jacklv-coder · jacklv-coder · Jul 26, 2026 · Jul 26, 2026
diff --git a/CHANGELOG.en.md b/CHANGELOG.en.md
@@ -38,13 +38,14 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit
   redistribution gates remain closed.
 - A checksum-bound `LICENSE-NOTICE-CANDIDATES.json`, strict validator, and
   outside-repository atomic materializer for the eight remaining RootFS source
-  origins. It indexes 8 remote license/attribution payloads, 46 aports files,
+  origins. It indexes 10 remote license/attribution payloads, 46 aports files,
   and the 21 existing evidence files for complete re-verification without
   committing payloads or opening engineering, legal, or redistribution gates.
 - `LICENSE-NOTICE-REVIEW-RESULTS.json` and a strict external payload-tree
-  verifier. All 75 candidate payloads now have checksum-bound engineering
-  review; `apk-tools` and `pax-utils` have no remaining candidate-material
-  engineering items, six origins still need package-specific material, and
+  verifier. All 77 candidate payloads now have checksum-bound engineering
+  review; `apk-tools`, `openssl`, and `pax-utils` have no remaining
+  candidate-material engineering items, five origins still need
+  package-specific material, and
   legal and redistribution gates remain closed.
 - Strict external download-cache input for the RootFS source-review
   materializer. A cache replaces network transport only: inputs remain

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -35,12 +35,12 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se
   法律与再分发门禁保持关闭。
 - 为剩余 8 个 RootFS source origin 加入 checksum-bound
   `LICENSE-NOTICE-CANDIDATES.json`、严格验证器和仓库外原子 materializer；索引
-  8 份远端许可证/attribution 材料、46 份 aports 文件与 21 份既有证据，支持完整
+  10 份远端许可证/attribution 材料、46 份 aports 文件与 21 份既有证据，支持完整
   复验，但不提交 payload，也不解除工程、法律或再分发门禁。
 - 加入 `LICENSE-NOTICE-REVIEW-RESULTS.json` 和严格外置 payload-tree 复验器；
-  75/75 个候选 payload 已完成 checksum-bound 工程复核，`apk-tools`、
-  `pax-utils` 的候选材料工程项关闭，另外 6 个 origin 仍需补逐包材料，法律和
-  再分发门禁保持关闭。
+  77/77 个候选 payload 已完成 checksum-bound 工程复核，`apk-tools`、
+  `openssl`、`pax-utils` 的候选材料工程项关闭，另外 5 个 origin 仍需补逐包
+  材料，法律和再分发门禁保持关闭。
 - RootFS source-review materializer 新增严格仓库外下载缓存输入；缓存只替代网络
   传输，仍逐项限制大小、拒绝 symlink/重叠路径、核对固定 SHA-512，并重新验证
   解包后的 canonical aports tree；v2 receipt 会明确区分网络与缓存获取，不伪造

diff --git a/Compliance/RootFS/v0.3.3/EVIDENCE.json b/Compliance/RootFS/v0.3.3/EVIDENCE.json
@@ -43,10 +43,10 @@
     "engineeringReviewedLicenseCandidates": 21,
     "sourceOriginsWithRemainingLicenseReviewItems": 8,
     "indexedLicenseNoticeCandidateOrigins": 8,
-    "pinnedRemoteLicenseNoticePayloads": 8,
+    "pinnedRemoteLicenseNoticePayloads": 10,
     "supplementalAportsCandidateFiles": 46,
-    "engineeringReviewedLicenseNoticeCandidatePayloads": 75,
-    "sourceOriginsWithRemainingCandidatePayloadReviewItems": 6
+    "engineeringReviewedLicenseNoticeCandidatePayloads": 77,
+    "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5
   },
   "engineeringStatus": {
     "completeInstalledPackageInventory": true,

diff --git a/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json b/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json
@@ -31,10 +31,10 @@
   "sourceOriginsWithOpenReviewItems": 10,
   "sourceOriginsWithRemainingReviewItems": 8,
   "indexedOpenSourceOrigins": 8,
-  "pinnedRemoteReferencePayloads": 8,
+  "pinnedRemoteReferencePayloads": 10,
   "supplementalAportsFiles": 46,
-  "engineeringReviewedCandidatePayloads": 75,
-  "sourceOriginsWithRemainingCandidatePayloadReviewItems": 6,
+  "engineeringReviewedCandidatePayloads": 77,
+  "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5,
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,
   "engineeringReviewCompleted": true,

diff --git a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json
@@ -106,6 +106,28 @@
       "byteCount": 6635,
       "sha256": "b226dd8531c618ff85a96a185c22c803168afbda1d8e4d8c13552c455b29b044"
     },
+    {
+      "kind": "package-attribution",
+      "sourceOrigin": "openssl",
+      "retrievalURLs": [
+        "https://raw.githubusercontent.com/openssl/openssl/01d5e2318405362b4de5e670c90d9b40a351d053/apps/CA.pl.in"
+      ],
+      "cacheKey": "openssl-3.1.4-CA.pl.in",
+      "outputPath": "supplemental/openssl/CA.pl.in",
+      "byteCount": 8041,
+      "sha256": "eac0e1059a78f7eb5b17ac90fbc3de5f1345c54dd890674aa36c9b4788b0c92a"
+    },
+    {
+      "kind": "package-attribution",
+      "sourceOrigin": "openssl",
+      "retrievalURLs": [
+        "https://raw.githubusercontent.com/openssl/openssl/01d5e2318405362b4de5e670c90d9b40a351d053/apps/tsget.in"
+      ],
+      "cacheKey": "openssl-3.1.4-tsget.in",
+      "outputPath": "supplemental/openssl/tsget.in",
+      "byteCount": 6778,
+      "sha256": "36239180730dd8fd7a3c448981a7e71bd5f7a93576865949d865fabee4fc2188"
+    },
     {
       "kind": "package-attribution",
       "sourceOrigin": "pax-utils",
@@ -309,7 +331,9 @@
         "aports/openssl/man-section.patch"
       ],
       "remoteEvidencePaths": [
-        "supplemental/openssl/README.md"
+        "supplemental/openssl/README.md",
+        "supplemental/openssl/CA.pl.in",
+        "supplemental/openssl/tsget.in"
       ],
       "remainingReviewItems": [
         "confirm-required-apache-notice-and-attribution-material"

diff --git a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json
@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "candidateManifestSha256": "55e13487c9c0b0ad0160e91c440120b6faa1ef75b0cf467676c67834ca1083cb",
+  "candidateManifestSha256": "82eb3905dd0314cbced81075d78cf6940833d8908feac87a9d0c4a49f30e1e44",
   "status": "candidate-payloads-engineering-reviewed-open-release-gates",
   "engineeringReviewCompleted": true,
   "allIndexedCandidatePayloadsReviewed": true,
@@ -13,10 +13,10 @@
   "legalReviewApproved": false,
   "redistributionApproved": false,
   "candidatePayloadTreeFormat": "sha256-path-lines-v1",
-  "candidatePayloadTreeSha256": "a54935ff29aa4f9784a74f26733bd915f8e6750e8487138af3f17a9389b93d30",
-  "reviewedPayloadFileCount": 75,
+  "candidatePayloadTreeSha256": "c79e6ac9edad292582e0fca75871a240463870e9384b8048ad674007f23b9aaf",
+  "reviewedPayloadFileCount": 77,
   "reviewedClosedOriginEvidenceCount": 4,
-  "sourceOriginsWithRemainingReviewItems": 6,
+  "sourceOriginsWithRemainingReviewItems": 5,
   "sources": [
     {
       "sourceOrigin": "alpine-baselayout",
@@ -141,16 +141,16 @@
       ],
       "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
       "licenseTextCoverage": "complete",
-      "attributionCoverage": "partial",
+      "attributionCoverage": "complete",
       "reviewedExistingEvidenceCount": 2,
       "reviewedReferenceLicenseCount": 1,
       "reviewedSupplementalAportsCount": 5,
-      "reviewedRemoteEvidenceCount": 1,
-      "resolvedReviewItems": [],
-      "remainingReviewItems": [
+      "reviewedRemoteEvidenceCount": 3,
+      "resolvedReviewItems": [
         "confirm-required-apache-notice-and-attribution-material"
       ],
-      "engineeringConclusion": "additional-package-material-required"
+      "remainingReviewItems": [],
+      "engineeringConclusion": "candidate-material-complete-engineering-only"
     },
     {
       "sourceOrigin": "pax-utils",

diff --git a/Compliance/RootFS/v0.3.3/NOTICE.md b/Compliance/RootFS/v0.3.3/NOTICE.md
@@ -43,15 +43,15 @@ for `libc-dev`, `zlib`.
 8 source origins still have package-specific open
 items, so this is not a complete or legally approved license/NOTICE bundle.
 `LICENSE-NOTICE-CANDIDATES.json` now pins an external candidate bundle for
-those open origins: 8 remote
+those open origins: 10 remote
 reference/attribution payloads and
 46 supplemental aports
 files, together with all checksum-bound reviewed evidence. The repository
 tool can materialize and re-verify that bundle outside the repository.
 `LICENSE-NOTICE-REVIEW-RESULTS.json` records checksum-bound engineering
-review of all 75 indexed
-payload files. 2 origins have no remaining
-candidate-material engineering items; 6 origins
+review of all 77 indexed
+payload files. 3 origins have no remaining
+candidate-material engineering items; 5 origins
 still require package-specific material. Legal review and redistribution
 approval remain open.
 

diff --git a/Compliance/RootFS/v0.3.3/README.md b/Compliance/RootFS/v0.3.3/README.md
@@ -20,11 +20,11 @@ pinned RootFS archive. It does not store the RootFS payload.
   attribution、声明与内联 notice 的路径、大小、SHA-256 和逐包未决审查项；
 - `LICENSE-REVIEW-RESULTS.json`：对全部 21 个候选的 checksum-bound 工程复核
   结论、coverage 和未决项处置；不表示法律或再分发批准；
-- `LICENSE-NOTICE-CANDIDATES.json`：为剩余 8 个 source origin 固定 8 份远端
+- `LICENSE-NOTICE-CANDIDATES.json`：为剩余 8 个 source origin 固定 10 份远端
   许可证/attribution 材料、46 份 aports 补充文件及现有 21 份复核证据的外置候选包；
   payload 不提交，工程、法律和再分发门禁保持关闭；
-- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 75 个 payload 文件树的
-  工程复核结果；2 个 origin 的候选材料工程项关闭，6 个仍需补逐包材料，法律和
+- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 77 个 payload 文件树的
+  工程复核结果；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，法律和
   再分发门禁保持关闭；
 - `RUNTIME-CONFIGURATION.json`：guest、`apk`、repository、world 和 DNS 默认配置；
 - `NOTICE.md`：可复现 attribution inventory 与尚未完成事项；
@@ -39,13 +39,44 @@ manifest, not a committed source archive or redistribution grant.
 `LICENSE-REVIEW-RESULTS.json` records the engineering review of all 21 pinned
 candidates. Two source origins have no remaining indexed review items; eight
 still have package-specific open items. `LICENSE-NOTICE-CANDIDATES.json`
-indexes an external candidate bundle for those eight origins: 8 pinned remote
+indexes an external candidate bundle for those eight origins: 10 pinned remote
 license/attribution payloads, 46 supplemental aports files, and the existing
 21 reviewed evidence files. `LICENSE-NOTICE-REVIEW-RESULTS.json` binds the
-engineering review to the exact 75-file payload tree. Two origins have no
-remaining candidate-material engineering items; six still require
+engineering review to the exact 77-file payload tree. Three origins have no
+remaining candidate-material engineering items; five still require
 package-specific material. Legal and redistribution approval remain open.
 
+OpenSSL 的工程结论绑定固定 `openssl-3.1.4.tar.gz`：源包根目录没有
+`NOTICE` 文件；固定 RootFS 的 APK database 将 guest 路径
+`/etc/ssl/misc/CA.pl` 与 `/etc/ssl/misc/tsget.pl` 归属到 inventory 中的
+`libcrypto3`。归档内 canonical guest-template 文件分别为 8,062 字节、
+SHA-256 `35a85ebe05ac4ee42a0efe544c02ad2c70bf374c4dcd8bf5aaf403b7c1b6cdd8`
+和 6,746 字节、SHA-256
+`1c303a261c93d09a04dbb5b4167e93553607a8d06e968bd1cf06325933c147bc`。
+候选包中的 `LICENSE.txt`、`AUTHORS.md`、`README.md`、`CA.pl.in` 和
+`tsget.in` 与固定源包字节一致；两个源码模板的 license/attribution 头部与上述
+生成后的安装文件一致，覆盖 OpenSSL Project、OpenTSA Project 及 Eric A.
+Young/Tim J. Hudson 版权归属。因此
+`confirm-required-apache-notice-and-attribution-material` 已在工程层关闭；
+这不表示法律审查或再分发批准。
+
+The OpenSSL engineering conclusion is bound to the pinned
+`openssl-3.1.4.tar.gz`: its source root contains no `NOTICE` file. The pinned
+RootFS APK database assigns guest paths `/etc/ssl/misc/CA.pl` and
+`/etc/ssl/misc/tsget.pl` to the inventoried `libcrypto3` package. Their
+canonical guest-template files are 8,062 bytes with SHA-256
+`35a85ebe05ac4ee42a0efe544c02ad2c70bf374c4dcd8bf5aaf403b7c1b6cdd8`
+and 6,746 bytes with SHA-256
+`1c303a261c93d09a04dbb5b4167e93553607a8d06e968bd1cf06325933c147bc`,
+respectively. The candidate `LICENSE.txt`, `AUTHORS.md`, `README.md`,
+`CA.pl.in`, and `tsget.in` are byte-identical to the pinned source; the two
+source-template license/attribution headers match the generated installed
+files and cover the OpenSSL Project, OpenTSA Project, and Eric A. Young/Tim J.
+Hudson copyright attributions. The
+`confirm-required-apache-notice-and-attribution-material` item is therefore
+closed at the engineering level only; this is not legal review or
+redistribution approval.
+
 ## 重新生成 / Regenerate
 
 先把经授权使用的固定 archive 放在仓库外，再运行：
@@ -212,18 +243,18 @@ advice, or redistribution approval.
 这些文件不构成完整第三方 LICENSE/NOTICE bundle、经审查的 copyleft
 corresponding-source 交付、法律意见或再分发授权。源码获取清单已完整覆盖固定
 inventory，21 个候选也都有工程复核结果；`libc-dev`、`zlib` 已关闭索引项，另外
-8 个 source origin 的 75 个新候选 payload 已完成 checksum-bound 工程复核；
-`apk-tools`、`pax-utils` 的候选材料工程项已关闭，另外 6 个 origin 仍需补逐包
-版权/notice 材料。修改说明、构建完整性、源码提供方式、法律审查、App Store
-2.5.2 产品策略和负责人批准仍是发行阻塞项。
+8 个 source origin 的 77 个新候选 payload 已完成 checksum-bound 工程复核；
+`apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个
+origin 仍需补逐包版权/notice 材料。修改说明、构建完整性、源码提供方式、法律
+审查、App Store 2.5.2 产品策略和负责人批准仍是发行阻塞项。
 
 These files are not a complete third-party LICENSE/NOTICE bundle, reviewed
 copyleft corresponding-source delivery, legal advice, or redistribution
 approval. The acquisition manifest completely covers the pinned inventory and
 all 21 indexed candidates have engineering review results. `libc-dev` and
-`zlib` have no remaining indexed items. All 75 newly indexed payloads have a
-checksum-bound engineering review; `apk-tools` and `pax-utils` have no
-remaining candidate-material engineering items, while six origins still need
-package-specific copyright/notice material. Modification, build completeness,
-source-offer mechanics, legal review, App Store 2.5.2 product policy, and
-authorized approval remain distribution blockers.
+`zlib` have no remaining indexed items. All 77 newly indexed payloads have a
+checksum-bound engineering review; `apk-tools`, `openssl`, and `pax-utils`
+have no remaining candidate-material engineering items, while five origins
+still need package-specific copyright/notice material. Modification, build
+completeness, source-offer mechanics, legal review, App Store 2.5.2 product
+policy, and authorized approval remain distribution blockers.
diff --git a/Compliance/RootFS/v0.3.3/SHA256SUMS b/Compliance/RootFS/v0.3.3/SHA256SUMS
@@ -1,10 +1,10 @@
-69fc3496bb4832d109942f72e81009a4d1774d459f372422263903802c5d3019  EVIDENCE.json
-c12f1bf7d6a83b8e4e549dee0cafe28162d9b7f0ab210af5370503fe72f195ec  LICENSE-INVENTORY.json
-55e13487c9c0b0ad0160e91c440120b6faa1ef75b0cf467676c67834ca1083cb  LICENSE-NOTICE-CANDIDATES.json
-faee5c5c91c7be648ff7772c69167be3056bbb3501e52a7057d208d8fbfa621c  LICENSE-NOTICE-REVIEW-RESULTS.json
+47e96d72ae690bf941bdf05bdc0eb9b1fb8f24e320d927109a6c3425d51abe7a  EVIDENCE.json
+2fa98989f7725bed0e82db2f5350d74893b732395227974d77a9ca55147da842  LICENSE-INVENTORY.json
+82eb3905dd0314cbced81075d78cf6940833d8908feac87a9d0c4a49f30e1e44  LICENSE-NOTICE-CANDIDATES.json
+0ae4a280c5c418bd54b00ae9e7a2dec16122d2d0cf61b34fd1e338598600cdfc  LICENSE-NOTICE-REVIEW-RESULTS.json
 3c7f786d9551d716c2a8b374d8cc63d11a46d67827be2fa0cea73b51b6b92eda  LICENSE-REVIEW-RESULTS.json
 3d483714a09cb2194e1b4af9aef5dfec2fbcfd44c70d521899398a3893f1908a  LICENSE-REVIEW.json
-39dff7ed584e32bb46559d29ffcff7cef4dc88278de1957383616fd412732a64  NOTICE.md
+b0fd80c51c7276c65d4122e65c628f2ef3cb67a5170fb6577f5399a93c848938  NOTICE.md
 4f7f7626f3d0891a29717e4b7932c36004ecc9aac25a4aa104c300aae979e3e1  PACKAGE-INVENTORY.tsv
 dbca9b285015a0d8b1d339a894b4594c9e335cbc2d7f9d5212a41095ae4bd1e1  RUNTIME-CONFIGURATION.json
 8e021cb8c4160c934a0202609691d7a94526cd016f4394a47da6e7a5ab41d0ea  SBOM.spdx.json

diff --git a/Docs/ReleaseCompliance.md b/Docs/ReleaseCompliance.md
@@ -75,12 +75,12 @@ aports snapshot/upstream distfile 获取清单和仓库外 materializer，并固
 全部 10 个 source origin 的 21 个 license、attribution、声明与内联 notice 候选。
 第二个仓库外工具从已验证 source-review 目录提取这些候选；固定结果清单记录
 21/21 个候选均已工程复核，`libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source
-origin 仍有逐包未决项。仓库现已为这 8 个 origin 固定外置候选包：8 份远端
+origin 仍有逐包未决项。仓库现已为这 8 个 origin 固定外置候选包：10 份远端
 许可证/attribution 材料、46 份 aports 补充文件和全部既有复核证据；工具可在
-仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 75 文件 payload
-tree；`apk-tools`、`pax-utils` 的候选材料工程项已关闭，另外 6 个 origin 仍需
-补逐包材料。修改与构建完整性、源码提供方式和法律审查仍未完成，不能视为完整
-NOTICE 或已批准的对应源码交付。
+仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 77 文件 payload
+tree；`apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个
+origin 仍需补逐包材料。修改与构建完整性、源码提供方式和法律审查仍未完成，
+不能视为完整 NOTICE 或已批准的对应源码交付。
 
 ## 当前仓库保护
 
@@ -179,8 +179,8 @@ Alpine `apk` 可以下载、安装和执行新增代码。即使初始 RootFS
 - [x] 对固定的 21 个 license/NOTICE 候选完成 checksum-bound 工程复核。
 - [x] 为剩余 8 个 source origin 建立 checksum-bound 外置候选包索引与可复验
   materializer；payload 不提交且批准门禁保持关闭。
-- [x] 对外置候选包的 75 个 payload 完成 checksum-bound 工程复核并固定结果；
-  2 个 origin 的候选材料工程项关闭，6 个仍需补逐包材料。
+- [x] 对外置候选包的 77 个 payload 完成 checksum-bound 工程复核并固定结果；
+  3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料。
 - [ ] 收集 license text 和 NOTICE。
 - [ ] 建立 copyleft corresponding source bundle。
 - [x] 固定 DNS、repository 和 package-manager 默认配置事实。

diff --git a/Docs/Roadmap.md b/Docs/Roadmap.md
@@ -103,7 +103,7 @@
 | 最低 Xcode 16 原生兼容 | 已通过 | Xcode 16.0 / iOS 18.0 SDK 完成 RootFS install、Simulator/device final-link 和 17 项 native smoke |
 | App lifecycle 与内存 | 进行中 | Simulator 与 Jack iPhone 均有 256 MiB `ru_maxrss` 门禁；真机 process suspend/resume、UIKit foreground/background、强制终止后数据恢复和有界 App delegate memory-warning 回调恢复已通过；补真实 memory pressure/jetsam |
 | RootFS ENOSPC/掉电 | 进行中 | 峰值空间预检、全 ENOSPC、七点持久化屏障、确定性掉电切点和 Jack iPhone 受限容量/ENOSPC 清理恢复已覆盖；补真实 storage pressure/强制断电 |
-| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、21/21 初始候选和 75/75 外置 payload 工程复核已完成；2 个 origin 的候选材料工程项关闭，6 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 |
+| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、21/21 初始候选和 77/77 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 |
 | App Store 2.5.2 | 阻塞 | guest download/execute policy 有书面结论 |
 
 ### 后续 runtime 执行顺序