Close remaining BusyBox notice review

CHANGELOG.en.md

@@ -32,17 +32,17 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit
   declared-license/attribution inventories, and default `apk`, repository, and
   DNS configuration; complete LICENSE/NOTICE and corresponding-source bundles
   remain distribution blockers.
-- A checksum-bound `LICENSE-REVIEW-RESULTS.json` and strict validator. All 37
+- A checksum-bound `LICENSE-REVIEW-RESULTS.json` and strict validator. All 78
   pinned RootFS license/NOTICE candidates have engineering review results;
   eight source origins retain package-level open items, and legal and
   redistribution gates remain closed.
 - A checksum-bound `LICENSE-NOTICE-CANDIDATES.json`, strict validator, and
   outside-repository atomic materializer for the eight remaining RootFS source
   origins. It indexes 13 remote license/attribution payloads, 47 aports files,
-  and the 37 existing evidence files for complete re-verification without
+  and the 78 existing evidence files for complete re-verification without
   committing payloads or opening engineering, legal, or redistribution gates.
 - `LICENSE-NOTICE-REVIEW-RESULTS.json` and a strict external payload-tree
-  verifier. All 97 candidate payloads now have checksum-bound engineering
+  verifier. All 138 candidate payloads now have checksum-bound engineering
   review. The pinned upstream `alpine-keys` GPL-to-MIT license-decision commit
   is included while its package-level copyright notice remains open. The
   `ca-certificates` generator is byte-identical to curl commit `3fdc4bdb`, and
@@ -63,11 +63,14 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit
   sources retain FSF copyright, GPLv2-or-later declarations, and BusyBox port
   attribution. `cut`, `sort`, and `uniq` link their corresponding `coreutils`
   sources, each retaining its GPLv2-or-later declaration and original
-  attribution. Other inline notices stay open;
-  `apk-tools`, `openssl`, and `pax-utils` have no remaining
-  candidate-material engineering items, five origins still need
-  package-specific material, and
-  legal and redistribution gates remain closed.
+  attribution. The remaining BusyBox review applies the 33 pinned aports
+  patches and configuration to derive 487 compilation units and a 562-file
+  include closure, then pins the 41 files retaining independent third-party
+  terms or provenance. BusyBox evidence increases to 60 files and its broad
+  engineering item closes. `apk-tools`, `busybox`, `openssl`, and `pax-utils`
+  have no remaining candidate-material engineering items, four origins still
+  need package-specific material, and legal and redistribution gates remain
+  closed.
 - Strict external download-cache input for the RootFS source-review
   materializer. A cache replaces network transport only: inputs remain
   size-bounded and symlink/overlap-rejected, with pinned SHA-512 and canonical

CHANGELOG.md

@@ -30,15 +30,15 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se
   10 个 source origin、SPDX 2.3 JSON SBOM、许可证声明/attribution inventory
   和 `apk`、repository、DNS 默认配置快照；完整 LICENSE/NOTICE 与对应源码 bundle
   仍保持发行阻塞。
-- 加入 checksum-bound `LICENSE-REVIEW-RESULTS.json` 和严格验证器；37/37 个固定
+- 加入 checksum-bound `LICENSE-REVIEW-RESULTS.json` 和严格验证器；78/78 个固定
   RootFS license/NOTICE 候选已完成工程复核，8 个 source origin 仍有包级未决项，
   法律与再分发门禁保持关闭。
 - 为剩余 8 个 RootFS source origin 加入 checksum-bound
   `LICENSE-NOTICE-CANDIDATES.json`、严格验证器和仓库外原子 materializer；索引
-  13 份远端许可证/attribution 材料、47 份 aports 文件与 37 份既有证据，支持完整
+  13 份远端许可证/attribution 材料、47 份 aports 文件与 78 份既有证据，支持完整
   复验，但不提交 payload，也不解除工程、法律或再分发门禁。
 - 加入 `LICENSE-NOTICE-REVIEW-RESULTS.json` 和严格外置 payload-tree 复验器；
-  97/97 个候选 payload 已完成 checksum-bound 工程复核；新增固定
+  138/138 个候选 payload 已完成 checksum-bound 工程复核；新增固定
   `alpine-keys` GPL→MIT 上游许可判定提交，但仍保留包级版权声明缺口；
   `ca-certificates` 生成脚本与 curl 提交 `3fdc4bdb` 字节一致并固定该精确
   revision 的 curl 授权文本，trust-store 审查仍保持未决；
@@ -54,9 +54,11 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se
   声明；`expand`/`unexpand` 共同链入 `coreutils/expand.c`，`fold` 链入
   `coreutils/fold.c`，两份源码均保留 FSF 版权、GPLv2-or-later 声明与 BusyBox
   改写署名；`cut`、`sort`、`uniq` 分别链入对应 `coreutils` 源码，三份源码均
-  保留 GPLv2-or-later 声明与原作者署名；其他内联第三方 notices 继续保持未决；
-  `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项关闭，另外 5 个 origin
-  仍需补逐包材料，法律和再分发门禁保持关闭。
+  保留 GPLv2-or-later 声明与原作者署名。其余 BusyBox 审查按固定 33 个 aports
+  补丁和配置生成 487 个编译单元、562 文件 include 闭包，并固定其中 41 份仍含
+  独立第三方条款或 provenance 的源码；BusyBox 证据增至 60 份，总括工程项关闭。
+  `apk-tools`、`busybox`、`openssl`、`pax-utils` 的候选材料工程项关闭，另外
+  4 个 origin 仍需补逐包材料，法律和再分发门禁保持关闭。
 - RootFS source-review materializer 新增严格仓库外下载缓存输入；缓存只替代网络
   传输，仍逐项限制大小、拒绝 symlink/重叠路径、核对固定 SHA-512，并重新验证
   解包后的 canonical aports tree；v2 receipt 会明确区分网络与缓存获取，不伪造

Compliance/RootFS/v0.3.3/EVIDENCE.json

@@ -39,14 +39,14 @@
     "sourceOrigins": 10,
     "declaredLicenseExpressions": 7,
     "licenseOrNoticeFilesInGuestTemplate": 0,
-    "indexedExternalLicenseReviewCandidates": 37,
-    "engineeringReviewedLicenseCandidates": 37,
+    "indexedExternalLicenseReviewCandidates": 78,
+    "engineeringReviewedLicenseCandidates": 78,
     "sourceOriginsWithRemainingLicenseReviewItems": 8,
     "indexedLicenseNoticeCandidateOrigins": 8,
     "pinnedRemoteLicenseNoticePayloads": 13,
     "supplementalAportsCandidateFiles": 47,
-    "engineeringReviewedLicenseNoticeCandidatePayloads": 97,
-    "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5
+    "engineeringReviewedLicenseNoticeCandidatePayloads": 138,
+    "sourceOriginsWithRemainingCandidatePayloadReviewItems": 4
   },
   "engineeringStatus": {
     "completeInstalledPackageInventory": true,

Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json

@@ -26,15 +26,15 @@
   "licenseOrNoticeFilesFoundInGuestTemplate": [
 
   ],
-  "indexedExternalReviewCandidates": 37,
-  "engineeringReviewedCandidates": 37,
+  "indexedExternalReviewCandidates": 78,
+  "engineeringReviewedCandidates": 78,
   "sourceOriginsWithOpenReviewItems": 10,
   "sourceOriginsWithRemainingReviewItems": 8,
   "indexedOpenSourceOrigins": 8,
   "pinnedRemoteReferencePayloads": 13,
   "supplementalAportsFiles": 47,
-  "engineeringReviewedCandidatePayloads": 97,
-  "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5,
+  "engineeringReviewedCandidatePayloads": 138,
+  "sourceOriginsWithRemainingCandidatePayloadReviewItems": 4,
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,
   "engineeringReviewCompleted": true,

Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json

@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "licenseReviewResultsSha256": "fe473ffd86d0d1ca7b1ad2594373311b8cc6181ee36865089780e1cf885fc0de",
+  "licenseReviewResultsSha256": "810f047bd36867c3a34318fef8535dcb87cc263f6a59df88b1abee56472e35ce",
   "status": "candidate-bundle-indexed-engineering-review-required",
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,
@@ -185,7 +185,9 @@
       "referenceLicensePaths": [
         "licenses/GPL-2.0.txt"
       ],
-      "supplementalAportsPaths": [],
+      "supplementalAportsPaths": [
+
+      ],
       "remoteEvidencePaths": [
         "supplemental/alpine-baselayout/netbase-6.4-copyright"
       ],
@@ -206,7 +208,9 @@
       "referenceLicensePaths": [
         "licenses/MIT-reference.txt"
       ],
-      "supplementalAportsPaths": [],
+      "supplementalAportsPaths": [
+
+      ],
       "remoteEvidencePaths": [
         "supplemental/alpine-keys/license-decision.patch"
       ],
@@ -231,7 +235,9 @@
         "aports/apk-tools/fix-recursive-solve-1.patch",
         "aports/apk-tools/fix-recursive-solve-2.patch"
       ],
-      "remoteEvidencePaths": [],
+      "remoteEvidencePaths": [
+
+      ],
       "remainingReviewItems": [
         "confirm-package-specific-attribution-and-aports-patch-notices"
       ],
@@ -261,7 +267,48 @@
         "evidence/busybox/coreutils-fold.c",
         "evidence/busybox/coreutils-cut.c",
         "evidence/busybox/coreutils-sort.c",
-        "evidence/busybox/coreutils-uniq.c"
+        "evidence/busybox/coreutils-uniq.c",
+        "evidence/busybox/build-closure-archival-bbunzip.c",
+        "evidence/busybox/build-closure-archival-libarchive-decompress_gunzip.c",
+        "evidence/busybox/build-closure-archival-libarchive-liblzo.h",
+        "evidence/busybox/build-closure-archival-libarchive-lzo1x_1.c",
+        "evidence/busybox/build-closure-archival-libarchive-lzo1x_1o.c",
+        "evidence/busybox/build-closure-archival-libarchive-lzo1x_c.c",
+        "evidence/busybox/build-closure-archival-libarchive-lzo1x_d.c",
+        "evidence/busybox/build-closure-archival-libarchive-unxz-xz.h",
+        "evidence/busybox/build-closure-archival-libarchive-unxz-xz_config.h",
+        "evidence/busybox/build-closure-archival-libarchive-unxz-xz_dec_bcj.c",
+        "evidence/busybox/build-closure-archival-libarchive-unxz-xz_dec_lzma2.c",
+        "evidence/busybox/build-closure-archival-libarchive-unxz-xz_dec_stream.c",
+        "evidence/busybox/build-closure-archival-libarchive-unxz-xz_lzma2.h",
+        "evidence/busybox/build-closure-archival-libarchive-unxz-xz_private.h",
+        "evidence/busybox/build-closure-archival-libarchive-unxz-xz_stream.h",
+        "evidence/busybox/build-closure-archival-lzop.c",
+        "evidence/busybox/build-closure-coreutils-dos2unix.c",
+        "evidence/busybox/build-closure-coreutils-sync.c",
+        "evidence/busybox/build-closure-coreutils-test.c",
+        "evidence/busybox/build-closure-coreutils-tr.c",
+        "evidence/busybox/build-closure-include-liblzo_interface.h",
+        "evidence/busybox/build-closure-libbb-change_identity.c",
+        "evidence/busybox/build-closure-libbb-correct_password.c",
+        "evidence/busybox/build-closure-libbb-hash_md5_sha.c",
+        "evidence/busybox/build-closure-libbb-procps.c",
+        "evidence/busybox/build-closure-libbb-progress.c",
+        "evidence/busybox/build-closure-libbb-pw_encrypt_des.c",
+        "evidence/busybox/build-closure-libbb-pw_encrypt_sha.c",
+        "evidence/busybox/build-closure-libbb-run_shell.c",
+        "evidence/busybox/build-closure-libbb-setup_environment.c",
+        "evidence/busybox/build-closure-libbb-vfork_daemon_rexec.c",
+        "evidence/busybox/build-closure-libpwdgrp-uidgid_get.c",
+        "evidence/busybox/build-closure-loginutils-add-remove-shell.c",
+        "evidence/busybox/build-closure-miscutils-bbconfig.c",
+        "evidence/busybox/build-closure-networking-nc_bloaty.c",
+        "evidence/busybox/build-closure-procps-pmap.c",
+        "evidence/busybox/build-closure-shell-ash.c",
+        "evidence/busybox/build-closure-shell-shell_common.c",
+        "evidence/busybox/build-closure-shell-shell_common.h",
+        "evidence/busybox/build-closure-util-linux-fdisk_osf.c",
+        "evidence/busybox/build-closure-util-linux-setsid.c"
       ],
       "referenceLicensePaths": [
         "licenses/GPL-2.0.txt"
@@ -305,7 +352,9 @@
         "aports/busybox/dad.if-up",
         "aports/busybox/default.script"
       ],
-      "remoteEvidencePaths": [],
+      "remoteEvidencePaths": [
+
+      ],
       "remainingReviewItems": [
         "confirm-enabled-bzip2-license-and-attribution-coverage",
         "confirm-enabled-ash-math-license-and-attribution-coverage",
@@ -336,7 +385,9 @@
         "licenses/MIT-reference.txt",
         "licenses/MPL-2.0.txt"
       ],
-      "supplementalAportsPaths": [],
+      "supplementalAportsPaths": [
+
+      ],
       "remoteEvidencePaths": [
         "supplemental/ca-certificates/curl-mk-ca-bundle.pl",
         "supplemental/ca-certificates/curl-COPYING"
@@ -371,7 +422,9 @@
         "aports/musl/handle-aux-at_base.patch",
         "aports/musl/remove-dns-63-records-limit.patch"
       ],
-      "remoteEvidencePaths": [],
+      "remoteEvidencePaths": [
+
+      ],
       "remainingReviewItems": [
         "confirm-third-party-musl-files-and-aports-helper-notice-coverage"
       ],
@@ -417,7 +470,9 @@
       "referenceLicensePaths": [
         "licenses/GPL-2.0.txt"
       ],
-      "supplementalAportsPaths": [],
+      "supplementalAportsPaths": [
+
+      ],
       "remoteEvidencePaths": [
         "supplemental/pax-utils/README.md"
       ],

Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json

@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "candidateManifestSha256": "537646fc1fe8bb81322d74a434227d83495ffbc4bff5a61f123a47e9effcd999",
+  "candidateManifestSha256": "534c12f8b9268a36cff13af3123bebbacf61d85b667fafce6d7649cae47c7e65",
   "status": "candidate-payloads-engineering-reviewed-open-release-gates",
   "engineeringReviewCompleted": true,
   "allIndexedCandidatePayloadsReviewed": true,
@@ -13,10 +13,10 @@
   "legalReviewApproved": false,
   "redistributionApproved": false,
   "candidatePayloadTreeFormat": "sha256-path-lines-v1",
-  "candidatePayloadTreeSha256": "e4d8eef692cba9ed38052e2b8067b5e9c46acbd6d0dd46b9158fd876d7a4ec40",
-  "reviewedPayloadFileCount": 97,
+  "candidatePayloadTreeSha256": "cc9aacfeb345129ea9df24834cdcf381dfb67c8393b11d4c1d4249855238d281",
+  "reviewedPayloadFileCount": 138,
   "reviewedClosedOriginEvidenceCount": 4,
-  "sourceOriginsWithRemainingReviewItems": 5,
+  "sourceOriginsWithRemainingReviewItems": 4,
   "sources": [
     {
       "sourceOrigin": "alpine-baselayout",
@@ -50,7 +50,9 @@
       "reviewedReferenceLicenseCount": 1,
       "reviewedSupplementalAportsCount": 0,
       "reviewedRemoteEvidenceCount": 1,
-      "resolvedReviewItems": [],
+      "resolvedReviewItems": [
+
+      ],
       "remainingReviewItems": [
         "collect-mit-license-grant-and-copyright-notice"
       ],
@@ -71,7 +73,9 @@
       "resolvedReviewItems": [
         "confirm-package-specific-attribution-and-aports-patch-notices"
       ],
-      "remainingReviewItems": [],
+      "remainingReviewItems": [
+
+      ],
       "engineeringConclusion": "candidate-material-complete-engineering-only"
     },
     {
@@ -80,9 +84,9 @@
         "GPL-2.0-only"
       ],
       "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
-      "licenseTextCoverage": "partial",
-      "attributionCoverage": "partial",
-      "reviewedExistingEvidenceCount": 19,
+      "licenseTextCoverage": "complete",
+      "attributionCoverage": "complete",
+      "reviewedExistingEvidenceCount": 60,
       "reviewedReferenceLicenseCount": 1,
       "reviewedSupplementalAportsCount": 37,
       "reviewedRemoteEvidenceCount": 0,
@@ -98,12 +102,13 @@
         "confirm-enabled-traceroute-and-traceroute6-license-and-attribution-coverage",
         "confirm-enabled-od-hexdump-and-hd-license-and-attribution-coverage",
         "confirm-enabled-expand-unexpand-and-fold-license-and-attribution-coverage",
-        "confirm-enabled-cut-sort-and-uniq-license-and-attribution-coverage"
+        "confirm-enabled-cut-sort-and-uniq-license-and-attribution-coverage",
+        "review-other-bundled-third-party-license-and-attribution-coverage"
       ],
       "remainingReviewItems": [
-        "review-other-bundled-third-party-license-and-attribution-coverage"
+
       ],
-      "engineeringConclusion": "additional-package-material-required"
+      "engineeringConclusion": "candidate-material-complete-engineering-only"
     },
     {
       "sourceOrigin": "ca-certificates",
@@ -139,7 +144,9 @@
       "reviewedReferenceLicenseCount": 3,
       "reviewedSupplementalAportsCount": 3,
       "reviewedRemoteEvidenceCount": 0,
-      "resolvedReviewItems": [],
+      "resolvedReviewItems": [
+
+      ],
       "remainingReviewItems": [
         "confirm-third-party-musl-files-and-aports-helper-notice-coverage"
       ],
@@ -160,7 +167,9 @@
       "resolvedReviewItems": [
         "confirm-required-apache-notice-and-attribution-material"
       ],
-      "remainingReviewItems": [],
+      "remainingReviewItems": [
+
+      ],
       "engineeringConclusion": "candidate-material-complete-engineering-only"
     },
     {
@@ -178,7 +187,9 @@
       "resolvedReviewItems": [
         "confirm-package-specific-copyright-and-aports-patch-notices"
       ],
-      "remainingReviewItems": [],
+      "remainingReviewItems": [
+
+      ],
       "engineeringConclusion": "candidate-material-complete-engineering-only"
     }
   ]