vyds - GPLv2 Section 3 corresponding source
FFmpeg WebAssembly core (@ffmpeg/core 0.12.6)
=============================================

Assembled: 2026-09-03
Task: board #506 (backend session, labels: legal, licensing)
Contact for source requests: [LEGAL TO SUPPLY - e.g. legal@vyds.io or a mailing
  address]

AUTHORITATIVE SOURCE POINTER
-----------------------------
The shipped @ffmpeg/core 0.12.6 binary was built from ffmpeg.wasm commit
e0d4c62a229ba58ea0c6e6b881e289f2fefe97c4, verified against the configure
line embedded in the binary itself (see CORE VERSION AND HOW IT WAS
IDENTIFIED below). This commit is the authoritative source reference for
this archive. The repository's v0.12.6 git tag points at an OLDER core
build and does NOT correspond to the shipped binary; it must not be used
as a source pointer for this product.

WHAT THIS IS
------------
vyds distributes a WebAssembly build of FFmpeg ("ffmpeg-core.wasm" plus its
JavaScript loader "ffmpeg-core.js") produced by the ffmpegwasm/ffmpeg.wasm
project as npm package @ffmpeg/core, version 0.12.6. The FFmpeg build inside
this binary is compiled with --enable-gpl and links x264 and x265 (both
GPL-2.0-or-later), which makes the combined work's effective license
GPL-2.0-or-later. GPLv2 Section 3 requires that anyone who distributes GPL
object code either (a) accompany it with the complete corresponding machine-
readable source, or (b) accompany it with a written offer, valid for at least
three years, to provide that source on request for no more than the cost of
performing the distribution.

This archive is the corresponding source for that binary: the exact upstream
source of FFmpeg and of every library statically linked into it, matched to
the precise commit that produced the bytes vyds ships, plus the ffmpeg.wasm
build recipe (Dockerfile and build/*.sh scripts) needed to reproduce the
build.

WRITTEN OFFER AND SOURCE AVAILABILITY

This archive is the complete corresponding source code for the FFmpeg-derived
components that Vyds LLC ("vyds") distributes in binary form in the vyds Chrome
extension and the vyds desktop application for macOS and Windows.

The binary these sources correspond to is the compiled WebAssembly core
identified in MANIFEST.txt, built from ffmpeg.wasm commit
e0d4c62a229ba58ea0c6e6b881e289f2fefe97c4. It includes FFmpeg and other
components licensed under the GNU General Public License, version 2 or later.

This source is published at https://vyds.io/oss-source and remains available
there for as long as vyds distributes the corresponding binaries.

Separately, and independently of that publication, Vyds LLC offers to any third
party, for three years from the date vyds last distributed the corresponding
binary, a complete machine-readable copy of the corresponding source code on a
medium customarily used for software interchange, for no more than the cost of
physically performing the distribution. To request a copy, write to
legal@vyds.io.

Nothing in this offer limits any right granted by the applicable licenses.

WHICH VYDS PRODUCTS THIS COVERS
--------------------------------
Both of the following ship the byte-identical ffmpeg-core.wasm (sha256
2390efa7fb66e7e42dbae15427571a5ffc96b829480904c30f471f0a78967f61, verified by
this session against both files on origin/main):
  - Chrome extension: lib/ffmpeg/ffmpeg-core.wasm + ffmpeg-core.js
    (used by trim/ and offscreen/ for local trim/stitch with -c copy)
  - Desktop app (macOS + Windows): desktop/frontend/lib/ffmpeg/ffmpeg-core.wasm
    + ffmpeg-core.js (used by the in-app trim editor)

Not covered by this archive: the desktop app's native ffmpeg subprocess
(macOS: user's own Homebrew install, nothing bundled; Windows: BtbN's
prebuilt gpl ffmpeg.exe fetched at build time - see
desktop/scripts/fetch-ffmpeg-windows.ps1 and board task #504) and vyds's
server-side ffmpeg-static dependency (web/package.json, GPL-3.0, used only in
the Vercel cron worker, never distributed to a user device, so GPL source
obligations do not attach to it).

CORE VERSION AND HOW IT WAS IDENTIFIED
----------------------------------------
- Shipped: @ffmpeg/core 0.12.6 (confirmed byte-for-byte: this session
  downloaded the @ffmpeg/core@0.12.6 npm tarball and its dist/umd and
  dist/esm ffmpeg-core.wasm files hash identically to both files vyds ships).
- FFmpeg version compiled in: 5.1.4 (read from the RELEASE file in the
  official ffmpeg.org 5.1.4 release tarball, and matches the "n5.1.4"
  FFMPEG_VERSION pinned in the build commit below).
- Effective build license: GPL-2.0-or-later. The full configure invocation is
  embedded as a literal string in ffmpeg-core.wasm:
    --target-os=none --arch=x86_32 --enable-cross-compile --disable-asm
    --disable-stripping --disable-programs --disable-doc --disable-debug
    --disable-runtime-cpudetect --disable-autodetect --nm=emnm --ar=emar
    --ranlib=emranlib --cc=emcc --cxx=em++ --objcc=emcc --dep-cc=emcc
    --extra-cflags='-I/opt/include -O3 -msimd128'
    --extra-cxxflags='-I/opt/include -O3 -msimd128' --disable-pthreads
    --disable-w32threads --disable-os2threads --enable-gpl --enable-libx264
    --enable-libx265 --enable-libvpx --enable-libmp3lame --enable-libtheora
    --enable-libvorbis --enable-libopus --enable-zlib --enable-libwebp
    --enable-libfreetype --enable-libfribidi --enable-libass --enable-libzimg
  --enable-version3 is absent, so this is GPL-2.0-or-later, not GPL-3 and not
  LGPL (x264/x265 are GPL-2.0-or-later, which sets the floor).

IMPORTANT CORRECTION TO THE ORIGINAL BOARD CARD
--------------------------------------------------
Card #506 suggested finding "the exact tag for core 0.12.6" (e.g. a tag like
v0.12.x). That tag does not exist. ffmpegwasm/ffmpeg.wasm is a monorepo where
each package (@ffmpeg/ffmpeg, @ffmpeg/core, @ffmpeg/util) is versioned and
released independently by changesets; git tags are repo-wide snapshots taken
at release time and do NOT track each package's own version number. Tag
"v0.12.6" exists in the repo, but at that tag packages/core/package.json
says version "0.12.3" and its Dockerfile has no --enable-libzimg - it is the
wrong commit for this purpose.

This session instead resolved the exact source commit two ways and cross-
checked them: (1) npm registry metadata for @ffmpeg/core@0.12.6 records
gitHead e0d4c62a229ba58ea0c6e6b881e289f2fefe97c4; (2) downloading that
commit's source shows FFMPEG_VERSION=n5.1.4 and a --enable-libzimg build
flag, exactly matching what is embedded in the shipped wasm binary, which is
the strongest possible confirmation (byte-identical output). The very next
commit on the repo, c3a763857c5e615ae8674715ad5e4f63ff469e9d (25 minutes
later), is titled "Release v0.12.10 | v0.12.6" and only touches package.json
version fields, CHANGELOGs and demo apps - it is the changesets version-bump
commit that assigned the number "0.12.6" to the tree already built at
e0d4c62a2. Both commits describe the same source; this archive uses
e0d4c62a229ba58ea0c6e6b881e289f2fefe97c4 as the addressed commit since it is
the one GitHub's release page and the npm gitHead both point back to.

CONTENTS OF THIS ARCHIVE
--------------------------
  README.txt          - this file
  MANIFEST.txt         - every component: version/commit, upstream URL,
                         sha256, license
  LICENSES/            - GPL-2.0 and LGPL-2.1 text, plus each component's own
                         license file(s) copied verbatim from its source tree
  sources/             - one source tarball per component (see MANIFEST.txt)

A NOTE ON THE FORKED DEPENDENCIES
------------------------------------
ffmpegwasm builds against its own forks of x264, x265, libvpx, lame, libogg,
theora, opus, libvorbis, zlib and libwebp (github.com/ffmpegwasm/<name>),
not vanilla upstream, because the wasm/emscripten build needs small patches
these forks carry. This archive mirrors what the build's Dockerfile actually
names, so anyone rebuilding from this archive gets the same source the
binary was actually produced from. freetype2 is also pulled from an
ffmpegwasm fork; fribidi, harfbuzz, libass, zimg and FFmpeg itself are
pulled directly from their canonical upstream repositories (unforked).

Two of the pinned refs are branches, not tags (x264 "4-cores" and lame
"master"), so there is no single immutable version number for them. This
session resolved each to the newest commit on that branch at or before the
ffmpeg.wasm build commit's timestamp (2023-12-25T07:02:32Z), which is the
best available approximation of what the Docker build actually fetched at
build time; both branches turned out to be untouched for well over a year
before that date (x264 "4-cores" last changed 2022-08-22, lame "master" last
changed 2020-10-29), so this is very unlikely to be wrong, but it is not a
cryptographic guarantee the way a tag pin is. See MANIFEST.txt for the exact
resolution method used per component.
