# Third-Party Notices and Media Binary Provenance This file describes third-party code shipped by the installable Silo Apple applications. Build and release tools that do not ship in an application bundle are outside its scope. Complete license texts are committed under `iosApp/Resources/OpenSourceLicenses/`. The shared resource source configures them for the iOS, tvOS, and macOS applications, with a local reader under Settings > About > Acknowledgements. That reader opens with Silo's own AGPL notice, `LICENSE`, and `APPSTORE-EXCEPTION.md`, and links the build's source archive when a release lane stamped one (`SiloSourceURL`). Generated-project and built-bundle verification is still required. The authoritative dependency lock is `iosApp/Silo.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved`. ## Shipped package products | Component | Exact revision | Shipped form | License | | --- | --- | --- | --- | | AetherEngine 7.56.0 and upstream `main` through `a6fbf0a1` + Silo subtitle, HLS authorization and playback recovery patches, every optional component off | `af67a2e0b1773560ea43e630e95d949e603adbf0` | Swift package target linked into each host app | LGPL-3.0-only with AetherEngine's Apple Store / DRM exception | | FFmpegBuild 3.12.1 | `9c87af0231fd1403654c14a0e867fe8aa43c5bea` | Nine separately embedded dynamic frameworks | See the component table below | | LibDovi 2.1.0 | `0d7cce1d6836a30d13a3a2326e50a153af53f014` | Static `Dovi.xcframework` linked through AetherEngine | MIT packaging; embedded libdovi is MIT | | Nuke and NukeUI 13.2.0 | `30f7a7e72e0607d304fbf69c799474bd5fb6d1ce` | Swift package targets linked into each host app | MIT | SwiftPM also resolves SMBClient 0.3.1 because AetherEngine publishes an optional `AetherEngineSMB` product. Silo depends only on the `AetherEngine` product. `AetherEngineSMB` and SMBClient are not linked or copied into Silo's app targets, so SMBClient is not a shipped component and its notice is not included here. ## AetherEngine Copyright (C) 2026 Vincent Herbst. AetherEngine is licensed under GNU LGPL version 3 with its upstream Apple Store / DRM exception. Silo builds a published fork revision: upstream release `7.56.0` and upstream `main` through commit `a6fbf0a1`, plus Silo patches for complete native subtitle renditions, source timing after a media reanchor, ASS subtitle routing, refreshable authorization for native HLS, sidecar subtitles and font bundles, and audio-switch tracking. Upstream compiles four optional components only for a host that enables their package traits, noting that they may need third-party patent licenses: `TrueHDObjectAudio` and `DTSXObjectAudio` (TrueHD Atmos and DTS:X object rendering), `DualLayerDolbyVision` (Profile 7 FEL composition) and `DolbyVisionStillReshaping`. The Silo fork leaves all four off, as upstream ships them, so LibTrueHD is neither resolved nor linked, TrueHD Atmos and DTS:X play through the channel bridge, and the TrueHD Atmos and DTS:X Playback setting is hidden. A unit test (`AetherOptionalComponentsTests`) fails if any of them is built in. Raw ASS events stay on the primary local overlay; secondary subtitles, secondary sidecars included, and software PiP receive normalized text, and packaged HLS retains its native text rendition for PiP and AirPlay. These modifications are published under the LGPL at the exact source revision below. The bundled acknowledgements include AetherEngine's complete license and exception plus the GNU GPL version 3 text incorporated by LGPLv3. - Exact source: (engine pull requests: , , , , , , , , , , , , ) - Upstream base: - Rebuild input: `Package.swift` and the source tree at that revision - Bundled texts: `AetherEngine-LGPL-3.0-App-Store-Exception.txt`, `GPL-3.0.txt` The exception permits Apple App Store and TestFlight distribution despite store signing, DRM, and relinking restrictions. It does not waive source-code obligations: the exact-revision link above must stay current for each release, and any downstream modifications must be published under the LGPL. The exact source revision linked above is that publication; keep it public for as long as builds that link this revision are distributed. ## FFmpegBuild and its component libraries AetherEngine's `AetherEngine` product depends on FFmpegBuild's umbrella product. The resolved FFmpegBuild manifest links all of these as separate dynamic frameworks: | Frameworks | Upstream input | License | | --- | --- | --- | | AetherLibavcodec, AetherLibavformat, AetherLibavutil, AetherLibswresample, AetherLibswscale, AetherLibavfilter | FFmpeg `n8.1.3` (currently `1041abdc962f4cc4f394aa8de9dc5236c0c3b9e7`) | LGPL-2.1-or-later | | AetherLibdav1d | dav1d `1.5.4` (currently `54706fc6bc0cdecab7e9593974a4039cc038fca7`) | BSD-2-Clause | | AetherLibzimg | zimg `release-3.0.6` (currently `f819b14e8f39d1282400b0d9543e8ef73c1b2bbd`) | WTFPL-2.0 | | AetherLibzvbi | libzvbi `v0.2.46` (currently `34bb6f660c5c1bacd4a66cc7b22311e4ca3c1ab5`) | LGPL-2.0-or-later, conveyed under LGPL-2.1; `src/ure.c` is MIT | FFmpegBuild 3.0.0 renamed every target, framework bundle, and install name with an `Aether` prefix so the build can coexist with another FFmpeg in the same app. Earlier releases added WMV/ASF and legacy Flash support, the VC-1 parser repair for seeking, and dSYMs for crash symbolication. 3.4.0 added FFmpeg support for the `dav1` (Dolby Vision AV1) MP4 sample entry. 3.5.0 moved to FFmpeg `n8.1.3`, and 3.6.0 enabled the `dts`, `truehd` and `loas` raw demuxers and added a local patch that probes the payload of an MPEG-TS audio PID labelled MPEG-1 audio. 3.7.0 patches the mp4 muxer's `dec3` box so an E-AC-3 track that carries its height channels and Atmos objects in a dependent substream keeps them, and 3.7.1 patches the mp4 muxer so a packet still queued behind a fragment's written samples cannot end that fragment's track early. 3.8.0 adds FFmpeg's native RealMedia, 3GP, Theora, VobSub and DVD LPCM support. 3.9.0 adds a local patch (`patches/dca-xll-x-heights.patch`) that lets FFmpeg's `dca` decoder read the height channels of DTS:X's standard presentation, which AetherEngine uses in place of LibDTSX. 3.10.0 adds FFmpeg's native AAC and ALAC encoders, which pad an audio track that ends before its video. 3.10.1 moves to libzvbi `v0.2.46` for CVE-2026-110654, and 3.10.2 ships a privacy manifest in the frameworks that stat files. 3.11.0 enables the audio filters AetherEngine's audio shaping runs and the `idet`, `fieldmatch` and `decimate` filters for inverse telecine; 3.11.1 adds a local patch (`patches/av1-delayed-rap.patch`) that treats AV1 full-refresh delayed random access points as keyframes. 3.12.0 adds a Matroska `skip_attachments` option (`patches/matroska-skip-attachments.patch`), and the pinned 3.12.1 release adds `patches/matroska-byte-seek-done.patch`, which clears a Matroska end of stream after a byte seek. Every release keeps FFmpeg `n8.1.3`, the same dav1d and zimg sources and the same nine frameworks, with no external codec library. The exact FFmpegBuild 3.12.1 `build.sh` and `patches/` are the rebuild recipe and patch record, and its `BUILD-INFO.txt` records the upstream commits, patch hashes, toolchain, configure lines and binary hashes of the published build: - it builds FFmpeg with dynamic linkage and does not enable GPL, version-3, or nonfree FFmpeg components; - it removes libzvbi's three GPL-family source files (`packet-830.c`, `pdc.c`, and `exp-vtx.c`) before compilation and publishes the LGPL replacement stubs; - it records its FFmpeg, dav1d, zimg, and libzvbi tags and every downstream patch applied to those sources; - it does not build the FFmpeg `concat` demuxer, which 2.5.0 removed. libzvbi 0.2.46 fixes an out-of-bounds write in teletext DRCS conversion (CVE-2026-110654, GHSA-p2vx-rpw8-hp43), reachable through the teletext decoder; 0.2.45 was the GHSA-86rm-g7qf-j2fh update. The commit IDs in the table are the values FFmpegBuild 3.12.1's `BUILD-INFO.txt` records, and match the tags' dereferenced values observed on 2026-09-04 (FFmpeg `n8.1.3` on 2026-10-09). That `BUILD-INFO.txt` names repository HEAD `4eba1217` (the 3.12.0 merge) with `build.sh` or `patches/` differing from it, because the binaries were rebuilt with the byte-seek patch before the 3.12.1 commit; the file's patch hashes identify the applied patch set. FFmpegBuild's script records tag names rather than immutable upstream commit IDs; recording the dereferenced commits here pins them if the tags ever move. Forking the pinned FFmpegBuild revision is cheap, commit-immutable insurance if stronger provenance is ever wanted, but the exact-revision links satisfy the source pointer as they stand. Historical binary inventory (FFmpegBuild 3.0.0): a tvOS Simulator debug build, inspected on 2026-09-04, embedded exactly the nine `Aether`-prefixed frameworks in the table under `SiloTV.app/Frameworks/`. Its `AetherLibavcodec` configure string contained `--enable-shared` without `--enable-gpl`, `--enable-version3`, or nonfree enablement, and the app binary exported no `avcodec_`/`avformat_` symbols of its own. These observations describe that older debug artifact; they are not a binary inventory of the current 3.12.1 dependency. Repeat this inventory against each release archive; debug evidence is not a release substitute. - Exact packaging source and rebuild script: - Current upstream tag resolutions: [FFmpeg](https://github.com/FFmpeg/FFmpeg/tree/1041abdc962f4cc4f394aa8de9dc5236c0c3b9e7), [dav1d](https://code.videolan.org/videolan/dav1d/-/tree/54706fc6bc0cdecab7e9593974a4039cc038fca7), [zimg](https://github.com/sekrit-twc/zimg/tree/f819b14e8f39d1282400b0d9543e8ef73c1b2bbd), and [libzvbi](https://github.com/zapping-vbi/zvbi/tree/34bb6f660c5c1bacd4a66cc7b22311e4ca3c1ab5) - Bundled texts: `FFmpegBuild-LGPL-2.1.txt`, `dav1d-BSD-2-Clause.txt`, `zimg-WTFPL.txt`, `libzvbi-ure-MIT.txt` No GPL-licensed FFmpeg or libzvbi object is expected in this package. That is an evidence statement about this pinned build recipe and inspected binary, not a substitute for a final release archive scan. ## LibDovi and libdovi LibDovi's packaging and rebuild script are MIT licensed, Copyright (c) 2026 Vincent Herbst. Its `Dovi.xcframework` contains the static `dolby_vision` 3.4.0 crate built from dovi_tool tag `libdovi-3.4.0`, exact upstream revision `d1abe0e27ff2c7ab3339614d06db9f8a058af6b2`, under the MIT license, Copyright (c) 2026 quietvoid. As with FFmpegBuild, LibDovi's rebuild script clones the tag name rather than an immutable commit. The commit above is the tag's value observed on 2026-09-04; preserve the actual release source alongside the static library. LibDovi's packaging `LICENSE` describes the embedded crate as dual MIT or Apache-2.0, but the exact `libdovi-3.4.0` source's `LICENSE` and Cargo manifest declare MIT. The bundled files reproduce the packaging license unmodified and also include quietvoid's controlling MIT text; this notice uses MIT for the embedded crate. - Exact packaging source and rebuild script: - Exact embedded crate source: - Bundled texts: `LibDovi-Packaging-MIT.txt`, `libdovi-MIT.txt` ## Nuke and NukeUI Nuke and NukeUI are distributed under the MIT license, Copyright (c) 2015-2026 Alexander Grebenyuk. - Exact source: - Bundled text: `Nuke-MIT.txt` ## ThumbHash decoder Silo includes an adapted copy of the ThumbHash Swift decoder, distributed under the MIT license, Copyright (c) 2023 Evan Wallace. Only the image decode path is retained; Silo adds bounds validation, cross-platform image creation, and a bounded asynchronous cache around the reference algorithm. - Exact source: - Bundled text: `ThumbHash-MIT.txt` ## Runtime attributions These services are not shipped in the app bundle, but the app shows their data or artwork. Settings > About > Acknowledgements lists each one from `ThirdPartyCredits.swift`; add an entry there when the app starts showing another service. - TMDB: rating badges and Requests artwork come from TMDB. Its API terms require the TMDB logo and the notice "This application uses TMDB and the TMDB APIs but is not endorsed, certified, or otherwise approved by TMDB." in an About or Credits section. The logo's provenance is in `iosApp/iosApp/ThirdPartyLogos.xcassets/README.md`. - DiceBear: profile avatar presets load from the DiceBear HTTP API. The default Fun Emoji style is a remix of Davis Uche's Fun Emoji Set under CC BY 4.0, which requires credit. ## Release checklist The dynamically embedded FFmpeg libraries and the statically linked SwiftLibass libraries use different rebuild paths. Before App Store, TestFlight, or other external distribution: 1. verify the release archive embeds the FFmpegBuild libraries as separate dynamic frameworks and does not merge or statically link them into the app binary (the debug-build inventory above is not a release substitute); 2. confirm the revisions in this file and in the bundled acknowledgements match what the release actually resolves in `Package.resolved`; 3. if AetherEngine or any LGPL component was modified, publish the modified source under its license before shipping; 4. publish the matching `Silo-source-.tar.gz` archive, with the app source, pinned Swift packages, SwiftLibass dependency sources, revision manifest, and rebuild instructions, before distributing a binary that links SwiftLibass. ## Local ASS rendering Silo uses SwiftLibass 1.4.0 for libass bindings and SwiftAssRenderer 1.3.1 for image compositing on all three Apple clients. Both Swift packages are MIT. The native libraries are libass 0.17.3 (ISC), Fontconfig 2.15.0, FreeType 2.13.2 (FreeType License), FriBidi 1.0.14 (LGPL-2.1-or-later), HarfBuzz 8.5.0, and libpng 1.6.43. Their full notices are bundled in `OpenSourceLicenses/`. This product uses the FreeType project. The native XCFrameworks contain static `.a` libraries and headers. Silo links the libraries without embedding subtitle framework wrappers or generated stubs. - SwiftAssRenderer source: - SwiftLibass source and binary artifacts: - Rebuild entry point: `build-libraries.sh` at that revision. - Transitive Swift dependencies: Combine Schedulers 1.2.2, Concurrency Extras 1.4.1, and IssueReporting from xctest-dynamic-overlay 1.13.1, all MIT; exact revisions are in `Package.resolved` and their notices are bundled. - The test-only `SiloASSFixture.ttf` is an original rectangular glyph generated by `iosApp/Tests/Fixtures/ASS/generate-font.py`; it is not shipped in the application. ### Source-based relinking FriBidi is statically linked. LGPL 2.1 section 6(a) allows the work that uses the library to be supplied as source code or object code so a recipient can modify the library and relink the application. Silo uses the source-code path; the app is distributed under the repository's AGPL license. The TestFlight and sideload workflows publish a source archive to GitHub Releases before their binary jobs run. TestFlight builds attach it to their `vX.Y.Z-beta.B` prerelease and include its URL in the build's What to Test notes; sideload builds attach it to their `v-build.` release. Earlier TestFlight builds published it under `source-`. External local TestFlight uploads require `SILO_RELEASE_SOURCE_URL` to point to the matching published archive. Other distribution channels must publish these materials and provide their location alongside the binary as well. `scripts/ci/package-release-source.py` captures the committed app tree and every resolved Swift package, plus immutable snapshots of SwiftLibass's six native libraries recorded in `scripts/ci/swift-libass-sources.json`. The archive includes a pinned ffmpeg-kit builder and a local build entry point that skips its destructive checkout step, preserving a recipient's edits. `REBUILD.md` explains how to build and relink through local package overrides. Signing credentials and untracked configuration are excluded. `revisions.json` records source revisions and checksums. SwiftLibass's upstream script clones an unpinned ffmpeg-kit branch. The builder and native source tags recorded here match its documented prebuilt versions; upstream does not publish a manifest establishing byte-for-byte provenance of those prebuilt libraries. The supplied rebuild inputs are pinned independently.