# iOS GPL distribution boundary

The iOS product contains two separate Mach-O executables:

- `HTPortalVPN.app/HTPortalVPN`, the proprietary user-interface application;
- `HTPortalVPN.app/PlugIns/PacketTunnel.appex/PacketTunnel`, the packet-tunnel
  extension containing n3n and the Hive Technology bridge.

The main executable does not link n3n. The packet-tunnel executable is
distributed under GPL-3.0-only, with the license notice and corresponding
source archive published for every build. Shared models and build files are
dual-licensed only as needed to build the GPL-covered packet tunnel.

This boundary reflects the actual iOS architecture. iOS does not launch an
external n3n process; the Network Extension is a separate executable embedded
in the application bundle and managed by the operating system.

For an App Store archive, `scripts/check-ios-release-gate.sh` requires:

- `IOS_PUBLIC_RELEASE_ALLOWED=YES`;
- the GNU GPL text and third-party notices;
- the corresponding-source packaging script;
- a build-specific `HTP_GPL_SOURCE_URL` under the public HT Portal source
  archive path.

Before submitting a build, generate the archive with:

```sh
scripts/package-source-offer.sh \
  "$(grep -E 'MARKETING_VERSION:' project.yml | head -1 | cut -d '"' -f2)-build$(grep -E 'CURRENT_PROJECT_VERSION:' project.yml | awk '{print $2}')"
```

Publish that archive at the URL embedded in the application and verify it over
HTTPS before uploading the binary. The archive records the application commit
in `SOURCE_REVISION` and the upstream n3n commit in
`third_party/n3n/UPSTREAM_COMMIT`. The release operator must also verify that
the main executable contains no `htp_n3n` or n3n edge symbols while the packet
tunnel does.

This is an engineering compliance boundary, not legal advice. Distribution
must comply with the GNU GPL, Apple agreements, and applicable law.
