 +> 固定 v0.3.3 归档已有可复现 package inventory、SPDX SBOM、默认配置证据、完整覆盖 inventory 的源码获取清单，以及 32 个初始候选和 92 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核结果；3 个 origin 的候选材料工程项已关闭，5 个仍需补逐包材料。完整 NOTICE、法律复核、对应源码交付审查与发行批准尚未闭环。以下 URL 与命令用于审计和本地开发，不构成公开再分发授权。应用必须先完成自己的法律与发行审查。 ## 1. 固定清单 @@ -118,7 +118,7 @@ receipt schema v2 强制包含该模式。旧 v1 source-review 的传输来源 规范化 aports 目录身份覆盖条目类型、路径、普通文件权限位和内容摘要；物化时会保留 这些权限位，`--verify` 会再次校验。 -在 source-review 目录验证通过后，可把固定的 28 个候选许可证/attribution 文件 +在 source-review 目录验证通过后，可把固定的 32 个候选许可证/attribution 文件 提取到另一个仓库外目录： ```bash @@ -139,7 +139,7 @@ ruby Scripts/rootfs-license-review-results.rb `APKBUILD`；`--verify` 会复核普通文件摘要、目录集合和符号链接目标。脚本不向 App、 Git 或 CI artifact 自动添加输出。这完成的是可复现的工程获取流程。archive 内没有 随附可识别的 LICENSE/COPYING/NOTICE 文件。候选工具会核对提取文件的大小、 -SHA-256、精确路径集合与无链接/特殊节点边界。固定结果清单记录 28/28 个候选均已 +SHA-256、精确路径集合与无链接/特殊节点边界。固定结果清单记录 32/32 个候选均已 工程复核，其中 `libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source origin 仍有 未决项；输出不能直接视为完整 NOTICE 或对应源码交付材料。 @@ -167,7 +167,7 @@ ruby Scripts/rootfs-license-notice-review-results.rb \ ``` 工具对远端材料强制 HTTPS、重定向次数、响应大小、固定字节数与 SHA-256，并原子 -创建输出。结果清单把工程复核绑定到精确的 88 文件 payload tree；复验器拒绝路径 +创建输出。结果清单把工程复核绑定到精确的 92 文件 payload tree；复验器拒绝路径 漂移、符号链接、特殊节点、已知摘要漂移和 tree digest 漂移。`apk-tools`、 `openssl` 与 `pax-utils` 的候选材料工程项已关闭，另外 5 个 origin 仍需补逐包 材料；候选 NOTICE 和 receipt 不代表法律审查或发行批准。 diff --git a/Docs/en/ReleaseCompliance.md b/Docs/en/ReleaseCompliance.md index 8d742ce..8f7cc33 100644 --- a/Docs/en/ReleaseCompliance.md +++ b/Docs/en/ReleaseCompliance.md @@ -36,15 +36,15 @@ the default `apk`, repository, and DNS snapshot. No identifiable LICENSE/COPYING/NOTICE file was found in the archive. A checksum-pinned aports-snapshot/upstream-distfile manifest covers the inventory, and an outside-repository materializer creates reproducible review inputs. A second -outside-repository tool pins, extracts, and verifies 28 license, attribution, +outside-repository tool pins, extracts, and verifies 32 license, attribution, declaration, and inline-notice candidates across all 10 source origins. -A pinned result manifest records engineering review of all 28 candidates. +A pinned result manifest records engineering review of all 32 candidates. `libc-dev` and `zlib` have no remaining indexed items; eight source origins still have package-level follow-up. The repository now pins an external candidate bundle for those origins: 13 remote license/attribution payloads, 47 supplemental aports files, and all existing reviewed evidence. The tool can atomically materialize and re-verify it outside the repository. A pinned -results manifest binds engineering review to the exact 88-file payload tree. +results manifest binds engineering review to the exact 92-file payload tree. `apk-tools`, `openssl`, and `pax-utils` have no remaining candidate-material engineering items; five origins still need package-specific material. Modification, build-completeness, source-offer, and legal reviews remain unresolved, so the @@ -117,12 +117,12 @@ The current code does not provide a complete product-level privacy policy. - [x] Generate a complete inventory from the pinned APK database. - [x] Generate a machine-readable SBOM validated against the SPDX 2.3 JSON schema. -- [x] Complete checksum-bound engineering review of all 28 pinned +- [x] Complete checksum-bound engineering review of all 32 pinned license/NOTICE candidates. - [x] Index a checksum-bound external candidate bundle and reproducible materializer for the eight remaining origins; payloads stay uncommitted and approval gates stay closed. -- [x] Complete checksum-bound engineering review of all 88 external candidate +- [x] Complete checksum-bound engineering review of all 92 external candidate payloads; three origins have no remaining candidate-material engineering items and five still need package-specific material. - [ ] Collect license texts and NOTICE files. diff --git a/Docs/en/Roadmap.md b/Docs/en/Roadmap.md index b8b1fc3..dc9d03e 100644 --- a/Docs/en/Roadmap.md +++ b/Docs/en/Roadmap.md @@ -98,7 +98,7 @@ This establishes the current Simulator, minimum-Xcode 16, and single-iPhone one- | Minimum Xcode 16 native | Passed | Xcode 16.0 / iOS 18.0 SDK completed RootFS install, Simulator/device final links, and the 17-check native smoke | | App lifecycle and memory | In progress | Simulator and Jack iPhone have 256 MiB `ru_maxrss` gates; physical process suspend/resume, UIKit foreground/background, post-termination data recovery, and bounded App-delegate memory-warning recovery passed; add real memory-pressure/jetsam evidence | | RootFS ENOSPC/power faults | In progress | Peak-space preflight, full ENOSPC, seven persistence barriers, deterministic power-loss cuts, and bounded capacity/ENOSPC cleanup recovery on Jack iPhone are covered; add real storage-pressure/power-cut evidence | -| License-reviewed RootFS | Blocked | The 15-package/10-origin evidence, all 28 initial candidates, and all 88 external payloads have checksum-bound engineering review; three origins have no remaining candidate-material engineering items, five still need package-specific material, followed by legal review, corresponding-source delivery review, and authorized approval | +| License-reviewed RootFS | Blocked | The 15-package/10-origin evidence, all 32 initial candidates, and all 92 external payloads have checksum-bound engineering review; three origins have no remaining candidate-material engineering items, five still need package-specific material, followed by legal review, corresponding-source delivery review, and authorized approval | | App Store 2.5.2 | Blocked | Written guest download/execute policy decision | ### Next runtime sequence diff --git a/Docs/en/RootFS.md b/Docs/en/RootFS.md index 6281072..7e06628 100644 --- a/Docs/en/RootFS.md +++ b/Docs/en/RootFS.md @@ -5,7 +5,7 @@ A RootFS is an external supply-chain input, not a normal fixture. PocketRoot commits immutable metadata and secure install code, not the payload. > [!WARNING] -> The pinned v0.3.3 archive now has a reproducible package inventory, SPDX SBOM, default-configuration evidence, a source-acquisition manifest covering the complete inventory, and checksum-bound engineering review of all 28 initial candidates and all 88 external LICENSE/NOTICE payloads. Three origins have no remaining candidate-material engineering items; five still need package-specific material. The complete NOTICE set, legal review, corresponding-source delivery review, and distribution approval remain open. The URL and commands below support audit and local development; they do not grant redistribution rights. +> The pinned v0.3.3 archive now has a reproducible package inventory, SPDX SBOM, default-configuration evidence, a source-acquisition manifest covering the complete inventory, and checksum-bound engineering review of all 32 initial candidates and all 92 external LICENSE/NOTICE payloads. Three origins have no remaining candidate-material engineering items; five still need package-specific material. The complete NOTICE set, legal review, corresponding-source delivery review, and distribution approval remain open. The URL and commands below support audit and local development; they do not grant redistribution rights. ## Pinned manifest @@ -95,7 +95,7 @@ Receipt schema v2 requires that explicit mode. A legacy v1 source-review directory has ambiguous transport provenance and is no longer accepted by `--verify`; pass it to `--download-cache` to regenerate a verifiable v2 bundle. -After that source-review directory verifies, extract the 28 pinned +After that source-review directory verifies, extract the 32 pinned license/attribution candidates into another directory outside the repository: ```bash @@ -122,7 +122,7 @@ engineering acquisition workflow, not legal review. The RootFS archive contains no identifiable LICENSE/COPYING/NOTICE files. The candidate tool rechecks extracted byte counts, SHA-256 digests, the exact path set, and the no-link/special-node boundary. The pinned results record engineering review of -all 28 candidates: `libc-dev` and `zlib` have no remaining indexed items, while +all 32 candidates: `libc-dev` and `zlib` have no remaining indexed items, while eight source origins still require follow-up. The output is not a completed NOTICE or corresponding-source delivery bundle. @@ -152,7 +152,7 @@ ruby Scripts/rootfs-license-notice-review-results.rb \ The tool enforces HTTPS, redirect and response-size bounds, pinned byte counts and SHA-256 digests, and atomic output creation. The results bind engineering -review to the exact 88-file payload tree; the verifier rejects path drift, +review to the exact 92-file payload tree; the verifier rejects path drift, links, special nodes, known-digest drift, and tree-digest drift. `apk-tools`, `openssl`, and `pax-utils` have no remaining candidate-material engineering items; five origins still need package-specific material. The candidate NOTICE diff --git a/README.md b/README.md index afeaee3..fb4ce2b 100644 --- a/README.md +++ b/README.md @@ -163,7 +163,7 @@ print("stderr:", result.stderr) - 展开大小：`18,838,016` 字节 - SHA-256：`be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4` -固定 URL 只是清单元数据，不代表库会自动下载。仓库已从固定归档生成 RootFS 包清单与 SPDX SBOM，并完成 28 个初始候选及 88 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核；5 个 source origin 仍需补逐包材料。许可证/NOTICE 法律复核、对应源码和完整发行物 SBOM 未完成前，不得把该 RootFS 加入 Package、App bundle 或公开发行物。 +固定 URL 只是清单元数据，不代表库会自动下载。仓库已从固定归档生成 RootFS 包清单与 SPDX SBOM，并完成 32 个初始候选及 92 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核；5 个 source origin 仍需补逐包材料。许可证/NOTICE 法律复核、对应源码和完整发行物 SBOM 未完成前，不得把该 RootFS 加入 Package、App bundle 或公开发行物。 ## 验证命令 diff --git a/Scripts/rootfs-license-notice-candidates.rb b/Scripts/rootfs-license-notice-candidates.rb index 802bffa..dca7918 100644 --- a/Scripts/rootfs-license-notice-candidates.rb +++ b/Scripts/rootfs-license-notice-candidates.rb @@ -20,7 +20,7 @@ module RootFSLicenseNoticeCandidates alpine-baselayout alpine-keys apk-tools busybox ca-certificates musl openssl pax-utils ].freeze - EXPECTED_EXISTING_EVIDENCE_FILES = 28 + EXPECTED_EXISTING_EVIDENCE_FILES = 32 EXPECTED_REMOTE_PAYLOAD_FILES = 13 EXPECTED_APORTS_FILES = 47 PAYLOAD_KINDS = %w[package-attribution spdx-license-text].freeze diff --git a/Scripts/rootfs-license-notice-review-results.rb b/Scripts/rootfs-license-notice-review-results.rb index e03e0f7..bb18781 100644 --- a/Scripts/rootfs-license-notice-review-results.rb +++ b/Scripts/rootfs-license-notice-review-results.rb @@ -22,7 +22,7 @@ module RootFSLicenseNoticeReviewResults COVERAGE = %w[complete partial reference-only].freeze SHA256_PATTERN = /\A[0-9a-f]{64}\z/ CANDIDATE_PAYLOAD_TREE_FORMAT = "sha256-path-lines-v1" - EXPECTED_REVIEWED_PAYLOAD_FILES = 88 + EXPECTED_REVIEWED_PAYLOAD_FILES = 92 MAX_REVIEWED_PAYLOAD_BYTES = 8 * 1_024 * 1_024 TOP_LEVEL_KEYS = %w[ allIndexedCandidatePayloadsReviewed archive candidateManifestSha256 diff --git a/Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb b/Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb index fc73b31..2808c58 100644 --- a/Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb +++ b/Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb @@ -29,7 +29,7 @@ def test_validates_complete_open_origin_candidate_index assert_equal 8, validated.fetch(:sources).length assert_equal 13, validated.fetch(:remote_payloads).length - assert_equal 28, validated.fetch(:existing_evidence_paths).length + assert_equal 32, validated.fetch(:existing_evidence_paths).length assert_equal 47, validated.fetch(:aports_paths).length end @@ -485,6 +485,65 @@ def test_pins_enabled_busybox_traceroute_and_traceroute6_inline_notice ) end + def test_pins_enabled_busybox_od_hexdump_and_hd_notices + source = @candidate.fetch("sources").find do |candidate| + candidate.fetch("sourceOrigin") == "busybox" + end + review_source = @review.fetch("sources").find do |candidate| + candidate.fetch("sourceOrigin") == "busybox" + end + expected = { + "evidence/busybox/coreutils-od.c" => { + member: "busybox-1.36.1/coreutils/od.c", + bytes: 6_634, + sha256: "8536f85598a87c49db70a583d9c40004719e64b4939e1d58bcbe30e1e8c5417a", + kinds: %w[inline-license-notice attribution] + }, + "evidence/busybox/coreutils-od_bloaty.c" => { + member: "busybox-1.36.1/coreutils/od_bloaty.c", + bytes: 37_473, + sha256: "eb4ae669c359554eac9dcbac2f7625fb5413b34a76ded366a1ec13e47a729b62", + kinds: %w[license-declaration attribution] + }, + "evidence/busybox/util-linux-hexdump.c" => { + member: "busybox-1.36.1/util-linux/hexdump.c", + bytes: 4_392, + sha256: "97e49fc1c02560fd65443a7eafbcfbeab44267f3146e0efa1738ae902d69de84", + kinds: %w[license-declaration attribution] + }, + "evidence/busybox/libbb-dump.c" => { + member: "busybox-1.36.1/libbb/dump.c", + bytes: 22_017, + sha256: "a1c705a48bd6eb43b4cb9cfb74d61f47f8500b601ebd9d3502906093f7c8ddfe", + kinds: %w[inline-license-notice attribution] + } + } + + expected.each do |output_path, values| + evidence = review_source.fetch("candidateEvidence").find do |candidate| + candidate.fetch("outputPath") == output_path + end + + assert_includes source.fetch("existingEvidencePaths"), output_path + assert_equal values.fetch(:member), evidence.fetch("member") + assert_equal values.fetch(:bytes), evidence.fetch("byteCount") + assert_equal values.fetch(:sha256), evidence.fetch("sha256") + assert_equal values.fetch(:kinds), evidence.fetch("evidenceKinds") + end + assert_includes( + source.fetch("supplementalAportsPaths"), + "aports/busybox/busyboxconfig" + ) + assert_includes( + source.fetch("remainingReviewItems"), + "confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage" + ) + assert_includes( + source.fetch("remainingReviewItems"), + "review-other-bundled-third-party-license-and-attribution-coverage" + ) + end + def test_rejects_overlapping_materialized_output_paths payloads = @candidate.fetch("remotePayloads") payloads.fetch(0)["outputPath"] = "licenses/collision" diff --git a/Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb b/Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb index 37d4254..a08435b 100644 --- a/Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb +++ b/Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb @@ -47,7 +47,7 @@ def test_validates_pinned_candidate_review_results assert_equal 8, validated.fetch(:sources).length assert_equal 13, validated.fetch(:remote_payloads).length assert_equal 47, validated.fetch(:aports_paths).length - assert_equal 88, @results.fetch("reviewedPayloadFileCount") + assert_equal 92, @results.fetch("reviewedPayloadFileCount") assert_equal 5, @results.fetch("sourceOriginsWithRemainingReviewItems") assert_equal %w[apk-tools openssl pax-utils], @@ -136,7 +136,7 @@ def test_binds_enabled_busybox_ash_math_to_inline_notices assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 10, source.fetch("reviewedExistingEvidenceCount") + assert_equal 14, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-ash-math-license-and-attribution-coverage" @@ -158,7 +158,7 @@ def test_binds_enabled_busybox_env_to_inline_notice assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 10, source.fetch("reviewedExistingEvidenceCount") + assert_equal 14, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-env-license-and-attribution-coverage" @@ -180,7 +180,7 @@ def test_binds_enabled_busybox_echo_to_inline_notice assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 10, source.fetch("reviewedExistingEvidenceCount") + assert_equal 14, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-echo-license-and-attribution-coverage" @@ -202,7 +202,7 @@ def test_binds_enabled_busybox_logger_to_inline_notice assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 10, source.fetch("reviewedExistingEvidenceCount") + assert_equal 14, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-logger-license-and-attribution-coverage" @@ -224,7 +224,7 @@ def test_binds_enabled_busybox_cal_to_inline_notice assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 10, source.fetch("reviewedExistingEvidenceCount") + assert_equal 14, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-cal-license-and-attribution-coverage" @@ -246,7 +246,7 @@ def test_binds_enabled_busybox_ping_and_ping6_to_inline_notice assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 10, source.fetch("reviewedExistingEvidenceCount") + assert_equal 14, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-ping-and-ping6-license-and-attribution-coverage" @@ -268,7 +268,7 @@ def test_binds_enabled_busybox_traceroute_and_traceroute6_to_inline_notice assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 10, source.fetch("reviewedExistingEvidenceCount") + assert_equal 14, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage" @@ -283,6 +283,28 @@ def test_binds_enabled_busybox_traceroute_and_traceroute6_to_inline_notice ) end + def test_binds_enabled_busybox_od_hexdump_and_hd_to_inline_notices + source = @results.fetch("sources").find do |candidate| + candidate.fetch("sourceOrigin") == "busybox" + end + + assert_equal "partial", source.fetch("licenseTextCoverage") + assert_equal "partial", source.fetch("attributionCoverage") + assert_equal 14, source.fetch("reviewedExistingEvidenceCount") + assert_includes( + source.fetch("resolvedReviewItems"), + "confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage" + ) + assert_equal( + ["review-other-bundled-third-party-license-and-attribution-coverage"], + source.fetch("remainingReviewItems") + ) + assert_equal( + "additional-package-material-required", + source.fetch("engineeringConclusion") + ) + end + def test_rejects_candidate_manifest_digest_drift @candidates["status"] = "changed" diff --git a/Tests/Scripts/RootFSLicenseReviewResultsTests.rb b/Tests/Scripts/RootFSLicenseReviewResultsTests.rb index 2fa158b..9d2e068 100644 --- a/Tests/Scripts/RootFSLicenseReviewResultsTests.rb +++ b/Tests/Scripts/RootFSLicenseReviewResultsTests.rb @@ -39,7 +39,7 @@ def test_validates_pinned_engineering_review_results sources = validate assert_equal 10, sources.length - assert_equal 28, + assert_equal 32, sources.sum { |entry| entry.fetch("candidateResults").length } assert_equal 8, sources.count { |entry| !entry.fetch("remainingReviewItems").empty? }