Harden SSH parsing and add notice tooling

- Enforce exact service and channel names with bounded failure parsing - Add hash-pinned offline notice assembly and regression coverage - Record advisory dispositions, provenance, integration evidence, and remaining gates
2026-09-16 15:06:38 +02:00
parent bea33e1c95
commit 51f835c22f
29 changed files with 3332 additions and 46 deletions
@@ -0,0 +1,109 @@
+# Scoped release notice inputs and unresolved obligations
+
+Reviewed local notice snapshot: **2026-09-16**. This is engineering evidence,
+not legal advice, legal clearance, a complete SBOM, or corresponding source.
+The bundle preserves separate files, not a single inferred umbrella license.
+
+## Provenance and scope
+
+`inputs.json` is the explicit, reviewed input policy for
+`tools/release_notices.py`. It records logical root/path, full-file size and
+SHA-256, optional zero-based half-open byte range, output SHA-256, and purpose.
+A null range means the **entire original file** is retained. Ranges select
+opening source notice comments verbatim, not source implementations. Even
+excerpts require the exact hash of the whole installed source file. Absolute
+machine paths, collection time, build artifacts and configuration are omitted.
+The manifest in each successful bundle repeats this evidence and identifies
+the catalog by hash. The catalog is trusted project policy, not a signed SBOM.
+
+Roots identify the project checkout, installed ESP-IDF package, and installed
+Xtensa toolchain. Managed manifests and package metadata are retained as
+provenance, not as substitutes for licenses. Hashes identify the reviewed local
+bytes; they do not authenticate upstream authorship or validate all package
+contents. Versions: ESP-IDF 5.5.0 / package 3.50500.0, Xtensa package
+14.2.0+20241119, esp_tinyusb 2.2.1, led_strip 3.0.3, mDNS 1.12.0,
+TinyUSB 0.21.0~1, wolfSSL 5.8.2~1, wolfSSH 1.4.20.
+
+The scoped inventory covers the six managed packages, the SDK/runtime groups
+in `docs/dependency_licenses.md`, two xterm packages, and the recorded icon
+summary. It retains configured-but-not-observed-linked groups too; inclusion
+is not a claim that each contributes to a release image. Full SDK/toolchain
+redistribution needs a broader review, including nested/test/tool licenses.
+No recursive license discovery is performed by the tool. Newly added files or
+NOTICEs outside the explicit list are not detected: review the catalog again
+when dependencies, selected objects, or distribution scope change.
+
+## Grants and evidence that must not be collapsed
+
+- Project: GPL-3.0-only; dependencies retain their own grants.
+- wolfSSL: preserve package LICENSE and README; GPLv3 option selected here.
+- **wolfSSH packaging discrepancy remains unresolved:** installed LICENSE and
+  README describe wolfSSL/wolfCrypt and GPLv2-or-later; wolfSSH source headers
+  explicitly grant GPL-3.0-or-later. Both evidence sets are included unchanged.
+  GPLv3 is selected for this integration, not GPL-2.0-only. Seek upstream
+  packaging clarification; this bundle does not silently repair vendor files.
+- Mbed TLS: preserve the whole dual-license document (Apache-2.0 OR
+  GPL-2.0-or-later); Apache-2.0 is the selection for this integration.
+- Preserve **all** argtable3 aggregate notices and **both** SDK and toolchain
+  Newlib texts. Neither aggregate is reduced to one guessed SPDX label.
+- GCC: preserve GPLv3 and the actual GCC Runtime Library Exception 3.1;
+  COPYING3.LIB is not a substitute. Eligibility/per-object review remains.
+- wpa_supplicant: retain COPYING **and** README containing the full BSD grant;
+  COPYING's historical GPL option discussion is not a current GPLv2-only grant.
+- Xtensa HAL and FatFs: retain complete opening permission/disclaimer comments.
+- TinyUSB's nested Espressif LED-strip license is retained separately; it is
+  not a seventh managed package.
+
+## TLSF full-text assembly
+
+`TLSF-BSD-3-Clause.txt` is a **project-assembled rendering**, not a claimed
+verbatim upstream LICENSE. Copyright holder and years come from the installed
+IDF 5.5.0 files `components/heap/tlsf/include/tlsf.h` and
+`components/heap/tlsf/tlsf_block_functions.h`: both identify **2006–2016 Matthew
+Conte** and **BSD-3-Clause**. The three conditions and disclaimer render that
+SPDX license, with this holder, rather than another project's copyright.
+The original SPDX comments are retained as separately hash-pinned excerpts;
+`components/heap/tlsf/README.md` also records the 2016 switch to BSD. No new
+license grant or independent upstream authentication is claimed by assembly.
+
+## Icons and browser notices
+
+The existing Pictogrammers summary is retained unchanged. Full Apache-2.0 text
+is supplied as `inputs/sdk/LICENSE`, the exact installed SDK copy; this is
+license text, **not proof of the individual icons' provenance or grant**.
+The project records Material Design Icons 7.4.47 and adapted USB/Wi-Fi masks.
+Exact two-icon origin/version/licensing and any applicable upstream NOTICE
+still need verification before distribution. No icon or web asset was changed
+or regenerated, and no upstream icon provenance was authenticated here.
+
+Both xterm MIT notices and `web_assets/SOURCES.md` are retained. This does not
+embed or serve notices in browser responses, authenticate preferred sources,
+or independently establish project-logo authorship. Arrange and verify actual
+firmware/device/browser recipient notice delivery; Git presence alone is not
+proof of delivery.
+
+## Remaining release gates — bundle success does not close these
+
+1. **Radio blobs:** establish required corresponding source or a defensible
+   System Library/other exception for actual linked content. The three local
+   Apache radio license files permit redistribution on their terms; they do
+   not settle GPL corresponding-source compatibility. No clearance or blanket
+   prohibition is asserted.
+2. Review final application **and bootloader** maps, runtime objects, ROM,
+   mixed/aggregate and nested package attributions. The catalog is bounded,
+   not an exhaustive selected-object audit or all-upstream-NOTICE inventory.
+3. Deliver exact preferred corresponding source through an appropriate GPLv3
+   method. Include application and required dependency sources, safe build
+   inputs, editable generators/patches, original hash-matching overlay inputs,
+   `tools/security_overrides.py`, `cmake/security_overrides.cmake`, root CMake
+   integration, `cmake/wolf_crypto_policy.{cmake,h}`, and **all**
+   `tools/wolfssh_order/` delta/patch/provenance inputs. Retain upstream grants
+   and generated modification/date notices (2026-09-15 baseline and
+   2026-09-16 wolfSSH ordering). There are eight generated C sources and one
+   PUBLIC forced header. This notice tool does **not** package those sources.
+4. Supply required asset preferred sources/build inputs, assess User Product
+   Installation Information, and validate recipient access and source offers.
+   Do not publish keys, passwords, Wi-Fi secrets, tickets, verifiers, NVS/flash
+   images, credential backups, or secret-bearing build configurations.
+5. Resolve wolfSSH packaging and icon provenance questions above. Do not use a
+   successful hash check as legal sign-off or whole-Phase-9 acceptance.
@@ -0,0 +1,28 @@
+Copyright (c) 2006-2016 Matthew Conte
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
@@ -0,0 +1,619 @@
+{
+  "inputs": [
+    {
+      "output_sha256": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903",
+      "path": "LICENSE",
+      "purpose": "Project GPL-3.0-only full text",
+      "range": null,
+      "root": "project",
+      "sha256": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903",
+      "size": 35147
+    },
+    {
+      "output_sha256": "2d1c62093cafdb54cd209813c526c35e2e470b62cc6f5b0cde9a040569662726",
+      "path": "dependencies.lock",
+      "purpose": "Exact resolved package identity; not complete package-content verification",
+      "range": null,
+      "root": "project",
+      "sha256": "2d1c62093cafdb54cd209813c526c35e2e470b62cc6f5b0cde9a040569662726",
+      "size": 2239
+    },
+    {
+      "output_sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "path": "managed_components/espressif__esp_tinyusb/LICENSE",
+      "purpose": "espressif__esp_tinyusb 2.2.1 complete package license; preserve original grant",
+      "range": null,
+      "root": "project",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "size": 11358
+    },
+    {
+      "output_sha256": "425288a2ceb030d3890a11e741408737769210f6c94b86e5d8af934969c1098e",
+      "path": "managed_components/espressif__esp_tinyusb/idf_component.yml",
+      "purpose": "Installed espressif__esp_tinyusb 2.2.1 manifest/provenance",
+      "range": null,
+      "root": "project",
+      "sha256": "425288a2ceb030d3890a11e741408737769210f6c94b86e5d8af934969c1098e",
+      "size": 552
+    },
+    {
+      "output_sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "path": "managed_components/espressif__led_strip/LICENSE",
+      "purpose": "espressif__led_strip 3.0.3 complete package license; preserve original grant",
+      "range": null,
+      "root": "project",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "size": 11358
+    },
+    {
+      "output_sha256": "f4f09e02e4e53be5b49defeab1b6da6cdb9acfe377df892dfef5a0c370a7f88e",
+      "path": "managed_components/espressif__led_strip/idf_component.yml",
+      "purpose": "Installed espressif__led_strip 3.0.3 manifest/provenance",
+      "range": null,
+      "root": "project",
+      "sha256": "f4f09e02e4e53be5b49defeab1b6da6cdb9acfe377df892dfef5a0c370a7f88e",
+      "size": 492
+    },
+    {
+      "output_sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "path": "managed_components/espressif__mdns/LICENSE",
+      "purpose": "espressif__mdns 1.12.0 complete package license; preserve original grant",
+      "range": null,
+      "root": "project",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "size": 11358
+    },
+    {
+      "output_sha256": "7d2b92cf9ab3055e97a271b98aac3f1044a0224997f419d60a2eda3e411e2ba7",
+      "path": "managed_components/espressif__mdns/idf_component.yml",
+      "purpose": "Installed espressif__mdns 1.12.0 manifest/provenance",
+      "range": null,
+      "root": "project",
+      "sha256": "7d2b92cf9ab3055e97a271b98aac3f1044a0224997f419d60a2eda3e411e2ba7",
+      "size": 536
+    },
+    {
+      "output_sha256": "f878d62e47e693ea64160218edb1b9b4755f4839a3179e5bef4a6b0359399431",
+      "path": "managed_components/espressif__tinyusb/LICENSE",
+      "purpose": "espressif__tinyusb 0.21.0~1 complete package license; preserve original grant",
+      "range": null,
+      "root": "project",
+      "sha256": "f878d62e47e693ea64160218edb1b9b4755f4839a3179e5bef4a6b0359399431",
+      "size": 1094
+    },
+    {
+      "output_sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "path": "managed_components/espressif__tinyusb/hw/bsp/espressif/components/led_strip/LICENSE",
+      "purpose": "Nested TinyUSB LED-strip Apache text, not a separate managed package",
+      "range": null,
+      "root": "project",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "size": 11358
+    },
+    {
+      "output_sha256": "7ede1ca2d096c412153fe0bf6ac7f66cee1700f0d8c0145fe16572d97107bab3",
+      "path": "managed_components/espressif__tinyusb/idf_component.yml",
+      "purpose": "Installed espressif__tinyusb 0.21.0~1 manifest/provenance",
+      "range": null,
+      "root": "project",
+      "sha256": "7ede1ca2d096c412153fe0bf6ac7f66cee1700f0d8c0145fe16572d97107bab3",
+      "size": 546
+    },
+    {
+      "output_sha256": "d685e441d8dc6e1cde6d8c186d91a75b2ec85996827e4ed3ba788624dfa9fb96",
+      "path": "managed_components/wolfssl__wolfssh/LICENSE.txt",
+      "purpose": "wolfssl__wolfssh 1.4.20 complete package license; preserve original grant",
+      "range": null,
+      "root": "project",
+      "sha256": "d685e441d8dc6e1cde6d8c186d91a75b2ec85996827e4ed3ba788624dfa9fb96",
+      "size": 18561
+    },
+    {
+      "output_sha256": "3f37e0907f74b39690264ddf2c98c4e0450aa124bb3bd83179072db95afbc009",
+      "path": "managed_components/wolfssl__wolfssh/README.md",
+      "purpose": "Vendor package licensing evidence; wolfSSH discrepancy deliberately retained",
+      "range": null,
+      "root": "project",
+      "sha256": "3f37e0907f74b39690264ddf2c98c4e0450aa124bb3bd83179072db95afbc009",
+      "size": 25197
+    },
+    {
+      "output_sha256": "b564e8ff99909fc2a2ac66044fb990be3e4c682ada98d4a70da5586468d55805",
+      "path": "managed_components/wolfssl__wolfssh/idf_component.yml",
+      "purpose": "Installed wolfssl__wolfssh 1.4.20 manifest/provenance",
+      "range": null,
+      "root": "project",
+      "sha256": "b564e8ff99909fc2a2ac66044fb990be3e4c682ada98d4a70da5586468d55805",
+      "size": 814
+    },
+    {
+      "output_sha256": "d5c223b9ed52c38966fcf90ea8c8cf03ea9094912787e3b973148225dc1578a0",
+      "path": "managed_components/wolfssl__wolfssh/src/internal.c",
+      "purpose": "Original wolfSSH GPL-3.0-or-later header; package discrepancy evidence",
+      "range": [
+        0,
+        893
+      ],
+      "root": "project",
+      "sha256": "81ff1f9166708abd5c2911e9fe57c0aee01c88b5d3f68c909ee8a856d37f36a9",
+      "size": 510670
+    },
+    {
+      "output_sha256": "d0389a2609e4d4e06bdf706fc2fcf23e393538c2ec445966adbf317affbe3c15",
+      "path": "managed_components/wolfssl__wolfssh/src/ssh.c",
+      "purpose": "Original wolfSSH GPL-3.0-or-later header; package discrepancy evidence",
+      "range": [
+        0,
+        792
+      ],
+      "root": "project",
+      "sha256": "a4f479ff87eea0980ec1ebdf2c7dd090da473780181b695a56799cb9611f4366",
+      "size": 92396
+    },
+    {
+      "output_sha256": "7c63cd47453716ce0edef178034cfe64777defb0ae79b22668c528ba657baad8",
+      "path": "managed_components/wolfssl__wolfssh/wolfssh/internal.h",
+      "purpose": "Original wolfSSH GPL-3.0-or-later header; package discrepancy evidence",
+      "range": [
+        0,
+        893
+      ],
+      "root": "project",
+      "sha256": "8e417149a68f8a6c0506957adf014b3e6c1727a723536826ce5fb0c9e1f1aba3",
+      "size": 42113
+    },
+    {
+      "output_sha256": "066c056f7d5185db684c04d059fc3e45c4d25193179d3c7ec0736f7a39d92523",
+      "path": "managed_components/wolfssl__wolfssl/LICENSE.txt",
+      "purpose": "wolfssl__wolfssl 5.8.2~1 complete package license; preserve original grant",
+      "range": null,
+      "root": "project",
+      "sha256": "066c056f7d5185db684c04d059fc3e45c4d25193179d3c7ec0736f7a39d92523",
+      "size": 35618
+    },
+    {
+      "output_sha256": "9236deefd68274ba254d6e1baa729aa65f6261047dc8b0b8d1cce923ad39c0fa",
+      "path": "managed_components/wolfssl__wolfssl/README.md",
+      "purpose": "Vendor package licensing evidence; wolfSSH discrepancy deliberately retained",
+      "range": null,
+      "root": "project",
+      "sha256": "9236deefd68274ba254d6e1baa729aa65f6261047dc8b0b8d1cce923ad39c0fa",
+      "size": 31216
+    },
+    {
+      "output_sha256": "7d2a0ee3ce246b64f959358c63e291871228d750ea1bcf82974d8d8934047f84",
+      "path": "managed_components/wolfssl__wolfssl/idf_component.yml",
+      "purpose": "Installed wolfssl__wolfssl 5.8.2~1 manifest/provenance",
+      "range": null,
+      "root": "project",
+      "sha256": "7d2a0ee3ce246b64f959358c63e291871228d750ea1bcf82974d8d8934047f84",
+      "size": 975
+    },
+    {
+      "output_sha256": "f3bc8715bad84b26396bb42d2abd11f919cf58163be158eab79ecbaabf84cdf2",
+      "path": "third_party/material-design-icons/LICENSE",
+      "purpose": "Original Pictogrammers summary; per-icon provenance remains open",
+      "range": null,
+      "root": "project",
+      "sha256": "f3bc8715bad84b26396bb42d2abd11f919cf58163be158eab79ecbaabf84cdf2",
+      "size": 1012
+    },
+    {
+      "output_sha256": "9875d806c9437b5dbdd7ba341beac4772abd8da8e1d14c1a6279fe802b43208b",
+      "path": "third_party/release-notices/README.md",
+      "purpose": "Scope, provenance, license choices and unresolved release gates",
+      "range": null,
+      "root": "project",
+      "sha256": "9875d806c9437b5dbdd7ba341beac4772abd8da8e1d14c1a6279fe802b43208b",
+      "size": 6822
+    },
+    {
+      "output_sha256": "8eb4021ed94ecea9bac60bda1a8be7bbc5ccbfe547196bb061dcbe29c01227de",
+      "path": "third_party/release-notices/TLSF-BSD-3-Clause.txt",
+      "purpose": "Project-assembled full TLSF BSD text; see provenance",
+      "range": null,
+      "root": "project",
+      "sha256": "8eb4021ed94ecea9bac60bda1a8be7bbc5ccbfe547196bb061dcbe29c01227de",
+      "size": 1503
+    },
+    {
+      "output_sha256": "bfb782d9f078b325b3d3cc971a30a19f83d88d3624558055f5cceaaf836c5f6c",
+      "path": "web_assets/SOURCES.md",
+      "purpose": "Recorded browser package provenance; not preferred-source delivery",
+      "range": null,
+      "root": "project",
+      "sha256": "bfb782d9f078b325b3d3cc971a30a19f83d88d3624558055f5cceaaf836c5f6c",
+      "size": 2224
+    },
+    {
+      "output_sha256": "e256f01188af527e4d06d21d06fbf785ae9c50d4b328bf03cbe0ba7f0aa4228f",
+      "path": "web_assets/addon-fit.LICENSE",
+      "purpose": "addon-fit 0.10.0 complete MIT notice",
+      "range": null,
+      "root": "project",
+      "sha256": "e256f01188af527e4d06d21d06fbf785ae9c50d4b328bf03cbe0ba7f0aa4228f",
+      "size": 1103
+    },
+    {
+      "output_sha256": "b569f629d00f2626a8100df2a1798210535621e42164dfd426a6fe5aac7b0ccd",
+      "path": "web_assets/xterm.LICENSE",
+      "purpose": "xterm 5.5.0 complete MIT notice",
+      "range": null,
+      "root": "project",
+      "sha256": "b569f629d00f2626a8100df2a1798210535621e42164dfd426a6fe5aac7b0ccd",
+      "size": 1261
+    },
+    {
+      "output_sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "path": "LICENSE",
+      "purpose": "Complete Apache-2.0 text; not an umbrella license for the SDK or proof of icon provenance",
+      "range": null,
+      "root": "sdk",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "size": 11358
+    },
+    {
+      "output_sha256": "a97df648b7db77f9f6f5e1ef5fe44eb6b154ecb8ae26ad39c92ea44201cce45c",
+      "path": "components/console/argtable3/LICENSE",
+      "purpose": "All aggregate BSD/TCL and other notices, without reduction",
+      "range": null,
+      "root": "sdk",
+      "sha256": "a97df648b7db77f9f6f5e1ef5fe44eb6b154ecb8ae26ad39c92ea44201cce45c",
+      "size": 8379
+    },
+    {
+      "output_sha256": "efe1692aa5b869edaa0ac88f95eb0276c1125304ffc636a299db3ebbab47f62b",
+      "path": "components/console/linenoise/LICENSE",
+      "purpose": "linenoise complete BSD notice",
+      "range": null,
+      "root": "sdk",
+      "sha256": "efe1692aa5b869edaa0ac88f95eb0276c1125304ffc636a299db3ebbab47f62b",
+      "size": 1408
+    },
+    {
+      "output_sha256": "583218cc7348bba9aa96e80eb6e83ec5beb326b31b08f595ea75a6053fb777f1",
+      "path": "components/esp-tls/esp_tls_mbedtls.c",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        122
+      ],
+      "root": "sdk",
+      "sha256": "09210c5a601647ca5775d127a2951bab2f3e509192b53487bbea8a93d8731b78",
+      "size": 50176
+    },
+    {
+      "output_sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "path": "components/esp_coex/lib/LICENSE",
+      "purpose": "Radio coexistence license; corresponding-source question unresolved",
+      "range": null,
+      "root": "sdk",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "size": 11358
+    },
+    {
+      "output_sha256": "b7899bfe4f45f8022277af60f5cd23b4d3b564204d8d4388a1aac9a79a4969fb",
+      "path": "components/esp_http_server/src/httpd_parse.c",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        124
+      ],
+      "root": "sdk",
+      "sha256": "6bba77064aaa68a06f8d4c01432064a1b050c91ed22741c547785b0d8a6c07d8",
+      "size": 42937
+    },
+    {
+      "output_sha256": "ac30b81150e83c53ca204dfc012632b5b3d69a0889477e1850067de0f24350c2",
+      "path": "components/esp_https_server/src/https_server.c",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        123
+      ],
+      "root": "sdk",
+      "sha256": "6481942b62e51125e2a43441fa0900cbda74bd2ea05c82f0c29eb4933c31946e",
+      "size": 15257
+    },
+    {
+      "output_sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "path": "components/esp_phy/lib/LICENSE",
+      "purpose": "Radio PHY license; corresponding-source question unresolved",
+      "range": null,
+      "root": "sdk",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "size": 11358
+    },
+    {
+      "output_sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "path": "components/esp_wifi/lib/LICENSE",
+      "purpose": "Radio Wi-Fi license; corresponding-source question unresolved",
+      "range": null,
+      "root": "sdk",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "size": 11358
+    },
+    {
+      "output_sha256": "2bb0c0fbfbda95040387540e08f5f5bd811c9a4fc271a4ded940b69e3d868a45",
+      "path": "components/fatfs/src/ff.c",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        944
+      ],
+      "root": "sdk",
+      "sha256": "b6511bc0102f42b941897cd9f96f75206b6851fedbebc6dcb17c220cb1d4bede",
+      "size": 251190
+    },
+    {
+      "output_sha256": "508a77d2e7b51d98adeed32648ad124b7b30241a8e70b2e72c99f92d8e5874d1",
+      "path": "components/freertos/FreeRTOS-Kernel/LICENSE.md",
+      "purpose": "FreeRTOS MIT full notice",
+      "range": null,
+      "root": "sdk",
+      "sha256": "508a77d2e7b51d98adeed32648ad124b7b30241a8e70b2e72c99f92d8e5874d1",
+      "size": 1036
+    },
+    {
+      "output_sha256": "8e3d9f79bbbdf6dfd6fbf132982a7ec3a45ff6dac92277034316efae4cccad84",
+      "path": "components/freertos/FreeRTOS-Kernel/include/freertos/task.h",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        1455
+      ],
+      "root": "sdk",
+      "sha256": "ac666bcbe4acb21c44cc820631f8c579d089698967015054c5ab42d092dddc2d",
+      "size": 133072
+    },
+    {
+      "output_sha256": "968c3f0d60fb9ee8cc1047503823e75ccc28bf6e7e7b0451894b01c1e400d939",
+      "path": "components/heap/tlsf/README.md",
+      "purpose": "TLSF author and BSD transition provenance",
+      "range": null,
+      "root": "sdk",
+      "sha256": "968c3f0d60fb9ee8cc1047503823e75ccc28bf6e7e7b0451894b01c1e400d939",
+      "size": 2960
+    },
+    {
+      "output_sha256": "e4bba79e27dbd0f9e632890a8c8d860222597124d31708166c0105a42a0d411e",
+      "path": "components/heap/tlsf/include/tlsf.h",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        109
+      ],
+      "root": "sdk",
+      "sha256": "69799f4f1e7c5f8d3a35e89f5efb8014aa00e6e49f96939b93fc39ceb95d0e8b",
+      "size": 3063
+    },
+    {
+      "output_sha256": "ea18a0b9b12226900ecc933d075e4c5ebeb3e54a5b0b53e62caab458485be65a",
+      "path": "components/heap/tlsf/tlsf_block_functions.h",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        103
+      ],
+      "root": "sdk",
+      "sha256": "c0e8ccac7b83c6964a8e19d83c69e1e2651c25101e34feb36b3e10b96d3fe5a8",
+      "size": 5502
+    },
+    {
+      "output_sha256": "3aced2d086d3f59cafb6589770c30c1e45a5bdf50c1d4375060b81a615db604c",
+      "path": "components/http_parser/LICENSE.txt",
+      "purpose": "HTTP parser full MIT attribution",
+      "range": null,
+      "root": "sdk",
+      "sha256": "3aced2d086d3f59cafb6589770c30c1e45a5bdf50c1d4375060b81a615db604c",
+      "size": 1298
+    },
+    {
+      "output_sha256": "a36dda207c36db5818729c54e7ad4e8b0c6fba847491ba64f372c1a2037b6d5c",
+      "path": "components/json/cJSON/LICENSE",
+      "purpose": "cJSON complete MIT notice; configured group",
+      "range": null,
+      "root": "sdk",
+      "sha256": "a36dda207c36db5818729c54e7ad4e8b0c6fba847491ba64f372c1a2037b6d5c",
+      "size": 1084
+    },
+    {
+      "output_sha256": "5b649eca17ae68aa41cbe5e4280f724f8dfdd1ed755f8b4c2e73f6ee290f2c54",
+      "path": "components/lwip/apps/dhcpserver/dhcpserver.c",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        122
+      ],
+      "root": "sdk",
+      "sha256": "953f46189bc64680ea5fa761e75511fadb3aebf698a0d9dff251d77166d78b80",
+      "size": 50677
+    },
+    {
+      "output_sha256": "ef4aac92e05e87cd1cdc140870ed52206ba03d4a7fe46c1e11d7ffa6c87d252b",
+      "path": "components/lwip/lwip/COPYING",
+      "purpose": "lwIP complete BSD notice",
+      "range": null,
+      "root": "sdk",
+      "sha256": "ef4aac92e05e87cd1cdc140870ed52206ba03d4a7fe46c1e11d7ffa6c87d252b",
+      "size": 1425
+    },
+    {
+      "output_sha256": "9b405ef4c89342f5eae1dd828882f931747f71001cfba7d114801039b52ad09b",
+      "path": "components/mbedtls/mbedtls/LICENSE",
+      "purpose": "Mbed TLS complete dual-license document; Apache option selected",
+      "range": null,
+      "root": "sdk",
+      "sha256": "9b405ef4c89342f5eae1dd828882f931747f71001cfba7d114801039b52ad09b",
+      "size": 29852
+    },
+    {
+      "output_sha256": "11402351e38392230bb8934ba1095c0c0049a296c0f8821f76e4672dff54b490",
+      "path": "components/mbedtls/mbedtls/framework/LICENSE",
+      "purpose": "Nested Mbed TLS framework license",
+      "range": null,
+      "root": "sdk",
+      "sha256": "11402351e38392230bb8934ba1095c0c0049a296c0f8821f76e4672dff54b490",
+      "size": 29861
+    },
+    {
+      "output_sha256": "fc26fc613803f5910ffe68b6f4924bc833d5613a0fed289f851dd4b6afdf76ea",
+      "path": "components/mbedtls/mbedtls/library/ssl_tls.c",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        223
+      ],
+      "root": "sdk",
+      "sha256": "b726c0c55bc5f32255f129d55f9f2fface85ce83de90a2d16c9017b93b738bff",
+      "size": 329921
+    },
+    {
+      "output_sha256": "0664aa34d3da2b71799883b2fc3250286f76ee69ed0b3676d53d25b635ee721d",
+      "path": "components/mbedtls/mbedtls/library/x509_create.c",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        169
+      ],
+      "root": "sdk",
+      "sha256": "fd399239aee30384786a19b47bfe5dd22b979d5d89bb38f29f0c82a3d81daaf7",
+      "size": 19803
+    },
+    {
+      "output_sha256": "20ed622a5f1a273258b415097609f6a236fb2f23f8c593c63e29e6cc77de0032",
+      "path": "components/mqtt/esp-mqtt/LICENSE",
+      "purpose": "ESP-MQTT complete Apache license; configured group",
+      "range": null,
+      "root": "sdk",
+      "sha256": "20ed622a5f1a273258b415097609f6a236fb2f23f8c593c63e29e6cc77de0032",
+      "size": 11339
+    },
+    {
+      "output_sha256": "0681089a556e93791da82718d68011ba452de245f7f59c3846936304756ac0c0",
+      "path": "components/newlib/COPYING.NEWLIB",
+      "purpose": "Complete SDK Newlib mixed notices, separate from toolchain version",
+      "range": null,
+      "root": "sdk",
+      "sha256": "0681089a556e93791da82718d68011ba452de245f7f59c3846936304756ac0c0",
+      "size": 46295
+    },
+    {
+      "output_sha256": "b8999cb392cc5bbe8cd679de59584ad8d2f26033123e76f1d662fa14b9d4f287",
+      "path": "components/protobuf-c/protobuf-c/LICENSE",
+      "purpose": "protobuf-c complete BSD notice; configured group",
+      "range": null,
+      "root": "sdk",
+      "sha256": "b8999cb392cc5bbe8cd679de59584ad8d2f26033123e76f1d662fa14b9d4f287",
+      "size": 1613
+    },
+    {
+      "output_sha256": "d19257540156a51ed50c2378e7159066415d8bbbe147779f8deb0d3e73f1b0a7",
+      "path": "components/spiffs/spiffs/LICENSE",
+      "purpose": "SPIFFS complete MIT notice; configured group",
+      "range": null,
+      "root": "sdk",
+      "sha256": "d19257540156a51ed50c2378e7159066415d8bbbe147779f8deb0d3e73f1b0a7",
+      "size": 1117
+    },
+    {
+      "output_sha256": "a87ac4e333d0f120408a9d814e40c3672cd27f365af89b4f2f6631f7a9338953",
+      "path": "components/wpa_supplicant/COPYING",
+      "purpose": "wpa_supplicant grant redirect and historical licensing context",
+      "range": null,
+      "root": "sdk",
+      "sha256": "a87ac4e333d0f120408a9d814e40c3672cd27f365af89b4f2f6631f7a9338953",
+      "size": 965
+    },
+    {
+      "output_sha256": "17ccbcf4b17a910795292fb4a95f4742d2ecda37d06fcf20d60ffbd70cfbc609",
+      "path": "components/wpa_supplicant/README",
+      "purpose": "wpa_supplicant full current BSD grant",
+      "range": null,
+      "root": "sdk",
+      "sha256": "17ccbcf4b17a910795292fb4a95f4742d2ecda37d06fcf20d60ffbd70cfbc609",
+      "size": 1803
+    },
+    {
+      "output_sha256": "274cb732d5292ab3fe9a58a7149b447fd3fb43517d9640f074d64dc485c24c98",
+      "path": "components/xtensa/include/xtensa/hal.h",
+      "purpose": "Original opening attribution/license comment(s), exact full-source hash and excerpt",
+      "range": [
+        0,
+        1797
+      ],
+      "root": "sdk",
+      "sha256": "2e54b026691b4c3b166500f011d99fec5f0824a08dff489dff75c43311010f89",
+      "size": 64919
+    },
+    {
+      "output_sha256": "1cc05e4ea172de6be2e6b961994de42a0f7433406619f6474811b11066718908",
+      "path": "package.json",
+      "purpose": "Installed SDK package 3.50500.0 identity",
+      "range": null,
+      "root": "sdk",
+      "sha256": "1cc05e4ea172de6be2e6b961994de42a0f7433406619f6474811b11066718908",
+      "size": 536
+    },
+    {
+      "output_sha256": "6474d3ae428762830d36e3b179c6e1622f8f5dc7d32ea94f47be9c122c467979",
+      "path": "version.txt",
+      "purpose": "Installed IDF 5.5.0 identity",
+      "range": null,
+      "root": "sdk",
+      "sha256": "6474d3ae428762830d36e3b179c6e1622f8f5dc7d32ea94f47be9c122c467979",
+      "size": 5
+    },
+    {
+      "output_sha256": "dd464ff1928a475656430e04342a94f0293d2aaf4447bdae438a69c7accc1698",
+      "path": "package.json",
+      "purpose": "Installed Xtensa toolchain 14.2.0+20241119 identity; not runtime license classification",
+      "range": null,
+      "root": "toolchain",
+      "sha256": "dd464ff1928a475656430e04342a94f0293d2aaf4447bdae438a69c7accc1698",
+      "size": 472
+    },
+    {
+      "output_sha256": "9d6b43ce4d8de0c878bf16b54d8e7a10d9bd42b75178153e3af6a815bdc90f74",
+      "path": "share/licenses/gcc/COPYING.RUNTIME",
+      "purpose": "Full GCC Runtime Library Exception 3.1; eligibility still requires review",
+      "range": null,
+      "root": "toolchain",
+      "sha256": "9d6b43ce4d8de0c878bf16b54d8e7a10d9bd42b75178153e3af6a815bdc90f74",
+      "size": 3324
+    },
+    {
+      "output_sha256": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903",
+      "path": "share/licenses/gcc/gcc/COPYING3",
+      "purpose": "Full GPLv3 runtime license text",
+      "range": null,
+      "root": "toolchain",
+      "sha256": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903",
+      "size": 35147
+    },
+    {
+      "output_sha256": "422aa40293093fb54fc66e692a0d68fd0b24ed5602e5d1d33ad05ba3909057e9",
+      "path": "share/licenses/newlib/COPYING.NEWLIB",
+      "purpose": "Complete actual toolchain Newlib mixed notices, not the older SDK summary",
+      "range": null,
+      "root": "toolchain",
+      "sha256": "422aa40293093fb54fc66e692a0d68fd0b24ed5602e5d1d33ad05ba3909057e9",
+      "size": 63318
+    }
+  ],
+  "schema": 1,
+  "snapshot": {
+    "idf": "5.5.0",
+    "managed": {
+      "espressif__esp_tinyusb": "2.2.1",
+      "espressif__led_strip": "3.0.3",
+      "espressif__mdns": "1.12.0",
+      "espressif__tinyusb": "0.21.0~1",
+      "wolfssl__wolfssh": "1.4.20",
+      "wolfssl__wolfssl": "5.8.2~1"
+    },
+    "reviewed": "2026-09-16",
+    "sdk_package": "3.50500.0",
+    "toolchain_package": "14.2.0+20241119"
+  }
+}