jacklv-coder · jacklv-coder · Jul 26, 2026 · Jul 26, 2026
diff --git a/CHANGELOG.en.md b/CHANGELOG.en.md
@@ -38,16 +38,17 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit
   redistribution gates remain closed.
 - A checksum-bound `LICENSE-NOTICE-CANDIDATES.json`, strict validator, and
   outside-repository atomic materializer for the eight remaining RootFS source
-  origins. It indexes 13 remote license/attribution payloads, 46 aports files,
+  origins. It indexes 13 remote license/attribution payloads, 47 aports files,
   and the 21 existing evidence files for complete re-verification without
   committing payloads or opening engineering, legal, or redistribution gates.
 - `LICENSE-NOTICE-REVIEW-RESULTS.json` and a strict external payload-tree
-  verifier. All 80 candidate payloads now have checksum-bound engineering
+  verifier. All 81 candidate payloads now have checksum-bound engineering
   review. The pinned upstream `alpine-keys` GPL-to-MIT license-decision commit
   is included while its package-level copyright notice remains open. The
   `ca-certificates` generator is byte-identical to curl commit `3fdc4bdb`, and
   that exact revision's curl license is pinned while trust-store review stays
-  open;
+  open. The pinned BusyBox configuration now binds enabled bzip2 support to
+  its exact source license while other inline third-party notices stay open;
   `apk-tools`, `openssl`, and `pax-utils` have no remaining
   candidate-material engineering items, five origins still need
   package-specific material, and

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -35,13 +35,15 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se
   法律与再分发门禁保持关闭。
 - 为剩余 8 个 RootFS source origin 加入 checksum-bound
   `LICENSE-NOTICE-CANDIDATES.json`、严格验证器和仓库外原子 materializer；索引
-  13 份远端许可证/attribution 材料、46 份 aports 文件与 21 份既有证据，支持完整
+  13 份远端许可证/attribution 材料、47 份 aports 文件与 21 份既有证据，支持完整
   复验，但不提交 payload，也不解除工程、法律或再分发门禁。
 - 加入 `LICENSE-NOTICE-REVIEW-RESULTS.json` 和严格外置 payload-tree 复验器；
-  80/80 个候选 payload 已完成 checksum-bound 工程复核；新增固定
+  81/81 个候选 payload 已完成 checksum-bound 工程复核；新增固定
   `alpine-keys` GPL→MIT 上游许可判定提交，但仍保留包级版权声明缺口；
   `ca-certificates` 生成脚本与 curl 提交 `3fdc4bdb` 字节一致并固定该精确
   revision 的 curl 授权文本，trust-store 审查仍保持未决；
+  BusyBox 固定配置确认 bzip2 与源包内精确授权绑定，其他内联第三方 notices
+  继续保持未决；
   `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项关闭，另外 5 个 origin
   仍需补逐包材料，法律和再分发门禁保持关闭。
 - RootFS source-review materializer 新增严格仓库外下载缓存输入；缓存只替代网络

diff --git a/Compliance/RootFS/v0.3.3/EVIDENCE.json b/Compliance/RootFS/v0.3.3/EVIDENCE.json
@@ -44,8 +44,8 @@
     "sourceOriginsWithRemainingLicenseReviewItems": 8,
     "indexedLicenseNoticeCandidateOrigins": 8,
     "pinnedRemoteLicenseNoticePayloads": 13,
-    "supplementalAportsCandidateFiles": 46,
-    "engineeringReviewedLicenseNoticeCandidatePayloads": 80,
+    "supplementalAportsCandidateFiles": 47,
+    "engineeringReviewedLicenseNoticeCandidatePayloads": 81,
     "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5
   },
   "engineeringStatus": {

diff --git a/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json b/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json
@@ -32,8 +32,8 @@
   "sourceOriginsWithRemainingReviewItems": 8,
   "indexedOpenSourceOrigins": 8,
   "pinnedRemoteReferencePayloads": 13,
-  "supplementalAportsFiles": 46,
-  "engineeringReviewedCandidatePayloads": 80,
+  "supplementalAportsFiles": 47,
+  "engineeringReviewedCandidatePayloads": 81,
   "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5,
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,

diff --git a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json
@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "licenseReviewResultsSha256": "3c7f786d9551d716c2a8b374d8cc63d11a46d67827be2fa0cea73b51b6b92eda",
+  "licenseReviewResultsSha256": "168230d46cf5933a9183c60e572e1a663417f63fe79998540b53887f7cdc2cb8",
   "status": "candidate-bundle-indexed-engineering-review-required",
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,
@@ -285,12 +285,14 @@
         "aports/busybox/0033-find-fix-xdev-depth-and-delete.patch",
         "aports/busybox/0034-udhcp-Avoid-leaking-uninitialized-stale-data.patch",
         "aports/busybox/bbsuid.c",
+        "aports/busybox/busyboxconfig",
         "aports/busybox/dad.if-up",
         "aports/busybox/default.script"
       ],
       "remoteEvidencePaths": [],
       "remainingReviewItems": [
-        "review-bundled-third-party-license-and-attribution-coverage",
+        "confirm-enabled-bzip2-license-and-attribution-coverage",
+        "review-other-bundled-third-party-license-and-attribution-coverage",
         "confirm-aports-patch-notices"
       ],
       "candidateState": "collected-engineering-review-required"

diff --git a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json
@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "candidateManifestSha256": "7df6c1d6dee4e95775fd21112a6b074d584eb2661ac019b7309f3e6f1e4c1584",
+  "candidateManifestSha256": "487a59b8814bb263b1e4109fe46b9dcd11f8d0300d9b06394a4fc9764ee6cf03",
   "status": "candidate-payloads-engineering-reviewed-open-release-gates",
   "engineeringReviewCompleted": true,
   "allIndexedCandidatePayloadsReviewed": true,
@@ -13,8 +13,8 @@
   "legalReviewApproved": false,
   "redistributionApproved": false,
   "candidatePayloadTreeFormat": "sha256-path-lines-v1",
-  "candidatePayloadTreeSha256": "98efff580466a00ba3f265f21c4cadab97f704551b61b1bcaae8c25ff27864d0",
-  "reviewedPayloadFileCount": 80,
+  "candidatePayloadTreeSha256": "03d388ba35900f7c6bf0cc1782905f4644c30068fe43b3a159f68e36a766cbca",
+  "reviewedPayloadFileCount": 81,
   "reviewedClosedOriginEvidenceCount": 4,
   "sourceOriginsWithRemainingReviewItems": 5,
   "sources": [
@@ -84,13 +84,14 @@
       "attributionCoverage": "partial",
       "reviewedExistingEvidenceCount": 3,
       "reviewedReferenceLicenseCount": 1,
-      "reviewedSupplementalAportsCount": 36,
+      "reviewedSupplementalAportsCount": 37,
       "reviewedRemoteEvidenceCount": 0,
       "resolvedReviewItems": [
-        "confirm-aports-patch-notices"
+        "confirm-aports-patch-notices",
+        "confirm-enabled-bzip2-license-and-attribution-coverage"
       ],
       "remainingReviewItems": [
-        "review-bundled-third-party-license-and-attribution-coverage"
+        "review-other-bundled-third-party-license-and-attribution-coverage"
       ],
       "engineeringConclusion": "additional-package-material-required"
     },

diff --git a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json
@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "licenseReviewManifestSha256": "3d483714a09cb2194e1b4af9aef5dfec2fbcfd44c70d521899398a3893f1908a",
+  "licenseReviewManifestSha256": "f3f7997a06a87064295e91b4c7f9dd37bb71b1ac1cc24d1b77156ca66f9d606e",
   "status": "engineering-reviewed-open-release-gates",
   "engineeringReviewCompleted": true,
   "allCandidateDigestsVerified": true,
@@ -108,7 +108,8 @@
       ],
       "resolvedReviewItems": [],
       "remainingReviewItems": [
-        "review-bundled-third-party-license-and-attribution-coverage",
+        "confirm-enabled-bzip2-license-and-attribution-coverage",
+        "review-other-bundled-third-party-license-and-attribution-coverage",
         "confirm-aports-patch-notices"
       ]
     },

diff --git a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json
@@ -155,7 +155,8 @@
         }
       ],
       "openReviewItems": [
-        "review-bundled-third-party-license-and-attribution-coverage",
+        "confirm-enabled-bzip2-license-and-attribution-coverage",
+        "review-other-bundled-third-party-license-and-attribution-coverage",
         "confirm-aports-patch-notices"
       ]
     },

diff --git a/Compliance/RootFS/v0.3.3/NOTICE.md b/Compliance/RootFS/v0.3.3/NOTICE.md
@@ -45,11 +45,11 @@ items, so this is not a complete or legally approved license/NOTICE bundle.
 `LICENSE-NOTICE-CANDIDATES.json` now pins an external candidate bundle for
 those open origins: 13 remote
 reference/attribution payloads and
-46 supplemental aports
+47 supplemental aports
 files, together with all checksum-bound reviewed evidence. The repository
 tool can materialize and re-verify that bundle outside the repository.
 `LICENSE-NOTICE-REVIEW-RESULTS.json` records checksum-bound engineering
-review of all 80 indexed
+review of all 81 indexed
 payload files. 3 origins have no remaining
 candidate-material engineering items; 5 origins
 still require package-specific material. Legal review and redistribution

diff --git a/Compliance/RootFS/v0.3.3/README.md b/Compliance/RootFS/v0.3.3/README.md
@@ -21,9 +21,9 @@ pinned RootFS archive. It does not store the RootFS payload.
 - `LICENSE-REVIEW-RESULTS.json`：对全部 21 个候选的 checksum-bound 工程复核
   结论、coverage 和未决项处置；不表示法律或再分发批准；
 - `LICENSE-NOTICE-CANDIDATES.json`：为剩余 8 个 source origin 固定 13 份远端
-  许可证/attribution 材料、46 份 aports 补充文件及现有 21 份复核证据的外置候选包；
+  许可证/attribution 材料、47 份 aports 补充文件及现有 21 份复核证据的外置候选包；
   payload 不提交，工程、法律和再分发门禁保持关闭；
-- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 80 个 payload 文件树的
+- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 81 个 payload 文件树的
   工程复核结果；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，法律和
   再分发门禁保持关闭；
 - `RUNTIME-CONFIGURATION.json`：guest、`apk`、repository、world 和 DNS 默认配置；
@@ -40,9 +40,9 @@ manifest, not a committed source archive or redistribution grant.
 candidates. Two source origins have no remaining indexed review items; eight
 still have package-specific open items. `LICENSE-NOTICE-CANDIDATES.json`
 indexes an external candidate bundle for those eight origins: 13 pinned remote
-license/attribution payloads, 46 supplemental aports files, and the existing
+license/attribution payloads, 47 supplemental aports files, and the existing
 21 reviewed evidence files. `LICENSE-NOTICE-REVIEW-RESULTS.json` binds the
-engineering review to the exact 80-file payload tree. Three origins have no
+engineering review to the exact 81-file payload tree. Three origins have no
 remaining candidate-material engineering items; five still require
 package-specific material. Legal and redistribution approval remain open.
 
@@ -72,6 +72,38 @@ reference-only,
 coverage remains partial, and the legal and redistribution gates do not
 change.
 
+固定 aports 提交 `d1b6f274f29076967826e0ecf6ebcaa5d360272f` 的
+`busyboxconfig` 为 31,529 字节，SHA-256
+`18d78e185ff0cccd6ccd09f4f78c5780175d78214e16acd1390e4ee85c74346e`；
+其中精确启用了 `CONFIG_BZIP2=y`、`CONFIG_BZIP2_SMALL=8` 和
+`CONFIG_FEATURE_BZIP2_DECOMPRESS=y`。外置候选树现同时绑定该配置与固定
+BusyBox 1.36.1 源包中的 1,999 字节
+`archival/libarchive/bz/LICENSE`（SHA-256
+`b5a136ed67798e51fe2e0ca0b2a21cb01b904ff0c9f7d563a6292e276607e58f`），
+从而在工程层关闭
+`confirm-enabled-bzip2-license-and-attribution-coverage`。BusyBox 其他已启用
+组件的内联第三方 notice 尚未形成完整集合，因此 license-text 与 attribution
+coverage 均保持 partial，
+`review-other-bundled-third-party-license-and-attribution-coverage` 保持未决，
+法律与再分发门禁不变。
+
+The `busyboxconfig` at pinned aports commit
+`d1b6f274f29076967826e0ecf6ebcaa5d360272f` is 31,529 bytes with SHA-256
+`18d78e185ff0cccd6ccd09f4f78c5780175d78214e16acd1390e4ee85c74346e`.
+It explicitly enables `CONFIG_BZIP2=y`, `CONFIG_BZIP2_SMALL=8`, and
+`CONFIG_FEATURE_BZIP2_DECOMPRESS=y`. The external candidate tree now binds
+that configuration to the 1,999-byte
+`archival/libarchive/bz/LICENSE` in the pinned BusyBox 1.36.1 source archive,
+whose SHA-256 is
+`b5a136ed67798e51fe2e0ca0b2a21cb01b904ff0c9f7d563a6292e276607e58f`.
+This closes
+`confirm-enabled-bzip2-license-and-attribution-coverage` at the engineering
+level. A complete set of inline third-party notices for BusyBox's other
+enabled components is still missing, so license-text and attribution coverage
+remain partial,
+`review-other-bundled-third-party-license-and-attribution-coverage` remains
+open, and the legal and redistribution gates do not change.
+
 `ca-certificates-20230506.tar.bz2` 中的 `mk-ca-bundle.pl`（20,863 字节，
 SHA-256 `9d828d97053868907ce6229d132132f0f26772393405dadd037b6f85a5c5b219`）
 与 curl 提交 `3fdc4bdb5b00835a1d04cf160cd61fe7f8feb477` 的
@@ -296,7 +328,7 @@ advice, or redistribution approval.
 这些文件不构成完整第三方 LICENSE/NOTICE bundle、经审查的 copyleft
 corresponding-source 交付、法律意见或再分发授权。源码获取清单已完整覆盖固定
 inventory，21 个候选也都有工程复核结果；`libc-dev`、`zlib` 已关闭索引项，另外
-8 个 source origin 的 80 个新候选 payload 已完成 checksum-bound 工程复核；
+8 个 source origin 的 81 个新候选 payload 已完成 checksum-bound 工程复核；
 `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个
 origin 仍需补逐包版权/notice 材料。修改说明、构建完整性、源码提供方式、法律
 审查、App Store 2.5.2 产品策略和负责人批准仍是发行阻塞项。
@@ -305,7 +337,7 @@ These files are not a complete third-party LICENSE/NOTICE bundle, reviewed
 copyleft corresponding-source delivery, legal advice, or redistribution
 approval. The acquisition manifest completely covers the pinned inventory and
 all 21 indexed candidates have engineering review results. `libc-dev` and
-`zlib` have no remaining indexed items. All 80 newly indexed payloads have a
+`zlib` have no remaining indexed items. All 81 newly indexed payloads have a
 checksum-bound engineering review; `apk-tools`, `openssl`, and `pax-utils`
 have no remaining candidate-material engineering items, while five origins
 still need package-specific copyright/notice material. Modification, build

diff --git a/Compliance/RootFS/v0.3.3/SHA256SUMS b/Compliance/RootFS/v0.3.3/SHA256SUMS
@@ -1,10 +1,10 @@
-d10ce04e007c10aea2112c8e654e41fbde6099ea18d96ae11dea434e4f5f708d  EVIDENCE.json
-f5a8d7fbd5b5a1664bf95c4e5dd3611994f03adff20ab77f378cdbc15900afdd  LICENSE-INVENTORY.json
-7df6c1d6dee4e95775fd21112a6b074d584eb2661ac019b7309f3e6f1e4c1584  LICENSE-NOTICE-CANDIDATES.json
-391ab116ec79ae5fd30b126384564a562fa857070b0276c711fb4e0ff4cf3d69  LICENSE-NOTICE-REVIEW-RESULTS.json
-3c7f786d9551d716c2a8b374d8cc63d11a46d67827be2fa0cea73b51b6b92eda  LICENSE-REVIEW-RESULTS.json
-3d483714a09cb2194e1b4af9aef5dfec2fbcfd44c70d521899398a3893f1908a  LICENSE-REVIEW.json
-710bb926e90d10572b6d4b07a59090ce480e1159e2ed4a774722a30272d4539e  NOTICE.md
+ab4f872dd7a01195401b3810ae8e79c825860ab9ad16f4cb7a0eaf44b5021a3e  EVIDENCE.json
+c7649aecc8c509e4bdcbca01b495d9298134c1e5979f90b5a0c76beadc0787b1  LICENSE-INVENTORY.json
+487a59b8814bb263b1e4109fe46b9dcd11f8d0300d9b06394a4fc9764ee6cf03  LICENSE-NOTICE-CANDIDATES.json
+2e64296adeb7d0cf8d56b2893b0ddbd2db2fecd7896122736b82d9ad2bf6121b  LICENSE-NOTICE-REVIEW-RESULTS.json
+168230d46cf5933a9183c60e572e1a663417f63fe79998540b53887f7cdc2cb8  LICENSE-REVIEW-RESULTS.json
+f3f7997a06a87064295e91b4c7f9dd37bb71b1ac1cc24d1b77156ca66f9d606e  LICENSE-REVIEW.json
+21169d70c7ee0020d36c698cd7f1564d7e2d69e90632edec17f7e8508e54ab12  NOTICE.md
 4f7f7626f3d0891a29717e4b7932c36004ecc9aac25a4aa104c300aae979e3e1  PACKAGE-INVENTORY.tsv
 dbca9b285015a0d8b1d339a894b4594c9e335cbc2d7f9d5212a41095ae4bd1e1  RUNTIME-CONFIGURATION.json
 8e021cb8c4160c934a0202609691d7a94526cd016f4394a47da6e7a5ab41d0ea  SBOM.spdx.json

diff --git a/Docs/ReleaseCompliance.md b/Docs/ReleaseCompliance.md
@@ -76,8 +76,8 @@ aports snapshot/upstream distfile 获取清单和仓库外 materializer，并固
 第二个仓库外工具从已验证 source-review 目录提取这些候选；固定结果清单记录
 21/21 个候选均已工程复核，`libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source
 origin 仍有逐包未决项。仓库现已为这 8 个 origin 固定外置候选包：13 份远端
-许可证/attribution 材料、46 份 aports 补充文件和全部既有复核证据；工具可在
-仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 80 文件 payload
+许可证/attribution 材料、47 份 aports 补充文件和全部既有复核证据；工具可在
+仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 81 文件 payload
 tree；`apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个
 origin 仍需补逐包材料。修改与构建完整性、源码提供方式和法律审查仍未完成，
 不能视为完整 NOTICE 或已批准的对应源码交付。
@@ -179,7 +179,7 @@ Alpine `apk` 可以下载、安装和执行新增代码。即使初始 RootFS
 - [x] 对固定的 21 个 license/NOTICE 候选完成 checksum-bound 工程复核。
 - [x] 为剩余 8 个 source origin 建立 checksum-bound 外置候选包索引与可复验
   materializer；payload 不提交且批准门禁保持关闭。
-- [x] 对外置候选包的 80 个 payload 完成 checksum-bound 工程复核并固定结果；
+- [x] 对外置候选包的 81 个 payload 完成 checksum-bound 工程复核并固定结果；
   3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料。
 - [ ] 收集 license text 和 NOTICE。
 - [ ] 建立 copyleft corresponding source bundle。

diff --git a/Docs/Roadmap.md b/Docs/Roadmap.md
@@ -103,7 +103,7 @@
 | 最低 Xcode 16 原生兼容 | 已通过 | Xcode 16.0 / iOS 18.0 SDK 完成 RootFS install、Simulator/device final-link 和 17 项 native smoke |
 | App lifecycle 与内存 | 进行中 | Simulator 与 Jack iPhone 均有 256 MiB `ru_maxrss` 门禁；真机 process suspend/resume、UIKit foreground/background、强制终止后数据恢复和有界 App delegate memory-warning 回调恢复已通过；补真实 memory pressure/jetsam |
 | RootFS ENOSPC/掉电 | 进行中 | 峰值空间预检、全 ENOSPC、七点持久化屏障、确定性掉电切点和 Jack iPhone 受限容量/ENOSPC 清理恢复已覆盖；补真实 storage pressure/强制断电 |
-| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、21/21 初始候选和 80/80 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 |
+| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、21/21 初始候选和 81/81 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 |
 | App Store 2.5.2 | 阻塞 | guest download/execute policy 有书面结论 |
 
 ### 后续 runtime 执行顺序