Participant Relationship Protocol

Back to matrix

E03-CJ: Yes

Rationale

A public implementation witness is the pinned cjdns client f5902ac on Linux ARM32 together with the replicated Rust route server 46c9c1b on Linux. Earlier source mapping established matching route-query, signed-announcement, state-hash and reset interfaces. The two exceptional entries in the 413-version registry license inventory are target-specific: BoringTun f288b2f enables ring only when target_arch is not arm; its ARM32 data path instead uses the included BSD-3-Clause ChaCha20Poly1305 implementation and a /dev/urandom wrapper. The server constant_time_eq 0.1.5 chain is reached through Redox-only dirs-sys/redox_users dependencies, not the Linux configuration. The remaining registry entries offer OSI-approved licensing options. Required Git components have GPL-3.0, MIT/Apache or BSD notices. Both pinned sodiumoxide revisions reference the same native libsodium submodule 8acd22717f6af798b1ed5fd275e2b4c789425cf5, whose actual license is ISC. The native cjdns build uses that source; its legacy-named event wrappers call the Rust interface rather than requiring an unaccounted libuv implementation. These public sources cover the selected protocol functions without an editorial code patch.

Assessment method

Documentary selected-function and target-specific license coverage

Source context

Pinned cjdns/BoringTun/route-server source, target guards, registry inventory and native libsodium submodule license

Outstanding qualification

E03 credits documentary source availability and license coverage for this target-specific witness, not a newly executed ARM build or interoperability test. ARM32 means Rust target_arch=arm, not aarch64. The existing x86 client candidate retains ring with legacy OpenSSL/SSLeay sources and is not the licensing witness used for this Yes. The score does not relabel CC0 as OSI-approved, claim identical announcement lists at all times, or certify cryptography, global scale, runtime behavior or every redistribution obligation. Dependency review reuses the retained 413-version inventory and inspects target guards, Git notices and native-source provenance; no fresh full binary/link-map audit was performed. The protocol column remains unchanged; this is an identified implementation configuration, not a new cipher or routing design.

Public sources

Editorial evidence references

The following identifiers refer to research records not included in this public package; they are not public links.