Sweetch Source Kit

App: Sweetch

FFmpeg 9.0.2 — source & relink kit · Kit ID: ffmpeg-9.0.2-kit-803732c2fbeb

FFmpeg 9.0.2 source and local rebuild/relink materials. This is not a Sweetch app download or a released-app source mapping.

Download and verify

Download source & relink kit Download SHA256SUMS

File: ffmpeg-source-relink.tar.gz
Size: 25,171,256 bytes
SHA-256: 803732c2fbebfb7fcc2d85831b0379599fb067745494ea1ce2277cb1a5ea0cac

After downloading, run this in the directory containing the archive:

printf '%s  %s\n' '803732c2fbebfb7fcc2d85831b0379599fb067745494ea1ce2277cb1a5ea0cac' 'ffmpeg-source-relink.tar.gz' | shasum -a 256 -c -

Continue only if the output is ffmpeg-source-relink.tar.gz: OK. The expected digest above identifies these exact bytes, not just a manifest read from inside an unverified archive. If it differs, stop and contact support.

Helper correspondence

This kit is recorded as local-only. Its compiler-produced FFmpeg helper is identified by SHA-256 61827a504476a470efacbcbbd8f1c1c3d04061e6872915434cc2b82d4725b9bf. This identifies the original build's helper, not a promise that every rebuild is byte-for-byte reproducible.

No released app, Apple export, re-signed helper or Store artefact is identified by this page. Signing and distribution can change bytes; this hash must not be represented as a release-artifact mapping. The source archive does not contain the helper executable, app binary, Apple SDK or signing keys.

Included sources and notices

This kit supplies six complete, pinned upstream source archives, the FFmpeg release signature and public release key, portable build/relink scripts, generated build/configuration evidence, and extracted licence and patent texts. The listed source inputs are unpatched in this build recipe. The exact source SHA-256 pins and source/rights inventory identify their provenance; the latter also explains the separate, unresolved archive and WebP helper scope.

Read the original texts below. These copies are extracted verbatim from this exact kit; summaries do not replace them or the notices in source files.

The recipe links FFmpeg and these external libraries statically into the identified helper. macOS system frameworks and libraries are not included in the kit. FFmpeg’s release signature is checked against the pinned upstream public key; the other source archives are hash-pinned, not represented as having the same signature proof.

Download and verify the archive first. Extract it into a new, empty directory, not into an app bundle or an existing source checkout. On an Apple Silicon macOS builder, the procedure requires compatible Xcode/compiler/SDK, CMake, pkg-config, make, GnuPG, Python 3 and the usual shell tools. The SDK and tools are not supplied. The recipe targets arm64 and macOS 15; a deployment target is not proof of a live macOS 15 run or universal encoder availability.

The original engineering README-relink.md is also inside the archive at its top level and at scripts/ffmpeg-relink.md. It includes repository-maintainer test and signing procedures as well as build details. The source kit does not contain scripts/tests; that repository-only unittest step is not a recipient prerequisite. Use the self-contained recipient commands below for this kit, and read the README for the detailed scope and signing limits.

Keep the verified archive outside the extracted directory. From the directory containing the download, stop on any failure:

mkdir ffmpeg-9.0.2-kit-803732c2fbeb &&
tar -xzf ffmpeg-source-relink.tar.gz -C ffmpeg-9.0.2-kit-803732c2fbeb &&
cd ffmpeg-9.0.2-kit-803732c2fbeb &&
python3 scripts/ffmpeg-relink-kit.py verify-kit \
  --kit ../ffmpeg-source-relink.tar.gz \
  --expected-kit-sha256 803732c2fbebfb7fcc2d85831b0379599fb067745494ea1ce2277cb1a5ea0cac

The kit includes all eight pinned inputs in Engine/.cache. From the extracted kit root, verify them, create a fresh work directory, build offline, and check the actual build receipt:

ROOT="$PWD"
BUILD_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/sweetch-ffmpeg-rebuild.XXXXXX")" &&
WORK="$BUILD_ROOT/build" &&
python3 scripts/ffmpeg-relink-kit.py verify-inputs \
  --root "$ROOT" --cache "$PWD/Engine/.cache" &&
bash scripts/build-ffmpeg.sh --offline \
  --cache-dir "$PWD/Engine/.cache" --work-dir "$WORK" --jobs 2 &&
python3 scripts/ffmpeg-relink-kit.py check-build \
  --root "$ROOT" --cache "$PWD/Engine/.cache" \
  --work "$WORK" --build-receipt "$WORK/build-receipt.json"

After a successful build and receipt check, the compiler-produced helper is $WORK/ffmpeg-build/ffmpeg. Do not reuse an old work directory or helper as rebuild evidence, download a substitute FFmpeg, or replace a source hash to accept different bytes. These commands do not install prerequisites or impose a process deadline. Your new local build logs can contain your own filesystem paths; do not publish or send them without inspecting their contents.

For modification/relink exploration, the documented prove-relink command uses only the verified kit, fresh work/evidence directories and three cold builds: unmodified A, one explicitly modified FFmpeg configuration marker B, and unmodified recovery C. Its checks include changed helper digests and a real MP3 encode/decode path. This describes what the procedure checks, not a claim that a particular recipient has run it or can install a modified Store app. Full source and scripts are provided for your own inspection and modification under their applicable licences.

Rights and distribution boundaries

Applicable licences preserve their own source, modification, redistribution and debugging/reverse-engineering rights. The Sweetch draft terms do not remove those rights. This archive is a pre-release FFmpeg-only engineering deliverable, not a binary release, a written offer of future fulfilment, or qualified review of LGPL static-link/source/object sufficiency, codec/patent rights by territory, Apple signing restrictions or Store terms.

No released MAS/direct application is mapped to this archive. It does not contain SweetchArchive or SweetchWebp source kits, and does not discharge those helpers’ separate notice/source obligations. The original inventory and upstream patent notices must not be interpreted as complete patent clearance. New kit bytes require a new kit ID and download path; this version identifies the exact archive above, without promising a legal source-offer retention period.

All source versions and recipient help · dmitro.havr.supp@gmail.com

Back to top
Table of Contents