# Third-party licenses and corresponding source

Original Fileloom source is GPL-3.0-or-later, as stated in `LICENSE`. This does not relicense bundled third-party libraries, engines, fonts, or models. `public/dependency-information.json`, `public/THIRD_PARTY_NOTICES.txt`, and `public/licenses/` are generated from installed lockfile packages during the build and copied to `dist/`.

The media wrapper `@ffmpeg/ffmpeg` 0.12.15 is MIT. The bundled single-threaded `@ffmpeg/core` 0.12.10 identifies its license as GPL-2.0-or-later and includes FFmpeg and enabled codec libraries. The original published WASM is unmodified except for splitting. `wasm-manifest.json` records original size/hash and every chunk size/hash; the browser and build verify byte-identical concatenation. Do not label this binary as covered only by the wrapper license or a general application license.

The core package release is associated with upstream commit `71aa99d37c02a7b4c435275ca9ef50e612f6efa1`, whose package change releases core 0.12.10 on 2025-01-07. `third-party-sources/` includes its complete source archive, Dockerfile/build scripts, dependency source archives, and a checksum manifest. `scripts/fetch-corresponding-source.mjs` records immutable archive URLs and SHA-256 values. It can reacquire those materials during development. The application never runs this tool.

The upstream Dockerfile uses Emscripten 3.1.40 and FFmpeg n5.1.4, with x264, x265, libvpx, LAME, Ogg, Theora, Opus, Vorbis, zlib, libwebp, FreeType, FriBidi, HarfBuzz, libass, and zimg. Source archives include their own license notices. The general-purpose Emscripten toolchain is obtained from the upstream Docker build. Preserve all upstream license and copyright files when rebuilding.

The earlier source-provenance blocker is resolved by a recorded public-source audit and complete source delivery. `third-party-sources/manifest.json` schema 2 pins 20 source archives and the evidence files that support the mapping. The original two branch references were investigated rather than silently promoted to release tags: x264 `4-cores` points to `33cac6b77d5b9259c552156013a817ab23119612` (2022-08-22), and LAME `master` points to its sole root commit `2badea1974ae36cb8312afe99cff1e6b3b5decee` (2020-10-29). Current public tips equal the publication-time tips and have no reachable commits after the 2025-01-07 package publication. Public history and immutable archives are retained. This establishes the available upstream source mapping; it does not assert that an upstream branch could never have been force-pushed.

The audit verifies the npm registry ECDSA signature with the public key valid at publication, the exact lockfile SHA-512 package integrity, and all four published core JavaScript/WASM files against the installed package. The original npm tarball is retained, so offline verification hashes those actual tarball bytes and compares its extracted members with the installed files; it does not merely trust a saved list of file hashes. The shipped WASM identifies FFmpeg 5.1.4, compiler 3.1.40 commit `5c27e79dd0a9c4e27ef2326841698cdd4f6b5784`, GPL configuration, disabled pthreads and the expected enabled libraries. `node scripts/verify-ffmpeg-provenance.mjs` repeats this audit entirely offline, including real version/build/license commands. Registry signing proves package identity and integrity, not a source-build attestation.

The source closure now also includes Emscripten at that exact compiler commit, SDL2 release 2.24.2 verified against the compiler port's original SHA-512, and zimg's pinned Googletest submodule. SDL2 is linked by the upstream `-sUSE_SDL=2` command; its source was missing from the earlier 17-archive bundle. Googletest is included for the original recursive checkout, but is not linked into the converter. The general-purpose compiler binary and ordinary operating-system build tools are obtained separately. Their source licenses and the supplied compiler runtime sources remain separate from the application license.

The production source page offers an explicit same-origin download of the complete FFmpeg corresponding-source ZIP, including all archives, licenses, original scripts, evidence and an archive-pinned Docker recipe. Its parts are at most 8 MiB, verified individually and after reconstruction. This optional download is excluded from automatic service-worker caching. The compact editable application ZIP remains available separately and includes the reviewed acquisition manifest and verifier; the full local release source ZIP includes the source archives directly. No remote repository is invented or needed to obtain the source from a complete production build.

This resolves the engineering source-identity, completeness and availability requirement. A signed upstream build attestation and a byte-identical recompilation are not claimed. The [GNU GPL FAQ](https://www.gnu.org/licenses/gpl-faq.en.html#MustSourceBuildToMatchExactHashOfBinary) explains that corresponding source does not have to reproduce an identical binary hash. No independent legal opinion is claimed. The actual upstream-core compilation remains Unverified on this Windows host because Docker, Podman and a Linux subsystem are unavailable; that is distinct from the verified, byte-reproducible Fileloom application build. See `third-party-sources/REBUILD.md` for the source-pinned recipe, its build-tool boundary and honest validation scope.

Noto Sans Regular is vendored under SIL OFL 1.1. `vendor/fonts/source.json` records the exact revision, source URL, and SHA-256. The original OFL text is supplied unchanged in `vendor/fonts/OFL.txt` and copied into build notices. Font output documents are not relicensed by the OFL. Tesseract code and PDF.js retain Apache-2.0. The English data npm package metadata declares MIT for its packaging, while the underlying Tessdata model source is Apache-2.0; both the packaging metadata and model license are retained. `vendor/licenses/` includes missing upstream wrapper/fontkit/model license texts and immutable source references. Other library licenses appear in the generated dependency inventory.

If publishing a source repository, include `third-party-sources/manifest.json`, this document, the source acquisition script, all source archives needed for the chosen redistribution route, and the corresponding license texts. Serve the full source materials through a real repository or downloadable archive; do not invent a repository address or rely only on a bare homepage link.