MANIFEST - vyds ffmpeg-core 0.12.6 corresponding source
Generated 2026-09-03 by the backend session for board task #506

Each row: source tarball in sources/, its sha256, upstream URL, license.
Full version/commit and resolution-method notes follow the table.

FILE                                                    SHA256                                                          
------------------------------------------------------------------------------------------------------------------------
ffmpeg.wasm-e0d4c62a229ba58ea0c6e6b881e289f2fefe97c4.tar.gz 6f9e1c6891e368c1ded5546f6ff09bacd031f679192d866c731dfd79def4c095
ffmpeg-5.1.4.tar.bz2                                    c3c1e316bf91468738dd0aff6eb1faab409f1edcd34fd1a4213626439bc5d743
ffmpeg-5.1.4.tar.bz2.asc                                ddfda0872792447e8e062c57e040b8b869268b4e3a350e5739717acda6cf263a
freetype2-6a2b3e4007e794bfc6c91030d0ed987f925164a8.tar.gz 09acceb42508c65b7b744cc2ad01d7548868ca57babc39f7683ec3c0f7541e8c
fribidi-f9e8e71a6fbf4a4619481284c9f484d10e559995.tar.gz 65ff6fb1a478c4d90ae16825da8c97b8a63e2674f8a2d6dae8800f89089640ba
harfbuzz-4a1d891c6317d2c83e5f3c2607ec5f5ccedffcde.tar.gz 69ba7c7a42643a3654781242016dd09245cab7353fc2a02cecb710e479c9a881
lame-2badea1974ae36cb8312afe99cff1e6b3b5decee.tar.gz    0d97ba0776988f5730e0ce1fa936e7c5d6836c757993ba55073513fe89cf410a
libass-d149636f502f5774ae1a8fb4c554b122674393b2.tar.gz  5cfe23562fa623a3b209d156ad469aeb2e31f69bf6b256ea737d87d9ed89301d
libogg-bada45718453ac27b56773ae663f7e65112f6a6e.tar.gz  4d61f8dfa248276c42bd5404b1a87ae9d8a0d58791f55e20018c7b39b38d8823
libvorbis-7798164043197d7e33f02de4353ce2aa5b248225.tar.gz 69b87cafe2815d02609886a63b9d4c0b7461e1e2f6ecf3960ede04053da6e96a
libvpx-10b9492dcf05b652e2e4b370e205bd605d421972.tar.gz  12181ed27342415e8b01bf09abfbf1dfa27a6a32f302fb78b48bd70efe50f702
libwebp-ca332209cb5567c9b249c86788cb2dbf8847e760.tar.gz 1676107dc385f9bf6cb4c2b94d4a9359d1fd95ab6309cb587191a742df292fe2
opus-e85ed7726db5d677c9c0677298ea0cb9c65bdd23.tar.gz    c6d574b17d70b8c289d997a8ac81314cf1fd8c52237c421b2ee34e69cea85bf8
theora-7ffd8b2ecfc2d93ae5e16028e7528e609266bfbf.tar.gz  c38e6a3fb19566a44dcb283323c48311dd484f1416f3f34676d3e7fd252dfbc5
x264-33cac6b77d5b9259c552156013a817ab23119612.tar.gz    75434a5a1f2d7d4314821c6054dd300731d69e2fa73314ba4a5ec9df38d4ec80
x265-2bb5520e9596f361bf0ed81b3b8da0d7fd999069.tar.gz    e5254828f5db7bc375d385e31247861d25facee87b43fa2d08ea3ab5569672ab
zimg-e5b0de6bebbcbc66732ed5afaafef6b2c7dfef87.tar.gz    3ab062eff30067799997bc3e911c0108a5b8cbcd6e0ef14053f17ff0ecd0add8
zlib-cacf7f1d4e3d44d871b605da3b647f07d718623f.tar.gz    6d4d6640ca3121620995ee255945161821218752b551a1a180f4215f7d124d45

====================================================================================================
COMPONENT DETAIL
====================================================================================================

Component:  ffmpeg.wasm (build recipe)
Version:    commit e0d4c62a229ba58ea0c6e6b881e289f2fefe97c4 (assigned version 0.12.6 by follow-on commit c3a763857c5e615ae8674715ad5e4f63ff469e9d)
Source URL: https://github.com/ffmpegwasm/ffmpeg.wasm
License:    MIT (wrapper/build scripts; compiled core is FFmpeg's license, see below)
File:       sources/ffmpeg.wasm-e0d4c62a229ba58ea0c6e6b881e289f2fefe97c4.tar.gz
SHA256:     6f9e1c6891e368c1ded5546f6ff09bacd031f679192d866c731dfd79def4c095
Notes:      npm gitHead for @ffmpeg/core@0.12.6; no git tag points at this commit

Component:  FFmpeg
Version:    5.1.4 (tag n5.1.4, commit 4729204c17f756e186d622060088371d10b34f7e)
Source URL: https://ffmpeg.org/releases/ffmpeg-5.1.4.tar.bz2
License:    GPL-2.0-or-later (as built: --enable-gpl, no --enable-version3)
File:       sources/ffmpeg-5.1.4.tar.bz2
SHA256:     c3c1e316bf91468738dd0aff6eb1faab409f1edcd34fd1a4213626439bc5d743
Notes:      official ffmpeg.org release tarball; RELEASE file confirms 5.1.4; GPG-signed by upstream (see .asc)

Component:  FFmpeg release signature
Version:    PGP detached signature for ffmpeg-5.1.4.tar.bz2
Source URL: https://ffmpeg.org/releases/ffmpeg-5.1.4.tar.bz2.asc
License:    n/a (signature file)
File:       sources/ffmpeg-5.1.4.tar.bz2.asc
SHA256:     ddfda0872792447e8e062c57e040b8b869268b4e3a350e5739717acda6cf263a
Notes:      not verified against a keyring in this pass; bundled for others to verify

Component:  freetype2
Version:    ffmpegwasm fork, branch/tag VER-2-10-4 -> commit 6a2b3e4007e794bfc6c91030d0ed987f925164a8
Source URL: https://github.com/ffmpegwasm/freetype2
License:    FTL or GPL-2.0 (dual; freetype allows either)
File:       sources/freetype2-6a2b3e4007e794bfc6c91030d0ed987f925164a8.tar.gz
SHA256:     09acceb42508c65b7b744cc2ad01d7548868ca57babc39f7683ec3c0f7541e8c
Notes:      tag pin

Component:  fribidi
Version:    canonical upstream, tag v1.0.9 -> commit f9e8e71a6fbf4a4619481284c9f484d10e559995
Source URL: https://github.com/fribidi/fribidi
License:    LGPL-2.1
File:       sources/fribidi-f9e8e71a6fbf4a4619481284c9f484d10e559995.tar.gz
SHA256:     65ff6fb1a478c4d90ae16825da8c97b8a63e2674f8a2d6dae8800f89089640ba
Notes:      tag pin; not a fork

Component:  harfbuzz
Version:    canonical upstream, tag 5.2.0 -> commit 4a1d891c6317d2c83e5f3c2607ec5f5ccedffcde
Source URL: https://github.com/harfbuzz/harfbuzz
License:    MIT ("Old MIT")
File:       sources/harfbuzz-4a1d891c6317d2c83e5f3c2607ec5f5ccedffcde.tar.gz
SHA256:     69ba7c7a42643a3654781242016dd09245cab7353fc2a02cecb710e479c9a881
Notes:      tag pin; not a fork

Component:  lame (libmp3lame)
Version:    ffmpegwasm fork, branch master -> commit 2badea1974ae36cb8312afe99cff1e6b3b5decee
Source URL: https://github.com/ffmpegwasm/lame
License:    LGPL-2.0
File:       sources/lame-2badea1974ae36cb8312afe99cff1e6b3b5decee.tar.gz
SHA256:     0d97ba0776988f5730e0ce1fa936e7c5d6836c757993ba55073513fe89cf410a
Notes:      branch ref, no version tags in this fork. Resolution method (legal-approved,
            task #506): resolved to the last commit on branch "master" at or before the
            ffmpeg.wasm build commit's timestamp, 2023-12-25T07:02:32Z. That branch last
            moved 2020-10-29, well before the build date, so the resolved commit
            2badea1974ae36cb8312afe99cff1e6b3b5decee is a documented, reproducible
            best-effort pin (not a cryptographic guarantee the way a tag pin is).

Component:  libass
Version:    canonical upstream, tag 0.15.0 -> commit d149636f502f5774ae1a8fb4c554b122674393b2
Source URL: https://github.com/libass/libass
License:    ISC
File:       sources/libass-d149636f502f5774ae1a8fb4c554b122674393b2.tar.gz
SHA256:     5cfe23562fa623a3b209d156ad469aeb2e31f69bf6b256ea737d87d9ed89301d
Notes:      not a fork; NOT in legal's original component list, confirmed compiled in via --enable-libass

Component:  libogg
Version:    ffmpegwasm fork (Ogg), tag v1.3.4 -> commit bada45718453ac27b56773ae663f7e65112f6a6e
Source URL: https://github.com/ffmpegwasm/Ogg
License:    BSD-3-Clause
File:       sources/libogg-bada45718453ac27b56773ae663f7e65112f6a6e.tar.gz
SHA256:     4d61f8dfa248276c42bd5404b1a87ae9d8a0d58791f55e20018c7b39b38d8823
Notes:      tag pin

Component:  libvorbis
Version:    ffmpegwasm fork, tag v1.3.3 -> commit 7798164043197d7e33f02de4353ce2aa5b248225
Source URL: https://github.com/ffmpegwasm/vorbis
License:    BSD-3-Clause
File:       sources/libvorbis-7798164043197d7e33f02de4353ce2aa5b248225.tar.gz
SHA256:     69b87cafe2815d02609886a63b9d4c0b7461e1e2f6ecf3960ede04053da6e96a
Notes:      tag pin

Component:  libvpx
Version:    ffmpegwasm fork, tag v1.13.1 -> commit 10b9492dcf05b652e2e4b370e205bd605d421972
Source URL: https://github.com/ffmpegwasm/libvpx
License:    BSD-3-Clause
File:       sources/libvpx-10b9492dcf05b652e2e4b370e205bd605d421972.tar.gz
SHA256:     12181ed27342415e8b01bf09abfbf1dfa27a6a32f302fb78b48bd70efe50f702
Notes:      tag pin

Component:  libwebp
Version:    ffmpegwasm fork, tag v1.3.2 -> commit ca332209cb5567c9b249c86788cb2dbf8847e760
Source URL: https://github.com/ffmpegwasm/libwebp
License:    BSD-3-Clause
File:       sources/libwebp-ca332209cb5567c9b249c86788cb2dbf8847e760.tar.gz
SHA256:     1676107dc385f9bf6cb4c2b94d4a9359d1fd95ab6309cb587191a742df292fe2
Notes:      NOT in legal's original component list for #506; confirmed compiled in via --enable-libwebp in the shipped binary

Component:  opus
Version:    ffmpegwasm fork, tag v1.3.1 -> commit e85ed7726db5d677c9c0677298ea0cb9c65bdd23
Source URL: https://github.com/ffmpegwasm/opus
License:    BSD-3-Clause
File:       sources/opus-e85ed7726db5d677c9c0677298ea0cb9c65bdd23.tar.gz
SHA256:     c6d574b17d70b8c289d997a8ac81314cf1fd8c52237c421b2ee34e69cea85bf8
Notes:      tag pin

Component:  theora
Version:    ffmpegwasm fork, tag v1.1.1 -> commit 7ffd8b2ecfc2d93ae5e16028e7528e609266bfbf
Source URL: https://github.com/ffmpegwasm/theora
License:    BSD-3-Clause
File:       sources/theora-7ffd8b2ecfc2d93ae5e16028e7528e609266bfbf.tar.gz
SHA256:     c38e6a3fb19566a44dcb283323c48311dd484f1416f3f34676d3e7fd252dfbc5
Notes:      tag pin

Component:  x264
Version:    ffmpegwasm fork, branch 4-cores -> commit 33cac6b77d5b9259c552156013a817ab23119612
Source URL: https://github.com/ffmpegwasm/x264
License:    GPL-2.0-or-later
File:       sources/x264-33cac6b77d5b9259c552156013a817ab23119612.tar.gz
SHA256:     75434a5a1f2d7d4314821c6054dd300731d69e2fa73314ba4a5ec9df38d4ec80
Notes:      branch ref, no version tags in this fork. Resolution method (legal-approved,
            task #506): resolved to the last commit on branch "4-cores" at or before the
            ffmpeg.wasm build commit's timestamp, 2023-12-25T07:02:32Z. That branch last
            moved 2022-08-22, well before the build date, so the resolved commit
            33cac6b77d5b9259c552156013a817ab23119612 is a documented, reproducible
            best-effort pin (not a cryptographic guarantee the way a tag pin is).

Component:  x265
Version:    ffmpegwasm fork, tag 3.4 -> commit 2bb5520e9596f361bf0ed81b3b8da0d7fd999069
Source URL: https://github.com/ffmpegwasm/x265
License:    GPL-2.0-or-later
File:       sources/x265-2bb5520e9596f361bf0ed81b3b8da0d7fd999069.tar.gz
SHA256:     e5254828f5db7bc375d385e31247861d25facee87b43fa2d08ea3ab5569672ab
Notes:      tag pin

Component:  zimg
Version:    canonical upstream, tag release-3.0.5 -> commit e5b0de6bebbcbc66732ed5afaafef6b2c7dfef87
Source URL: https://github.com/sekrit-twc/zimg
License:    WTFPL-2.0
File:       sources/zimg-e5b0de6bebbcbc66732ed5afaafef6b2c7dfef87.tar.gz
SHA256:     3ab062eff30067799997bc3e911c0108a5b8cbcd6e0ef14053f17ff0ecd0add8
Notes:      not a fork; NOT in legal's original component list, confirmed compiled in via --enable-libzimg. No git submodules at this tag.

Component:  zlib
Version:    ffmpegwasm fork, tag v1.2.11 -> commit cacf7f1d4e3d44d871b605da3b647f07d718623f
Source URL: https://github.com/ffmpegwasm/zlib
License:    zlib License
File:       sources/zlib-cacf7f1d4e3d44d871b605da3b647f07d718623f.tar.gz
SHA256:     6d4d6640ca3121620995ee255945161821218752b551a1a180f4215f7d124d45
Notes:      tag pin; license text embedded in zlib.h header (extracted)

====================================================================================================
COMPONENTS CONFIRMED ABSENT (documented negative)
====================================================================================================

fdk-aac: ABSENT from this build (confirmed via the binary's configure line); no source
obligation. The configure invocation embedded in ffmpeg-core.wasm (see README.txt, CORE
VERSION AND HOW IT WAS IDENTIFIED) carries no --enable-libfdk-aac flag. Recorded here so
no future auditor has to re-derive this.
