[raylei50653]

Summary

Phase C PR-C4 (scope §6), release readiness. Contract, results and limits: docs/reference/native_runtime_resolved_config.md §20.

Not a distributable release. The licence status is local-only and the release key does not exist yet. Both are owner items, listed below.

• Licence re-audit, per object (owner instruction 10-08): shipping/license_audit.json, checked and rendered into THIRD_PARTY.md by scripts/native/license_audit.py.

  • Every claim is checked against the object's own wheel's licence file. Equal file sha256 is never taken as equal terms.
  • Official terms are version-matched: docs version switcher, release-notes component table, or the URL tag. The snapshots' sha256 and the clauses are quoted verbatim.

  status	objects
  granted in shipped + official text (17)	cudart, cufft, cublas, cublasLt, curand, cusparse, nvrtc, nvjpeg, cupti, cusparseLt, NCCL, torch ×6
  both grant, texts differ (6)	cuDNN ×5 (wheel ".so and .h, cudnn64_7.dll" vs 9.19.0 docs ".so and .dll"); libnvinfer (wheel = NVIDIA SLA + TRT Supplement §12.1, one-year auto-renew term, downstream ≥ as restrictive; 10.16.1 docs = SDK agreement "runtime .so")
  official text only (3)	libnvJitLink, libcufile: absent from the wheels' 2018 CUDA EULA, listed in CUDA 13.0 Update 2 EULA Attachment A (that release's component table names exactly these wheel versions). libnvshmem_host: the wheel carries the CUDA EULA; the NVSHMEM 3.4.5 SLA says "any portion of the SDK"
  no licence text shipped (1)	libgomp: GNU libgomp (GPL-3.0+ WITH GCC-exception-3.1); torch's LICENSE/NOTICE don't cover it; no GPL text and no source offer in the package

  The MANIFEST now records the audit sha256 and distribution: local-only.

• minisign signature: <name>.sha256.minisig signs the package digest, which covers the tarball and the installer.

  • The trusted comment is package=<name> commit=<sha> manifest_sha256=<sha>, so the installed MANIFEST.json can be checked against a signed value.
  • The user verifies before installing (minisign -V, then sha256sum -c). install.sh is byte-identical to PR-C3 (afa5d06a…).
  • check_shipping_package.py tarball --pubkey adds the fourth file and a signature check: minisign -V, an independent Ed25519 reader, and the trusted comment compared against the MANIFEST.
  • run_package_container.sh verify runs the user's check in Ubuntu 24.04.

• README.txt in the tree: sm_120; driver ≥ 580.95.05 (CUDA 13.0 U2 table; verified only on WSL2 616.92); glibc ≥ 2.39; verify → install → run; named limits; licences.

• Unchanged: stage computation, entrypoint pin, operator library, the 27 vendor objects and third_party_set.json, launcher, auditor, installer.

Formal run

• r1 bfd086c7 → FAIL, on one clause only. The original gate 4 required all four release files to be byte-identical across two builds, but host minisign 0.12 (libsodium 1.0.22) signs non-deterministically; container minisign 0.11 does not. Everything else passed.
• §20.4a amendment (f2ff5700, committed before r2): the three package files must be byte-identical, and the second signature must verify with the same trusted comment.
• r2 bc75dcab → PASS, re-run from scratch. Results in results/465_prc4_release/full_bc75dcab/ (not versioned), evaluation.json daa17f1c….

Gate	Result
1–2	build/install exit 0; static 12/12 (README included)
3 licence audit	coverage / bundled_texts / official_terms / notice 4/4, complete
4 package + signature	tree_clean, identity_current; tarball --pubkey 8/8; tarball c753496a…, installer and digest identical across builds; second signature verifies with the same trusted comment; MANIFEST = tree, licenses key correct
5 user verification (Ubuntu 24.04, minisign 0.11)	Signature and comment signature verified + 2× OK
6 install from tarball	install-trace 5/5 (one RENAME_NOREPLACE, 277 mutations in staging); static --manifest 13/13; --verify 0; installed MANIFEST.json sha256 = signed manifest_sha256
7 installed tree, clean container	EXACT: detector 5316/5316, MOT 7/7, graph 7/7; identical to the PR-C3 formal run
8 G2-2/G2-4	runtime 3/3; EXACT, 7/7 identical

Negative controls all gave their required result:

• Signature: refused (S1–S5, S7). Changed digest (S1), PR-C3's P3 repack with the digest recomputed (S2), changed installer (S3), edited trusted comment (S4), another key (S5), and no signature file (S7). In S1–S5, both the container verify and the host signature check fail. In S7 the container verify fails and the host check fails release_set and signature.
• Corrupt tarball, signature valid (S6). The signature verifies but sha256sum -c fails. Both steps are needed.
• Wrong content in a valid signature (S8). A wrong manifest_sha256 in a validly signed comment passes minisign; only the trusted-comment comparison catches it.
• Tampered installed tree (S9). --verify passes a consistently tampered installed tree; the MANIFEST sha256 no longer matches the signed value.
• Audit (L1–L3). Replaced cuFile licence file, altered snapshot, and a false claim for nvJitLink each fail the right check.

Review fixes (review of 59de3f28; fix 96bb41c0, docs §20.8)

Four P2, all checker coverage gaps, fixed in checker code only. Identity, audit, THIRD_PARTY.md, README and package are unchanged, so r2 still describes the source.

1. Release-notes matching now uses the object's own component row. cudart 13.0.88 no longer borrows NVRTC's 13.0.88.
2. Every granting official claim must be bound to the object's validated release (same source, same archive version, or matching switcher/tag). The context-only current CUDA EULA no longer counts.
3. A grant_* status requires a granting official claim. A shipped-text grant cannot be grant_in_official_only.
4. Pre-C4 source commits keep the PR-C3 MANIFEST reading, so PR-C3's MANIFEST derives exactly again.

Replay on r2's artifacts (results/465_prc4_release/review_fix_96bb41c0/):

• Gate 3 stays 4/4.
• L1–L3 still fail as required.
• The review's three false-PASS cases now fail (R1 official_terms, R2 official_terms, R3 coverage).
• PR-C3 and r2 MANIFESTs derive exactly, and r2 tarball --pubkey stays 8/8.

For owner review / decision

1. §4 licence items (THIRD_PARTY.md → Open items):

   • which text governs the three official-only objects;
   • TRT and cuDNN differing texts, including TRT's term and its downstream-restriction condition;
   • libgomp: ship the GPL-3.0 and RLE texts plus a source offer, or something else;
   • whether the general NVIDIA conditions are met.

   Stays local-only until you close these.

2. Release key: generate it yourself (minisign -G, with a password) and add shipping/package/minisign.pub in a separate PR. Key management is in §20.1. No key was committed here; the runs used throwaway test keys.

3. Design points (§20.1):

   • Sign the digest, not each file.
   • The trusted comment carries the MANIFEST sha256.
   • Users verify before installing; the installer stays minisign-free.
   • README.txt is inside the tree.
   • THIRD_PARTY.md is generated from the audit; the exporter's --notice is removed.

4. The §20.4a amendment after r1: disclosed in §20.4a / §20.5; r1's FAIL is kept.

Merge order

Review and merge the stacked republish PR into this branch first. That merge is required: test_runtime_identity_staleness fails without it.

CI on this branch alone fails 4 tests, all in the stale-identity group (test_runtime_identity_staleness ×2, test_research_lock ×2: implementation moved, not republished). These are expected until #545 is merged in. All other CI jobs pass.

scripts/pre_push.sh passed on the combined head with #545 (5323 passed).

🤖 Generated with Claude Code