# Browser source offer and rebuild instructions

This file accompanies the browser codec assets served by the Audivane web
application. The exact source archives are under `sources/`; optional toolchain
archives are under `toolchain/`. Every archive is pinned by SHA-256 (or by
canonical extracted content for Android Gitiles). No required source archive is
missing.

- **ffmpeg.wasm browser build (Dockerfile, bindings and build scripts) 0.12.10 (tag v12.15)** — MIT for ffmpeg.wasm glue; the built FFmpeg core is GPL-2.0-or-later
  - Source: https://codeload.github.com/ffmpegwasm/ffmpeg.wasm/tar.gz/71aa99d37c02a7b4c435275ca9ef50e612f6efa1
  - Ref: `v12.15`
  - Commit: `71aa99d37c02a7b4c435275ca9ef50e612f6efa1`
  - Archive SHA-256: `53c5842f160cece0e39345876f9483b56aa84b966637ff6f624353a0fa884219`
  - Included as: `sources/ffmpeg.wasm-71aa99d.tar.gz`
  - Role: Build recipe and FFmpeg fftools/bind overlay for the distributed @ffmpeg/core WASM.
- **FFmpeg 5.1.4** — GPL-2.0-or-later for this build (configured with --enable-gpl)
  - Source: https://codeload.github.com/FFmpeg/FFmpeg/tar.gz/4729204c17f756e186d622060088371d10b34f7e
  - Ref: `n5.1.4`
  - Commit: `4729204c17f756e186d622060088371d10b34f7e`
  - Archive SHA-256: `0d7ad57d4dd851d577fc6c19e5cec5b6e5faaeb2dbd52ab76127e3c3763fec6d`
  - Included as: `sources/ffmpeg-5.1.4.tar.gz`
  - Role: FFmpeg libraries and fftools compiled into the distributed core. The upstream Dockerfile references git tag n5.1.4; this archive is that exact commit.
- **ffmpegwasm/x264 branch 4-cores at 33cac6b (x264 core)** — GPL-2.0-or-later
  - Source: https://codeload.github.com/ffmpegwasm/x264/tar.gz/33cac6b77d5b9259c552156013a817ab23119612
  - Ref: `4-cores`
  - Commit: `33cac6b77d5b9259c552156013a817ab23119612`
  - Archive SHA-256: `75434a5a1f2d7d4314821c6054dd300731d69e2fa73314ba4a5ec9df38d4ec80`
  - Included as: `sources/x264-33cac6b.tar.gz`
  - Role: Linked with --enable-gpl --enable-libx264 in the core.
- **ffmpegwasm/x265 3.4** — GPL-2.0-or-later
  - Source: https://codeload.github.com/ffmpegwasm/x265/tar.gz/2bb5520e9596f361bf0ed81b3b8da0d7fd999069
  - Ref: `3.4`
  - Commit: `2bb5520e9596f361bf0ed81b3b8da0d7fd999069`
  - Archive SHA-256: `e5254828f5db7bc375d385e31247861d25facee87b43fa2d08ea3ab5569672ab`
  - Included as: `sources/x265-3.4.tar.gz`
  - Role: Linked with --enable-gpl --enable-libx265 in the core.
- **ffmpegwasm/libvpx 1.13.1** — BSD-3-Clause
  - Source: https://codeload.github.com/ffmpegwasm/libvpx/tar.gz/10b9492dcf05b652e2e4b370e205bd605d421972
  - Ref: `v1.13.1`
  - Commit: `10b9492dcf05b652e2e4b370e205bd605d421972`
  - Archive SHA-256: `12181ed27342415e8b01bf09abfbf1dfa27a6a32f302fb78b48bd70efe50f702`
  - Included as: `sources/libvpx-1.13.1.tar.gz`
  - Role: Linked with --enable-libvpx in the core.
- **ffmpegwasm/lame 3.100** — LGPL-2.0-or-later
  - Source: https://codeload.github.com/ffmpegwasm/lame/tar.gz/2badea1974ae36cb8312afe99cff1e6b3b5decee
  - Ref: `master`
  - Commit: `2badea1974ae36cb8312afe99cff1e6b3b5decee`
  - Archive SHA-256: `0d97ba0776988f5730e0ce1fa936e7c5d6836c757993ba55073513fe89cf410a`
  - Included as: `sources/lame-3.100.tar.gz`
  - Role: Linked with --enable-libmp3lame in the core.
- **ffmpegwasm/Ogg 1.3.4** — BSD-3-Clause
  - Source: https://codeload.github.com/ffmpegwasm/Ogg/tar.gz/bada45718453ac27b56773ae663f7e65112f6a6e
  - Ref: `v1.3.4`
  - Commit: `bada45718453ac27b56773ae663f7e65112f6a6e`
  - Archive SHA-256: `4d61f8dfa248276c42bd5404b1a87ae9d8a0d58791f55e20018c7b39b38d8823`
  - Included as: `sources/ogg-1.3.4.tar.gz`
  - Role: Linked for Ogg container support in the core.
- **ffmpegwasm/theora 1.1.1** — BSD-3-Clause
  - Source: https://codeload.github.com/ffmpegwasm/theora/tar.gz/7ffd8b2ecfc2d93ae5e16028e7528e609266bfbf
  - Ref: `v1.1.1`
  - Commit: `7ffd8b2ecfc2d93ae5e16028e7528e609266bfbf`
  - Archive SHA-256: `c38e6a3fb19566a44dcb283323c48311dd484f1416f3f34676d3e7fd252dfbc5`
  - Included as: `sources/theora-1.1.1.tar.gz`
  - Role: Linked with --enable-libtheora in the core.
- **ffmpegwasm/opus 1.3.1** — BSD-3-Clause
  - Source: https://codeload.github.com/ffmpegwasm/opus/tar.gz/e85ed7726db5d677c9c0677298ea0cb9c65bdd23
  - Ref: `v1.3.1`
  - Commit: `e85ed7726db5d677c9c0677298ea0cb9c65bdd23`
  - Archive SHA-256: `c6d574b17d70b8c289d997a8ac81314cf1fd8c52237c421b2ee34e69cea85bf8`
  - Included as: `sources/opus-1.3.1.tar.gz`
  - Role: Linked with --enable-libopus in the core.
- **ffmpegwasm/vorbis 1.3.3** — BSD-3-Clause
  - Source: https://codeload.github.com/ffmpegwasm/vorbis/tar.gz/7798164043197d7e33f02de4353ce2aa5b248225
  - Ref: `v1.3.3`
  - Commit: `7798164043197d7e33f02de4353ce2aa5b248225`
  - Archive SHA-256: `69b87cafe2815d02609886a63b9d4c0b7461e1e2f6ecf3960ede04053da6e96a`
  - Included as: `sources/vorbis-1.3.3.tar.gz`
  - Role: Linked with --enable-libvorbis in the core.
- **ffmpegwasm/zlib 1.2.11** — Zlib
  - Source: https://codeload.github.com/ffmpegwasm/zlib/tar.gz/cacf7f1d4e3d44d871b605da3b647f07d718623f
  - Ref: `v1.2.11`
  - Commit: `cacf7f1d4e3d44d871b605da3b647f07d718623f`
  - Archive SHA-256: `6d4d6640ca3121620995ee255945161821218752b551a1a180f4215f7d124d45`
  - Included as: `sources/zlib-1.2.11.tar.gz`
  - Role: Linked with --enable-zlib in the core.
- **ffmpegwasm/libwebp 1.3.2** — BSD-3-Clause
  - Source: https://codeload.github.com/ffmpegwasm/libwebp/tar.gz/ca332209cb5567c9b249c86788cb2dbf8847e760
  - Ref: `v1.3.2`
  - Commit: `ca332209cb5567c9b249c86788cb2dbf8847e760`
  - Archive SHA-256: `1676107dc385f9bf6cb4c2b94d4a9359d1fd95ab6309cb587191a742df292fe2`
  - Included as: `sources/libwebp-1.3.2.tar.gz`
  - Role: Linked with --enable-libwebp in the core.
- **ffmpegwasm/freetype2 2.10.4** — FreeType License / GPL-2.0-or-later
  - Source: https://codeload.github.com/ffmpegwasm/freetype2/tar.gz/6a2b3e4007e794bfc6c91030d0ed987f925164a8
  - Ref: `VER-2-10-4`
  - Commit: `6a2b3e4007e794bfc6c91030d0ed987f925164a8`
  - Archive SHA-256: `09acceb42508c65b7b744cc2ad01d7548868ca57babc39f7683ec3c0f7541e8c`
  - Included as: `sources/freetype-2.10.4.tar.gz`
  - Role: Linked with --enable-libfreetype in the core.
- **fribidi/fribidi 1.0.9** — LGPL-2.1-or-later
  - Source: https://codeload.github.com/fribidi/fribidi/tar.gz/f9e8e71a6fbf4a4619481284c9f484d10e559995
  - Ref: `v1.0.9`
  - Commit: `f9e8e71a6fbf4a4619481284c9f484d10e559995`
  - Archive SHA-256: `65ff6fb1a478c4d90ae16825da8c97b8a63e2674f8a2d6dae8800f89089640ba`
  - Included as: `sources/fribidi-1.0.9.tar.gz`
  - Role: Linked with --enable-libfribidi in the core.
- **harfbuzz/harfbuzz 5.2.0** — MIT
  - Source: https://codeload.github.com/harfbuzz/harfbuzz/tar.gz/4a1d891c6317d2c83e5f3c2607ec5f5ccedffcde
  - Ref: `5.2.0`
  - Commit: `4a1d891c6317d2c83e5f3c2607ec5f5ccedffcde`
  - Archive SHA-256: `69ba7c7a42643a3654781242016dd09245cab7353fc2a02cecb710e479c9a881`
  - Included as: `sources/harfbuzz-5.2.0.tar.gz`
  - Role: Linked with --enable-libass in the core.
- **libass/libass 0.15.0** — ISC
  - Source: https://codeload.github.com/libass/libass/tar.gz/d149636f502f5774ae1a8fb4c554b122674393b2
  - Ref: `0.15.0`
  - Commit: `d149636f502f5774ae1a8fb4c554b122674393b2`
  - Archive SHA-256: `5cfe23562fa623a3b209d156ad469aeb2e31f69bf6b256ea737d87d9ed89301d`
  - Included as: `sources/libass-0.15.0.tar.gz`
  - Role: Linked with --enable-libass in the core.
- **sekrit-twc/zimg release-3.0.5** — WTFPL
  - Source: https://codeload.github.com/sekrit-twc/zimg/tar.gz/e5b0de6bebbcbc66732ed5afaafef6b2c7dfef87
  - Ref: `release-3.0.5`
  - Commit: `e5b0de6bebbcbc66732ed5afaafef6b2c7dfef87`
  - Archive SHA-256: `3ab062eff30067799997bc3e911c0108a5b8cbcd6e0ef14053f17ff0ecd0add8`
  - Included as: `sources/zimg-3.0.5.tar.gz`
  - Role: Linked with --enable-libzimg in the core. The googletest submodule is test-only and is not linked.
- **SDL 2.24.2 (Emscripten 3.1.40 sdl2 port)** — Zlib
  - Source: https://codeload.github.com/libsdl-org/SDL/tar.gz/55b03c7493a7abed33cf803d1380a40fa8af903f
  - Ref: `release-2.24.2`
  - Commit: `55b03c7493a7abed33cf803d1380a40fa8af903f`
  - Archive SHA-256: `a726e31f8ad9443a2a9a649f12751442d8ca5ea78a84fde14f760c81706b4127`
  - Included as: `sources/SDL-2.24.2.tar.gz`
  - Role: Linked through emcc -sUSE_SDL=2. Emscripten 3.1.40 tools/ports/sdl2.py pins TAG=release-2.24.2 and the archive SHA-512 below.
- **Google liblc3 1.1.3** — Apache-2.0
  - Source: https://github.com/google/liblc3/archive/refs/tags/v1.1.3.tar.gz
  - Ref: `v1.1.3`

  - Archive SHA-256: `276752ff54ce6a77d54ec133397b9d7e71f90caf3d9afa32d8b0e891b8ecb8af`
  - Included as: `sources/liblc3-1.1.3.tar.gz`
  - Role: Source of the supplemental lc3_codec.wasm. Same pinned tarball as the native build.
- **AOSP libldac (LDAC encoder) commit eeee1a3f** — Apache-2.0 (retain LICENSE and NOTICE)
  - Source: https://android.googlesource.com/platform/external/libldac/+archive/eeee1a3f5f8df1282e3a6d297085885fd886737b.tar.gz
  - Ref: `eeee1a3f5f8df1282e3a6d297085885fd886737b`
  - Commit: `eeee1a3f5f8df1282e3a6d297085885fd886737b`
  - Content SHA-256: `ebba69bc820b93c2ea4c49feaee9e82ffabdb604f89f6c332c2fe922ff3b4d95` (upstream Gitiles regenerates archive bytes)
  - Included as: `sources/libldac-eeee1a3f.tar.gz`
  - Role: Encoder source in the supplemental ldac_codec.wasm.
- **hegdi/libldacdec (LDAC decoder) commit 7f3bd6cc** — MIT, copyright 2021 Dirk Helbig
  - Source: https://github.com/hegdi/libldacdec/archive/7f3bd6cc1586b764b02f2e4f20b16c7ff18758b9.tar.gz
  - Ref: `7f3bd6cc1586b764b02f2e4f20b16c7ff18758b9`
  - Commit: `7f3bd6cc1586b764b02f2e4f20b16c7ff18758b9`
  - Archive SHA-256: `c6a1cde751cb18f69ccf7d8817f24972560be4e62b3fdbe75159c1207bc5a046`
  - Included as: `sources/libldacdec-7f3bd6cc.tar.gz`
  - Role: Decoder source in the supplemental ldac_codec.wasm.

## Source completeness

Every source archive named by the ffmpeg.wasm Dockerfile and the supplemental build script is present and hash-verified. No required source archive is missing.

The inferred source ref is documented below. An absent upstream npm
attestation is recorded as an evidence bound in `REPORT.json`; it is not a
missing source archive.

## Distributed core identity

- npm package: `@ffmpeg/core@0.12.10`
- Tarball: `distributed/npm/core-0.12.10.tgz`
- Tarball SHA-256: `d00089ce82e1bdf637ddbe42e0c3d41a1ba8cf4c9e825e7fa4d0bb970e844bd4`
- `dist/esm/ffmpeg-core.wasm` SHA-256: `9f57947a5bd530d8f00c5b3f2cb2a3492faa7e5d823315342d6a8656d0a6b7b7`
- `dist/esm/ffmpeg-core.js` SHA-256: `67a48f11645f85439f3fde4f2119042c16b374b910206b7a7a24f342e28dcae3`
- Inferred release source: https://github.com/ffmpegwasm/ffmpeg.wasm commit
  `71aa99d37c02a7b4c435275ca9ef50e612f6efa1` (tag `v12.15`)
- Last build-affecting source: commit `bd903bbf18d133dc9add2149a2e921c392309451`
- Wrong tag: `v0.12.10` is commit
  `c3a763857c5e615ae8674715ad5e4f63ff469e9d` and is not this package's source.

## Rebuilding the core

The upstream recipe is the Dockerfile included at
`build/ffmpeg-wasm/Dockerfile`. The single-thread production target is:

```sh
make prd
```

It uses `emscripten/emsdk:3.1.40`, FFmpeg `n5.1.4`, and the dependency
archives above. Recording the Docker image digest and resolved dependency
commits is optional additional evidence; a rebuild was not performed here and
bit-identical reproduction is not required by this material set.

## Rebuilding the supplemental modules

```sh
LC_ALL=C \
CODEC_WASM_BUILD_DIR=/tmp/opencode/codec-wasm-build \
CODEC_WASM_EMSDK_DIR=/tmp/opencode/emsdk \
tools/build_codec_wasm.sh
```

The absolute build directory and `LC_ALL=C` are part of the observed build
identity: the LDAC WASM embeds the libldacdec source path and its link order
depends on the locale. The script does not currently enforce either condition.
With Emscripten 6.0.13 the rebuild reproduces both served modules exactly; see
`provenance/supplemental-reproduction.json`.

## Evidence bounds

- The npm core bytes are verified against the published tarball; the source ref
  is inferred because the npm publication has no gitHead or provenance
  attestation. The complete source archive set for that ref is included.
- No byte-for-byte rebuild of the npm core was performed here.
- Audibility and codec conformance are separate verification results, not
  claims made by this material set.