av-tools/SOURCE.md

# Source and reproducibility record

This file identifies the source corresponding to av-tools 0.2.0. It is not a
substitute for satisfying a component's licence or for delivering complete
Corresponding Source with an object-code release.

## av-tools

- Canonical repository:
  `git@git.add-ideas.de:zemion/av-tools.git`
- Browser source: `https://git.add-ideas.de/zemion/av-tools`
- Version: `0.2.0`
- Release source identity: immutable annotated tag `v0.2.0`
  (`refs/tags/v0.2.0`) in the canonical repository.
- Application licence: `GPL-3.0-or-later`; full GPL version 3 terms in
  `LICENSE`.
- Copyright: Copyright © 2026 Albrecht Degering.

The release tag is the source identity because embedding a commit's own hash
inside that commit is impossible. Before publishing binary bytes, verify that
the tag exists, is annotated, points to the reviewed release commit and is
available without authentication:

```sh
test "$(git cat-file -t v0.2.0)" = tag
git rev-parse v0.2.0^{commit}
git ls-remote --tags \
  https://git.add-ideas.de/zemion/av-tools.git refs/tags/v0.2.0
```

The Toolbox manifest names the canonical repository and SPDX licence. Publish
the tag/source archive beside the binary release and checksum.

## Pinned npm inputs

`package-lock.json` is authoritative. The FFmpeg-related runtime packages are:

| Package                      | Exact version | npm integrity                                                                                     |
| ---------------------------- | ------------- | ------------------------------------------------------------------------------------------------- |
| `@ffmpeg/ffmpeg`             | 0.12.15       | `sha512-1C8Obr4GsN3xw+/1Ww6PFM84wSQAGsdoTuTWPOj2OizsRDLT4CXTaVjPhkw6ARyDus1B9X/L2LiXHqYYsGnRFw==` |
| `@ffmpeg/util`               | 0.12.2        | `sha512-ouyoW+4JB7WxjeZ2y6KpRvB+dLp7Cp4ro8z0HIVpZVCM7AwFlHa0c4R8Y/a4M3wMqATpYKhC7lSFHQ0T11MEDw==` |
| `@ffmpeg/types` (transitive) | 0.12.4        | `sha512-k9vJQNBGTxE5AhYDtOYR5rO5fKsspbg51gbcwtbkw2lCdoIILzklulcjJfIDwrtn7XhDeF2M+THwJ2FGrLeV6A==` |

Install exact packages and recreate the verified same-origin assets without a
network fetch during the production build:

```sh
npm ci
npm run vendor:ffmpeg
npm run vendor:verify-runtime
npm run build
```

`scripts/copy-ffmpeg-assets.mjs` fails closed against
`scripts/reviewed-ffmpeg-core-lock.json`, verifies the deterministic tracked
ZIP and unpacks only its five declared entries. It does not download them or
fall back to published core packages. The reviewed bytes are:

For a publication check, generate the build-qualified Corresponding Source
archive and run `npm run vendor:verify`; that stricter gate hashes the archive
as well as every runtime input.

| Release path                                                                 |    Bytes | SHA-256                                                            |
| ---------------------------------------------------------------------------- | -------: | ------------------------------------------------------------------ |
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/st/ffmpeg-core.js`                 |   111804 | `80c05d79d0e4e9434977b76cb851d10ddf2bfd378570178700d2c43b8afdcb24` |
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/st/ffmpeg-core.wasm`               | 32232580 | `fe41ddc77220cef6c04f5d48eeffcaaaef179ad270642e098f9945013aa0c9dc` |
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.js`                 |   128953 | `4f2650099ab70cb2583951c0421147c62bea6c18dfbba5cfae4d7698b5d0ab62` |
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.wasm`               | 32718455 | `abbead010cb0448b26f01a36a3c8c03a6b04aca07812ddd4719a7f4b6bf4b645` |
| `vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.worker.js`          |     2115 | `f77898d631dc010b45c29c23cb4379c611a7d7b131bf591d08a656bb729a4ca3` |
| `vendor/ffmpeg-core-0.12.10-reviewed-stack5m.1.zip` (deterministic artifact) | 21338974 | `ebc068c6d096de55ae3335b04b7121130665f5b0ffa7a828067122733f55185f` |

## Bundled contact-sheet font

Contact-sheet labels use one unmodified DejaVu Sans 2.37 TrueType file. It is
served same-origin and mounted read-only for the duration of a labelled job;
the browser verifies its size and SHA-256 before use.

| Release path                |   Bytes | SHA-256                                                            |
| --------------------------- | ------: | ------------------------------------------------------------------ |
| `fonts/DejaVuSans.ttf`      | 757,076 | `7da195a74c55bef988d0d48f9508bd5d849425c1770dba5d7bfc6ce9ed848954` |
| `LICENSES/DEJAVU_FONTS.txt` |     n/a | licence text embedded in the reviewed font and official archive    |

The byte-for-byte source is `ttf/DejaVuSans.ttf` in the official
`dejavu-fonts-ttf-2.37.tar.bz2` release:

- project download record: `https://dejavu-fonts.github.io/Download.html`;
- archive URL:
  `https://downloads.sourceforge.net/project/dejavu/dejavu/2.37/dejavu-fonts-ttf-2.37.tar.bz2`;
- archive SHA-256:
  `fa9ca4d13871dd122f61258a80d01751d603b4d3ee14095d65453b4e846e17d7`;
- corresponding upstream tag `version_2_37`, commit
  `0eda8a319c08835009849583cd090bb5b141ce25`.

The release archive and the bundled file were independently hashed and the
font's internal version string is `Version 2.37`. The file is not modified or
subsetted. Its Bitstream Vera/Arev permission terms are reproduced verbatim in
`LICENSES/DEJAVU_FONTS.txt`.

## Corresponding ffmpeg.wasm and FFmpeg source

- Base ffmpeg.wasm release tag containing `@ffmpeg/ffmpeg` 0.12.15 and the
  source configuration for core 0.12.10:
  `v12.15` at `71aa99d37c02a7b4c435275ca9ef50e612f6efa1`.
- FFmpeg source selected by that revision's `Dockerfile`: tag `n5.1.4`,
  peeled Git commit `4729204c17f756e186d622060088371d10b34f7e`.
- Emscripten image selected upstream: `emscripten/emsdk:3.1.40`.

Obtain and inspect those sources:

```sh
git clone https://github.com/ffmpegwasm/ffmpeg.wasm.git
git -C ffmpeg.wasm checkout 71aa99d37c02a7b4c435275ca9ef50e612f6efa1

git clone https://git.ffmpeg.org/ffmpeg.git ffmpeg
git -C ffmpeg checkout 4729204c17f756e186d622060088371d10b34f7e
```

The upstream build control files are `Dockerfile`, `Makefile`,
`build/ffmpeg.sh`, `build/ffmpeg-wasm.sh` and the other scripts under
`build/` at the ffmpeg.wasm release revision. `make prd` builds single-thread;
`make prd-mt` builds multithread.

The shipped profile is rebuilt by
`scripts/build-reviewed-ffmpeg-core.sh`. It applies upstream ffmpeg.wasm commit
`b409e36475bc21f0451b5b1e1d126fa82871439a` (`-sSTACK_SIZE=5MB`), uses exact
Emscripten 3.1.40 and CMake 3.27.9 identities, makes upstream container-stage
isolation explicit and refuses maintainer-local paths in output. The exact
source archive, toolchain, patch, asset and Opus-gate identities are locked in
`scripts/reviewed-ffmpeg-core-lock.json`.

The Dockerfile uses branch names for two inputs. Repository history resolves
those refs to tips that predate the ffmpeg.wasm v12.15 release and have not
changed since:

- x264 `4-cores`:
  `33cac6b77d5b9259c552156013a817ab23119612`;
- x265 `3.4`:
  `2bb5520e9596f361bf0ed81b3b8da0d7fd999069`;
- LAME `master`:
  `2badea1974ae36cb8312afe99cff1e6b3b5decee`.

Use those immutable commits when assembling Corresponding Source:

```sh
git clone https://github.com/ffmpegwasm/x264.git
git -C x264 checkout 33cac6b77d5b9259c552156013a817ab23119612

git clone https://github.com/ffmpegwasm/x265.git
git -C x265 checkout 2bb5520e9596f361bf0ed81b3b8da0d7fd999069

git clone https://github.com/ffmpegwasm/lame.git
git -C lame checkout 2badea1974ae36cb8312afe99cff1e6b3b5decee
```

`scripts/ffmpeg-source-lock.json` records every source selected by the
upstream build as an immutable Git commit. Create the deterministic
Corresponding Source bundle and sidecar with:

```sh
npm run source:package
```

The command writes
`release/ffmpeg-core-0.12.10-reviewed-stack5m.1-corresponding-source.tar.xz`
and its
`.sha256` sidecar. Pass `-- --force` only to replace those exact outputs.
The reviewed archive for this build profile is 43,050,052 bytes with SHA-256
`2ab505f72be883d1257bc71cbb93880d1ade5bc029792621cb87b4ecc068399a`.
The reviewed object-code archive does not contain every linked component's
source and legal file, so publish this Corresponding Source bundle and the
notices beside the object code. A homepage link alone is not asserted to
satisfy GPL source obligations.

See `docs/FFMPEG_BUILD.md` for the observed version/configuration and
`THIRD_PARTY_NOTICES.md` for component roles and terms.