@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/licensing/candidates/blackberry-source-declaration-evidence.json

@@ -0,0 +1,369 @@
+{
+  "schemaVersion": 1,
+  "collectedOn": "2026-10-21",
+  "status": "supplemental-original-source-evidence-not-release-clearance",
+  "input": {
+    "fileSha256": "4a1eb672e488b99d3381979a9eb1de4890edee79cfbcded9502683d48dbc7d54",
+    "sha256": "16180800cc2f077638d2e13a33bd68609d0b6eedd1fbfdbae6d5d4a1c53f826f",
+    "shaMeaning": "canonical inventory archiveSha256 field (input archive identity)",
+    "candidateFilter": "decision=candidate-explicit-apache and sourceUrl contains /Blackberry/",
+    "count": 20
+  },
+  "sourceCapture": {
+    "originalUrl": "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+    "archivedUrl": "https://web.archive.org/web/20220524122924id_/https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+    "captureTimestamp": "2022-05-24T12:29:24Z",
+    "bodySha256": "0eecad03b5404f25ae29ae65e3f5c6aed52640162c7e890636b98f7511531c1b",
+    "bodyBytes": 135787,
+    "rawBodyRetained": false,
+    "independentlyVerifiedRuleMetadataAssociations": 3,
+    "declarationOccurrences": 3
+  },
+  "officialRepository": {
+    "repository": "blackberry/threat-research-and-intelligence",
+    "checkedCommit": "1e7ca21c7ec357797d872ea92c6a2c1f6c7412f4",
+    "treeSha": "a73af478c7c94a9ae37ec3fdef648d6878e181b5",
+    "licenseBlobSha1": "261eeb9e9f8b2b4b0d119366dda99c6fd7d35c64",
+    "candidateFilenameMatchesObserved": 0,
+    "noticePathsObserved": [],
+    "limit": "Tree path and license evidence does not prove absent embedded rules or exact candidate payload equality."
+  },
+  "records": [
+    {
+      "rule": "BLACKBERRY_Boratrat",
+      "inputBlockSha256": "fd85a87f42417db24e6f196784d6311213bdf05d0a59e7c2f615eea0ab984ac2",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRAT.yar#L1-L41",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Boratratinformation",
+      "inputBlockSha256": "86045fff85de1a64665eb6f145ae543c275bf63bb91a2b67dd599f6ee9a98b04",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRATInformation.yar#L1-L45",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Boratratkeylogger",
+      "inputBlockSha256": "d7ce8042ea5f91d4376800f126ed2a6f9a049c71fe5c0bb9bd47c7504ca1f14a",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRATKeylogger.yar#L1-L39",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Eternityclipper",
+      "inputBlockSha256": "2726cef225aefb79e7cb4007f5641475668659d4b3bb97feb123eadc6cd6c773",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityClipper.yar#L4-L30",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Eternityransom",
+      "inputBlockSha256": "1f2eb8993bb1e9fd431adcfdd783abf5a0d54a3b2b72c70b827e8874d51e67e6",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityRansom.yar#L4-L28",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Eternitystealer",
+      "inputBlockSha256": "8ab404d8a2f1d46ed4e2be15a1e8d1256d48d41d7ffc1bd36e0908d3e64911fe",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityStealer.yar#L4-L32",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Eternityworm",
+      "inputBlockSha256": "82e449fda7a8c46cfa591b61a4d8308ef162854d06a748568223e7249b9c904f",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityWorm.yar#L4-L31",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Headertip",
+      "inputBlockSha256": "ef91bbe62b40b521c84973303b28be4f136856c9096d80f34d329cc7697ca556",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/HeaderTip.yar#L1-L18",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_EXE_Jupyter_Cert_36Ff",
+      "inputBlockSha256": "089bc0bdd7189e32bab80c5837f72358683180804c0a9b666db519e3019316b8",
+      "inventoryAuthor": "BlackBerry Research & Intelligence Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_EXE_Jupyter_Cert_36ff.yar#L3-L18",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_MSI_EXE_Jupyter_Certificate",
+      "inputBlockSha256": "ff8a2b33895337a27bd1581ed488d19790f904c66c9dc2d7bf78f644555e4dc2",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_MSI_EXE_Jupyter_Certificate.yar#L1-L43",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_MSI_Jupyter_Embedded_Powershell",
+      "inputBlockSha256": "8a94cbb1ee9381ea573e9ebb8be64a7b4eb2dd55d5119ad48cc2044c15a86250",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell.yar#L1-L20",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_Win32_Blackguard",
+      "inputBlockSha256": "871272a43ebaaa3ccb7090c4f7c6589ef0cf9cf516fdb2f1a8ccf74231064d8d",
+      "inventoryAuthor": "BlackBerry Threat Research team ",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_BlackGuard.yar#L3-L39",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_Win32_Jupyter_Download_And_Execute_Module",
+      "inputBlockSha256": "79ee456d5354a4c827efb67f94e0a05ebef94c87ff642dc220e8f8541b823f22",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_Jupyter_Download_and_Execute_Module.yar#L4-L30",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Infostealer_Win32_Jupyter_Main_Module",
+      "inputBlockSha256": "6b1274e7c8fc298cfaabdd672ca626b720dad790c53d93c57cde5ae35f6fa6e8",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_Jupyter_Main_Module.yar#L3-L42",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Win32_Chaos_Builder_Ransomware_2022",
+      "inputBlockSha256": "ee16b70502aa218e0cb27a0321930d3d4a081ea2ad407b2c224c85b7e37b4a38",
+      "inventoryAuthor": "BlackBerry Threat Research",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Win32_Chaos_Builder_Ransomware_2022.yar#L4-L44",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "mapped",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "sourceKind": "official BlackBerry-authored blog snapshot",
+        "originalUrl": "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+        "archivedUrl": "https://web.archive.org/web/20220524122924id_/https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+        "captureTimestamp": "2022-05-24T12:29:24Z",
+        "captureDigest": "MRBR7T733XQ3G32E7FGJLQPAQNXMWJHI",
+        "pageTitle": "Yashma Ransomware, Tracing the Chaos Family Tree",
+        "author": "BlackBerry Threat Research",
+        "date": "2022-05-10",
+        "description": "Detects Chaos Ransomware Builder",
+        "declarationExcerpt": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+        "declarationExcerptSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+        "mappingRationale": "Exact rule description, author, date, and per-rule Apache declaration appear in the dated capture of the official BlackBerry blog."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Win32_Chaosransomware_2022",
+      "inputBlockSha256": "6abca8e28ae8fa4b6cdc368f7eefb24991f2d6ec3d8d0b973713fb0828fc8d0a",
+      "inventoryAuthor": "BlackBerry Threat Research",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Win32_ChaosRansomware_2022.yar#L3-L45",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "mapped",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "sourceKind": "official BlackBerry-authored blog snapshot",
+        "originalUrl": "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+        "archivedUrl": "https://web.archive.org/web/20220524122924id_/https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+        "captureTimestamp": "2022-05-24T12:29:24Z",
+        "captureDigest": "MRBR7T733XQ3G32E7FGJLQPAQNXMWJHI",
+        "pageTitle": "Yashma Ransomware, Tracing the Chaos Family Tree",
+        "author": "BlackBerry Threat Research",
+        "date": "2022-05-10",
+        "description": "Detects Ransomware Built by Chaos Ransomware Builder",
+        "declarationExcerpt": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+        "declarationExcerptSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+        "mappingRationale": "Exact rule description, author, date, and per-rule Apache declaration appear in the dated capture of the official BlackBerry blog."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Mal_Win32_Onyx_Strain_Chaos_Ransomware_2022",
+      "inputBlockSha256": "08996bbbd5f4c33f9ee04a4a47142dd1b2fb5e7fdc328dede94a6e5f88eb14f7",
+      "inventoryAuthor": "BlackBerry Threat Research",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Win32_Onyx_Strain_Chaos_Ransomware_2022.yar#L3-L28",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "mapped",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "sourceKind": "official BlackBerry-authored blog snapshot",
+        "originalUrl": "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+        "archivedUrl": "https://web.archive.org/web/20220524122924id_/https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree",
+        "captureTimestamp": "2022-05-24T12:29:24Z",
+        "captureDigest": "MRBR7T733XQ3G32E7FGJLQPAQNXMWJHI",
+        "pageTitle": "Yashma Ransomware, Tracing the Chaos Family Tree",
+        "author": "BlackBerry Threat Research",
+        "date": "2022-05-10",
+        "description": "Detects Onyx Ransomware build off of Chaos Builder v4",
+        "declarationExcerpt": "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team",
+        "declarationExcerptSha256": "db83a8437461d2abfccc449b0f947d8b2b27abfd5a4b63e70fc185bd45f93b4a",
+        "mappingRationale": "Exact rule description, author, date, and per-rule Apache declaration appear in the dated capture of the official BlackBerry blog."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Snake",
+      "inputBlockSha256": "8a34db29325b1121bbb7ed6f82945a8186bad9a35aa95c40d02eb74e04797ad4",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Snake.yar#L1-L19",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Windealer_Executable",
+      "inputBlockSha256": "96c90e1d7f24ce6ba5a092cb634686ac5eb46ec9c863e2bc22e732e1db81a0da",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Windealer_executable.yar#L1-L23",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    },
+    {
+      "rule": "BLACKBERRY_Windealer_Library",
+      "inputBlockSha256": "cfa7fb90906a234a90fd8593f65b9aa92a77e808a8f54516f02c0b3dbfab3e52",
+      "inventoryAuthor": "BlackBerry Threat Research Team",
+      "inventorySourceUrl": "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Windealer_Library.yar#L1-L26",
+      "candidateLicense": "Apache-2.0",
+      "primaryEvidence": {
+        "status": "unresolved",
+        "sourceEquality": "unknown",
+        "noticeStatus": "unknown",
+        "rightsStatus": "unknown",
+        "gap": "No exact primary per-rule declaration was retained in this bounded pass; mirror metadata and current official repository license are insufficient.",
+        "mappingRationale": "Unresolved; do not infer from the repository-wide license or mirror copy."
+      }
+    }
+  ],
+  "limits": [
+    "Three original-author per-rule declarations were found in a dated official-blog capture; 17 entries lack that primary-source mapping in this bounded pass.",
+    "No aggregate candidate payload equality, NOTICE/adaptation compliance, rights clearance, public-domain classification or runtime release approval is established.",
+    "Not consumed by the current candidate builder; its four release blockers and existing unresolved counts are unchanged.",
+    "Worker request count could not be established because host search tools may expand fetches; root stopped the search and independently checked the three mapped declarations and source tree."
+  ]
+}