Harden SSH parsing and add notice tooling
- Enforce exact service and channel names with bounded failure parsing - Add hash-pinned offline notice assembly and regression coverage - Record advisory dispositions, provenance, integration evidence, and remaining gates
This commit is contained in:
+109
@@ -0,0 +1,109 @@
|
||||
# Scoped release notice inputs and unresolved obligations
|
||||
|
||||
Reviewed local notice snapshot: **2026-09-16**. This is engineering evidence,
|
||||
not legal advice, legal clearance, a complete SBOM, or corresponding source.
|
||||
The bundle preserves separate files, not a single inferred umbrella license.
|
||||
|
||||
## Provenance and scope
|
||||
|
||||
`inputs.json` is the explicit, reviewed input policy for
|
||||
`tools/release_notices.py`. It records logical root/path, full-file size and
|
||||
SHA-256, optional zero-based half-open byte range, output SHA-256, and purpose.
|
||||
A null range means the **entire original file** is retained. Ranges select
|
||||
opening source notice comments verbatim, not source implementations. Even
|
||||
excerpts require the exact hash of the whole installed source file. Absolute
|
||||
machine paths, collection time, build artifacts and configuration are omitted.
|
||||
The manifest in each successful bundle repeats this evidence and identifies
|
||||
the catalog by hash. The catalog is trusted project policy, not a signed SBOM.
|
||||
|
||||
Roots identify the project checkout, installed ESP-IDF package, and installed
|
||||
Xtensa toolchain. Managed manifests and package metadata are retained as
|
||||
provenance, not as substitutes for licenses. Hashes identify the reviewed local
|
||||
bytes; they do not authenticate upstream authorship or validate all package
|
||||
contents. Versions: ESP-IDF 5.5.0 / package 3.50500.0, Xtensa package
|
||||
14.2.0+20241119, esp_tinyusb 2.2.1, led_strip 3.0.3, mDNS 1.12.0,
|
||||
TinyUSB 0.21.0~1, wolfSSL 5.8.2~1, wolfSSH 1.4.20.
|
||||
|
||||
The scoped inventory covers the six managed packages, the SDK/runtime groups
|
||||
in `docs/dependency_licenses.md`, two xterm packages, and the recorded icon
|
||||
summary. It retains configured-but-not-observed-linked groups too; inclusion
|
||||
is not a claim that each contributes to a release image. Full SDK/toolchain
|
||||
redistribution needs a broader review, including nested/test/tool licenses.
|
||||
No recursive license discovery is performed by the tool. Newly added files or
|
||||
NOTICEs outside the explicit list are not detected: review the catalog again
|
||||
when dependencies, selected objects, or distribution scope change.
|
||||
|
||||
## Grants and evidence that must not be collapsed
|
||||
|
||||
- Project: GPL-3.0-only; dependencies retain their own grants.
|
||||
- wolfSSL: preserve package LICENSE and README; GPLv3 option selected here.
|
||||
- **wolfSSH packaging discrepancy remains unresolved:** installed LICENSE and
|
||||
README describe wolfSSL/wolfCrypt and GPLv2-or-later; wolfSSH source headers
|
||||
explicitly grant GPL-3.0-or-later. Both evidence sets are included unchanged.
|
||||
GPLv3 is selected for this integration, not GPL-2.0-only. Seek upstream
|
||||
packaging clarification; this bundle does not silently repair vendor files.
|
||||
- Mbed TLS: preserve the whole dual-license document (Apache-2.0 OR
|
||||
GPL-2.0-or-later); Apache-2.0 is the selection for this integration.
|
||||
- Preserve **all** argtable3 aggregate notices and **both** SDK and toolchain
|
||||
Newlib texts. Neither aggregate is reduced to one guessed SPDX label.
|
||||
- GCC: preserve GPLv3 and the actual GCC Runtime Library Exception 3.1;
|
||||
COPYING3.LIB is not a substitute. Eligibility/per-object review remains.
|
||||
- wpa_supplicant: retain COPYING **and** README containing the full BSD grant;
|
||||
COPYING's historical GPL option discussion is not a current GPLv2-only grant.
|
||||
- Xtensa HAL and FatFs: retain complete opening permission/disclaimer comments.
|
||||
- TinyUSB's nested Espressif LED-strip license is retained separately; it is
|
||||
not a seventh managed package.
|
||||
|
||||
## TLSF full-text assembly
|
||||
|
||||
`TLSF-BSD-3-Clause.txt` is a **project-assembled rendering**, not a claimed
|
||||
verbatim upstream LICENSE. Copyright holder and years come from the installed
|
||||
IDF 5.5.0 files `components/heap/tlsf/include/tlsf.h` and
|
||||
`components/heap/tlsf/tlsf_block_functions.h`: both identify **2006–2016 Matthew
|
||||
Conte** and **BSD-3-Clause**. The three conditions and disclaimer render that
|
||||
SPDX license, with this holder, rather than another project's copyright.
|
||||
The original SPDX comments are retained as separately hash-pinned excerpts;
|
||||
`components/heap/tlsf/README.md` also records the 2016 switch to BSD. No new
|
||||
license grant or independent upstream authentication is claimed by assembly.
|
||||
|
||||
## Icons and browser notices
|
||||
|
||||
The existing Pictogrammers summary is retained unchanged. Full Apache-2.0 text
|
||||
is supplied as `inputs/sdk/LICENSE`, the exact installed SDK copy; this is
|
||||
license text, **not proof of the individual icons' provenance or grant**.
|
||||
The project records Material Design Icons 7.4.47 and adapted USB/Wi-Fi masks.
|
||||
Exact two-icon origin/version/licensing and any applicable upstream NOTICE
|
||||
still need verification before distribution. No icon or web asset was changed
|
||||
or regenerated, and no upstream icon provenance was authenticated here.
|
||||
|
||||
Both xterm MIT notices and `web_assets/SOURCES.md` are retained. This does not
|
||||
embed or serve notices in browser responses, authenticate preferred sources,
|
||||
or independently establish project-logo authorship. Arrange and verify actual
|
||||
firmware/device/browser recipient notice delivery; Git presence alone is not
|
||||
proof of delivery.
|
||||
|
||||
## Remaining release gates — bundle success does not close these
|
||||
|
||||
1. **Radio blobs:** establish required corresponding source or a defensible
|
||||
System Library/other exception for actual linked content. The three local
|
||||
Apache radio license files permit redistribution on their terms; they do
|
||||
not settle GPL corresponding-source compatibility. No clearance or blanket
|
||||
prohibition is asserted.
|
||||
2. Review final application **and bootloader** maps, runtime objects, ROM,
|
||||
mixed/aggregate and nested package attributions. The catalog is bounded,
|
||||
not an exhaustive selected-object audit or all-upstream-NOTICE inventory.
|
||||
3. Deliver exact preferred corresponding source through an appropriate GPLv3
|
||||
method. Include application and required dependency sources, safe build
|
||||
inputs, editable generators/patches, original hash-matching overlay inputs,
|
||||
`tools/security_overrides.py`, `cmake/security_overrides.cmake`, root CMake
|
||||
integration, `cmake/wolf_crypto_policy.{cmake,h}`, and **all**
|
||||
`tools/wolfssh_order/` delta/patch/provenance inputs. Retain upstream grants
|
||||
and generated modification/date notices (2026-09-15 baseline and
|
||||
2026-09-16 wolfSSH ordering). There are eight generated C sources and one
|
||||
PUBLIC forced header. This notice tool does **not** package those sources.
|
||||
4. Supply required asset preferred sources/build inputs, assess User Product
|
||||
Installation Information, and validate recipient access and source offers.
|
||||
Do not publish keys, passwords, Wi-Fi secrets, tickets, verifiers, NVS/flash
|
||||
images, credential backups, or secret-bearing build configurations.
|
||||
5. Resolve wolfSSH packaging and icon provenance questions above. Do not use a
|
||||
successful hash check as legal sign-off or whole-Phase-9 acceptance.
|
||||
Reference in New Issue
Block a user