Pin BusyBox env notice

CHANGELOG.en.md

@@ -32,25 +32,26 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit
   declared-license/attribution inventories, and default `apk`, repository, and
   DNS configuration; complete LICENSE/NOTICE and corresponding-source bundles
   remain distribution blockers.
-- A checksum-bound `LICENSE-REVIEW-RESULTS.json` and strict validator. All 22
+- A checksum-bound `LICENSE-REVIEW-RESULTS.json` and strict validator. All 23
   pinned RootFS license/NOTICE candidates have engineering review results;
   eight source origins retain package-level open items, and legal and
   redistribution gates remain closed.
 - A checksum-bound `LICENSE-NOTICE-CANDIDATES.json`, strict validator, and
   outside-repository atomic materializer for the eight remaining RootFS source
   origins. It indexes 13 remote license/attribution payloads, 47 aports files,
-  and the 22 existing evidence files for complete re-verification without
+  and the 23 existing evidence files for complete re-verification without
   committing payloads or opening engineering, legal, or redistribution gates.
 - `LICENSE-NOTICE-REVIEW-RESULTS.json` and a strict external payload-tree
-  verifier. All 82 candidate payloads now have checksum-bound engineering
+  verifier. All 83 candidate payloads now have checksum-bound engineering
   review. The pinned upstream `alpine-keys` GPL-to-MIT license-decision commit
   is included while its package-level copyright notice remains open. The
   `ca-certificates` generator is byte-identical to curl commit `3fdc4bdb`, and
   that exact revision's curl license is pinned while trust-store review stays
   open. The pinned BusyBox configuration now binds enabled bzip2 support to
-  its exact source license and confirms that enabled ash arithmetic links
-  `shell/math.c`, which retains complete MIT and BSD-3-Clause notices, while
-  other inline third-party notices stay open;
+  its exact source license, confirms that enabled ash arithmetic links
+  `shell/math.c`, which retains complete MIT and BSD-3-Clause notices, and
+  confirms that the installed `env` applet links `coreutils/env.c`, which
+  retains its complete BSD notice; other inline third-party notices stay open;
   `apk-tools`, `openssl`, and `pax-utils` have no remaining
   candidate-material engineering items, five origins still need
   package-specific material, and

CHANGELOG.md

@@ -30,20 +30,21 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se
   10 个 source origin、SPDX 2.3 JSON SBOM、许可证声明/attribution inventory
   和 `apk`、repository、DNS 默认配置快照；完整 LICENSE/NOTICE 与对应源码 bundle
   仍保持发行阻塞。
-- 加入 checksum-bound `LICENSE-REVIEW-RESULTS.json` 和严格验证器；22/22 个固定
+- 加入 checksum-bound `LICENSE-REVIEW-RESULTS.json` 和严格验证器；23/23 个固定
   RootFS license/NOTICE 候选已完成工程复核，8 个 source origin 仍有包级未决项，
   法律与再分发门禁保持关闭。
 - 为剩余 8 个 RootFS source origin 加入 checksum-bound
   `LICENSE-NOTICE-CANDIDATES.json`、严格验证器和仓库外原子 materializer；索引
-  13 份远端许可证/attribution 材料、47 份 aports 文件与 22 份既有证据，支持完整
+  13 份远端许可证/attribution 材料、47 份 aports 文件与 23 份既有证据，支持完整
   复验，但不提交 payload，也不解除工程、法律或再分发门禁。
 - 加入 `LICENSE-NOTICE-REVIEW-RESULTS.json` 和严格外置 payload-tree 复验器；
-  82/82 个候选 payload 已完成 checksum-bound 工程复核；新增固定
+  83/83 个候选 payload 已完成 checksum-bound 工程复核；新增固定
   `alpine-keys` GPL→MIT 上游许可判定提交，但仍保留包级版权声明缺口；
   `ca-certificates` 生成脚本与 curl 提交 `3fdc4bdb` 字节一致并固定该精确
   revision 的 curl 授权文本，trust-store 审查仍保持未决；
-  BusyBox 固定配置确认 bzip2 与源包内精确授权绑定，并确认启用的 ash 算术模块
-  链入保留完整 MIT 与 BSD-3-Clause notices 的 `shell/math.c`；其他内联第三方
+  BusyBox 固定配置确认 bzip2 与源包内精确授权绑定，确认启用的 ash 算术模块
+  链入保留完整 MIT 与 BSD-3-Clause notices 的 `shell/math.c`，并确认已安装的
+  `env` applet 链入保留完整 BSD notice 的 `coreutils/env.c`；其他内联第三方
   notices 继续保持未决；
   `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项关闭，另外 5 个 origin
   仍需补逐包材料，法律和再分发门禁保持关闭。

Compliance/RootFS/v0.3.3/EVIDENCE.json

@@ -39,13 +39,13 @@
     "sourceOrigins": 10,
     "declaredLicenseExpressions": 7,
     "licenseOrNoticeFilesInGuestTemplate": 0,
-    "indexedExternalLicenseReviewCandidates": 22,
-    "engineeringReviewedLicenseCandidates": 22,
+    "indexedExternalLicenseReviewCandidates": 23,
+    "engineeringReviewedLicenseCandidates": 23,
     "sourceOriginsWithRemainingLicenseReviewItems": 8,
     "indexedLicenseNoticeCandidateOrigins": 8,
     "pinnedRemoteLicenseNoticePayloads": 13,
     "supplementalAportsCandidateFiles": 47,
-    "engineeringReviewedLicenseNoticeCandidatePayloads": 82,
+    "engineeringReviewedLicenseNoticeCandidatePayloads": 83,
     "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5
   },
   "engineeringStatus": {

Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json

@@ -26,14 +26,14 @@
   "licenseOrNoticeFilesFoundInGuestTemplate": [
 
   ],
-  "indexedExternalReviewCandidates": 22,
-  "engineeringReviewedCandidates": 22,
+  "indexedExternalReviewCandidates": 23,
+  "engineeringReviewedCandidates": 23,
   "sourceOriginsWithOpenReviewItems": 10,
   "sourceOriginsWithRemainingReviewItems": 8,
   "indexedOpenSourceOrigins": 8,
   "pinnedRemoteReferencePayloads": 13,
   "supplementalAportsFiles": 47,
-  "engineeringReviewedCandidatePayloads": 82,
+  "engineeringReviewedCandidatePayloads": 83,
   "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5,
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,

Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json

@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "licenseReviewResultsSha256": "f2d53935baf0dffe43a3e68b3a1151a3d5d6a497ab2793592487919014b12577",
+  "licenseReviewResultsSha256": "1c714f4b65e01a1a35cbfa58a8b964e511c67187e00a010d7036439f6c013d43",
   "status": "candidate-bundle-indexed-engineering-review-required",
   "candidateBundleIndexComplete": true,
   "candidatePayloadCommitted": false,
@@ -246,7 +246,8 @@
         "evidence/busybox/AUTHORS",
         "evidence/busybox/LICENSE",
         "evidence/busybox/bzip2-LICENSE",
-        "evidence/busybox/shell-math.c"
+        "evidence/busybox/shell-math.c",
+        "evidence/busybox/coreutils-env.c"
       ],
       "referenceLicensePaths": [
         "licenses/GPL-2.0.txt"
@@ -294,6 +295,7 @@
       "remainingReviewItems": [
         "confirm-enabled-bzip2-license-and-attribution-coverage",
         "confirm-enabled-ash-math-license-and-attribution-coverage",
+        "confirm-enabled-env-license-and-attribution-coverage",
         "review-other-bundled-third-party-license-and-attribution-coverage",
         "confirm-aports-patch-notices"
       ],

Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json

@@ -4,7 +4,7 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "candidateManifestSha256": "04e1cd4b1e0f51c396a36fef432640a576a5f33e1ec802bd135d96fd3ce7da2f",
+  "candidateManifestSha256": "5b64ca8c2312ce190bdcf8d80c14fdc5155d78b7b2469404a0e4180e1281e2ec",
   "status": "candidate-payloads-engineering-reviewed-open-release-gates",
   "engineeringReviewCompleted": true,
   "allIndexedCandidatePayloadsReviewed": true,
@@ -13,8 +13,8 @@
   "legalReviewApproved": false,
   "redistributionApproved": false,
   "candidatePayloadTreeFormat": "sha256-path-lines-v1",
-  "candidatePayloadTreeSha256": "b0a7ffeb09f02b3b751a4cf29dbb8ce65658b60c70316ea3c295c7bdb8360349",
-  "reviewedPayloadFileCount": 82,
+  "candidatePayloadTreeSha256": "0b8a148b1af67eca6737eb57ad0a66d0f34d06212a952f96bc6f1b65dc7c5fe1",
+  "reviewedPayloadFileCount": 83,
   "reviewedClosedOriginEvidenceCount": 4,
   "sourceOriginsWithRemainingReviewItems": 5,
   "sources": [
@@ -82,14 +82,15 @@
       "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open",
       "licenseTextCoverage": "partial",
       "attributionCoverage": "partial",
-      "reviewedExistingEvidenceCount": 4,
+      "reviewedExistingEvidenceCount": 5,
       "reviewedReferenceLicenseCount": 1,
       "reviewedSupplementalAportsCount": 37,
       "reviewedRemoteEvidenceCount": 0,
       "resolvedReviewItems": [
         "confirm-aports-patch-notices",
         "confirm-enabled-bzip2-license-and-attribution-coverage",
-        "confirm-enabled-ash-math-license-and-attribution-coverage"
+        "confirm-enabled-ash-math-license-and-attribution-coverage",
+        "confirm-enabled-env-license-and-attribution-coverage"
       ],
       "remainingReviewItems": [
         "review-other-bundled-third-party-license-and-attribution-coverage"

Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json

@@ -4,11 +4,11 @@
     "version": "v0.3.3",
     "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4"
   },
-  "licenseReviewManifestSha256": "956ec98fd3ec39f8f277b8293c85f4d7ed9841d7754f563e91638521c29cf989",
+  "licenseReviewManifestSha256": "63feb98198ef530764dcff4f890b3d423ab28bdec0ac9d193df8fe11a7983673",
   "status": "engineering-reviewed-open-release-gates",
   "engineeringReviewCompleted": true,
   "allCandidateDigestsVerified": true,
-  "reviewedCandidateCount": 22,
+  "reviewedCandidateCount": 23,
   "sourceOriginsWithRemainingReviewItems": 8,
   "completeLicenseTextBundlePresent": false,
   "completePackageNoticeSetPresent": false,
@@ -109,12 +109,18 @@
           "outputPath": "evidence/busybox/shell-math.c",
           "sha256": "8f2d57454d233b67662047cd3411c77ecde7e428ef1f6652d66f177b1d06e2f3",
           "conclusion": "inline-license-and-attribution-notice"
+        },
+        {
+          "outputPath": "evidence/busybox/coreutils-env.c",
+          "sha256": "730d258bcbeeef301fc00611d0e325958f3f378576af54c524f9be662b0ac757",
+          "conclusion": "inline-license-and-attribution-notice"
         }
       ],
       "resolvedReviewItems": [],
       "remainingReviewItems": [
         "confirm-enabled-bzip2-license-and-attribution-coverage",
         "confirm-enabled-ash-math-license-and-attribution-coverage",
+        "confirm-enabled-env-license-and-attribution-coverage",
         "review-other-bundled-third-party-license-and-attribution-coverage",
         "confirm-aports-patch-notices"
       ]

Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json

@@ -165,11 +165,25 @@
             "attribution"
           ],
           "reviewState": "unreviewed-candidate"
+        },
+        {
+          "sourceKind": "distfile-member",
+          "distfile": "busybox-1.36.1.tar.bz2",
+          "member": "busybox-1.36.1/coreutils/env.c",
+          "outputPath": "evidence/busybox/coreutils-env.c",
+          "byteCount": 4753,
+          "sha256": "730d258bcbeeef301fc00611d0e325958f3f378576af54c524f9be662b0ac757",
+          "evidenceKinds": [
+            "inline-license-notice",
+            "attribution"
+          ],
+          "reviewState": "unreviewed-candidate"
         }
       ],
       "openReviewItems": [
         "confirm-enabled-bzip2-license-and-attribution-coverage",
         "confirm-enabled-ash-math-license-and-attribution-coverage",
+        "confirm-enabled-env-license-and-attribution-coverage",
         "review-other-bundled-third-party-license-and-attribution-coverage",
         "confirm-aports-patch-notices"
       ]

Compliance/RootFS/v0.3.3/NOTICE.md

@@ -33,12 +33,12 @@ Generated from the exact `v0.3.3` archive with SHA-256
 No file whose path identifies it as LICENSE, COPYING, NOTICE, or a license-directory member was found in the guest template.
 
 Declared identifiers and expressions are recorded in
-`LICENSE-INVENTORY.json`. `LICENSE-REVIEW.json` pins 22
+`LICENSE-INVENTORY.json`. `LICENSE-REVIEW.json` pins 23
 candidate license, attribution, declaration, and inline-notice files across
 all 10 source origins. The external review tool
 extracts and verifies those candidates from the pinned source-review bundle.
 `LICENSE-REVIEW-RESULTS.json` records the checksum-bound engineering review
-of all 22 candidates. All indexed review items are resolved
+of all 23 candidates. All indexed review items are resolved
 for `libc-dev`, `zlib`.
 8 source origins still have package-specific open
 items, so this is not a complete or legally approved license/NOTICE bundle.
@@ -49,7 +49,7 @@ reference/attribution payloads and
 files, together with all checksum-bound reviewed evidence. The repository
 tool can materialize and re-verify that bundle outside the repository.
 `LICENSE-NOTICE-REVIEW-RESULTS.json` records checksum-bound engineering
-review of all 82 indexed
+review of all 83 indexed
 payload files. 3 origins have no remaining
 candidate-material engineering items; 5 origins
 still require package-specific material. Legal review and redistribution