feat: Add OpenSSL packaging validation script and tests; enhance production readiness checks

Author: MarlonJD

README.md

@@ -457,18 +457,19 @@ scripts/check_release_readiness.sh
 REQUIRE_PRODUCTION_READY=1 scripts/check_release_readiness.sh
 ```
 
-The default gate checks package shape, forbidden runtime dependencies,
-unit/integration opt-in tests, benchmark smoke, and the compressed release
-binary size proxy. The strict gate additionally requires
+The default gate checks package shape, forbidden runtime dependencies, local
+OpenSSL package/module/link validation, unit/integration opt-in tests,
+benchmark smoke, and the compressed release binary size proxy. The strict gate additionally requires
 `LiveKitNative.productionReadiness.status == .productionReady`, no blockers,
 tests, benchmarks, the size gate, Apple platform builds, and configured LiveKit
 integration variables so a production tag cannot pass with any release gate
 disabled.
 That strict gate intentionally fails today because LiveKit E2E secure RTP/RTCP
 verification, CI-gated TURN-only hardening, real-device video display validation,
-standards-compliant live SCTP, Apple-platform OpenSSL packaging validation,
-real-device audio route/interruption recovery, full live congestion/adaptive-quality
-policy, and end-to-end LiveKit tests are still open.
+standards-compliant live SCTP, Apple-platform OpenSSL redistribution/signing
+validation beyond the local package gate, real-device audio route/interruption
+validation, full live congestion/adaptive-quality policy, and end-to-end
+LiveKit tests are still open.
 
 Opt-in LiveKit integration tests are disabled unless a local or cloud LiveKit
 server is explicitly configured:

Sources/LiveKitNative/Core/ProductionReadiness.swift

@@ -28,7 +28,7 @@ public extension LiveKitNative {
     static let productionReadiness = LiveKitNativeProductionReadiness(
         status: .developerPreview,
         blockers: [
-            "ICEAgent nomination, local ICE trickle signaling, server ICE server configuration application, STUN UDP server-reflexive candidate gathering, bound local ICE UDP host candidate gathering and socket reuse for STUN checks and media datagrams, default Room socket-backed subscriber/publisher media-data startup configuration, OpenSSL-backed WebRTC DTLS-SRTP use_srtp handshake/exporter wiring, DTLS-SRTP packet protection, RFC 5764 DTLS/SRTP datagram demux, shared persistent DTLS application-data plus SRTP session binding, SDP DTLS role/fingerprint extraction, handshaker-backed media-session binding with result role/profile validation, injected Room publisher/subscriber media startup, injected selected-pair ICE consent freshness loop with transport closure on expiry, injected publisher transport teardown, Room publisher RTP/RTCP and subscriber RTCP bridges through injected secure media transport, publisher and subscriber RTCP receive-handler loops, deterministic NACK/PLI RTCP feedback policy primitives, bounded subscriber feedback planning from H.264/VP8 RTP loss signals, Room subscriber feedback dispatch through injected subscriber RTCP transport, bounded RTP jitter-buffer primitives, stateful Opus/H.264 publisher RTP packetizer bridges, native camera/microphone publisher capture pipelines, Room publisher RTP sender registry lifecycle coverage, subscriber RTP jitter-buffer/feedback dispatch, and default Room TURN relay allocation/permission maintenance execution exist, but production readiness still needs LiveKit server E2E secure RTP/RTCP integration, Apple-platform OpenSSL packaging validation, and the remaining media pipeline gates.",
+            "ICEAgent nomination, local ICE trickle signaling, server ICE server configuration application, STUN UDP server-reflexive candidate gathering, bound local ICE UDP host candidate gathering and socket reuse for STUN checks and media datagrams, default Room socket-backed subscriber/publisher media-data startup configuration, OpenSSL-backed WebRTC DTLS-SRTP use_srtp handshake/exporter wiring, DTLS-SRTP packet protection, RFC 5764 DTLS/SRTP datagram demux, shared persistent DTLS application-data plus SRTP session binding, SDP DTLS role/fingerprint extraction, handshaker-backed media-session binding with result role/profile validation, injected Room publisher/subscriber media startup, injected selected-pair ICE consent freshness loop with transport closure on expiry, injected publisher transport teardown, Room publisher RTP/RTCP and subscriber RTCP bridges through injected secure media transport, publisher and subscriber RTCP receive-handler loops, deterministic NACK/PLI RTCP feedback policy primitives, bounded subscriber feedback planning from H.264/VP8 RTP loss signals, Room subscriber feedback dispatch through injected subscriber RTCP transport, bounded RTP jitter-buffer primitives, stateful Opus/H.264 publisher RTP packetizer bridges, native camera/microphone publisher capture pipelines, Room publisher RTP sender registry lifecycle coverage, subscriber RTP jitter-buffer/feedback dispatch, default Room TURN relay allocation/permission maintenance execution, and local OpenSSL package/module/link validation exist, but production readiness still needs LiveKit server E2E secure RTP/RTCP integration, Apple-platform OpenSSL redistribution/signing validation, and the remaining media pipeline gates.",
             "Fresh join, resume reconnect, disconnect, and failed signal-loop boundaries regenerate local ICE credentials, clear stale peer negotiation state, parse TURN UDP/TCP/TLS endpoint configuration, order TURN relay fallback candidates as UDP, TCP, then TLS, select supported TURN relay session configurations from parsed ICE server endpoints with credentials, exercise TURN Allocate, Refresh, CreatePermission, and ChannelBind request/authentication/response-validation primitives with one-shot stale nonce retry, cover TURN ChannelData framing, provide deterministic allocation/permission maintenance scheduling and execution, plan relayed ICE candidates from TURN bindings, compose and execute bounded TURN relay session setup plans over UDP datagram and TCP/TLS stream transports, expose ChannelData relay transports over abstract media datagram transports, allocate default UDP TURN relay candidates through the bound Room ICE socket, use ChannelData relay bindings for relayed ICE checks and media datagrams, bind default Room TURN relay maintenance loops to selected relay pairs with transport closure on expired refresh failure, provide relay-only ICE candidate policy plus an opt-in LiveKit TURN-only validation harness, provide deterministic ICE consent freshness planning plus an injected Room startup loop, run ICEAgent connectivity checks through paced scheduling with queued triggered-check priority plus role-conflict role switching and pair-priority recompute, and rebuild reconnect SyncState SDP/trickle state with fresh local ICE credentials, but CI-gated TURN-only validation and live media recovery are not complete.",
             "Publisher camera capture can encode H.264 through VideoToolbox with bounded frame backpressure/drop control and publisher microphone capture can encode Opus through AudioToolbox before RTP/SRTP send, while subscriber RTP can pass through jitter buffering, H.264/Opus packet assembly, NACK/PLI feedback, opt-in Opus decode-to-audio-playout scheduling, opt-in H.264 VideoToolbox decode-to-pixel-buffer scheduling, application-provided subscriber video renderer handoff, UIKit/AppKit VideoView sample-buffer rendering, opt-in iOS voice-chat audio-session lifecycle configuration, and deterministic audio interruption/route recovery with Room observer-loop reactivation; real-device video display validation, LiveKit E2E media validation, real-device route/interruption audio validation, and production runtime pacing remain incomplete.",
             "Production H.264 now uses real VideoToolbox encode output for publish smoke coverage, opt-in VideoToolbox decode output for subscribe smoke coverage, and UIKit/AppKit VideoView rendering for decoded frames, but production readiness still requires real-device display validation, hardware acceleration verification where the OS exposes that signal, and explicit fallback behavior instead of relying on a pure Swift codec implementation.",

Tests/LiveKitNativeTests/OpenSSLPackagingTests.swift

@@ -0,0 +1,54 @@
+import XCTest
+
+final class OpenSSLPackagingTests: XCTestCase {
+    func testPackageDeclaresOpenSSLSystemLibraryAndWrapperTargets() throws {
+        let package = try String(contentsOf: repositoryRoot.appendingPathComponent("Package.swift"))
+
+        XCTAssertTrue(package.contains(".systemLibrary("))
+        XCTAssertTrue(package.contains("name: \"COpenSSL\""))
+        XCTAssertTrue(package.contains("pkgConfig: \"openssl\""))
+        XCTAssertTrue(package.contains(".brew([\"openssl@3\"])"))
+        XCTAssertTrue(package.contains("name: \"CLiveKitNativeOpenSSL\""))
+        XCTAssertTrue(package.contains("\"COpenSSL\""))
+        XCTAssertTrue(package.contains("\"CLiveKitNativeOpenSSL\""))
+    }
+
+    func testOpenSSLModuleMapExportsRequiredHeadersAndLibraries() throws {
+        let moduleMap = try String(
+            contentsOf: repositoryRoot.appendingPathComponent("Sources/COpenSSL/module.modulemap")
+        )
+
+        for header in ["ssl.h", "srtp.h", "err.h", "x509.h", "pem.h"] {
+            XCTAssertTrue(moduleMap.contains("header \"openssl/\(header)\""))
+        }
+        XCTAssertTrue(moduleMap.contains("link \"ssl\""))
+        XCTAssertTrue(moduleMap.contains("link \"crypto\""))
+        XCTAssertTrue(moduleMap.contains("export *"))
+    }
+
+    func testOpenSSLWrapperHeaderExposesDTLSUseSRTPSurface() throws {
+        let header = try String(
+            contentsOf: repositoryRoot.appendingPathComponent(
+                "Sources/CLiveKitNativeOpenSSL/include/CLiveKitNativeOpenSSL.h"
+            )
+        )
+
+        for symbol in [
+            "lkn_dtls_identity_create",
+            "lkn_dtls_session_create",
+            "lkn_dtls_session_do_handshake",
+            "lkn_dtls_session_export_keying_material",
+            "lkn_dtls_session_selected_srtp_profile",
+            "lkn_dtls_last_error_string",
+        ] {
+            XCTAssertTrue(header.contains(symbol))
+        }
+    }
+
+    private var repositoryRoot: URL {
+        URL(fileURLWithPath: #filePath)
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+    }
+}

Tests/LiveKitNativeTests/ProductionReadinessTests.swift

@@ -14,6 +14,8 @@ final class ProductionReadinessTests: XCTestCase {
         XCTAssertTrue(readiness.blockers.contains { $0.contains("outbound DATA TSN acknowledgement tracking") })
         XCTAssertTrue(readiness.blockers.contains { $0.contains("SACK gap-triggered retransmission") })
         XCTAssertTrue(readiness.blockers.contains { $0.contains("deterministic cwnd/rwnd send gating") })
+        XCTAssertTrue(readiness.blockers.contains { $0.contains("local OpenSSL package/module/link validation") })
+        XCTAssertTrue(readiness.blockers.contains { $0.contains("Apple-platform OpenSSL redistribution/signing validation") })
         XCTAssertTrue(readiness.blockers.contains { $0.contains("full standards-compliant SCTP association state") })
         XCTAssertFalse(readiness.blockers.contains { $0.contains("promotion of live DataPacket coverage") })
     }

docs/STATUS.md

@@ -12,7 +12,8 @@ Production readiness is intentionally represented in code through
 `LiveKitNative.productionReadiness` and `LiveKitNative.assertProductionReady()`.
 The current status is `developerPreview`, with explicit blockers for LiveKit
 server E2E secure RTP/RTCP verification, TURN/ICE hardening,
-default live media send/receive completion, Apple-platform OpenSSL packaging,
+default live media send/receive completion, Apple-platform OpenSSL
+redistribution/signing validation beyond the local package gate,
 VideoToolbox-backed production H.264
 encode/decode with hardware path verification and fallback policy,
 standards-compliant DTLS-backed SCTP, media
@@ -993,8 +994,9 @@ The following checks passed after the latest implementation pass:
 - LiveKit server E2E verification for the OpenSSL-backed DTLS 1.2
   WebRTC `use_srtp` extension negotiation and exporter now wired into the
   default live Room path.
-- Apple-platform OpenSSL packaging/signing validation for iOS and macOS release
-  builds.
+- Local OpenSSL package/module/link validation now runs in the release readiness
+  gate; Apple-platform OpenSSL redistribution/signing validation for iOS and
+  macOS release builds remains open.
 - LiveKit E2E verification for default live RTP/RTCP media send/receive on top
   of the handshaker-backed secure media session binder.
 - Production hardening for the default camera/audio capture and encode loops,
@@ -1094,8 +1096,8 @@ The following checks passed after the latest implementation pass:
 
 1. Continue `1.0.0` hardening by extending the new live OpenSSL-backed
    DTLS-SRTP default Room startup coverage into full RTP/RTCP media
-   send/receive validation, then validate the OpenSSL packaging story for iOS
-   release builds.
+   send/receive validation, then validate the OpenSSL redistribution/signing
+   story for iOS release builds.
 2. Replace the current DTLS data-channel packet envelope and deterministic
    fragment/retry primitive with a standards-compliant SCTP association,
    validate it through the default shared media/data Room path, and add
@@ -1126,8 +1128,8 @@ The following checks passed after the latest implementation pass:
    blockers.
 10. Keep full VP8 pixel reconstruction, publisher transceiver negotiation,
    LiveKit E2E secure RTP/RTCP verification, real-device media timing, and
-   Apple-platform OpenSSL packaging validation as the hardening path before a
-   usable end-to-end release.
+   Apple-platform OpenSSL redistribution/signing validation as the hardening
+   path before a usable end-to-end release.
 
 ## Practical Release Status
 

scripts/check_openssl_packaging.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+fail() {
+  echo "OpenSSL packaging validation failed: $*"
+  exit 1
+}
+
+require_file() {
+  local path="$1"
+  [[ -f "$path" ]] || fail "missing $path"
+}
+
+require_text() {
+  local path="$1"
+  local text="$2"
+  grep -Fq "$text" "$path" || fail "expected '$text' in $path"
+}
+
+package_file="Package.swift"
+modulemap_file="Sources/COpenSSL/module.modulemap"
+wrapper_header="Sources/CLiveKitNativeOpenSSL/include/CLiveKitNativeOpenSSL.h"
+wrapper_source="Sources/CLiveKitNativeOpenSSL/CLiveKitNativeOpenSSL.c"
+
+require_file "$package_file"
+require_file "$modulemap_file"
+require_file "$wrapper_header"
+require_file "$wrapper_source"
+
+require_text "$package_file" '.systemLibrary('
+require_text "$package_file" 'name: "COpenSSL"'
+require_text "$package_file" 'pkgConfig: "openssl"'
+require_text "$package_file" '.brew(["openssl@3"])'
+require_text "$package_file" 'name: "CLiveKitNativeOpenSSL"'
+require_text "$package_file" '"COpenSSL"'
+require_text "$package_file" '"CLiveKitNativeOpenSSL"'
+
+for header in ssl.h srtp.h err.h x509.h pem.h; do
+  require_text "$modulemap_file" "header \"openssl/$header\""
+done
+require_text "$modulemap_file" 'link "ssl"'
+require_text "$modulemap_file" 'link "crypto"'
+
+for symbol in \
+  lkn_dtls_identity_create \
+  lkn_dtls_session_create \
+  lkn_dtls_session_do_handshake \
+  lkn_dtls_session_export_keying_material \
+  lkn_dtls_session_selected_srtp_profile \
+  lkn_dtls_last_error_string
+do
+  require_text "$wrapper_header" "$symbol"
+done
+
+command -v pkg-config >/dev/null 2>&1 || fail "pkg-config is required for the COpenSSL system library"
+pkg-config --exists openssl || fail "pkg-config cannot resolve openssl"
+
+openssl_version="$(pkg-config --modversion openssl)"
+openssl_major="${openssl_version%%.*}"
+case "$openssl_major" in
+  ''|*[!0-9]*)
+    fail "could not parse OpenSSL version '$openssl_version'"
+    ;;
+esac
+if (( openssl_major < 3 )); then
+  fail "OpenSSL 3.x is required, found $openssl_version"
+fi
+
+openssl_include_dir="$(pkg-config --variable=includedir openssl)"
+openssl_lib_dir="$(pkg-config --variable=libdir openssl)"
+
+for header in ssl.h srtp.h err.h x509.h pem.h; do
+  require_file "$openssl_include_dir/openssl/$header"
+done
+
+shopt -s nullglob
+ssl_libraries=("$openssl_lib_dir"/libssl.*)
+crypto_libraries=("$openssl_lib_dir"/libcrypto.*)
+shopt -u nullglob
+(( ${#ssl_libraries[@]} > 0 )) || fail "missing libssl in $openssl_lib_dir"
+(( ${#crypto_libraries[@]} > 0 )) || fail "missing libcrypto in $openssl_lib_dir"
+
+compiler="${CC:-cc}"
+command -v "$compiler" >/dev/null 2>&1 || fail "C compiler '$compiler' is required"
+openssl_cflags="$(pkg-config --cflags openssl)"
+
+# Intentionally let pkg-config split flags the same way the C compiler expects them.
+# shellcheck disable=SC2086
+"$compiler" -fsyntax-only -I"$repo_root/Sources/CLiveKitNativeOpenSSL/include" $openssl_cflags "$wrapper_source"
+
+echo "OpenSSL packaging validation passed for OpenSSL $openssl_version."

scripts/check_release_readiness.sh

@@ -47,6 +47,9 @@ fi
 
 echo "Package shape passed."
 
+echo "==> Checking OpenSSL packaging"
+scripts/check_openssl_packaging.sh
+
 echo "==> Checking production readiness marker"
 readiness_file="Sources/LiveKitNative/Core/ProductionReadiness.swift"
 if [[ "$require_production_ready" == "1" ]]; then