{
  "checkedDate": "2026-09-07",
  "description": "Upstream source archives and build instructions associated with installed media packages. All downloaded archive bytes are unmodified.",
  "packages": [
    {
      "name": "@ffmpeg/core",
      "version": "0.12.10",
      "npmUrl": "https://registry.npmjs.org/@ffmpeg/core/0.12.10",
      "license": "GPL-2.0-or-later",
      "gitHeadInNpm": null,
      "releaseTag": "v12.15",
      "releaseCommit": "71aa99d37c02a7b4c435275ca9ef50e612f6efa1",
      "releaseUrl": "https://github.com/ffmpegwasm/ffmpeg.wasm/releases/tag/v12.15",
      "evidence": "Release explicitly names core 0.12.10; tag resolves to release commit that sets package version 0.12.10. npm timestamp 2025-01-07T10:13:14.328Z follows commit 2025-01-07T10:12:48Z.",
      "npmDistIntegrity": "sha512-dzNplnn2Nxle2c2i2rrDhqcB19q9cglCkWnoMTDN9Q9l3PvdjZWd1HfSPjCNWc/p8Q3CT+Es9fWOR0UhAeYQZA==",
      "npmTarball": "https://registry.npmjs.org/@ffmpeg/core/-/core-0.12.10.tgz",
      "buildRecipeUrl": "https://github.com/ffmpegwasm/ffmpeg.wasm/blob/71aa99d37c02a7b4c435275ca9ef50e612f6efa1/Dockerfile",
      "upstreamFFmpegVersion": "n5.1.4",
      "upstreamFFmpegCommit": "4729204c17f756e186d622060088371d10b34f7e",
      "wasmWrapperLicense": "MIT for ffmpeg.wasm repository wrapper; does not replace built core GPL license"
    },
    {
      "name": "heic-to",
      "version": "1.5.2",
      "npmUrl": "https://registry.npmjs.org/heic-to/1.5.2",
      "npmLicense": "LGPL-3.0",
      "sourceLicense": "LGPL-3.0-or-later",
      "releaseCommit": "f37af866f9aa6212ddc84b67a279c9f2386aba4f",
      "evidence": "Exact npm gitHead; commit title Bump to v1.5.2; README maps release to libheif 1.22.2.",
      "npmDistIntegrity": "sha512-8Fns+lZHAWmz5U5IUxDeXKwIf3foBoKNPLxxFY4B0MkLjNuomEIHCoDbDE+x/llFK3NCEO1cu4+n3iUKY+Svmw==",
      "npmTarball": "https://registry.npmjs.org/heic-to/-/heic-to-1.5.2.tgz",
      "buildRecipeUrl": "https://github.com/hoppergee/heic-to/blob/f37af866f9aa6212ddc84b67a279c9f2386aba4f/README.md",
      "preferredSources": [
        "libheif 1.22.2",
        "libde265 1.0.16"
      ],
      "documentedBuildFlags": [
        "LIBDE265_VERSION=1.0.16",
        "USE_WASM=0",
        "USE_UNSAFE_EVAL=0 for CSP build"
      ],
      "buildScript": "esbuild.mjs and package-lock.json in source archive"
    }
  ],
  "sources": [
    {
      "name": "ffmpeg-wasm-build",
      "repo": "ffmpegwasm/ffmpeg.wasm",
      "ref": "71aa99d37c02a7b4c435275ca9ef50e612f6efa1",
      "filename": "ffmpeg-wasm-v12.15.tar.gz",
      "license": "Build wrapper MIT; resulting core GPL-2.0-or-later with external codec notices",
      "role": "@ffmpeg/core 0.12.10 release source and build instructions",
      "commit": "71aa99d37c02a7b4c435275ca9ef50e612f6efa1",
      "sourcePageUrl": "https://github.com/ffmpegwasm/ffmpeg.wasm/tree/71aa99d37c02a7b4c435275ca9ef50e612f6efa1",
      "downloadUrl": "https://codeload.github.com/ffmpegwasm/ffmpeg.wasm/tar.gz/71aa99d37c02a7b4c435275ca9ef50e612f6efa1",
      "sizeBytes": 1329368,
      "sha256": "53c5842f160cece0e39345876f9483b56aa84b966637ff6f624353a0fa884219",
      "path": "/tmp/localfile-engine-sources/ffmpeg-wasm-v12.15.tar.gz",
      "modified": false,
      "licenseFiles": [
        "LICENSE"
      ]
    },
    {
      "name": "heic-to",
      "repo": "hoppergee/heic-to",
      "ref": "f37af866f9aa6212ddc84b67a279c9f2386aba4f",
      "filename": "heic-to-1.5.2.tar.gz",
      "license": "LGPL-3.0-or-later per source LICENSE",
      "role": "heic-to 1.5.2 exact npm gitHead",
      "commit": "f37af866f9aa6212ddc84b67a279c9f2386aba4f",
      "sourcePageUrl": "https://github.com/hoppergee/heic-to/tree/f37af866f9aa6212ddc84b67a279c9f2386aba4f",
      "downloadUrl": "https://codeload.github.com/hoppergee/heic-to/tar.gz/f37af866f9aa6212ddc84b67a279c9f2386aba4f",
      "sizeBytes": 5970908,
      "sha256": "9d89de791cf8cc394637dcc74eb39319b9e3c5cff3271abbb4902916a94c785d",
      "path": "/tmp/localfile-engine-sources/heic-to-1.5.2.tar.gz",
      "modified": false,
      "licenseFiles": [
        "LICENSE"
      ]
    },
    {
      "name": "ffmpeg",
      "repo": "FFmpeg/FFmpeg",
      "ref": "n5.1.4",
      "filename": "ffmpeg-5.1.4.tar.gz",
      "license": "LGPL-2.1-or-later base; GPL-2.0-or-later when --enable-gpl (used by this core)",
      "role": "FFmpeg preferred source version from matched build recipe",
      "commit": "4729204c17f756e186d622060088371d10b34f7e",
      "sourcePageUrl": "https://github.com/FFmpeg/FFmpeg/tree/4729204c17f756e186d622060088371d10b34f7e",
      "downloadUrl": "https://codeload.github.com/FFmpeg/FFmpeg/tar.gz/4729204c17f756e186d622060088371d10b34f7e",
      "sizeBytes": 14428595,
      "sha256": "0d7ad57d4dd851d577fc6c19e5cec5b6e5faaeb2dbd52ab76127e3c3763fec6d",
      "path": "/tmp/localfile-engine-sources/ffmpeg-5.1.4.tar.gz",
      "modified": false,
      "licenseFiles": [
        "COPYING.GPLv2",
        "COPYING.GPLv3",
        "COPYING.LGPLv2.1",
        "COPYING.LGPLv3",
        "LICENSE.md"
      ]
    },
    {
      "name": "libheif",
      "repo": "strukturag/libheif",
      "ref": "v1.22.2",
      "filename": "libheif-1.22.2.tar.gz",
      "license": "LGPL-3.0-or-later library; source tree contains component-specific licenses",
      "role": "libheif version explicitly named in heic-to 1.5.2 README",
      "commit": "763bc8bb87788d64d39ece623ceed988de12dc5b",
      "sourcePageUrl": "https://github.com/strukturag/libheif/tree/763bc8bb87788d64d39ece623ceed988de12dc5b",
      "downloadUrl": "https://codeload.github.com/strukturag/libheif/tar.gz/763bc8bb87788d64d39ece623ceed988de12dc5b",
      "sizeBytes": 2006398,
      "sha256": "0a3559b557793d8d634d071ee7181af34f2b69b0d61cd48a0dcdbfe4ea79fc43",
      "path": "/tmp/localfile-engine-sources/libheif-1.22.2.tar.gz",
      "modified": false,
      "licenseFiles": [
        "COPYING"
      ]
    },
    {
      "name": "libde265",
      "repo": "strukturag/libde265",
      "ref": "v1.0.16",
      "filename": "libde265-1.0.16.tar.gz",
      "license": "LGPL-3.0-or-later library; source tree contains component-specific licenses",
      "role": "libde265 version explicitly set in heic-to 1.5.2 build instructions",
      "commit": "7ba65889d3d6d8a0d99b5360b028243ba843be3a",
      "sourcePageUrl": "https://github.com/strukturag/libde265/tree/7ba65889d3d6d8a0d99b5360b028243ba843be3a",
      "downloadUrl": "https://codeload.github.com/strukturag/libde265/tar.gz/7ba65889d3d6d8a0d99b5360b028243ba843be3a",
      "sizeBytes": 439851,
      "sha256": "9dedf12d5b5047c270d1fc54f5d92fc29d9ea21b94d3f2d998200258353189a0",
      "path": "/tmp/localfile-engine-sources/libde265-1.0.16.tar.gz",
      "modified": false,
      "licenseFiles": [
        "COPYING"
      ]
    }
  ],
  "ffmpegRecipeUpstreamRefs": [
    {
      "repo": "ffmpegwasm/x264",
      "ref": "4-cores",
      "recipeVariable": "X264_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/x264/tree/4-cores",
      "exactHistoricalCommitProven": false,
      "floatingRef": true,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/x265",
      "ref": "3.4",
      "recipeVariable": "X265_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/x265/tree/3.4",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/libvpx",
      "ref": "v1.13.1",
      "recipeVariable": "LIBVPX_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/libvpx/tree/v1.13.1",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/lame",
      "ref": "master",
      "recipeVariable": "LAME_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/lame/tree/master",
      "exactHistoricalCommitProven": false,
      "floatingRef": true,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/Ogg",
      "ref": "v1.3.4",
      "recipeVariable": "OGG_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/Ogg/tree/v1.3.4",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/theora",
      "ref": "v1.1.1",
      "recipeVariable": "THEORA_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/theora/tree/v1.1.1",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/opus",
      "ref": "v1.3.1",
      "recipeVariable": "OPUS_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/opus/tree/v1.3.1",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/vorbis",
      "ref": "v1.3.3",
      "recipeVariable": "VORBIS_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/vorbis/tree/v1.3.3",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/zlib",
      "ref": "v1.2.11",
      "recipeVariable": "ZLIB_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/zlib/tree/v1.2.11",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/libwebp",
      "ref": "v1.3.2",
      "recipeVariable": "LIBWEBP_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/libwebp/tree/v1.3.2",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "ffmpegwasm/freetype2",
      "ref": "VER-2-10-4",
      "recipeVariable": "FREETYPE2_BRANCH",
      "sourceUrl": "https://github.com/ffmpegwasm/freetype2/tree/VER-2-10-4",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "fribidi/fribidi",
      "ref": "v1.0.9",
      "recipeVariable": "FRIBIDI_BRANCH",
      "sourceUrl": "https://github.com/fribidi/fribidi/tree/v1.0.9",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "harfbuzz/harfbuzz",
      "ref": "5.2.0",
      "recipeVariable": "HARFBUZZ_BRANCH",
      "sourceUrl": "https://github.com/harfbuzz/harfbuzz/tree/5.2.0",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "libass/libass",
      "ref": "0.15.0",
      "recipeVariable": "LIBASS_BRANCH",
      "sourceUrl": "https://github.com/libass/libass/tree/0.15.0",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "FFmpeg/FFmpeg",
      "ref": "n5.1.4",
      "recipeVariable": "FFMPEG_VERSION",
      "sourceUrl": "https://github.com/FFmpeg/FFmpeg/tree/n5.1.4",
      "exactHistoricalCommitProven": false,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    },
    {
      "repo": "sekrit-twc/zimg",
      "ref": "release-3.0.5",
      "recipeVariable": "ZIMG_BRANCH",
      "sourceUrl": "https://github.com/sekrit-twc/zimg/tree/release-3.0.5",
      "exactHistoricalCommitProven": false,
      "recursiveSubmodules": true,
      "floatingRef": null,
      "selectorType": "git ref from Dockerfile; historical resolution not recorded"
    }
  ],
  "ffmpegAdditionalBuildInputs": {
    "emscriptenDockerImage": "emscripten/emsdk:3.1.40",
    "sdl2": "embuilder build sdl2 sdl2-mt; Emscripten port version not resolved here",
    "aptPackages": [
      "pkg-config",
      "autoconf",
      "automake",
      "libtool",
      "ragel",
      "git"
    ]
  },
  "sourceCompletenessLimitations": [
    "The ffmpeg.wasm release tag proves release association, not a byte-for-byte source-to-binary attestation; npm core metadata contains no gitHead.",
    "The Dockerfile fetches external repositories. In particular x264 4-cores and lame master are floating branches; exact commits used by the 2025 publisher are not recorded. Other named refs also require immutable resolution for a reproducible rebuild.",
    "The five downloaded archives do not include all FFmpeg codec dependency sources. Their original refs and URLs are listed separately. zimg is cloned recursively, so submodule sources also need inclusion for a complete source bundle.",
    "The FFmpeg recipe pins emscripten/emsdk:3.1.40 by tag, not digest, and pulls apt build dependencies without exact versions. It also builds SDL2 via Emscripten ports. Those build inputs are not downloaded here.",
    "heic-to source includes generated libheif JavaScript. The preferred C/C++ sources are the separately downloaded libheif and libde265 archives. Exact build environment is not fully recorded: README uses brew install emscripten and a local llvm-nm path replacement.",
    "heic-to README sets LIBDE265_VERSION=1.0.16 USE_WASM=0. The libheif script defaults AOM and OpenJPEG support off; no evidence reviewed here proves additional optional codecs were enabled in the published bundle.",
    "No byte-identical rebuild or package-binary comparison was performed. These artifacts should be labeled upstream sources and build instructions, not certified complete corresponding source or verified reproducible source.",
    "License notices and source links do not by themselves resolve every distribution obligation. Preserve the exact license grants and copyright notices, and retain the means needed to replace/rebuild applicable LGPL components."
  ],
  "licenseFiles": [
    "GPL-2.0.txt",
    "GPL-3.0.txt",
    "LGPL-3.0.txt",
    "heic-to-LICENSE.txt",
    "ffmpeg-wasm-MIT.txt"
  ],
  "allArchivesUnder25MB": true
}