feat: publish av-tools 0.2.0
This commit is contained in:
93
SOURCE.md
93
SOURCE.md
@@ -1,6 +1,6 @@
|
||||
# Source and reproducibility record
|
||||
|
||||
This file identifies the source corresponding to av-tools 0.1.0. It is not a
|
||||
This file identifies the source corresponding to av-tools 0.2.0. It is not a
|
||||
substitute for satisfying a component's licence or for delivering complete
|
||||
Corresponding Source with an object-code release.
|
||||
|
||||
@@ -9,9 +9,9 @@ Corresponding Source with an object-code release.
|
||||
- Canonical repository:
|
||||
`git@git.add-ideas.de:zemion/av-tools.git`
|
||||
- Browser source: `https://git.add-ideas.de/zemion/av-tools`
|
||||
- Version: `0.1.0`
|
||||
- Release source identity: immutable annotated tag `v0.1.0`
|
||||
(`refs/tags/v0.1.0`) in the canonical repository.
|
||||
- Version: `0.2.0`
|
||||
- Release source identity: immutable annotated tag `v0.2.0`
|
||||
(`refs/tags/v0.2.0`) in the canonical repository.
|
||||
- Application licence: `GPL-3.0-or-later`; full GPL version 3 terms in
|
||||
`LICENSE`.
|
||||
- Copyright: Copyright © 2026 Albrecht Degering.
|
||||
@@ -22,10 +22,10 @@ the tag exists, is annotated, points to the reviewed release commit and is
|
||||
available without authentication:
|
||||
|
||||
```sh
|
||||
test "$(git cat-file -t v0.1.0)" = tag
|
||||
git rev-parse v0.1.0^{commit}
|
||||
test "$(git cat-file -t v0.2.0)" = tag
|
||||
git rev-parse v0.2.0^{commit}
|
||||
git ls-remote --tags \
|
||||
https://git.add-ideas.de/zemion/av-tools.git refs/tags/v0.1.0
|
||||
https://git.add-ideas.de/zemion/av-tools.git refs/tags/v0.2.0
|
||||
```
|
||||
|
||||
The Toolbox manifest names the canonical repository and SPDX licence. Publish
|
||||
@@ -40,34 +40,66 @@ the tag/source archive beside the binary release and checksum.
|
||||
| `@ffmpeg/ffmpeg` | 0.12.15 | `sha512-1C8Obr4GsN3xw+/1Ww6PFM84wSQAGsdoTuTWPOj2OizsRDLT4CXTaVjPhkw6ARyDus1B9X/L2LiXHqYYsGnRFw==` |
|
||||
| `@ffmpeg/util` | 0.12.2 | `sha512-ouyoW+4JB7WxjeZ2y6KpRvB+dLp7Cp4ro8z0HIVpZVCM7AwFlHa0c4R8Y/a4M3wMqATpYKhC7lSFHQ0T11MEDw==` |
|
||||
| `@ffmpeg/types` (transitive) | 0.12.4 | `sha512-k9vJQNBGTxE5AhYDtOYR5rO5fKsspbg51gbcwtbkw2lCdoIILzklulcjJfIDwrtn7XhDeF2M+THwJ2FGrLeV6A==` |
|
||||
| `@ffmpeg/core` | 0.12.10 | `sha512-dzNplnn2Nxle2c2i2rrDhqcB19q9cglCkWnoMTDN9Q9l3PvdjZWd1HfSPjCNWc/p8Q3CT+Es9fWOR0UhAeYQZA==` |
|
||||
| `@ffmpeg/core-mt` | 0.12.10 | `sha512-atyRTOpa58bLCIgd6GXBZAXWyWD3AUoQyzxqjvGhp9MuSzdILtOTI62ffLswBsCnLq15lQ8IETHUpm1oe4V9FQ==` |
|
||||
|
||||
Install exact packages and recreate the copied same-origin assets without a
|
||||
Install exact packages and recreate the verified same-origin assets without a
|
||||
network fetch during the production build:
|
||||
|
||||
```sh
|
||||
npm ci
|
||||
npm run vendor:ffmpeg
|
||||
npm run vendor:verify
|
||||
npm run vendor:verify-runtime
|
||||
npm run build
|
||||
```
|
||||
|
||||
`scripts/copy-ffmpeg-assets.mjs` copies the ESM distributions from the
|
||||
installed core packages; it does not download them. The copied bytes are:
|
||||
`scripts/copy-ffmpeg-assets.mjs` fails closed against
|
||||
`scripts/reviewed-ffmpeg-core-lock.json`, verifies the deterministic tracked
|
||||
ZIP and unpacks only its five declared entries. It does not download them or
|
||||
fall back to published core packages. The reviewed bytes are:
|
||||
|
||||
| Release path | Bytes | SHA-256 |
|
||||
| ------------------------------------------------ | -------: | ------------------------------------------------------------------ |
|
||||
| `vendor/ffmpeg/0.12.10/st/ffmpeg-core.js` | 111804 | `67a48f11645f85439f3fde4f2119042c16b374b910206b7a7a24f342e28dcae3` |
|
||||
| `vendor/ffmpeg/0.12.10/st/ffmpeg-core.wasm` | 32232419 | `9f57947a5bd530d8f00c5b3f2cb2a3492faa7e5d823315342d6a8656d0a6b7b7` |
|
||||
| `vendor/ffmpeg/0.12.10/mt/ffmpeg-core.js` | 128947 | `270a2e6ff945e173238610669a3f7132df5f9c52698a9bf708cf5c2ab6bda0de` |
|
||||
| `vendor/ffmpeg/0.12.10/mt/ffmpeg-core.wasm` | 32718323 | `be2c97605366b78f3f13e21b52e81a55a79e1f29c133b03a68ec187b1a2ec41a` |
|
||||
| `vendor/ffmpeg/0.12.10/mt/ffmpeg-core.worker.js` | 2115 | `f77898d631dc010b45c29c23cb4379c611a7d7b131bf591d08a656bb729a4ca3` |
|
||||
For a publication check, generate the build-qualified Corresponding Source
|
||||
archive and run `npm run vendor:verify`; that stricter gate hashes the archive
|
||||
as well as every runtime input.
|
||||
|
||||
| Release path | Bytes | SHA-256 |
|
||||
| ---------------------------------------------------------------------------- | -------: | ------------------------------------------------------------------ |
|
||||
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/st/ffmpeg-core.js` | 111804 | `80c05d79d0e4e9434977b76cb851d10ddf2bfd378570178700d2c43b8afdcb24` |
|
||||
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/st/ffmpeg-core.wasm` | 32232580 | `fe41ddc77220cef6c04f5d48eeffcaaaef179ad270642e098f9945013aa0c9dc` |
|
||||
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.js` | 128953 | `4f2650099ab70cb2583951c0421147c62bea6c18dfbba5cfae4d7698b5d0ab62` |
|
||||
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.wasm` | 32718455 | `abbead010cb0448b26f01a36a3c8c03a6b04aca07812ddd4719a7f4b6bf4b645` |
|
||||
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.worker.js` | 2115 | `f77898d631dc010b45c29c23cb4379c611a7d7b131bf591d08a656bb729a4ca3` |
|
||||
| `vendor/ffmpeg-core-0.12.10-reviewed-stack5m.1.zip` (deterministic artifact) | 21338974 | `ebc068c6d096de55ae3335b04b7121130665f5b0ffa7a828067122733f55185f` |
|
||||
|
||||
## Bundled contact-sheet font
|
||||
|
||||
Contact-sheet labels use one unmodified DejaVu Sans 2.37 TrueType file. It is
|
||||
served same-origin and mounted read-only for the duration of a labelled job;
|
||||
the browser verifies its size and SHA-256 before use.
|
||||
|
||||
| Release path | Bytes | SHA-256 |
|
||||
| --------------------------- | ------: | ------------------------------------------------------------------ |
|
||||
| `fonts/DejaVuSans.ttf` | 757,076 | `7da195a74c55bef988d0d48f9508bd5d849425c1770dba5d7bfc6ce9ed848954` |
|
||||
| `LICENSES/DEJAVU_FONTS.txt` | n/a | licence text embedded in the reviewed font and official archive |
|
||||
|
||||
The byte-for-byte source is `ttf/DejaVuSans.ttf` in the official
|
||||
`dejavu-fonts-ttf-2.37.tar.bz2` release:
|
||||
|
||||
- project download record: `https://dejavu-fonts.github.io/Download.html`;
|
||||
- archive URL:
|
||||
`https://downloads.sourceforge.net/project/dejavu/dejavu/2.37/dejavu-fonts-ttf-2.37.tar.bz2`;
|
||||
- archive SHA-256:
|
||||
`fa9ca4d13871dd122f61258a80d01751d603b4d3ee14095d65453b4e846e17d7`;
|
||||
- corresponding upstream tag `version_2_37`, commit
|
||||
`0eda8a319c08835009849583cd090bb5b141ce25`.
|
||||
|
||||
The release archive and the bundled file were independently hashed and the
|
||||
font's internal version string is `Version 2.37`. The file is not modified or
|
||||
subsetted. Its Bitstream Vera/Arev permission terms are reproduced verbatim in
|
||||
`LICENSES/DEJAVU_FONTS.txt`.
|
||||
|
||||
## Corresponding ffmpeg.wasm and FFmpeg source
|
||||
|
||||
- Upstream ffmpeg.wasm release tag containing `@ffmpeg/ffmpeg` 0.12.15,
|
||||
`@ffmpeg/core` 0.12.10 and `@ffmpeg/core-mt` 0.12.10:
|
||||
- Base ffmpeg.wasm release tag containing `@ffmpeg/ffmpeg` 0.12.15 and the
|
||||
source configuration for core 0.12.10:
|
||||
`v12.15` at `71aa99d37c02a7b4c435275ca9ef50e612f6efa1`.
|
||||
- FFmpeg source selected by that revision's `Dockerfile`: tag `n5.1.4`,
|
||||
peeled Git commit `4729204c17f756e186d622060088371d10b34f7e`.
|
||||
@@ -88,6 +120,14 @@ The upstream build control files are `Dockerfile`, `Makefile`,
|
||||
`build/` at the ffmpeg.wasm release revision. `make prd` builds single-thread;
|
||||
`make prd-mt` builds multithread.
|
||||
|
||||
The shipped profile is rebuilt by
|
||||
`scripts/build-reviewed-ffmpeg-core.sh`. It applies upstream ffmpeg.wasm commit
|
||||
`b409e36475bc21f0451b5b1e1d126fa82871439a` (`-sSTACK_SIZE=5MB`), uses exact
|
||||
Emscripten 3.1.40 and CMake 3.27.9 identities, makes upstream container-stage
|
||||
isolation explicit and refuses maintainer-local paths in output. The exact
|
||||
source archive, toolchain, patch, asset and Opus-gate identities are locked in
|
||||
`scripts/reviewed-ffmpeg-core-lock.json`.
|
||||
|
||||
The Dockerfile uses branch names for two inputs. Repository history resolves
|
||||
those refs to tips that predate the ffmpeg.wasm v12.15 release and have not
|
||||
changed since:
|
||||
@@ -121,10 +161,13 @@ npm run source:package
|
||||
```
|
||||
|
||||
The command writes
|
||||
`release/ffmpeg-core-0.12.10-corresponding-source.tar.xz` and its
|
||||
`release/ffmpeg-core-0.12.10-reviewed-stack5m.1-corresponding-source.tar.xz`
|
||||
and its
|
||||
`.sha256` sidecar. Pass `-- --force` only to replace those exact outputs.
|
||||
The npm packages contain the resulting binaries but not every linked
|
||||
component's source and legal file, so publish this reviewed bundle and the
|
||||
The reviewed archive for this build profile is 43,050,052 bytes with SHA-256
|
||||
`2ab505f72be883d1257bc71cbb93880d1ade5bc029792621cb87b4ecc068399a`.
|
||||
The reviewed object-code archive does not contain every linked component's
|
||||
source and legal file, so publish this Corresponding Source bundle and the
|
||||
notices beside the object code. A homepage link alone is not asserted to
|
||||
satisfy GPL source obligations.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user