Pin alpine-keys license provenance

CHANGELOG.en.md

@@ -38,12 +38,14 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit
   redistribution gates remain closed.
 - A checksum-bound `LICENSE-NOTICE-CANDIDATES.json`, strict validator, and
   outside-repository atomic materializer for the eight remaining RootFS source
-  origins. It indexes 10 remote license/attribution payloads, 46 aports files,
+  origins. It indexes 11 remote license/attribution payloads, 46 aports files,
   and the 21 existing evidence files for complete re-verification without
   committing payloads or opening engineering, legal, or redistribution gates.
 - `LICENSE-NOTICE-REVIEW-RESULTS.json` and a strict external payload-tree
-  verifier. All 77 candidate payloads now have checksum-bound engineering
-  review; `apk-tools`, `openssl`, and `pax-utils` have no remaining
+  verifier. All 78 candidate payloads now have checksum-bound engineering
+  review. The pinned upstream `alpine-keys` GPL-to-MIT license-decision commit
+  is included while its package-level copyright notice remains open;
+  `apk-tools`, `openssl`, and `pax-utils` have no remaining
   candidate-material engineering items, five origins still need
   package-specific material, and
   legal and redistribution gates remain closed.

CHANGELOG.md

@@ -35,12 +35,13 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se
   法律与再分发门禁保持关闭。
 - 为剩余 8 个 RootFS source origin 加入 checksum-bound
   `LICENSE-NOTICE-CANDIDATES.json`、严格验证器和仓库外原子 materializer；索引
-  10 份远端许可证/attribution 材料、46 份 aports 文件与 21 份既有证据，支持完整
+  11 份远端许可证/attribution 材料、46 份 aports 文件与 21 份既有证据，支持完整
   复验，但不提交 payload，也不解除工程、法律或再分发门禁。
 - 加入 `LICENSE-NOTICE-REVIEW-RESULTS.json` 和严格外置 payload-tree 复验器；
-  77/77 个候选 payload 已完成 checksum-bound 工程复核，`apk-tools`、
-  `openssl`、`pax-utils` 的候选材料工程项关闭，另外 5 个 origin 仍需补逐包
-  材料，法律和再分发门禁保持关闭。
+  78/78 个候选 payload 已完成 checksum-bound 工程复核；新增固定
+  `alpine-keys` GPL→MIT 上游许可判定提交，但仍保留包级版权声明缺口；
+  `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项关闭，另外 5 个 origin
+  仍需补逐包材料，法律和再分发门禁保持关闭。
 - RootFS source-review materializer 新增严格仓库外下载缓存输入；缓存只替代网络
   传输，仍逐项限制大小、拒绝 symlink/重叠路径、核对固定 SHA-512，并重新验证
   解包后的 canonical aports tree；v2 receipt 会明确区分网络与缓存获取，不伪造

Compliance/RootFS/v0.3.3/EVIDENCE.json

@@ -43,9 +43,9 @@
     "engineeringReviewedLicenseCandidates": 21,
     "sourceOriginsWithRemainingLicenseReviewItems": 8,
     "indexedLicenseNoticeCandidateOrigins": 8,
-    "pinnedRemoteLicenseNoticePayloads": 10,
+    "pinnedRemoteLicenseNoticePayloads": 11,
     "supplementalAportsCandidateFiles": 46,
-    "engineeringReviewedLicenseNoticeCandidatePayloads": 77,
+    "engineeringReviewedLicenseNoticeCandidatePayloads": 78,
     "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5
   },
   "engineeringStatus": {

Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json

@@ -31,9 +31,9 @@
   "sourceOriginsWithOpenReviewItems": 10,
   "sourceOriginsWithRemainingReviewItems": 8,
   "indexedOpenSourceOrigins": 8,
-  "pinnedRemoteReferencePayloads": 10,
+  "pinnedRemoteReferencePayloads": 11,
   "supplementalAportsFiles": 46,
-  "engineeringReviewedCandidatePayloads": 77,
+  "engineeringReviewedCandidatePayloads": 78,
   "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5,
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,

Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json

@@ -95,6 +95,17 @@
       "byteCount": 1234,
       "sha256": "795b66147ea5ad692991caa7008ece551fb0fa88b9c53656223bd1518dc58ab2"
     },
+    {
+      "kind": "package-attribution",
+      "sourceOrigin": "alpine-keys",
+      "retrievalURLs": [
+        "https://gitlab.alpinelinux.org/alpine/aports/-/commit/7f1f035cf4f7bbea5cf7b65f9bbedc311d735596.patch"
+      ],
+      "cacheKey": "alpine-keys-7f1f035-license-decision.patch",
+      "outputPath": "supplemental/alpine-keys/license-decision.patch",
+      "byteCount": 772,
+      "sha256": "a939e8baa52febea02d5bcfcc306822827eac3fd979a637c7723c84af3487e3e"
+    },
     {
       "kind": "package-attribution",
       "sourceOrigin": "openssl",
@@ -174,7 +185,9 @@
         "licenses/MIT-reference.txt"
       ],
       "supplementalAportsPaths": [],
-      "remoteEvidencePaths": [],
+      "remoteEvidencePaths": [
+        "supplemental/alpine-keys/license-decision.patch"
+      ],
       "remainingReviewItems": [
         "collect-mit-license-grant-and-copyright-notice"
       ],

Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json

@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "candidateManifestSha256": "82eb3905dd0314cbced81075d78cf6940833d8908feac87a9d0c4a49f30e1e44",
+  "candidateManifestSha256": "65b61668f3535149c949ed45e166934d9d0353d73835dc2d39ee9ba31be751b2",
   "status": "candidate-payloads-engineering-reviewed-open-release-gates",
   "engineeringReviewCompleted": true,
   "allIndexedCandidatePayloadsReviewed": true,
@@ -13,8 +13,8 @@
   "legalReviewApproved": false,
   "redistributionApproved": false,
   "candidatePayloadTreeFormat": "sha256-path-lines-v1",
-  "candidatePayloadTreeSha256": "c79e6ac9edad292582e0fca75871a240463870e9384b8048ad674007f23b9aaf",
-  "reviewedPayloadFileCount": 77,
+  "candidatePayloadTreeSha256": "1291b4df5e9a7b4375afbf31de492d832b3ca693bf390a1c2619652ee0739418",
+  "reviewedPayloadFileCount": 78,
   "reviewedClosedOriginEvidenceCount": 4,
   "sourceOriginsWithRemainingReviewItems": 5,
   "sources": [
@@ -49,7 +49,7 @@
       "reviewedExistingEvidenceCount": 1,
       "reviewedReferenceLicenseCount": 1,
       "reviewedSupplementalAportsCount": 0,
-      "reviewedRemoteEvidenceCount": 0,
+      "reviewedRemoteEvidenceCount": 1,
       "resolvedReviewItems": [],
       "remainingReviewItems": [
         "collect-mit-license-grant-and-copyright-notice"

Compliance/RootFS/v0.3.3/NOTICE.md

@@ -43,13 +43,13 @@ for `libc-dev`, `zlib`.
 8 source origins still have package-specific open
 items, so this is not a complete or legally approved license/NOTICE bundle.
 `LICENSE-NOTICE-CANDIDATES.json` now pins an external candidate bundle for
-those open origins: 10 remote
+those open origins: 11 remote
 reference/attribution payloads and
 46 supplemental aports
 files, together with all checksum-bound reviewed evidence. The repository
 tool can materialize and re-verify that bundle outside the repository.
 `LICENSE-NOTICE-REVIEW-RESULTS.json` records checksum-bound engineering
-review of all 77 indexed
+review of all 78 indexed
 payload files. 3 origins have no remaining
 candidate-material engineering items; 5 origins
 still require package-specific material. Legal review and redistribution

Compliance/RootFS/v0.3.3/README.md

@@ -20,10 +20,10 @@ pinned RootFS archive. It does not store the RootFS payload.
   attribution、声明与内联 notice 的路径、大小、SHA-256 和逐包未决审查项；
 - `LICENSE-REVIEW-RESULTS.json`：对全部 21 个候选的 checksum-bound 工程复核
   结论、coverage 和未决项处置；不表示法律或再分发批准；
-- `LICENSE-NOTICE-CANDIDATES.json`：为剩余 8 个 source origin 固定 10 份远端
+- `LICENSE-NOTICE-CANDIDATES.json`：为剩余 8 个 source origin 固定 11 份远端
   许可证/attribution 材料、46 份 aports 补充文件及现有 21 份复核证据的外置候选包；
   payload 不提交，工程、法律和再分发门禁保持关闭；
-- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 77 个 payload 文件树的
+- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 78 个 payload 文件树的
   工程复核结果；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，法律和
   再分发门禁保持关闭；
 - `RUNTIME-CONFIGURATION.json`：guest、`apk`、repository、world 和 DNS 默认配置；
@@ -39,13 +39,39 @@ manifest, not a committed source archive or redistribution grant.
 `LICENSE-REVIEW-RESULTS.json` records the engineering review of all 21 pinned
 candidates. Two source origins have no remaining indexed review items; eight
 still have package-specific open items. `LICENSE-NOTICE-CANDIDATES.json`
-indexes an external candidate bundle for those eight origins: 10 pinned remote
+indexes an external candidate bundle for those eight origins: 11 pinned remote
 license/attribution payloads, 46 supplemental aports files, and the existing
 21 reviewed evidence files. `LICENSE-NOTICE-REVIEW-RESULTS.json` binds the
-engineering review to the exact 77-file payload tree. Three origins have no
+engineering review to the exact 78-file payload tree. Three origins have no
 remaining candidate-material engineering items; five still require
 package-specific material. Legal and redistribution approval remain open.
 
+`alpine-keys` 的 MIT 声明现同时绑定当前固定 aports `APKBUILD` 与上游不可变提交
+`7f1f035cf4f7bbea5cf7b65f9bbedc311d735596`：该提交由包维护者 Natanael
+Copa 将 `license` 从 `GPL` 改为 `MIT`。外置候选包保存这份 772 字节、
+SHA-256 `a939e8baa52febea02d5bcfcc306822827eac3fd979a637c7723c84af3487e3e`
+的原始补丁，用于增强许可证声明的工程 provenance。该补丁没有提供包本身的
+MIT grant；固定 SPDX MIT 文本也只是参考。固定 aports tree 的 17 个公钥
+payload 仍没有明确的包级版权声明，因此 license-text coverage 保持
+reference-only，
+`collect-mit-license-grant-and-copyright-notice` 保持未决，attribution coverage
+仍为 partial，法律与再分发门禁不变。
+
+The `alpine-keys` MIT declaration is now bound to both the current pinned
+aports `APKBUILD` and immutable upstream commit
+`7f1f035cf4f7bbea5cf7b65f9bbedc311d735596`, where package maintainer
+Natanael Copa changed `license` from `GPL` to `MIT`. The external candidate
+bundle preserves the raw 772-byte patch with SHA-256
+`a939e8baa52febea02d5bcfcc306822827eac3fd979a637c7723c84af3487e3e`
+to strengthen engineering provenance for the declaration. The patch does not
+provide the package's own MIT grant, and the pinned SPDX MIT text remains only
+a reference. The 17 public-key payloads in the pinned aports tree still have
+no explicit package-level copyright notice, so license-text coverage remains
+reference-only,
+`collect-mit-license-grant-and-copyright-notice` remains open, attribution
+coverage remains partial, and the legal and redistribution gates do not
+change.
+
 OpenSSL 的工程结论绑定固定 `openssl-3.1.4.tar.gz`：源包根目录没有
 `NOTICE` 文件；固定 RootFS 的 APK database 将 guest 路径
 `/etc/ssl/misc/CA.pl` 与 `/etc/ssl/misc/tsget.pl` 归属到 inventory 中的
@@ -243,7 +269,7 @@ advice, or redistribution approval.
 这些文件不构成完整第三方 LICENSE/NOTICE bundle、经审查的 copyleft
 corresponding-source 交付、法律意见或再分发授权。源码获取清单已完整覆盖固定
 inventory，21 个候选也都有工程复核结果；`libc-dev`、`zlib` 已关闭索引项，另外
-8 个 source origin 的 77 个新候选 payload 已完成 checksum-bound 工程复核；
+8 个 source origin 的 78 个新候选 payload 已完成 checksum-bound 工程复核；
 `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个
 origin 仍需补逐包版权/notice 材料。修改说明、构建完整性、源码提供方式、法律
 审查、App Store 2.5.2 产品策略和负责人批准仍是发行阻塞项。
@@ -252,7 +278,7 @@ These files are not a complete third-party LICENSE/NOTICE bundle, reviewed
 copyleft corresponding-source delivery, legal advice, or redistribution
 approval. The acquisition manifest completely covers the pinned inventory and
 all 21 indexed candidates have engineering review results. `libc-dev` and
-`zlib` have no remaining indexed items. All 77 newly indexed payloads have a
+`zlib` have no remaining indexed items. All 78 newly indexed payloads have a
 checksum-bound engineering review; `apk-tools`, `openssl`, and `pax-utils`
 have no remaining candidate-material engineering items, while five origins
 still need package-specific copyright/notice material. Modification, build

Compliance/RootFS/v0.3.3/SHA256SUMS

@@ -1,10 +1,10 @@
-47e96d72ae690bf941bdf05bdc0eb9b1fb8f24e320d927109a6c3425d51abe7a  EVIDENCE.json
-2fa98989f7725bed0e82db2f5350d74893b732395227974d77a9ca55147da842  LICENSE-INVENTORY.json
-82eb3905dd0314cbced81075d78cf6940833d8908feac87a9d0c4a49f30e1e44  LICENSE-NOTICE-CANDIDATES.json
-0ae4a280c5c418bd54b00ae9e7a2dec16122d2d0cf61b34fd1e338598600cdfc  LICENSE-NOTICE-REVIEW-RESULTS.json
+372abe76057ea5573999c38db5ca92a180a99c0b1d10b61342a6cccc1a1dff09  EVIDENCE.json
+8d82477fb7076d2f5582a1b8a29675e3d4ec029bf54c7ed01fb4dd8fb47deb0f  LICENSE-INVENTORY.json
+65b61668f3535149c949ed45e166934d9d0353d73835dc2d39ee9ba31be751b2  LICENSE-NOTICE-CANDIDATES.json
+d6d1ec6f3a487d9d9f048486e7ad05a698caf6f25ca2bf6bb7e0d45aec03fbc6  LICENSE-NOTICE-REVIEW-RESULTS.json
 3c7f786d9551d716c2a8b374d8cc63d11a46d67827be2fa0cea73b51b6b92eda  LICENSE-REVIEW-RESULTS.json
 3d483714a09cb2194e1b4af9aef5dfec2fbcfd44c70d521899398a3893f1908a  LICENSE-REVIEW.json
-b0fd80c51c7276c65d4122e65c628f2ef3cb67a5170fb6577f5399a93c848938  NOTICE.md
+4573a70b9fded20bd65d72ae4d63908a9c13e5c2f5ac6c95a1f926fb068ab1f6  NOTICE.md
 4f7f7626f3d0891a29717e4b7932c36004ecc9aac25a4aa104c300aae979e3e1  PACKAGE-INVENTORY.tsv
 dbca9b285015a0d8b1d339a894b4594c9e335cbc2d7f9d5212a41095ae4bd1e1  RUNTIME-CONFIGURATION.json
 8e021cb8c4160c934a0202609691d7a94526cd016f4394a47da6e7a5ab41d0ea  SBOM.spdx.json

Docs/ReleaseCompliance.md

@@ -75,9 +75,9 @@ aports snapshot/upstream distfile 获取清单和仓库外 materializer，并固
 全部 10 个 source origin 的 21 个 license、attribution、声明与内联 notice 候选。
 第二个仓库外工具从已验证 source-review 目录提取这些候选；固定结果清单记录
 21/21 个候选均已工程复核，`libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source
-origin 仍有逐包未决项。仓库现已为这 8 个 origin 固定外置候选包：10 份远端
+origin 仍有逐包未决项。仓库现已为这 8 个 origin 固定外置候选包：11 份远端
 许可证/attribution 材料、46 份 aports 补充文件和全部既有复核证据；工具可在
-仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 77 文件 payload
+仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 78 文件 payload
 tree；`apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个
 origin 仍需补逐包材料。修改与构建完整性、源码提供方式和法律审查仍未完成，
 不能视为完整 NOTICE 或已批准的对应源码交付。
@@ -179,7 +179,7 @@ Alpine `apk` 可以下载、安装和执行新增代码。即使初始 RootFS 
 - [x] 对固定的 21 个 license/NOTICE 候选完成 checksum-bound 工程复核。
 - [x] 为剩余 8 个 source origin 建立 checksum-bound 外置候选包索引与可复验
   materializer；payload 不提交且批准门禁保持关闭。
-- [x] 对外置候选包的 77 个 payload 完成 checksum-bound 工程复核并固定结果；
+- [x] 对外置候选包的 78 个 payload 完成 checksum-bound 工程复核并固定结果；
   3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料。
 - [ ] 收集 license text 和 NOTICE。
 - [ ] 建立 copyleft corresponding source bundle。

Docs/Roadmap.md

@@ -103,7 +103,7 @@
 | 最低 Xcode 16 原生兼容 | 已通过 | Xcode 16.0 / iOS 18.0 SDK 完成 RootFS install、Simulator/device final-link 和 17 项 native smoke |
 | App lifecycle 与内存 | 进行中 | Simulator 与 Jack iPhone 均有 256 MiB `ru_maxrss` 门禁；真机 process suspend/resume、UIKit foreground/background、强制终止后数据恢复和有界 App delegate memory-warning 回调恢复已通过；补真实 memory pressure/jetsam |
 | RootFS ENOSPC/掉电 | 进行中 | 峰值空间预检、全 ENOSPC、七点持久化屏障、确定性掉电切点和 Jack iPhone 受限容量/ENOSPC 清理恢复已覆盖；补真实 storage pressure/强制断电 |
-| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、21/21 初始候选和 77/77 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 |
+| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、21/21 初始候选和 78/78 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 |
 | App Store 2.5.2 | 阻塞 | guest download/execute policy 有书面结论 |
 
 ### 后续 runtime 执行顺序

Docs/RootFS.md

@@ -5,7 +5,7 @@
 RootFS 是 PocketRoot 的外部供应链输入，不是普通测试 fixture。仓库提交的是不可变清单、校验和安全安装代码，不提交、镜像或默认打包 RootFS 二进制。
 
 > [!WARNING]
-> 固定 v0.3.3 归档已有可复现 package inventory、SPDX SBOM、默认配置证据、完整覆盖 inventory 的源码获取清单，以及 21 个初始候选和 77 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核结果；3 个 origin 的候选材料工程项已关闭，5 个仍需补逐包材料。完整 NOTICE、法律复核、对应源码交付审查与发行批准尚未闭环。以下 URL 与命令用于审计和本地开发，不构成公开再分发授权。应用必须先完成自己的法律与发行审查。
+> 固定 v0.3.3 归档已有可复现 package inventory、SPDX SBOM、默认配置证据、完整覆盖 inventory 的源码获取清单，以及 21 个初始候选和 78 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核结果；3 个 origin 的候选材料工程项已关闭，5 个仍需补逐包材料。完整 NOTICE、法律复核、对应源码交付审查与发行批准尚未闭环。以下 URL 与命令用于审计和本地开发，不构成公开再分发授权。应用必须先完成自己的法律与发行审查。
 
 ## 1. 固定清单
 
@@ -143,7 +143,7 @@ SHA-256、精确路径集合与无链接/特殊节点边界。固定结果清单
 工程复核，其中 `libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source origin 仍有
 未决项；输出不能直接视为完整 NOTICE 或对应源码交付材料。
 
-剩余 8 个 origin 的外置 LICENSE/NOTICE 候选包清单还固定了 10 份远端许可证/
+剩余 8 个 origin 的外置 LICENSE/NOTICE 候选包清单还固定了 11 份远端许可证/
 attribution 材料与 46 份 aports 补充文件。清单可独立校验；实际物化和复验必须
 同时提供上面已经验证的两个仓库外目录：
 
@@ -167,7 +167,7 @@ ruby Scripts/rootfs-license-notice-review-results.rb \
 ```
 
 工具对远端材料强制 HTTPS、重定向次数、响应大小、固定字节数与 SHA-256，并原子
-创建输出。结果清单把工程复核绑定到精确的 77 文件 payload tree；复验器拒绝路径
+创建输出。结果清单把工程复核绑定到精确的 78 文件 payload tree；复验器拒绝路径
 漂移、符号链接、特殊节点、已知摘要漂移和 tree digest 漂移。`apk-tools`、
 `openssl` 与 `pax-utils` 的候选材料工程项已关闭，另外 5 个 origin 仍需补逐包
 材料；候选 NOTICE 和 receipt 不代表法律审查或发行批准。