TREJJ VPN 1.1.6 macOS open-source release materials
=====================================================

Purpose
-------

This archive is intended to accompany:

  TREJJ VPN-1.1.6-mac-universal.pkg

Make this archive and its sibling .sha256 file available next to that PKG. The
archive preserves the checksum-pinned upstream source archives byte-for-byte,
the reviewed macOS build recipe and manifest, and the license texts extracted
from those verified sources. The reviewed recipe statically links OpenSSL, LZO,
and LZ4 into OpenVPN.

Contents
--------

  macos/openvpn/.source-cache/
               Original OpenVPN 2.7.5, OpenSSL 3.5.7, LZO 2.10, and
               LZ4 1.10.0 source archives
  scripts/     The OpenVPN build recipe and its reviewed manifest
  LICENSES/    License and notice texts extracted from the verified source
               archives, including OpenVPN's project notice and full GPLv2 text
  PAYLOAD-INPUTS.txt
               SHA-256 values of the reviewed thin OpenVPN release inputs;
               the binaries themselves are intentionally not included
  SHA256SUMS   SHA-256 values for every other file in this archive

The preserved paths let a reviewer run the recipe from this directory on a
supported Apple-silicon build Mac with Xcode and Rosetta:

  ./scripts/build-macos-openvpn-from-source.sh

Verification
------------

From the directory containing both sibling files, integrity-check the archive:

  shasum -a 256 -c \
    TREJJ-VPN-1.1.6-macos-openvpn-sources.tar.gz.sha256

After extraction, enter the top-level directory and run:

  shasum -a 256 -c SHA256SUMS

The detached SHA-256 detects a mismatch against the value you received; it does
not authenticate the publisher by itself. Obtain the PKG, source archive, and
checksums through TREJJ's authenticated release channel, and retain both
artifact hashes in the approved release record. PAYLOAD-INPUTS.txt records the
unsigned thin inputs used before universal merging and Developer ID signing; it
is not a substitute for recording the final stapled PKG hash.

Review boundary
---------------

This source-material bundle supports distribution review and source
availability. It excludes TREJJ application source, Apple SDK components,
signed binaries, credentials, and notarization records. It is not legal advice,
does not itself certify compliance, and does not replace TREJJ's review of the
applicable licenses, notices, source-delivery requirements, written-offer
requirements, or other release-specific obligations.
