From 9749fd1d7a68c3b6fd786779332d2548fcaad64f Mon Sep 17 00:00:00 2001 From: Jintao Date: Sun, 26 Jul 2026 20:43:02 +0800 Subject: [PATCH] Pin BusyBox echo notice --- CHANGELOG.en.md | 11 ++-- CHANGELOG.md | 10 ++-- Compliance/RootFS/v0.3.3/EVIDENCE.json | 6 +- .../RootFS/v0.3.3/LICENSE-INVENTORY.json | 6 +- .../v0.3.3/LICENSE-NOTICE-CANDIDATES.json | 6 +- .../v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json | 11 ++-- .../RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json | 10 +++- Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json | 14 +++++ Compliance/RootFS/v0.3.3/NOTICE.md | 6 +- Compliance/RootFS/v0.3.3/README.md | 60 ++++++++++++------- Compliance/RootFS/v0.3.3/SHA256SUMS | 14 ++--- Docs/ReleaseCompliance.md | 10 ++-- Docs/Roadmap.md | 2 +- Docs/RootFS.md | 8 +-- Docs/en/ReleaseCompliance.md | 10 ++-- Docs/en/Roadmap.md | 2 +- Docs/en/RootFS.md | 8 +-- README.md | 2 +- Scripts/rootfs-license-notice-candidates.rb | 2 +- .../rootfs-license-notice-review-results.rb | 2 +- .../RootFSLicenseNoticeCandidatesTests.rb | 41 ++++++++++++- .../RootFSLicenseNoticeReviewResultsTests.rb | 28 ++++++++- .../RootFSLicenseReviewResultsTests.rb | 2 +- 23 files changed, 185 insertions(+), 86 deletions(-) diff --git a/CHANGELOG.en.md b/CHANGELOG.en.md index f9edb61..e0add7c 100644 --- a/CHANGELOG.en.md +++ b/CHANGELOG.en.md @@ -32,17 +32,17 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit declared-license/attribution inventories, and default `apk`, repository, and DNS configuration; complete LICENSE/NOTICE and corresponding-source bundles remain distribution blockers. -- A checksum-bound `LICENSE-REVIEW-RESULTS.json` and strict validator. All 23 +- A checksum-bound `LICENSE-REVIEW-RESULTS.json` and strict validator. All 24 pinned RootFS license/NOTICE candidates have engineering review results; eight source origins retain package-level open items, and legal and redistribution gates remain closed. - A checksum-bound `LICENSE-NOTICE-CANDIDATES.json`, strict validator, and outside-repository atomic materializer for the eight remaining RootFS source origins. It indexes 13 remote license/attribution payloads, 47 aports files, - and the 23 existing evidence files for complete re-verification without + and the 24 existing evidence files for complete re-verification without committing payloads or opening engineering, legal, or redistribution gates. - `LICENSE-NOTICE-REVIEW-RESULTS.json` and a strict external payload-tree - verifier. All 83 candidate payloads now have checksum-bound engineering + verifier. All 84 candidate payloads now have checksum-bound engineering review. The pinned upstream `alpine-keys` GPL-to-MIT license-decision commit is included while its package-level copyright notice remains open. The `ca-certificates` generator is byte-identical to curl commit `3fdc4bdb`, and @@ -50,8 +50,9 @@ All notable PocketRoot changes are recorded here. Semantic Versioning begins wit open. The pinned BusyBox configuration now binds enabled bzip2 support to its exact source license, confirms that enabled ash arithmetic links `shell/math.c`, which retains complete MIT and BSD-3-Clause notices, and - confirms that the installed `env` applet links `coreutils/env.c`, which - retains its complete BSD notice; other inline third-party notices stay open; + confirms that the installed `env` and `echo` applets link + `coreutils/env.c` and `coreutils/echo.c`, respectively, with complete BSD + notices; other inline third-party notices stay open; `apk-tools`, `openssl`, and `pax-utils` have no remaining candidate-material engineering items, five origins still need package-specific material, and diff --git a/CHANGELOG.md b/CHANGELOG.md index 72f6c14..f938e6e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,22 +30,22 @@ PocketRoot 的重要变化记录在这里。首个公开版本发布后遵循 Se 10 个 source origin、SPDX 2.3 JSON SBOM、许可证声明/attribution inventory 和 `apk`、repository、DNS 默认配置快照；完整 LICENSE/NOTICE 与对应源码 bundle 仍保持发行阻塞。 -- 加入 checksum-bound `LICENSE-REVIEW-RESULTS.json` 和严格验证器；23/23 个固定 +- 加入 checksum-bound `LICENSE-REVIEW-RESULTS.json` 和严格验证器；24/24 个固定 RootFS license/NOTICE 候选已完成工程复核，8 个 source origin 仍有包级未决项， 法律与再分发门禁保持关闭。 - 为剩余 8 个 RootFS source origin 加入 checksum-bound `LICENSE-NOTICE-CANDIDATES.json`、严格验证器和仓库外原子 materializer；索引 - 13 份远端许可证/attribution 材料、47 份 aports 文件与 23 份既有证据，支持完整 + 13 份远端许可证/attribution 材料、47 份 aports 文件与 24 份既有证据，支持完整 复验，但不提交 payload，也不解除工程、法律或再分发门禁。 - 加入 `LICENSE-NOTICE-REVIEW-RESULTS.json` 和严格外置 payload-tree 复验器； - 83/83 个候选 payload 已完成 checksum-bound 工程复核；新增固定 + 84/84 个候选 payload 已完成 checksum-bound 工程复核；新增固定 `alpine-keys` GPL→MIT 上游许可判定提交，但仍保留包级版权声明缺口； `ca-certificates` 生成脚本与 curl 提交 `3fdc4bdb` 字节一致并固定该精确 revision 的 curl 授权文本，trust-store 审查仍保持未决； BusyBox 固定配置确认 bzip2 与源包内精确授权绑定，确认启用的 ash 算术模块 链入保留完整 MIT 与 BSD-3-Clause notices 的 `shell/math.c`，并确认已安装的 - `env` applet 链入保留完整 BSD notice 的 `coreutils/env.c`；其他内联第三方 - notices 继续保持未决； + `env` 与 `echo` applet 分别链入保留完整 BSD notice 的 `coreutils/env.c` 与 + `coreutils/echo.c`；其他内联第三方 notices 继续保持未决； `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项关闭，另外 5 个 origin 仍需补逐包材料，法律和再分发门禁保持关闭。 - RootFS source-review materializer 新增严格仓库外下载缓存输入；缓存只替代网络 diff --git a/Compliance/RootFS/v0.3.3/EVIDENCE.json b/Compliance/RootFS/v0.3.3/EVIDENCE.json index 0f60aed..2ca2f26 100644 --- a/Compliance/RootFS/v0.3.3/EVIDENCE.json +++ b/Compliance/RootFS/v0.3.3/EVIDENCE.json @@ -39,13 +39,13 @@ "sourceOrigins": 10, "declaredLicenseExpressions": 7, "licenseOrNoticeFilesInGuestTemplate": 0, - "indexedExternalLicenseReviewCandidates": 23, - "engineeringReviewedLicenseCandidates": 23, + "indexedExternalLicenseReviewCandidates": 24, + "engineeringReviewedLicenseCandidates": 24, "sourceOriginsWithRemainingLicenseReviewItems": 8, "indexedLicenseNoticeCandidateOrigins": 8, "pinnedRemoteLicenseNoticePayloads": 13, "supplementalAportsCandidateFiles": 47, - "engineeringReviewedLicenseNoticeCandidatePayloads": 83, + "engineeringReviewedLicenseNoticeCandidatePayloads": 84, "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5 }, "engineeringStatus": { diff --git a/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json b/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json index c7a6de2..adaabf0 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-INVENTORY.json @@ -26,14 +26,14 @@ "licenseOrNoticeFilesFoundInGuestTemplate": [ ], - "indexedExternalReviewCandidates": 23, - "engineeringReviewedCandidates": 23, + "indexedExternalReviewCandidates": 24, + "engineeringReviewedCandidates": 24, "sourceOriginsWithOpenReviewItems": 10, "sourceOriginsWithRemainingReviewItems": 8, "indexedOpenSourceOrigins": 8, "pinnedRemoteReferencePayloads": 13, "supplementalAportsFiles": 47, - "engineeringReviewedCandidatePayloads": 83, + "engineeringReviewedCandidatePayloads": 84, "sourceOriginsWithRemainingCandidatePayloadReviewItems": 5, "candidateBundleIndexComplete": true, "candidatePayloadCommitted": false, diff --git a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json index 8022d57..893f2ca 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-CANDIDATES.json @@ -4,7 +4,7 @@ "version": "v0.3.3", "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4" }, - "licenseReviewResultsSha256": "1c714f4b65e01a1a35cbfa58a8b964e511c67187e00a010d7036439f6c013d43", + "licenseReviewResultsSha256": "c6a98e9cd36e12758a41ac6ff57fa437eefb2742449cd58843024b2fd507bfbd", "status": "candidate-bundle-indexed-engineering-review-required", "candidateBundleIndexComplete": true, "candidatePayloadCommitted": false, @@ -247,7 +247,8 @@ "evidence/busybox/LICENSE", "evidence/busybox/bzip2-LICENSE", "evidence/busybox/shell-math.c", - "evidence/busybox/coreutils-env.c" + "evidence/busybox/coreutils-env.c", + "evidence/busybox/coreutils-echo.c" ], "referenceLicensePaths": [ "licenses/GPL-2.0.txt" @@ -296,6 +297,7 @@ "confirm-enabled-bzip2-license-and-attribution-coverage", "confirm-enabled-ash-math-license-and-attribution-coverage", "confirm-enabled-env-license-and-attribution-coverage", + "confirm-enabled-echo-license-and-attribution-coverage", "review-other-bundled-third-party-license-and-attribution-coverage", "confirm-aports-patch-notices" ], diff --git a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json index 79e30ce..a90e1cf 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-NOTICE-REVIEW-RESULTS.json @@ -4,7 +4,7 @@ "version": "v0.3.3", "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4" }, - "candidateManifestSha256": "5b64ca8c2312ce190bdcf8d80c14fdc5155d78b7b2469404a0e4180e1281e2ec", + "candidateManifestSha256": "1a2c73b6d79da7131c5226c10ac308912e96c78e99e9992ffc9c67bfa2c25ada", "status": "candidate-payloads-engineering-reviewed-open-release-gates", "engineeringReviewCompleted": true, "allIndexedCandidatePayloadsReviewed": true, @@ -13,8 +13,8 @@ "legalReviewApproved": false, "redistributionApproved": false, "candidatePayloadTreeFormat": "sha256-path-lines-v1", - "candidatePayloadTreeSha256": "0b8a148b1af67eca6737eb57ad0a66d0f34d06212a952f96bc6f1b65dc7c5fe1", - "reviewedPayloadFileCount": 83, + "candidatePayloadTreeSha256": "bfa4112f76a4e43588da38dd9184022d88aa052ea89800feaada392020d5fea0", + "reviewedPayloadFileCount": 84, "reviewedClosedOriginEvidenceCount": 4, "sourceOriginsWithRemainingReviewItems": 5, "sources": [ @@ -82,7 +82,7 @@ "reviewState": "candidate-payloads-engineering-reviewed-legal-review-open", "licenseTextCoverage": "partial", "attributionCoverage": "partial", - "reviewedExistingEvidenceCount": 5, + "reviewedExistingEvidenceCount": 6, "reviewedReferenceLicenseCount": 1, "reviewedSupplementalAportsCount": 37, "reviewedRemoteEvidenceCount": 0, @@ -90,7 +90,8 @@ "confirm-aports-patch-notices", "confirm-enabled-bzip2-license-and-attribution-coverage", "confirm-enabled-ash-math-license-and-attribution-coverage", - "confirm-enabled-env-license-and-attribution-coverage" + "confirm-enabled-env-license-and-attribution-coverage", + "confirm-enabled-echo-license-and-attribution-coverage" ], "remainingReviewItems": [ "review-other-bundled-third-party-license-and-attribution-coverage" diff --git a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json index c89e047..3ba1b26 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW-RESULTS.json @@ -4,11 +4,11 @@ "version": "v0.3.3", "sha256": "be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4" }, - "licenseReviewManifestSha256": "63feb98198ef530764dcff4f890b3d423ab28bdec0ac9d193df8fe11a7983673", + "licenseReviewManifestSha256": "62630d0db3c725b0e858e02273da509f012eeba5095b003d65859b4f0840f1e2", "status": "engineering-reviewed-open-release-gates", "engineeringReviewCompleted": true, "allCandidateDigestsVerified": true, - "reviewedCandidateCount": 23, + "reviewedCandidateCount": 24, "sourceOriginsWithRemainingReviewItems": 8, "completeLicenseTextBundlePresent": false, "completePackageNoticeSetPresent": false, @@ -114,6 +114,11 @@ "outputPath": "evidence/busybox/coreutils-env.c", "sha256": "730d258bcbeeef301fc00611d0e325958f3f378576af54c524f9be662b0ac757", "conclusion": "inline-license-and-attribution-notice" + }, + { + "outputPath": "evidence/busybox/coreutils-echo.c", + "sha256": "fcdd9f96dc44bc1b813d478725911054948da20e4d929282b35722c28924577c", + "conclusion": "inline-license-and-attribution-notice" } ], "resolvedReviewItems": [], @@ -121,6 +126,7 @@ "confirm-enabled-bzip2-license-and-attribution-coverage", "confirm-enabled-ash-math-license-and-attribution-coverage", "confirm-enabled-env-license-and-attribution-coverage", + "confirm-enabled-echo-license-and-attribution-coverage", "review-other-bundled-third-party-license-and-attribution-coverage", "confirm-aports-patch-notices" ] diff --git a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json index 7e7da17..1c83ca3 100644 --- a/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json +++ b/Compliance/RootFS/v0.3.3/LICENSE-REVIEW.json @@ -178,12 +178,26 @@ "attribution" ], "reviewState": "unreviewed-candidate" + }, + { + "sourceKind": "distfile-member", + "distfile": "busybox-1.36.1.tar.bz2", + "member": "busybox-1.36.1/coreutils/echo.c", + "outputPath": "evidence/busybox/coreutils-echo.c", + "byteCount": 9960, + "sha256": "fcdd9f96dc44bc1b813d478725911054948da20e4d929282b35722c28924577c", + "evidenceKinds": [ + "inline-license-notice", + "attribution" + ], + "reviewState": "unreviewed-candidate" } ], "openReviewItems": [ "confirm-enabled-bzip2-license-and-attribution-coverage", "confirm-enabled-ash-math-license-and-attribution-coverage", "confirm-enabled-env-license-and-attribution-coverage", + "confirm-enabled-echo-license-and-attribution-coverage", "review-other-bundled-third-party-license-and-attribution-coverage", "confirm-aports-patch-notices" ] diff --git a/Compliance/RootFS/v0.3.3/NOTICE.md b/Compliance/RootFS/v0.3.3/NOTICE.md index f85545b..ef7b7cf 100644 --- a/Compliance/RootFS/v0.3.3/NOTICE.md +++ b/Compliance/RootFS/v0.3.3/NOTICE.md @@ -33,12 +33,12 @@ Generated from the exact `v0.3.3` archive with SHA-256 No file whose path identifies it as LICENSE, COPYING, NOTICE, or a license-directory member was found in the guest template. Declared identifiers and expressions are recorded in -`LICENSE-INVENTORY.json`. `LICENSE-REVIEW.json` pins 23 +`LICENSE-INVENTORY.json`. `LICENSE-REVIEW.json` pins 24 candidate license, attribution, declaration, and inline-notice files across all 10 source origins. The external review tool extracts and verifies those candidates from the pinned source-review bundle. `LICENSE-REVIEW-RESULTS.json` records the checksum-bound engineering review -of all 23 candidates. All indexed review items are resolved +of all 24 candidates. All indexed review items are resolved for `libc-dev`, `zlib`. 8 source origins still have package-specific open items, so this is not a complete or legally approved license/NOTICE bundle. @@ -49,7 +49,7 @@ reference/attribution payloads and files, together with all checksum-bound reviewed evidence. The repository tool can materialize and re-verify that bundle outside the repository. `LICENSE-NOTICE-REVIEW-RESULTS.json` records checksum-bound engineering -review of all 83 indexed +review of all 84 indexed payload files. 3 origins have no remaining candidate-material engineering items; 5 origins still require package-specific material. Legal review and redistribution diff --git a/Compliance/RootFS/v0.3.3/README.md b/Compliance/RootFS/v0.3.3/README.md index 29a3c42..b3204c2 100644 --- a/Compliance/RootFS/v0.3.3/README.md +++ b/Compliance/RootFS/v0.3.3/README.md @@ -16,14 +16,14 @@ pinned RootFS archive. It does not store the RootFS payload. SHA-256； - `LICENSE-INVENTORY.json`：声明的许可证表达式、标识符和 archive 内 license/notice 文件检查结果； -- `LICENSE-REVIEW.json`：覆盖 10 个 source origin 的 23 个候选许可证文本、 +- `LICENSE-REVIEW.json`：覆盖 10 个 source origin 的 24 个候选许可证文本、 attribution、声明与内联 notice 的路径、大小、SHA-256 和逐包未决审查项； -- `LICENSE-REVIEW-RESULTS.json`：对全部 23 个候选的 checksum-bound 工程复核 +- `LICENSE-REVIEW-RESULTS.json`：对全部 24 个候选的 checksum-bound 工程复核 结论、coverage 和未决项处置；不表示法律或再分发批准； - `LICENSE-NOTICE-CANDIDATES.json`：为剩余 8 个 source origin 固定 13 份远端 - 许可证/attribution 材料、47 份 aports 补充文件及现有 23 份复核证据的外置候选包； + 许可证/attribution 材料、47 份 aports 补充文件及现有 24 份复核证据的外置候选包； payload 不提交，工程、法律和再分发门禁保持关闭； -- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 83 个 payload 文件树的 +- `LICENSE-NOTICE-REVIEW-RESULTS.json`：绑定候选清单与 84 个 payload 文件树的 工程复核结果；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，法律和 再分发门禁保持关闭； - `RUNTIME-CONFIGURATION.json`：guest、`apk`、repository、world 和 DNS 默认配置； @@ -34,15 +34,15 @@ pinned RootFS archive. It does not store the RootFS payload. `SOURCE-ACQUISITION.json` pins the aports snapshots and upstream distfiles needed to assemble an external source-review directory. It is an acquisition manifest, not a committed source archive or redistribution grant. -`LICENSE-REVIEW.json` pins 23 unreviewed candidate evidence files across all +`LICENSE-REVIEW.json` pins 24 unreviewed candidate evidence files across all 10 source origins; it is an engineering review index, not legal approval. -`LICENSE-REVIEW-RESULTS.json` records the engineering review of all 23 pinned +`LICENSE-REVIEW-RESULTS.json` records the engineering review of all 24 pinned candidates. Two source origins have no remaining indexed review items; eight still have package-specific open items. `LICENSE-NOTICE-CANDIDATES.json` indexes an external candidate bundle for those eight origins: 13 pinned remote license/attribution payloads, 47 supplemental aports files, and the existing -23 reviewed evidence files. `LICENSE-NOTICE-REVIEW-RESULTS.json` binds the -engineering review to the exact 83-file payload tree. Three origins have no +24 reviewed evidence files. `LICENSE-NOTICE-REVIEW-RESULTS.json` binds the +engineering review to the exact 84-file payload tree. Three origins have no remaining candidate-material engineering items; five still require package-specific material. Legal and redistribution approval remain open. @@ -78,9 +78,11 @@ change. 其中精确启用了 `CONFIG_BZIP2=y`、`CONFIG_BZIP2_SMALL=8` 和 `CONFIG_FEATURE_BZIP2_DECOMPRESS=y`，也启用了 `CONFIG_ASH=y`、 `CONFIG_FEATURE_SH_MATH=y`、`CONFIG_FEATURE_SH_MATH_64=y` 和 -`CONFIG_ENV=y`；BusyBox `shell/Kbuild.src` 在该配置下把 `math.o` 链入构建， -`coreutils/env.c` 则通过 `lib-$(CONFIG_ENV) += env.o` 链入。外置候选树现同时绑定该配置与固定 -BusyBox 1.36.1 源包中的 1,999 字节 +`CONFIG_ENV=y`、`CONFIG_ECHO=y`、`CONFIG_FEATURE_FANCY_ECHO=y`；BusyBox +`shell/Kbuild.src` 在该配置下把 `math.o` 链入构建，`coreutils/env.c` 与 +`coreutils/echo.c` 则分别通过 `lib-$(CONFIG_ENV) += env.o` 和 +`lib-$(CONFIG_ECHO) += echo.o` 链入。外置候选树现同时绑定该配置与固定 BusyBox +1.36.1 源包中的 1,999 字节 `archival/libarchive/bz/LICENSE`（SHA-256 `b5a136ed67798e51fe2e0ca0b2a21cb01b904ff0c9f7d563a6292e276607e58f`）， 从而在工程层关闭 @@ -93,7 +95,12 @@ BusyBox 1.36.1 源包中的 1,999 字节 `730d258bcbeeef301fc00611d0e325958f3f378576af54c524f9be662b0ac757`）， 其中保留完整 BSD 版权及许可通知。固定 RootFS 中 `/usr/bin/env` 的目标为 `/bin/busybox`，因此在工程层关闭 -`confirm-enabled-env-license-and-attribution-coverage`。BusyBox 其他已启用 +`confirm-enabled-env-license-and-attribution-coverage`；同时绑定 9,960 字节 +`coreutils/echo.c`（SHA-256 +`fcdd9f96dc44bc1b813d478725911054948da20e4d929282b35722c28924577c`）， +其中保留完整 Berkeley BSD 版权及许可通知。固定 RootFS 中 `/bin/echo` 的目标为 +`/bin/busybox`，因此在工程层关闭 +`confirm-enabled-echo-license-and-attribution-coverage`。BusyBox 其他已启用 组件的内联第三方 notice 尚未形成完整集合，因此 license-text 与 attribution coverage 均保持 partial， `review-other-bundled-third-party-license-and-attribution-coverage` 保持未决， @@ -104,11 +111,13 @@ The `busyboxconfig` at pinned aports commit `18d78e185ff0cccd6ccd09f4f78c5780175d78214e16acd1390e4ee85c74346e`. It explicitly enables `CONFIG_BZIP2=y`, `CONFIG_BZIP2_SMALL=8`, `CONFIG_FEATURE_BZIP2_DECOMPRESS=y`, `CONFIG_ASH=y`, -`CONFIG_FEATURE_SH_MATH=y`, `CONFIG_FEATURE_SH_MATH_64=y`, and -`CONFIG_ENV=y`; BusyBox `shell/Kbuild.src` links `math.o` under that -configuration, while `coreutils/env.c` is linked by -`lib-$(CONFIG_ENV) += env.o`. The external candidate tree now binds -that configuration to the 1,999-byte +`CONFIG_FEATURE_SH_MATH=y`, `CONFIG_FEATURE_SH_MATH_64=y`, `CONFIG_ENV=y`, +`CONFIG_ECHO=y`, and `CONFIG_FEATURE_FANCY_ECHO=y`; BusyBox +`shell/Kbuild.src` links `math.o` under that configuration, while +`coreutils/env.c` and `coreutils/echo.c` are linked by +`lib-$(CONFIG_ENV) += env.o` and `lib-$(CONFIG_ECHO) += echo.o`, +respectively. The external candidate tree now binds that configuration to the +1,999-byte `archival/libarchive/bz/LICENSE` in the pinned BusyBox 1.36.1 source archive, whose SHA-256 is `b5a136ed67798e51fe2e0ca0b2a21cb01b904ff0c9f7d563a6292e276607e58f`. @@ -124,6 +133,11 @@ SHA-256 is the file retains its complete BSD copyright and license notice. The pinned RootFS maps `/usr/bin/env` to `/bin/busybox`, closing `confirm-enabled-env-license-and-attribution-coverage` at the engineering +level. It also binds the 9,960-byte `coreutils/echo.c`, whose SHA-256 is +`fcdd9f96dc44bc1b813d478725911054948da20e4d929282b35722c28924577c`; +the file retains its complete Berkeley BSD copyright and license notice. The +pinned RootFS maps `/bin/echo` to `/bin/busybox`, closing +`confirm-enabled-echo-license-and-attribution-coverage` at the engineering level. A complete set of inline third-party notices for BusyBox's other enabled components is still missing, so license-text and attribution coverage remain partial, @@ -303,13 +317,13 @@ ruby Scripts/rootfs-license-review-results.rb ``` 工具只提取 `LICENSE-REVIEW.json` 固定的候选文件，并再次核对大小、SHA-256、 -路径全集、无符号链接/特殊节点边界。结果清单证明 23 个候选已完成工程复核； +路径全集、无符号链接/特殊节点边界。结果清单证明 24 个候选已完成工程复核； 外置输出仍不是可直接随产品发行的 NOTICE bundle。 The tool extracts only candidates pinned by `LICENSE-REVIEW.json`, then rechecks byte counts, SHA-256 digests, the exact path set, and the no-symlink/ special-node boundary. The results manifest proves engineering review of all -23 candidates; the external output is still not a product-ready NOTICE bundle. +24 candidates; the external output is still not a product-ready NOTICE bundle. 剩余 8 个 source origin 的材料可继续组装为外置候选包。先校验清单；实际物化 必须同时提供已经通过 `--verify` 的 source-review 和 license-review 目录，以及 @@ -353,8 +367,8 @@ advice, or redistribution approval. 这些文件不构成完整第三方 LICENSE/NOTICE bundle、经审查的 copyleft corresponding-source 交付、法律意见或再分发授权。源码获取清单已完整覆盖固定 -inventory，23 个候选也都有工程复核结果；`libc-dev`、`zlib` 已关闭索引项，另外 -8 个 source origin 的 83 个新候选 payload 已完成 checksum-bound 工程复核； +inventory，24 个候选也都有工程复核结果；`libc-dev`、`zlib` 已关闭索引项，另外 +8 个 source origin 的 84 个新候选 payload 已完成 checksum-bound 工程复核； `apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个 origin 仍需补逐包版权/notice 材料。修改说明、构建完整性、源码提供方式、法律 审查、App Store 2.5.2 产品策略和负责人批准仍是发行阻塞项。 @@ -362,8 +376,8 @@ origin 仍需补逐包版权/notice 材料。修改说明、构建完整性、 These files are not a complete third-party LICENSE/NOTICE bundle, reviewed copyleft corresponding-source delivery, legal advice, or redistribution approval. The acquisition manifest completely covers the pinned inventory and -all 23 indexed candidates have engineering review results. `libc-dev` and -`zlib` have no remaining indexed items. All 83 newly indexed payloads have a +all 24 indexed candidates have engineering review results. `libc-dev` and +`zlib` have no remaining indexed items. All 84 newly indexed payloads have a checksum-bound engineering review; `apk-tools`, `openssl`, and `pax-utils` have no remaining candidate-material engineering items, while five origins still need package-specific copyright/notice material. Modification, build diff --git a/Compliance/RootFS/v0.3.3/SHA256SUMS b/Compliance/RootFS/v0.3.3/SHA256SUMS index 84eb549..2b4ac59 100644 --- a/Compliance/RootFS/v0.3.3/SHA256SUMS +++ b/Compliance/RootFS/v0.3.3/SHA256SUMS @@ -1,10 +1,10 @@ -71a6a120b6ba67ade0086abdd26d54ca3609268bf343f539dec7bc34f4582283 EVIDENCE.json -e7ab124c9b4b21af22568ca0ec5cb66caf7d6e06bc21418d533ae3719ba0d88e LICENSE-INVENTORY.json -5b64ca8c2312ce190bdcf8d80c14fdc5155d78b7b2469404a0e4180e1281e2ec LICENSE-NOTICE-CANDIDATES.json -b387a49932f859f8213c94f7f416cdec208d594bfcf5f52b0da2bf09ec993106 LICENSE-NOTICE-REVIEW-RESULTS.json -1c714f4b65e01a1a35cbfa58a8b964e511c67187e00a010d7036439f6c013d43 LICENSE-REVIEW-RESULTS.json -63feb98198ef530764dcff4f890b3d423ab28bdec0ac9d193df8fe11a7983673 LICENSE-REVIEW.json -7cf228dd972c31a5e741dcad37cab56bbd6e907024bd0a5789429288daf86efe NOTICE.md +040dfb91dd7e6d1fbdee332ec139f9baf38460653efd9122463815a001ac8394 EVIDENCE.json +b8457b190109443072b0df702b1c9400914f914cee9315d36908edf659b716ad LICENSE-INVENTORY.json +1a2c73b6d79da7131c5226c10ac308912e96c78e99e9992ffc9c67bfa2c25ada LICENSE-NOTICE-CANDIDATES.json +04d064d9f36a1d8c1eef4052623036b41de62bd6998c7ac07b6e4228b47a0748 LICENSE-NOTICE-REVIEW-RESULTS.json +c6a98e9cd36e12758a41ac6ff57fa437eefb2742449cd58843024b2fd507bfbd LICENSE-REVIEW-RESULTS.json +62630d0db3c725b0e858e02273da509f012eeba5095b003d65859b4f0840f1e2 LICENSE-REVIEW.json +cfcebd8b93a0400d97b54f7922bd6c979608a30dfa5d6b2c36cfc7b30ba4c5f4 NOTICE.md 4f7f7626f3d0891a29717e4b7932c36004ecc9aac25a4aa104c300aae979e3e1 PACKAGE-INVENTORY.tsv dbca9b285015a0d8b1d339a894b4594c9e335cbc2d7f9d5212a41095ae4bd1e1 RUNTIME-CONFIGURATION.json 8e021cb8c4160c934a0202609691d7a94526cd016f4394a47da6e7a5ab41d0ea SBOM.spdx.json diff --git a/Docs/ReleaseCompliance.md b/Docs/ReleaseCompliance.md index e788e16..53952d2 100644 --- a/Docs/ReleaseCompliance.md +++ b/Docs/ReleaseCompliance.md @@ -72,12 +72,12 @@ machine-readable SBOM。仓库现在从固定 archive 可复现生成 15 个已 `apk`、repository、DNS 默认配置快照。archive 内没有发现可识别的 LICENSE/COPYING/NOTICE 文件。仓库另有与 inventory 一一对应、固定 checksum 的 aports snapshot/upstream distfile 获取清单和仓库外 materializer，并固定了覆盖 -全部 10 个 source origin 的 23 个 license、attribution、声明与内联 notice 候选。 +全部 10 个 source origin 的 24 个 license、attribution、声明与内联 notice 候选。 第二个仓库外工具从已验证 source-review 目录提取这些候选；固定结果清单记录 -23/23 个候选均已工程复核，`libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source +24/24 个候选均已工程复核，`libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source origin 仍有逐包未决项。仓库现已为这 8 个 origin 固定外置候选包：13 份远端 许可证/attribution 材料、47 份 aports 补充文件和全部既有复核证据；工具可在 -仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 83 文件 payload +仓库外原子生成并复验。固定结果清单把工程复核绑定到精确的 84 文件 payload tree；`apk-tools`、`openssl`、`pax-utils` 的候选材料工程项已关闭，另外 5 个 origin 仍需补逐包材料。修改与构建完整性、源码提供方式和法律审查仍未完成， 不能视为完整 NOTICE 或已批准的对应源码交付。 @@ -176,10 +176,10 @@ Alpine `apk` 可以下载、安装和执行新增代码。即使初始 RootFS - [x] 从固定 APK database 生成完整 package inventory。 - [x] 生成并通过 SPDX 2.3 JSON schema 校验的 machine-readable SBOM。 -- [x] 对固定的 23 个 license/NOTICE 候选完成 checksum-bound 工程复核。 +- [x] 对固定的 24 个 license/NOTICE 候选完成 checksum-bound 工程复核。 - [x] 为剩余 8 个 source origin 建立 checksum-bound 外置候选包索引与可复验 materializer；payload 不提交且批准门禁保持关闭。 -- [x] 对外置候选包的 83 个 payload 完成 checksum-bound 工程复核并固定结果； +- [x] 对外置候选包的 84 个 payload 完成 checksum-bound 工程复核并固定结果； 3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料。 - [ ] 收集 license text 和 NOTICE。 - [ ] 建立 copyleft corresponding source bundle。 diff --git a/Docs/Roadmap.md b/Docs/Roadmap.md index d862564..36b47c9 100644 --- a/Docs/Roadmap.md +++ b/Docs/Roadmap.md @@ -103,7 +103,7 @@ | 最低 Xcode 16 原生兼容 | 已通过 | Xcode 16.0 / iOS 18.0 SDK 完成 RootFS install、Simulator/device final-link 和 17 项 native smoke | | App lifecycle 与内存 | 进行中 | Simulator 与 Jack iPhone 均有 256 MiB `ru_maxrss` 门禁；真机 process suspend/resume、UIKit foreground/background、强制终止后数据恢复和有界 App delegate memory-warning 回调恢复已通过；补真实 memory pressure/jetsam | | RootFS ENOSPC/掉电 | 进行中 | 峰值空间预检、全 ENOSPC、七点持久化屏障、确定性掉电切点和 Jack iPhone 受限容量/ENOSPC 清理恢复已覆盖；补真实 storage pressure/强制断电 | -| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、23/23 初始候选和 83/83 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 | +| License-reviewed RootFS | 阻塞 | 15 包 inventory、10 source origin、SPDX SBOM、默认配置证据、外置源码获取流程、24/24 初始候选和 84/84 外置 payload 工程复核已完成；3 个 origin 的候选材料工程项关闭，5 个仍需补逐包材料，之后完成法律复核、对应源码交付审查与负责人批准 | | App Store 2.5.2 | 阻塞 | guest download/execute policy 有书面结论 | ### 后续 runtime 执行顺序 diff --git a/Docs/RootFS.md b/Docs/RootFS.md index be1b720..a3d76c0 100644 --- a/Docs/RootFS.md +++ b/Docs/RootFS.md @@ -5,7 +5,7 @@ RootFS 是 PocketRoot 的外部供应链输入，不是普通测试 fixture。仓库提交的是不可变清单、校验和安全安装代码，不提交、镜像或默认打包 RootFS 二进制。 > [!WARNING] -> 固定 v0.3.3 归档已有可复现 package inventory、SPDX SBOM、默认配置证据、完整覆盖 inventory 的源码获取清单，以及 23 个初始候选和 83 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核结果；3 个 origin 的候选材料工程项已关闭，5 个仍需补逐包材料。完整 NOTICE、法律复核、对应源码交付审查与发行批准尚未闭环。以下 URL 与命令用于审计和本地开发，不构成公开再分发授权。应用必须先完成自己的法律与发行审查。 +> 固定 v0.3.3 归档已有可复现 package inventory、SPDX SBOM、默认配置证据、完整覆盖 inventory 的源码获取清单，以及 24 个初始候选和 84 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核结果；3 个 origin 的候选材料工程项已关闭，5 个仍需补逐包材料。完整 NOTICE、法律复核、对应源码交付审查与发行批准尚未闭环。以下 URL 与命令用于审计和本地开发，不构成公开再分发授权。应用必须先完成自己的法律与发行审查。 ## 1. 固定清单 @@ -118,7 +118,7 @@ receipt schema v2 强制包含该模式。旧 v1 source-review 的传输来源 规范化 aports 目录身份覆盖条目类型、路径、普通文件权限位和内容摘要；物化时会保留 这些权限位，`--verify` 会再次校验。 -在 source-review 目录验证通过后，可把固定的 23 个候选许可证/attribution 文件 +在 source-review 目录验证通过后，可把固定的 24 个候选许可证/attribution 文件 提取到另一个仓库外目录： ```bash @@ -139,7 +139,7 @@ ruby Scripts/rootfs-license-review-results.rb `APKBUILD`；`--verify` 会复核普通文件摘要、目录集合和符号链接目标。脚本不向 App、 Git 或 CI artifact 自动添加输出。这完成的是可复现的工程获取流程。archive 内没有 随附可识别的 LICENSE/COPYING/NOTICE 文件。候选工具会核对提取文件的大小、 -SHA-256、精确路径集合与无链接/特殊节点边界。固定结果清单记录 23/23 个候选均已 +SHA-256、精确路径集合与无链接/特殊节点边界。固定结果清单记录 24/24 个候选均已 工程复核，其中 `libc-dev`、`zlib` 的索引项已关闭，另外 8 个 source origin 仍有 未决项；输出不能直接视为完整 NOTICE 或对应源码交付材料。 @@ -167,7 +167,7 @@ ruby Scripts/rootfs-license-notice-review-results.rb \ ``` 工具对远端材料强制 HTTPS、重定向次数、响应大小、固定字节数与 SHA-256，并原子 -创建输出。结果清单把工程复核绑定到精确的 83 文件 payload tree；复验器拒绝路径 +创建输出。结果清单把工程复核绑定到精确的 84 文件 payload tree；复验器拒绝路径 漂移、符号链接、特殊节点、已知摘要漂移和 tree digest 漂移。`apk-tools`、 `openssl` 与 `pax-utils` 的候选材料工程项已关闭，另外 5 个 origin 仍需补逐包 材料；候选 NOTICE 和 receipt 不代表法律审查或发行批准。 diff --git a/Docs/en/ReleaseCompliance.md b/Docs/en/ReleaseCompliance.md index 8d08ac9..a473000 100644 --- a/Docs/en/ReleaseCompliance.md +++ b/Docs/en/ReleaseCompliance.md @@ -36,15 +36,15 @@ the default `apk`, repository, and DNS snapshot. No identifiable LICENSE/COPYING/NOTICE file was found in the archive. A checksum-pinned aports-snapshot/upstream-distfile manifest covers the inventory, and an outside-repository materializer creates reproducible review inputs. A second -outside-repository tool pins, extracts, and verifies 23 license, attribution, +outside-repository tool pins, extracts, and verifies 24 license, attribution, declaration, and inline-notice candidates across all 10 source origins. -A pinned result manifest records engineering review of all 23 candidates. +A pinned result manifest records engineering review of all 24 candidates. `libc-dev` and `zlib` have no remaining indexed items; eight source origins still have package-level follow-up. The repository now pins an external candidate bundle for those origins: 13 remote license/attribution payloads, 47 supplemental aports files, and all existing reviewed evidence. The tool can atomically materialize and re-verify it outside the repository. A pinned -results manifest binds engineering review to the exact 83-file payload tree. +results manifest binds engineering review to the exact 84-file payload tree. `apk-tools`, `openssl`, and `pax-utils` have no remaining candidate-material engineering items; five origins still need package-specific material. Modification, build-completeness, source-offer, and legal reviews remain unresolved, so the @@ -117,12 +117,12 @@ The current code does not provide a complete product-level privacy policy. - [x] Generate a complete inventory from the pinned APK database. - [x] Generate a machine-readable SBOM validated against the SPDX 2.3 JSON schema. -- [x] Complete checksum-bound engineering review of all 23 pinned +- [x] Complete checksum-bound engineering review of all 24 pinned license/NOTICE candidates. - [x] Index a checksum-bound external candidate bundle and reproducible materializer for the eight remaining origins; payloads stay uncommitted and approval gates stay closed. -- [x] Complete checksum-bound engineering review of all 83 external candidate +- [x] Complete checksum-bound engineering review of all 84 external candidate payloads; three origins have no remaining candidate-material engineering items and five still need package-specific material. - [ ] Collect license texts and NOTICE files. diff --git a/Docs/en/Roadmap.md b/Docs/en/Roadmap.md index b71ca0a..2ba8d56 100644 --- a/Docs/en/Roadmap.md +++ b/Docs/en/Roadmap.md @@ -98,7 +98,7 @@ This establishes the current Simulator, minimum-Xcode 16, and single-iPhone one- | Minimum Xcode 16 native | Passed | Xcode 16.0 / iOS 18.0 SDK completed RootFS install, Simulator/device final links, and the 17-check native smoke | | App lifecycle and memory | In progress | Simulator and Jack iPhone have 256 MiB `ru_maxrss` gates; physical process suspend/resume, UIKit foreground/background, post-termination data recovery, and bounded App-delegate memory-warning recovery passed; add real memory-pressure/jetsam evidence | | RootFS ENOSPC/power faults | In progress | Peak-space preflight, full ENOSPC, seven persistence barriers, deterministic power-loss cuts, and bounded capacity/ENOSPC cleanup recovery on Jack iPhone are covered; add real storage-pressure/power-cut evidence | -| License-reviewed RootFS | Blocked | The 15-package/10-origin evidence, all 23 initial candidates, and all 83 external payloads have checksum-bound engineering review; three origins have no remaining candidate-material engineering items, five still need package-specific material, followed by legal review, corresponding-source delivery review, and authorized approval | +| License-reviewed RootFS | Blocked | The 15-package/10-origin evidence, all 24 initial candidates, and all 84 external payloads have checksum-bound engineering review; three origins have no remaining candidate-material engineering items, five still need package-specific material, followed by legal review, corresponding-source delivery review, and authorized approval | | App Store 2.5.2 | Blocked | Written guest download/execute policy decision | ### Next runtime sequence diff --git a/Docs/en/RootFS.md b/Docs/en/RootFS.md index ffbfe0c..ca236d7 100644 --- a/Docs/en/RootFS.md +++ b/Docs/en/RootFS.md @@ -5,7 +5,7 @@ A RootFS is an external supply-chain input, not a normal fixture. PocketRoot commits immutable metadata and secure install code, not the payload. > [!WARNING] -> The pinned v0.3.3 archive now has a reproducible package inventory, SPDX SBOM, default-configuration evidence, a source-acquisition manifest covering the complete inventory, and checksum-bound engineering review of all 23 initial candidates and all 83 external LICENSE/NOTICE payloads. Three origins have no remaining candidate-material engineering items; five still need package-specific material. The complete NOTICE set, legal review, corresponding-source delivery review, and distribution approval remain open. The URL and commands below support audit and local development; they do not grant redistribution rights. +> The pinned v0.3.3 archive now has a reproducible package inventory, SPDX SBOM, default-configuration evidence, a source-acquisition manifest covering the complete inventory, and checksum-bound engineering review of all 24 initial candidates and all 84 external LICENSE/NOTICE payloads. Three origins have no remaining candidate-material engineering items; five still need package-specific material. The complete NOTICE set, legal review, corresponding-source delivery review, and distribution approval remain open. The URL and commands below support audit and local development; they do not grant redistribution rights. ## Pinned manifest @@ -95,7 +95,7 @@ Receipt schema v2 requires that explicit mode. A legacy v1 source-review directory has ambiguous transport provenance and is no longer accepted by `--verify`; pass it to `--download-cache` to regenerate a verifiable v2 bundle. -After that source-review directory verifies, extract the 23 pinned +After that source-review directory verifies, extract the 24 pinned license/attribution candidates into another directory outside the repository: ```bash @@ -122,7 +122,7 @@ engineering acquisition workflow, not legal review. The RootFS archive contains no identifiable LICENSE/COPYING/NOTICE files. The candidate tool rechecks extracted byte counts, SHA-256 digests, the exact path set, and the no-link/special-node boundary. The pinned results record engineering review of -all 23 candidates: `libc-dev` and `zlib` have no remaining indexed items, while +all 24 candidates: `libc-dev` and `zlib` have no remaining indexed items, while eight source origins still require follow-up. The output is not a completed NOTICE or corresponding-source delivery bundle. @@ -152,7 +152,7 @@ ruby Scripts/rootfs-license-notice-review-results.rb \ The tool enforces HTTPS, redirect and response-size bounds, pinned byte counts and SHA-256 digests, and atomic output creation. The results bind engineering -review to the exact 83-file payload tree; the verifier rejects path drift, +review to the exact 84-file payload tree; the verifier rejects path drift, links, special nodes, known-digest drift, and tree-digest drift. `apk-tools`, `openssl`, and `pax-utils` have no remaining candidate-material engineering items; five origins still need package-specific material. The candidate NOTICE diff --git a/README.md b/README.md index c3409d9..0ceb43d 100644 --- a/README.md +++ b/README.md @@ -163,7 +163,7 @@ print("stderr:", result.stderr) - 展开大小：`18,838,016` 字节 - SHA-256：`be0f3c133f78f28b023288459b33dc28fa253a6ef29f7123bc5f3892edf90ad4` -固定 URL 只是清单元数据，不代表库会自动下载。仓库已从固定归档生成 RootFS 包清单与 SPDX SBOM，并完成 23 个初始候选及 83 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核；5 个 source origin 仍需补逐包材料。许可证/NOTICE 法律复核、对应源码和完整发行物 SBOM 未完成前，不得把该 RootFS 加入 Package、App bundle 或公开发行物。 +固定 URL 只是清单元数据，不代表库会自动下载。仓库已从固定归档生成 RootFS 包清单与 SPDX SBOM，并完成 24 个初始候选及 84 个外置 LICENSE/NOTICE payload 的 checksum-bound 工程复核；5 个 source origin 仍需补逐包材料。许可证/NOTICE 法律复核、对应源码和完整发行物 SBOM 未完成前，不得把该 RootFS 加入 Package、App bundle 或公开发行物。 ## 验证命令 diff --git a/Scripts/rootfs-license-notice-candidates.rb b/Scripts/rootfs-license-notice-candidates.rb index 90e8aa0..c80cea6 100644 --- a/Scripts/rootfs-license-notice-candidates.rb +++ b/Scripts/rootfs-license-notice-candidates.rb @@ -20,7 +20,7 @@ module RootFSLicenseNoticeCandidates alpine-baselayout alpine-keys apk-tools busybox ca-certificates musl openssl pax-utils ].freeze - EXPECTED_EXISTING_EVIDENCE_FILES = 23 + EXPECTED_EXISTING_EVIDENCE_FILES = 24 EXPECTED_REMOTE_PAYLOAD_FILES = 13 EXPECTED_APORTS_FILES = 47 PAYLOAD_KINDS = %w[package-attribution spdx-license-text].freeze diff --git a/Scripts/rootfs-license-notice-review-results.rb b/Scripts/rootfs-license-notice-review-results.rb index 406cb57..1417804 100644 --- a/Scripts/rootfs-license-notice-review-results.rb +++ b/Scripts/rootfs-license-notice-review-results.rb @@ -22,7 +22,7 @@ module RootFSLicenseNoticeReviewResults COVERAGE = %w[complete partial reference-only].freeze SHA256_PATTERN = /\A[0-9a-f]{64}\z/ CANDIDATE_PAYLOAD_TREE_FORMAT = "sha256-path-lines-v1" - EXPECTED_REVIEWED_PAYLOAD_FILES = 83 + EXPECTED_REVIEWED_PAYLOAD_FILES = 84 MAX_REVIEWED_PAYLOAD_BYTES = 8 * 1_024 * 1_024 TOP_LEVEL_KEYS = %w[ allIndexedCandidatePayloadsReviewed archive candidateManifestSha256 diff --git a/Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb b/Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb index 4bdf33b..444e147 100644 --- a/Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb +++ b/Tests/Scripts/RootFSLicenseNoticeCandidatesTests.rb @@ -29,7 +29,7 @@ def test_validates_complete_open_origin_candidate_index assert_equal 8, validated.fetch(:sources).length assert_equal 13, validated.fetch(:remote_payloads).length - assert_equal 23, validated.fetch(:existing_evidence_paths).length + assert_equal 24, validated.fetch(:existing_evidence_paths).length assert_equal 47, validated.fetch(:aports_paths).length end @@ -282,6 +282,45 @@ def test_pins_enabled_busybox_env_inline_notice ) end + def test_pins_enabled_busybox_echo_inline_notice + source = @candidate.fetch("sources").find do |candidate| + candidate.fetch("sourceOrigin") == "busybox" + end + review_source = @review.fetch("sources").find do |candidate| + candidate.fetch("sourceOrigin") == "busybox" + end + evidence = review_source.fetch("candidateEvidence").find do |candidate| + candidate.fetch("outputPath") == "evidence/busybox/coreutils-echo.c" + end + + assert_includes( + source.fetch("existingEvidencePaths"), + "evidence/busybox/coreutils-echo.c" + ) + assert_includes( + source.fetch("supplementalAportsPaths"), + "aports/busybox/busyboxconfig" + ) + assert_includes( + source.fetch("remainingReviewItems"), + "confirm-enabled-echo-license-and-attribution-coverage" + ) + assert_includes( + source.fetch("remainingReviewItems"), + "review-other-bundled-third-party-license-and-attribution-coverage" + ) + assert_equal "busybox-1.36.1/coreutils/echo.c", evidence.fetch("member") + assert_equal 9_960, evidence.fetch("byteCount") + assert_equal( + "fcdd9f96dc44bc1b813d478725911054948da20e4d929282b35722c28924577c", + evidence.fetch("sha256") + ) + assert_equal( + %w[inline-license-notice attribution], + evidence.fetch("evidenceKinds") + ) + end + def test_rejects_overlapping_materialized_output_paths payloads = @candidate.fetch("remotePayloads") payloads.fetch(0)["outputPath"] = "licenses/collision" diff --git a/Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb b/Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb index ea3979a..7d39639 100644 --- a/Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb +++ b/Tests/Scripts/RootFSLicenseNoticeReviewResultsTests.rb @@ -47,7 +47,7 @@ def test_validates_pinned_candidate_review_results assert_equal 8, validated.fetch(:sources).length assert_equal 13, validated.fetch(:remote_payloads).length assert_equal 47, validated.fetch(:aports_paths).length - assert_equal 83, @results.fetch("reviewedPayloadFileCount") + assert_equal 84, @results.fetch("reviewedPayloadFileCount") assert_equal 5, @results.fetch("sourceOriginsWithRemainingReviewItems") assert_equal %w[apk-tools openssl pax-utils], @@ -136,7 +136,7 @@ def test_binds_enabled_busybox_ash_math_to_inline_notices assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 5, source.fetch("reviewedExistingEvidenceCount") + assert_equal 6, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-ash-math-license-and-attribution-coverage" @@ -158,7 +158,7 @@ def test_binds_enabled_busybox_env_to_inline_notice assert_equal "partial", source.fetch("licenseTextCoverage") assert_equal "partial", source.fetch("attributionCoverage") - assert_equal 5, source.fetch("reviewedExistingEvidenceCount") + assert_equal 6, source.fetch("reviewedExistingEvidenceCount") assert_includes( source.fetch("resolvedReviewItems"), "confirm-enabled-env-license-and-attribution-coverage" @@ -173,6 +173,28 @@ def test_binds_enabled_busybox_env_to_inline_notice ) end + def test_binds_enabled_busybox_echo_to_inline_notice + source = @results.fetch("sources").find do |candidate| + candidate.fetch("sourceOrigin") == "busybox" + end + + assert_equal "partial", source.fetch("licenseTextCoverage") + assert_equal "partial", source.fetch("attributionCoverage") + assert_equal 6, source.fetch("reviewedExistingEvidenceCount") + assert_includes( + source.fetch("resolvedReviewItems"), + "confirm-enabled-echo-license-and-attribution-coverage" + ) + assert_equal( + ["review-other-bundled-third-party-license-and-attribution-coverage"], + source.fetch("remainingReviewItems") + ) + assert_equal( + "additional-package-material-required", + source.fetch("engineeringConclusion") + ) + end + def test_rejects_candidate_manifest_digest_drift @candidates["status"] = "changed" diff --git a/Tests/Scripts/RootFSLicenseReviewResultsTests.rb b/Tests/Scripts/RootFSLicenseReviewResultsTests.rb index 9b2f122..6b965f7 100644 --- a/Tests/Scripts/RootFSLicenseReviewResultsTests.rb +++ b/Tests/Scripts/RootFSLicenseReviewResultsTests.rb @@ -39,7 +39,7 @@ def test_validates_pinned_engineering_review_results sources = validate assert_equal 10, sources.length - assert_equal 23, + assert_equal 24, sources.sum { |entry| entry.fetch("candidateResults").length } assert_equal 8, sources.count { |entry| !entry.fetch("remainingReviewItems").empty? }