{
  "schemaVersion": 1,
  "scope": {
    "asset": "@php-wasm/web-8-5 3.1.46 Asyncify php_8_5.wasm",
    "assetSha256": "ed97ea5422dbf23e0687c98203cc8c6d7f2772a3d71b03d4991d2fdd93a048f0",
    "assetBytes": 21019221,
    "phpVersion": "8.5.8",
    "phpBuildDate": "Jul 8 2026 07:06:40",
    "platform": "wasm32-emscripten",
    "purpose": "Complete legal and source inventory for the exact shipped PHP WebAssembly main module"
  },
  "buildProvenance": {
    "wordpressPlayground": {
      "release": "v3.1.46",
      "commit": "581c7c172428159eb4e6c5309054a568cd39a97a",
      "repository": "https://github.com/WordPress/wordpress-playground",
      "packageGitHead": "581c7c172428159eb4e6c5309054a568cd39a97a"
    },
    "php": {
      "version": "8.5.8",
      "tag": "php-8.5.8",
      "tagObject": "8a3b5a5124006c11a8fbfce838ec7dd53615cc77",
      "commit": "26b97507444c4fbda072f57dda1820f7b7d5e467",
      "repository": "https://github.com/php/php-src"
    },
    "emscripten": {
      "version": "4.0.19",
      "commit": "08e2de1031913e4ba7963b1c56f35f036a7d4d56",
      "repository": "https://github.com/emscripten-core/emscripten"
    },
    "recipe": {
      "path": "packages/php-wasm/compile/php/Dockerfile",
      "variant": "web Asyncify with the platform-default feature set",
      "sourceUrl": "https://github.com/WordPress/wordpress-playground/blob/581c7c172428159eb4e6c5309054a568cd39a97a/packages/php-wasm/compile/php/Dockerfile"
    }
  },
  "linkedComponents": [
    {
      "id": "wordpress-playground-php-wasm",
      "version": "3.1.46",
      "source": "WordPress Playground commit 581c7c172428159eb4e6c5309054a568cd39a97a",
      "license": "GPL-2.0-or-later",
      "legalFiles": ["LICENSE.php-wasm-GPL-2.0-or-later.txt"],
      "evidence": "npm package gitHead and integrity plus exact loader/WebAssembly hashes"
    },
    {
      "id": "php",
      "version": "8.5.8",
      "source": "php-src commit 26b97507444c4fbda072f57dda1820f7b7d5e467, patched by the pinned WordPress Playground recipe",
      "license": "PHP-4.0 (BSD-3-Clause) plus separately identified bundled-source terms",
      "legalFiles": [
        "LICENSE.PHP-4.0.txt",
        "LICENSE.PHP-Zend-2.0.txt",
        "NOTICE.PHP-REDIST-BINS.txt",
        "LICENSE.PHP-CLI-http-parser-MIT.txt",
        "NOTICE.PHP-public-domain-hash-code.txt"
      ],
      "bundledSourceNotices": [
        {
          "component": "Zend Engine",
          "source": "php-src Zend/LICENSE at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
          "license": "Zend Engine License version 2.00",
          "legalFile": "LICENSE.PHP-Zend-2.0.txt"
        },
        {
          "component": "php-src binary redistribution notices",
          "source": "php-src README.REDIST.BINS at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
          "legalFile": "NOTICE.PHP-REDIST-BINS.txt"
        },
        {
          "component": "CLI HTTP parser",
          "source": "php-src sapi/cli/php_http_parser.c at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
          "sourceSha256": "5c601ebbeaceda9ae3018be99e56cedc1568211a22ecdc19a9ac7bcb9f8a303e",
          "license": "MIT",
          "legalFile": "LICENSE.PHP-CLI-http-parser-MIT.txt"
        },
        {
          "component": "bundled hash implementations",
          "source": "php-src ext/hash at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
          "algorithms": ["FNV", "Keccak/SHA-3", "MurmurHash3"],
          "license": "Public-Domain, CC0-1.0 and MIT-like permission",
          "legalFile": "NOTICE.PHP-public-domain-hash-code.txt"
        }
      ],
      "evidence": "PHP_VERSION and PHP_BUILD_DATE runtime constants; the loaded Zend engine, CLI SAPI source marker and hash_algos() runtime audit"
    },
    {
      "id": "pcre2",
      "version": "10.44",
      "source": "php-src ext/pcre/pcre2lib at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "PCRE2 BSD licence",
      "legalFiles": ["LICENSE.PCRE2-10.44.txt"],
      "evidence": "PCRE_VERSION=10.44 2024-06-07"
    },
    {
      "id": "php-libbcmath",
      "version": "PHP 8.5.8 vendored snapshot",
      "source": "php-src ext/bcmath/libbcmath at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "LGPL-2.0-or-later",
      "legalFiles": ["LICENSE.PHP-bcmath-LGPL-2.1.txt"],
      "evidence": "loaded bcmath extension and exact php-src source identity"
    },
    {
      "id": "timelib",
      "version": "2022.15",
      "source": "php-src ext/date/lib at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "MIT",
      "legalFiles": ["LICENSE.PHP-timelib-MIT.txt"],
      "evidence": "timelib version in runtime module information"
    },
    {
      "id": "iana-tzdata",
      "version": "2026.1",
      "source": "php-src ext/date/lib/timezonedb.h at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "Public-Domain",
      "legalFiles": ["NOTICE.IANA-TZDATA-2026.1.txt"],
      "evidence": "runtime Timezone Database Version=2026.1"
    },
    {
      "id": "php-libmagic",
      "version": "PHP 8.5.8 vendored snapshot",
      "source": "php-src ext/fileinfo/libmagic at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "BSD-2-Clause",
      "legalFiles": ["LICENSE.PHP-libmagic-BSD.txt"],
      "evidence": "loaded fileinfo extension and exact php-src source identity"
    },
    {
      "id": "lexbor",
      "version": "2.7.0",
      "source": "php-src ext/lexbor at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "Apache-2.0",
      "legalFiles": [
        "LICENSE.PHP-Lexbor-Apache-2.0.txt",
        "NOTICE.PHP-Lexbor.txt"
      ],
      "evidence": "loaded lexbor extension and runtime Lexbor version=2.7.0"
    },
    {
      "id": "libmbfl",
      "version": "1.3.2",
      "source": "php-src ext/mbstring/libmbfl at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "LGPL-2.1",
      "legalFiles": ["LICENSE.PHP-libmbfl-LGPL-2.1.txt"],
      "evidence": "loaded mbstring extension and runtime libmbfl version=1.3.2"
    },
    {
      "id": "php-uriparser",
      "version": "1.0.2",
      "source": "php-src ext/uri/uriparser at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "BSD-3-Clause",
      "legalFiles": ["LICENSE.PHP-uriparser-BSD-3-Clause.txt"],
      "evidence": "loaded uri extension and runtime bundled version=1.0.2"
    },
    {
      "id": "php-libavifinfo",
      "version": "PHP 8.5.8 vendored snapshot",
      "source": "php-src ext/standard/libavifinfo at commit 26b97507444c4fbda072f57dda1820f7b7d5e467",
      "license": "BSD-2-Clause with Alliance for Open Media Patent License 1.0",
      "legalFiles": [
        "LICENSE.PHP-libavifinfo-BSD-2-Clause.txt",
        "PATENTS.PHP-libavifinfo.txt"
      ],
      "evidence": "loaded standard extension and exact php-src source identity"
    },
    {
      "id": "zlib",
      "version": "1.2.13",
      "source": "https://www.zlib.net/fossils/zlib-1.2.13.tar.gz",
      "sourceArchiveSha256": "b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30",
      "sourceCommit": "04f42ceca40f73e2978b50e93806c2a18c1281fc",
      "license": "Zlib",
      "legalFiles": ["LICENSE.zlib-1.2.13.txt"],
      "evidence": "ZLIB_VERSION=1.2.13 and cURL linked zlib version"
    },
    {
      "id": "libzip",
      "version": "1.9.2",
      "source": "https://libzip.org/download/libzip-1.9.2.tar.gz",
      "sourceArchiveSha256": "fd6a7f745de3d69cf5603edc9cb33d2890f0198e415255d0987a0cf10d824c6f",
      "sourceCommit": "5532f9baa0c44cc5435ad135686a4ea009075b9a",
      "license": "BSD-3-Clause",
      "legalFiles": ["LICENSE.libzip-1.9.2.txt"],
      "evidence": "ZipArchive::LIBZIP_VERSION=1.9.2"
    },
    {
      "id": "libxml2",
      "version": "2.9.10",
      "source": "https://gitlab.gnome.org/GNOME/libxml2/-/tree/41a34e1f4ffae2ce401600dbb5fe43f8fe402641",
      "sourceCommit": "41a34e1f4ffae2ce401600dbb5fe43f8fe402641",
      "license": "MIT",
      "legalFiles": ["LICENSE.libxml2-2.9.10.txt"],
      "evidence": "LIBXML_DOTTED_VERSION=2.9.10 and loaded version=20910-GITv2.9.10"
    },
    {
      "id": "sqlite",
      "version": "3.51.0",
      "source": "https://sqlite.org/2025/sqlite-autoconf-3510000.tar.gz",
      "sourceArchiveSha256": "42e26dfdd96aa2e6b1b1be5c88b0887f9959093f650d693cb02eb9c36d146ca5",
      "sourceId": "fb2c931ae597f8d00a37574ff67aeed3eced",
      "license": "Public-Domain",
      "legalFiles": ["NOTICE.SQLite-3.51.0.txt"],
      "evidence": "SQLite3::version()=3.51.0"
    },
    {
      "id": "libgd",
      "version": "2.3.3",
      "source": "https://github.com/libgd/libgd/releases/download/gd-2.3.3/libgd-2.3.3.tar.gz",
      "sourceArchiveSha256": "dd3f1f0bb016edcc0b2d082e8229c822ad1d02223511997c80461481759b1ed2",
      "sourceCommit": "b5319a41286107b53daa0e08e402aa1819764bdc",
      "license": "BSD-like bundled terms",
      "legalFiles": ["LICENSE.libgd-2.3.3.txt"],
      "evidence": "GD_VERSION=2.3.3"
    },
    {
      "id": "libjpeg-turbo",
      "version": "3.0.3",
      "source": "https://github.com/libjpeg-turbo/libjpeg-turbo/releases/download/3.0.3/libjpeg-turbo-3.0.3.tar.gz",
      "sourceArchiveSha256": "343e789069fc7afbcdfe44dbba7dbbf45afa98a15150e079a38e60e44578865d",
      "sourceCommit": "7fa4b5b762c9a99b46b0b7838f5fd55071b92ea5",
      "license": "IJG AND BSD-3-Clause AND Zlib",
      "legalFiles": ["LICENSE.libjpeg-turbo-3.0.3.txt"],
      "evidence": "binary version marker libjpeg-turbo 3.0.3"
    },
    {
      "id": "libpng",
      "version": "1.6.39",
      "source": "https://prdownloads.sourceforge.net/libpng/libpng-1.6.39.tar.gz?download",
      "sourceArchiveSha256": "af4fb7f260f839919e5958e5ab01a275d4fe436d45442a36ee62f73e5beb75ba",
      "sourceCommit": "07b8803110da160b158ebfef872627da6c85cbdf",
      "license": "Libpng",
      "legalFiles": ["LICENSE.libpng-1.6.39.txt"],
      "evidence": "binary version marker 1.6.39 and GD PNG support"
    },
    {
      "id": "libwebp-and-libsharpyuv",
      "version": "commit 845d5476a866141ba35ac133f856fa62f0b7445f",
      "source": "https://chromium.googlesource.com/webm/libwebp/+archive/845d5476a866141ba35ac133f856fa62f0b7445f.tar.gz",
      "sourceArchiveSha256": "c68cbb9501e11d2686ec027b550867214c2e9232678a28ddafaa0abcb96ab4c4",
      "sourceCommit": "845d5476a866141ba35ac133f856fa62f0b7445f",
      "license": "BSD-3-Clause with WebM patent grant",
      "legalFiles": ["LICENSE.libwebp.txt", "PATENTS.libwebp.txt"],
      "evidence": "exact WordPress build-recipe commit and linked libwebp/libsharpyuv archives"
    },
    {
      "id": "libavif",
      "version": "1.3.0",
      "source": "https://github.com/AOMediaCodec/libavif/archive/refs/tags/v1.3.0.tar.gz",
      "sourceArchiveSha256": "0a545e953cc049bf5bcf4ee467306a2f113a75110edf59e61248873101cd26c1",
      "sourceCommit": "1aadfad932c98c069a1204261b1856f81f3bc199",
      "license": "BSD-2-Clause plus bundled component terms",
      "legalFiles": ["LICENSE.libavif-1.3.0.txt"],
      "evidence": "WordPress build recipe uses AVIF_CODEC_AOM=LOCAL and GD reports AVIF support"
    },
    {
      "id": "libaom",
      "version": "3.12.1",
      "source": "https://aomedia.googlesource.com/aom/+archive/v3.12.1.tar.gz",
      "sourceArchiveSha256": "8ecd25e39c4c94240d3aba272f8bde80f7a1c0448843c50d17a3eba54bd68586",
      "sourceCommit": "10aece4157eb79315da205f39e19bf6ab3ee30d0",
      "license": "BSD-2-Clause with Alliance for Open Media Patent License 1.0",
      "legalFiles": ["LICENSE.libaom-3.12.1.txt", "PATENTS.libaom-3.12.1.txt"],
      "evidence": "libavif v1.3.0 LocalAom.cmake pins v3.12.1; binary encoder and decoder version markers confirm 3.12.1"
    },
    {
      "id": "libyuv",
      "version": "snapshot vendored by libaom 3.12.1",
      "source": "third_party/libyuv in the exact libaom v3.12.1 archive",
      "license": "BSD-3-Clause",
      "legalFiles": ["LICENSE.libyuv.txt"],
      "evidence": "libavif LOCAL AOM build enables AOM's bundled libyuv path"
    },
    {
      "id": "openssl",
      "version": "1.1.1t",
      "source": "https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
      "sourceArchiveSha256": "8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b",
      "sourceCommit": "830bf8e1e4749ad65c51b6a1d0d769ae689404ba",
      "license": "OpenSSL and Original SSLeay licences",
      "legalFiles": ["LICENSE.OpenSSL-1.1.1t.txt"],
      "evidence": "OPENSSL_VERSION_TEXT and cURL SSL version both report OpenSSL 1.1.1t"
    },
    {
      "id": "curl",
      "version": "7.69.1",
      "source": "https://curl.se/download/curl-7.69.1.tar.gz",
      "sourceArchiveSha256": "01ae0c123dee45b01bbaef94c0bc00ed2aec89cb2ee0fd598e0d302a6b5e0a98",
      "sourceCommit": "b81e0b07784dc4c1e8d0a86194b9d28776d071c0",
      "license": "curl",
      "legalFiles": ["LICENSE.curl-7.69.1.txt"],
      "evidence": "curl_version()=7.69.1"
    },
    {
      "id": "libiconv",
      "version": "1.17",
      "source": "https://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.17.tar.gz",
      "sourceArchiveSha256": "8f74213b56238c85a50a5329f77e06198771e70dd9a739779f4c02f65d971313",
      "license": "LGPL-2.1-or-later",
      "legalFiles": ["LICENSE.libiconv-1.17-LGPL-2.1.txt"],
      "evidence": "ICONV_VERSION=1.17"
    },
    {
      "id": "oniguruma",
      "version": "6.9.10",
      "source": "WordPress Playground prebuilt archive at commit b38db761632d860bd519021d33a2230117841ee4",
      "linkedArchiveGitBlob": "1e4a8d4f15b680d2f93433cb1adbb7dcd499b0a5",
      "linkedArchiveSha256": "d040c88febc3d7f3548860b096640966647b34c118887041f25f51f3259eb36f",
      "buildCompiler": "Emscripten 4.0.5 (the archive was later linked into the Emscripten 4.0.19 main module)",
      "auditedReleaseCommit": "4ef89209a239c1aea328cf13c05a2807e5c146d1",
      "auditedReleaseArchiveSha256": "ad92309d0d13eebc27f6592e875f3efbfa3dda2bf6da5952e00f0a2120c921a8",
      "upstreamSourceRange": {
        "firstCommitWithExactInstalledHeader": "005482a534c821017882bc5ab1940b842b426081",
        "lastCommitBeforeHeaderChanged": "3eb317dc4413692e4eaa92a68839c74aa74fbc77",
        "excludingCommit": "ba9abef9cdbeed860c18d02a66b682f549b35a82",
        "installedHeaderGitBlob": "22e9b317b95bb55ac8e9d9da93fc4f64d3930f4a"
      },
      "buildCommitStatus": "The upstream recipe cloned its default branch without a revision. The exact build-time HEAD is not recoverable; the committed archive, installed header, runtime version and bounded upstream source interval are pinned instead of falsely claiming the v6.9.10 tag.",
      "license": "BSD-2-Clause",
      "legalFiles": ["LICENSE.Oniguruma-6.9.10.txt"],
      "evidence": "MB_ONIGURUMA_VERSION=6.9.10; exact committed archive and header blobs; the exact shipped WebAssembly hash remains the final binary identity"
    },
    {
      "id": "emscripten-runtime",
      "version": "4.0.19",
      "source": "Emscripten commit 08e2de1031913e4ba7963b1c56f35f036a7d4d56",
      "license": "MIT OR NCSA",
      "legalFiles": ["LICENSE.Emscripten-4.0.19.txt"],
      "evidence": "pinned WordPress base-image recipe and generated main-module loader/runtime"
    },
    {
      "id": "musl-libc",
      "version": "Emscripten 4.0.19 snapshot",
      "source": "Emscripten system/lib/libc/musl at commit 08e2de1031913e4ba7963b1c56f35f036a7d4d56",
      "license": "MIT and component notices",
      "legalFiles": ["LICENSE.musl.txt"],
      "evidence": "Emscripten libc linked into the main module"
    },
    {
      "id": "llvm-compiler-rt",
      "version": "Emscripten 4.0.19 snapshot",
      "source": "Emscripten system/lib/compiler-rt at commit 08e2de1031913e4ba7963b1c56f35f036a7d4d56",
      "license": "Apache-2.0 WITH LLVM-exception (current code) and NCSA OR MIT (legacy code)",
      "legalFiles": ["LICENSE.llvm-compiler-rt.txt"],
      "evidence": "compiler-rt builtins such as __extenddftf2 are defined in the main module"
    },
    {
      "id": "llvm-libcxx",
      "version": "Emscripten 4.0.19 snapshot",
      "source": "Emscripten system/lib/libcxx at commit 08e2de1031913e4ba7963b1c56f35f036a7d4d56",
      "license": "Apache-2.0 WITH LLVM-exception",
      "legalFiles": ["LICENSE.libcxx.txt"],
      "evidence": "C++ standard-library symbols are defined in the main module"
    },
    {
      "id": "llvm-libcxxabi",
      "version": "Emscripten 4.0.19 snapshot",
      "source": "Emscripten system/lib/libcxxabi at commit 08e2de1031913e4ba7963b1c56f35f036a7d4d56",
      "license": "Apache-2.0 WITH LLVM-exception",
      "legalFiles": ["LICENSE.libcxxabi.txt"],
      "evidence": "__cxa and C++ RTTI symbols are defined in the main module"
    },
    {
      "id": "dlmalloc",
      "version": "2.8.6",
      "source": "Emscripten system/lib/dlmalloc.c at commit 08e2de1031913e4ba7963b1c56f35f036a7d4d56",
      "license": "Public-Domain",
      "legalFiles": ["NOTICE.dlmalloc-2.8.6.txt"],
      "evidence": "Emscripten default allocator source for this build"
    }
  ],
  "excludedDetections": [
    {
      "id": "gmp",
      "status": "not linked",
      "runtimeEvidence": "extension_loaded('gmp')=false and function_exists('gmp_init')=false",
      "rawStringExplanation": "gmp_* names are compiled into Zend/Optimizer/zend_func_infos.h for optimization metadata even when ext/gmp is absent"
    },
    {
      "id": "libsodium",
      "status": "not linked",
      "runtimeEvidence": "extension_loaded('sodium')=false and function_exists('sodium_crypto_box')=false",
      "rawStringExplanation": "sodium_* names are compiled into Zend/Optimizer/zend_func_infos.h for optimization metadata even when ext/sodium is absent"
    },
    {
      "id": "tidy",
      "status": "not linked",
      "runtimeEvidence": "extension_loaded('tidy')=false, function_exists('tidy_parse_string')=false and class_exists('tidy')=false",
      "rawStringExplanation": "generic tidy strings and PHP credit/name tables are not evidence of libtidy"
    },
    {
      "id": "intl-and-icu",
      "status": "not shipped",
      "runtimeEvidence": "extension_loaded('intl')=false and class_exists('IntlDateFormatter')=false",
      "rawStringExplanation": "intlcal_* names come from Zend optimizer metadata; the npm package's separate intl.so side module is outside the pack's closed file set"
    },
    {
      "id": "freetype",
      "status": "not linked",
      "runtimeEvidence": "the exact libgd recipe sets ENABLE_FREETYPE=OFF and supplies stubs",
      "rawStringExplanation": "phpinfo reports a synthetic gdlib-config feature string, but the final link contains no FreeType archive"
    },
    {
      "id": "imagemagick-and-imagick",
      "status": "not linked",
      "runtimeEvidence": "extension_loaded('imagick')=false and class_exists('Imagick')=false",
      "rawStringExplanation": "the web build sets WITH_IMAGICK=no"
    },
    {
      "id": "standalone-libaom-3.13.1-recipe",
      "status": "not linked",
      "runtimeEvidence": "the final link consumes libavif's LOCAL AOM 3.12.1 build and the binary reports encoder/decoder 3.12.1",
      "rawStringExplanation": "the neighbouring 3.13.1 library recipe is not a dependency of this libavif build"
    }
  ]
}