# FFmpeg developer-bundle source and rights inventory

This is a **local development recipe**, not a legal clearance, source offer, Apple review result or permission to distribute the binary. The application embeds only a statically linked `SweetchFFmpeg` executable; it never downloads/installs tools at runtime or uses PATH. The SHA-256 archive lock is `sources.sha256`. The recipe also verifies the FFmpeg release signature using the pinned release key fingerprint `FCF986EA15E6E293A5644F10B4322F04D67658D8`. Binary hash, SDK/compiler, `-L`, configure and capability inventory are generated in `Engine/build/inventory.txt` by QA, not preasserted here.

| Source | Identity | Archive URL | Licence/notice source |
|---|---|---|---|
| FFmpeg | n9.0.2, source release matching tag `946fcce07b6dcd0331c8cc609192aeff5e1924f8` | https://ffmpeg.org/releases/ffmpeg-9.0.2.tar.xz | https://ffmpeg.org/legal.html and source `LICENSE.md` |
| LAME | 3.100 | https://downloads.sourceforge.net/project/lame/lame/3.100/lame-3.100.tar.gz | source `COPYING`, LGPL |
| libogg | `be05b13e98b048f0b5a0f5fa8ce514d56db5f822` | https://github.com/xiph/ogg/archive/be05b13e98b048f0b5a0f5fa8ce514d56db5f822.tar.gz | source `COPYING` |
| libopus | `ddbe48383984d56acd9e1ab6a090c54ca6b735a6` | https://github.com/xiph/opus/archive/ddbe48383984d56acd9e1ab6a090c54ca6b735a6.tar.gz | source `COPYING`, `LICENSE_PLEASE_READ.txt` |
| libvorbis | `0657aee69dec8508a0011f47f3b69d7538e9d262` | https://github.com/xiph/vorbis/archive/0657aee69dec8508a0011f47f3b69d7538e9d262.tar.gz | source `COPYING` |
| libvpx | `9f9b7e9ba2eb9d01640a9e69a3d655866265cf7f` = commit of annotated tag `v1.15.0` ("Wigeon Duck"), BSD-3-Clause; **no source changes**, built from the unpatched archive | https://github.com/webmproject/libvpx/archive/9f9b7e9ba2eb9d01640a9e69a3d655866265cf7f.tar.gz | source `LICENSE` (BSD-3-Clause) and `PATENTS` |

The helper is built as the **LGPL v2.1-or-later FFmpeg profile**: configure has no `--enable-gpl`, no GPL-only external codec (x264/x265/xvid absent), and `--disable-autodetect` lets only the explicitly enabled libraries in. libvpx 1.15.0 (BSD-3-Clause, not a GPL dependency) is statically linked for VP8/VP9 software encoding (`video.to.webm`); it does not alter the LGPL profile and is never combined with `--enable-gpl`. Hardware H.264/HEVC encoding comes from `--enable-videotoolbox`, whose VideoToolbox framework is a system framework linked by the OS at run time, not bundled GPL/third-party code.

Source-offer/redistribution obligations, exact transitive code/license inventory, codec/patent rights, Mac App Store terms and exported-bundle signatures are **unresolved**. In particular the LGPL §6 relink obligation for a **statically** linked helper (how a recipient can relink the app against a modified FFmpeg) is **unresolved**; this document does not discharge it. Never publish this developer binary before qualified legal/distribution review. CMake and pkg-config are build-time prerequisites only; binary must fail if linked against any non-system dynamic library. The app-signing identifier in this development project is provisional, not a selected owner's Store bundle identifier.

# libarchive developer-bundle source and rights inventory

This is the same kind of **local development recipe**: `scripts/build-archive-helper.sh` builds Sweetch's own CLI source `Engine/archive/SweetchArchive.c` against pinned libarchive, oldunzip and deflate64-rs source archives with hash-locked local source patches. Only the statically linked executable `Engine/build/archive/SweetchArchive` enters a profile or app bundle; no library dylib or source tree is bundled, and the app never installs tools at runtime or uses PATH. Archive and patch SHA-256 locks are comment lines in `Engine/sources.sha256` so the unrelated FFmpeg cache validator does not depend on ZIP inputs. The recipe verifies all locks and applies patches without fuzz before compilation; helper hash, SDK/compiler, Rust toolchain, `file`, `vtool`, `otool -L`, signature and version are recorded in `Engine/build/archive/inventory.txt` by the recipe, not preasserted here.

| Source | Identity | Archive URL | Licence/notice source |
|---|---|---|---|
| libarchive | 3.8.10 official release tarball, `libarchive-3.8.10-legacy-zip.patch` (exact SHA-256 pinned in `sources.sha256`); private ZIP read seams for file-backed methods 1–6/9 only | https://github.com/libarchive/libarchive/releases/download/v3.8.10/libarchive-3.8.10.tar.gz | source `COPYING` (BSD-2-Clause for the distribution as a whole; a few files carry a 3-clause UC Regents notice, `archive_parse_date.c` is public domain, and the bundled BLAKE2 files are triple-licensed CC0-1.0/OpenSSL/Apache-2.0) |
| liblzma (xz-utils) | 5.8.1 official release tarball, **no source changes**, static `liblzma.a` only (no xz/xzdec/lzmadec/lzmainfo front-ends, no scripts) | https://github.com/tukaani-project/xz/releases/download/v5.8.1/xz-5.8.1.tar.xz | source `COPYING` / `COPYING.0BSD`: liblzma is public domain, the build system and command-line tools are 0BSD |
| oldunzip | jsummers/oldunzip commit `9876449cda39c7218bdacce4890d1f203abb34e0`, patched `ozunshrink.h`, `ozunreduce.h`, `unimplode6a.h` by `oldunzip-strict-entry.patch` | https://github.com/jsummers/oldunzip/archive/9876449cda39c7218bdacce4890d1f203abb34e0.tar.gz | each included single header grants the choice of MIT (Jason Summers copyright 2019–2021, preserve notices) or public domain/Unlicense; `unimplode6a.h` credits Mark Adler's public-domain Info-ZIP code |
| deflate64-rs | anatawa12/deflate64-rs commit `a0dd6ef0ade9e0458a4c05bb9ea45f815f7ac62a`, package `deflate64` 0.1.12, patched by `deflate64-strict-entry.patch`, statically linked with local `deflate64-ffi` C ABI | https://github.com/anatawa12/deflate64-rs/archive/a0dd6ef0ade9e0458a4c05bb9ea45f815f7ac62a.tar.gz | source `LICENSE` MIT (copyright .NET Foundation and Contributors; anatawa12 2023); retain upstream MIT notice in redistribution |

- Enabled formats: ZIP read/write (one libarchive dispatcher; ordinary regular ZIP files additionally support Shrink method 1, Reduce factors 1–4 methods 2–5, Implode method 6 and Deflate64 method 9), TAR/pax read/write, gzip read/write through the OS zlib, bzip2 read through the OS libbz2, XZ/LZMA read through pinned static liblzma, RAR/RAR5 read and 7z read. The method 1–6 codec is a bounded in-process worker feeding the same libarchive reader; method 9 is a 64 KiB incremental Rust static library. No second ZIP parser or runtime decompressor is introduced. Source-based fixture provenance is in `Tests/SweetchCoreTests/Fixtures/archives/legacy-zip/PROVENANCE.md`; acceptance and safety evidence remain subject to independent QA, not asserted by this candidate. Encrypted archives, xar, zstd and lz4 are not added.
- Build profile: `--disable-shared --enable-static`, only the library (no bsdtar/bsdcat/bsdcpio/bsdunzip front-ends), `--without-openssl --without-xml2 --without-bsdxml --without-expat --without-iconv --with-lzma --without-lz4 --without-zstd --without-libb2 --without-cng --disable-acl --disable-xattr`. `--with-lzma` resolves to pinned static liblzma, with no external `xz`. Rust/Cargo **1.96.0**, target `aarch64-apple-darwin`, `--locked --offline` and macOS deployment target 15.0 are development build prerequisites; the lock contains only local deflate64 0.1.12, no crates.io dependencies.
- Dynamic linkage is limited to Apple system libraries/frameworks (`/usr/lib` and `/System/Library`); libarchive, liblzma, oldunzip and deflate64-rs are statically linked. The helper is one arm64 Mach-O, ad-hoc signed by the recipe, with no third-party dylib.
- `/usr/bin/bsdtar`, `unrar` and any user-installed archive tool are **not** accepted substitutes for this build in route evidence.
- Source-offer, redistribution, patent and App Store terms for shipping this statically linked helper, including new ZIP codec notices and Deflate64 intellectual-property rights, are **unresolved**, exactly as for the FFmpeg helper above. Never publish this developer binary before qualified legal/distribution review.

# libwebp developer-bundle source and rights inventory

This is the same kind of **local development recipe**: `scripts/build-webp-helper.sh` builds Sweetch's own CLI source `Engine/webp/SweetchWebp.c` against one pinned, unmodified libwebp release. Only the statically linked executable `Engine/build/webp/SweetchWebp` enters a profile or app bundle; no libwebp dylib or source tree is bundled, and the app never installs tools at runtime or uses PATH. The SHA-256 lock line is `Engine/sources.sha256` (`libwebp-pin`), verified before extraction on every build. Helper hash, SDK/compiler, `file`, `vtool`, `otool -L`, signature and version are recorded in `Engine/build/webp/inventory.txt` by the recipe, not preasserted here.

| Source | Identity | Archive URL | Licence/notice source |
|---|---|---|---|
| libwebp | 1.6.0 official release tarball (tag `v1.6.0` in `webmproject/libwebp`), **no source changes** | https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.6.0.tar.gz | source `COPYING` (BSD-3-Clause) and `PATENTS` (the WebP additional patent grant) |
| libsharpyuv | 1.6.0, shipped in the same libwebp tarball, **no source changes**, static `libsharpyuv.a` only | same archive | source `COPYING` (BSD-3-Clause) |

- Build profile: `--disable-shared --enable-static`, only `libwebp` and `libsharpyuv` (the RGB→YUV converter its lossy encoder calls); `--disable-libwebpmux --disable-libwebpdemux --disable-sdl --disable-gl --disable-gif --disable-jpeg --disable-png --disable-tiff --disable-wic --disable-neon`. `cwebp`, `dwebp`, `webpmux`, `webpinfo`, `gif2webp` and `img2webp` are therefore not built. Input decoding is Apple ImageIO, so the helper does not link libpng/libjpeg/libtiff/libgif.
- The helper is one Mach-O whose only dynamic dependencies are Apple system frameworks (`ImageIO`, `CoreGraphics`, `CoreFoundation`) and `libSystem`; libwebp and libsharpyuv are statically linked. It is ad-hoc signed by the build recipe as `org.sweetch.mac.webp` with the hardened runtime and no entitlements.
- `cwebp`, `dwebp` or any user-installed WebP tool are **not** accepted substitutes for this build in route evidence.
- Source-offer, redistribution, patent and App Store terms for shipping this statically linked helper are **unresolved**, exactly as for the FFmpeg and libarchive helpers above. Never publish this developer binary before qualified legal/distribution review.