av-tools/SOURCE.md

Source and reproducibility record

This file identifies the source corresponding to av-tools 0.3.0. It is not a substitute for satisfying a component's licence or for delivering complete Corresponding Source with an object-code release.

av-tools

• Canonical repository: git@git.add-ideas.de:lotobo/av-tools.git
• Browser source: https://git.add-ideas.de/lotobo/av-tools
• Version: 0.3.0
• Release source identity: immutable annotated tag v0.3.0 (refs/tags/v0.3.0) in the canonical repository.
• Application licence: GPL-3.0-or-later; full GPL version 3 terms in LICENSE.
• Copyright: Copyright © 2026 Albrecht Degering.

The release tag is the source identity because embedding a commit's own hash inside that commit is impossible. Before publishing binary bytes, verify that the tag exists, is annotated, points to the reviewed release commit and is available without authentication:

test "$(git cat-file -t v0.3.0)" = tag
git rev-parse v0.3.0^{commit}
git ls-remote --tags \
  https://git.add-ideas.de/lotobo/av-tools.git refs/tags/v0.3.0

The Toolbox manifest names the canonical repository and SPDX licence. Publish the tag/source archive beside the binary release and checksum.

Pinned npm inputs

package-lock.json is authoritative. The FFmpeg-related runtime packages are:

Package	Exact version	npm integrity
@ffmpeg/ffmpeg	0.12.15	sha512-1C8Obr4GsN3xw+/1Ww6PFM84wSQAGsdoTuTWPOj2OizsRDLT4CXTaVjPhkw6ARyDus1B9X/L2LiXHqYYsGnRFw==
@ffmpeg/util	0.12.2	sha512-ouyoW+4JB7WxjeZ2y6KpRvB+dLp7Cp4ro8z0HIVpZVCM7AwFlHa0c4R8Y/a4M3wMqATpYKhC7lSFHQ0T11MEDw==
@ffmpeg/types (transitive)	0.12.4	sha512-k9vJQNBGTxE5AhYDtOYR5rO5fKsspbg51gbcwtbkw2lCdoIILzklulcjJfIDwrtn7XhDeF2M+THwJ2FGrLeV6A==

Install exact packages and recreate the verified same-origin assets without a network fetch during the production build:

npm ci
npm run vendor:ffmpeg
npm run vendor:verify-runtime
npm run build

scripts/copy-ffmpeg-assets.mjs fails closed against scripts/reviewed-ffmpeg-core-lock.json, verifies the deterministic tracked ZIP and unpacks only its five declared entries. It does not download them or fall back to published core packages. The reviewed bytes are:

For a publication check, generate the build-qualified Corresponding Source archive and run npm run vendor:verify; that stricter gate hashes the archive as well as every runtime input.

Release path	Bytes	SHA-256
vendor/ffmpeg/0.12.10-reviewed-stack5m.1/st/ffmpeg-core.js	111804	80c05d79d0e4e9434977b76cb851d10ddf2bfd378570178700d2c43b8afdcb24
vendor/ffmpeg/0.12.10-reviewed-stack5m.1/st/ffmpeg-core.wasm	32232580	fe41ddc77220cef6c04f5d48eeffcaaaef179ad270642e098f9945013aa0c9dc
vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.js	128953	4f2650099ab70cb2583951c0421147c62bea6c18dfbba5cfae4d7698b5d0ab62
vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.wasm	32718455	abbead010cb0448b26f01a36a3c8c03a6b04aca07812ddd4719a7f4b6bf4b645
vendor/ffmpeg/0.12.10-reviewed-stack5m.1/mt/ffmpeg-core.worker.js	2115	f77898d631dc010b45c29c23cb4379c611a7d7b131bf591d08a656bb729a4ca3
vendor/ffmpeg-core-0.12.10-reviewed-stack5m.1.zip (deterministic artifact)	21338974	ebc068c6d096de55ae3335b04b7121130665f5b0ffa7a828067122733f55185f

Bundled contact-sheet font

Contact-sheet labels use one unmodified DejaVu Sans 2.37 TrueType file. It is served same-origin and mounted read-only for the duration of a labelled job; the browser verifies its size and SHA-256 before use.

Release path	Bytes	SHA-256
fonts/DejaVuSans.ttf	757,076	7da195a74c55bef988d0d48f9508bd5d849425c1770dba5d7bfc6ce9ed848954
LICENSES/DEJAVU_FONTS.txt	n/a	licence text embedded in the reviewed font and official archive

The byte-for-byte source is ttf/DejaVuSans.ttf in the official dejavu-fonts-ttf-2.37.tar.bz2 release:

• project download record: https://dejavu-fonts.github.io/Download.html;
• archive URL: https://downloads.sourceforge.net/project/dejavu/dejavu/2.37/dejavu-fonts-ttf-2.37.tar.bz2;
• archive SHA-256: fa9ca4d13871dd122f61258a80d01751d603b4d3ee14095d65453b4e846e17d7;
• corresponding upstream tag version_2_37, commit 0eda8a319c08835009849583cd090bb5b141ce25.

The release archive and the bundled file were independently hashed and the font's internal version string is Version 2.37. The file is not modified or subsetted. Its Bitstream Vera/Arev permission terms are reproduced verbatim in LICENSES/DEJAVU_FONTS.txt.

Corresponding ffmpeg.wasm and FFmpeg source

• Base ffmpeg.wasm release tag containing @ffmpeg/ffmpeg 0.12.15 and the source configuration for core 0.12.10: v12.15 at 71aa99d37c02a7b4c435275ca9ef50e612f6efa1.
• FFmpeg source selected by that revision's Dockerfile: tag n5.1.4, peeled Git commit 4729204c17f756e186d622060088371d10b34f7e.
• Emscripten image selected upstream: emscripten/emsdk:3.1.40.

Obtain and inspect those sources:

git clone https://github.com/ffmpegwasm/ffmpeg.wasm.git
git -C ffmpeg.wasm checkout 71aa99d37c02a7b4c435275ca9ef50e612f6efa1

git clone https://git.ffmpeg.org/ffmpeg.git ffmpeg
git -C ffmpeg checkout 4729204c17f756e186d622060088371d10b34f7e

The upstream build control files are Dockerfile, Makefile, build/ffmpeg.sh, build/ffmpeg-wasm.sh and the other scripts under build/ at the ffmpeg.wasm release revision. make prd builds single-thread; make prd-mt builds multithread.

The shipped profile is rebuilt by scripts/build-reviewed-ffmpeg-core.sh. It applies upstream ffmpeg.wasm commit b409e36475bc21f0451b5b1e1d126fa82871439a (-sSTACK_SIZE=5MB), uses exact Emscripten 3.1.40 and CMake 3.27.9 identities, makes upstream container-stage isolation explicit and refuses maintainer-local paths in output. The exact source archive, toolchain, patch, asset and Opus-gate identities are locked in scripts/reviewed-ffmpeg-core-lock.json.

The Dockerfile uses branch names for two inputs. Repository history resolves those refs to tips that predate the ffmpeg.wasm v12.15 release and have not changed since:

• x264 4-cores: 33cac6b77d5b9259c552156013a817ab23119612;
• x265 3.4: 2bb5520e9596f361bf0ed81b3b8da0d7fd999069;
• LAME master: 2badea1974ae36cb8312afe99cff1e6b3b5decee.

Use those immutable commits when assembling Corresponding Source:

git clone https://github.com/ffmpegwasm/x264.git
git -C x264 checkout 33cac6b77d5b9259c552156013a817ab23119612

git clone https://github.com/ffmpegwasm/x265.git
git -C x265 checkout 2bb5520e9596f361bf0ed81b3b8da0d7fd999069

git clone https://github.com/ffmpegwasm/lame.git
git -C lame checkout 2badea1974ae36cb8312afe99cff1e6b3b5decee

scripts/ffmpeg-source-lock.json records every source selected by the upstream build as an immutable Git commit. Create the deterministic Corresponding Source bundle and sidecar with:

npm run source:package

The command writes release/ffmpeg-core-0.12.10-reviewed-stack5m.1-corresponding-source.tar.xz and its .sha256 sidecar. Pass -- --force only to replace those exact outputs. The reviewed archive for this build profile is 43,050,052 bytes with SHA-256 2ab505f72be883d1257bc71cbb93880d1ade5bc029792621cb87b4ecc068399a. The reviewed object-code archive does not contain every linked component's source and legal file, so publish this Corresponding Source bundle and the notices beside the object code. A homepage link alone is not asserted to satisfy GPL source obligations.

See docs/FFMPEG_BUILD.md for the observed version/configuration and THIRD_PARTY_NOTICES.md for component roles and terms.