# Third-party source and replacement manifest

This is the source/replacement index for the native and bundled third-party artifacts checked into this repository. It is deliberately **not** a license grant and does not modify any PolyForm terms. License texts and notices remain in `app/src/main/assets/`, `THIRD_PARTY_LICENSES/`, and the component-specific files named below.

## Exact checked-in artifacts

SHA-256 values below are for the files in this checkout, not for an upstream download. Recompute with `sha256sum <path>` after replacing anything.

| Checked-in file | Role / version recorded by this tree | SHA-256 |
|---|---|---|
| `app/libs/mpvlib.aar` | Standard all-ABI MPV AAR; MPV `f5bcfb195412e0ca733eac2e850879cd3b1ded18` (`v0.41.0-dev-gf5bcfb195`), FFmpeg `n9.0` | `3b8b283a012a996260464e02c31c55f3b5e4058c03f3de93b761f632b7284f09` |
| `app/libs/mpvlib-no-vulkun.aar` | No-Vulkan all-ABI MPV AAR; same MPV/FFmpeg pins as above | `533733375452a760e13c5f46fa3ad49a6280c140843afdac56c310c8220fe8d1` |
| `app/src/main/jniLibs/arm64-v8a/libffmpeg_exec.so` | Standalone FFmpeg helper, arm64-v8a; upstream project labels its FFmpeg line `9.0` | `9085507b0dc32643b4d6d084a7e7d3469ef17907a7ba15c22d3997ed09c932aa` |
| `app/src/main/jniLibs/arm64-v8a/libffprobe_exec.so` | Standalone FFprobe helper, arm64-v8a; upstream project labels its FFmpeg line `9.0` | `d8e929fcb2b3b5a1a7c8dc234f6d98834eaf8ff2ce408a85060a470b243e0bb5` |
| `app/src/main/jniLibs/arm64-v8a/libpython.so` | Embedded CPython runtime, arm64-v8a; application bundle is labelled Python `3.13.12` | `e41982d1d30ec6de8a2e71b4cb46d67849ee00e85a78685064a1573e2d610d90` |
| `app/src/main/jniLibs/armeabi-v7a/libpython.so` | Embedded CPython runtime, armeabi-v7a; bundle labelled Python `3.13.12` | `96baf206e847640175a76774103e765dd23b850a92f95ae3c114aef22bb9130f` |
| `app/src/main/jniLibs/x86/libpython.so` | Embedded CPython runtime, x86; bundle labelled Python `3.13.12` | `87d45c647e5a457be6300bbebca2acb97a8f00a8eb5a365b6b3a97912ae3da5e` |
| `app/src/main/jniLibs/x86_64/libpython.so` | Embedded CPython runtime, x86_64; bundle labelled Python `3.13.12` | `297ca623f33982d4fe4b1425e9981da51b73a15605f844c5db379480df978cd4` |
| `app/src/main/assets/ytdl/python313.zip` | Python standard-library/application bundle used by yt-dlp; labelled Python `3.13.12` | `70a211bcd992c9e82d44bf538033cb96c90ac5164b06dcc4db459c47ab3ca0a4` |

The AARs are **not** the MPVFlow device runtime. The former are imported `mpvlib.aar` / `mpvlib-no-vulkun.aar` artifacts with four ABIs. MPVFlow is rebuilt separately, arm64-only, by `scripts/build-mpvflow-mpv-runtime.sh`; its output is an APK/runtime build product and is not one of the two checked-in AAR hashes above. References to MPV `c1529642089bfebfc928a1c1664638a7a5d219ba` belong to that MPVFlow checkout/cache identity. References to `f5bcfb195412e0ca733eac2e850879cd3b1ded18` belong to the AAR build. Do not substitute one revision for the other.

## Permanent upstream locations and rebuild entry points

* **MPV/libmpv (AAR):** source repository [mpv-player/mpv](https://github.com/mpv-player/mpv), pinned source archive [`f5bcfb195412e0ca733eac2e850879cd3b1ded18.tar.gz`](https://github.com/mpv-player/mpv/archive/f5bcfb195412e0ca733eac2e850879cd3b1ded18.tar.gz). The wrapper/profile source is [Riteshp2001/mpvlibAndroid](https://github.com/Riteshp2001/mpvlibAndroid); the script pins [Standard profile `45b206be0e8d199fbc3a68f9adfc02ed6afccb71`](https://github.com/Riteshp2001/mpvlibAndroid/tree/45b206be0e8d199fbc3a68f9adfc02ed6afccb71) and [No-Vulkan profile `108a82cc09eb38bd6e717b318117408b19a70f8f`](https://github.com/Riteshp2001/mpvlibAndroid/tree/108a82cc09eb38bd6e717b318117408b19a70f8f). Rebuild with [`scripts/build-mpv-lgpl-aar.sh`](https://github.com/ZHINFINITY/Mpv-infinity/blob/3c81ff6109d3f90f298d81805bbcc81824dbf735/scripts/build-mpv-lgpl-aar.sh), which applies [`buildscripts/patches/mpv_video_shaders.patch`](https://github.com/Riteshp2001/mpvlibAndroid/blob/45b206be0e8d199fbc3a68f9adfc02ed6afccb71/buildscripts/patches/mpv_video_shaders.patch), disables MPV GPL/Rubber Band/DVDnav, and runs [`scripts/verify-mpv-aar-lgpl.py`](https://github.com/ZHINFINITY/Mpv-infinity/blob/3c81ff6109d3f90f298d81805bbcc81824dbf735/scripts/verify-mpv-aar-lgpl.py) before replacing an AAR.
* **MPVFlow device runtime:** the build script consumes the separately prepared local checkout at `MPV_SOURCE_DIR` (default `mpv-source`) and the [pinned Android builder](https://github.com/NihilDigit/mpv-android-anvil/tree/1efc82739f6f7034cd63e7ee8b3ec5431df27467) at `MPV_BUILDER_DIR` (default `native-builder`). The MPVFlow workflow/cache pins are `c1529642089bfebfc928a1c1664638a7a5d219ba` for the MPV checkout and `1efc82739f6f7034cd63e7ee8b3ec5431df27467` for the builder. A source archive for the MPV revision is [`c1529642089bfebfc928a1c1664638a7a5d219ba.tar.gz`](https://github.com/mpv-player/mpv/archive/c1529642089bfebfc928a1c1664638a7a5d219ba.tar.gz). Recreate the arm64 runtime only through [`scripts/build-mpvflow-mpv-runtime.sh`](https://github.com/ZHINFINITY/Mpv-infinity/blob/3c81ff6109d3f90f298d81805bbcc81824dbf735/scripts/build-mpvflow-mpv-runtime.sh) and [`scripts/prepare-mpvflow.py`](https://github.com/ZHINFINITY/Mpv-infinity/blob/3c81ff6109d3f90f298d81805bbcc81824dbf735/scripts/prepare-mpvflow.py); it pins libplacebo `0d043c7f6f79cd3687c023454bdacbe615e4d96f` ([archive](https://github.com/haasn/libplacebo/archive/0d043c7f6f79cd3687c023454bdacbe615e4d96f.tar.gz)), glslang `1062752a891c95b2bfeed9e356562d88f9df84ac` ([archive](https://github.com/KhronosGroup/glslang/archive/1062752a891c95b2bfeed9e356562d88f9df84ac.tar.gz)), FFmpeg `n9.0.2` ([archive](https://ffmpeg.org/releases/ffmpeg-9.0.2.tar.xz)), and libbluray `1.4.1` ([archive](https://downloads.videolan.org/pub/videolan/libbluray/1.4.1/libbluray-1.4.1.tar.xz), SHA-256 `76b5dc40097f28dca4ebb009c98ed51321b2927453f75cc72cf74acd09b9f449`). The script also retains the separate LGPL `libudfread` dependency and statically links libbluray as documented by its ELF checks.
* **Standalone FFmpeg/FFprobe helpers:** public provenance is [hzw1199/Android-FFmpeg-Prebuilt](https://github.com/hzw1199/Android-FFmpeg-Prebuilt), specifically its [`ffmpeg-9.0/`](https://github.com/hzw1199/Android-FFmpeg-Prebuilt/tree/main/ffmpeg-9.0) tree and [README](https://github.com/hzw1199/Android-FFmpeg-Prebuilt/blob/main/README.md). The repository documents Android arm64, NDK r28, and `--disable-gpl --disable-nonfree`. The checked-in files are renamed/stripped app `.so` helpers, whereas upstream documents `bin/ffmpeg`, `bin/ffprobe`, and `libffmpeg.so`; this manifest therefore records provenance, **not** a claim that the upstream files are byte-for-byte replacements or that the exact local Android wrapper recipe is recoverable from this repository. Replace only after rebuilding/validating the app's invocation and dynamic-loader contract, and update the hashes.
* **CPython/yt-dlp bundle:** authoritative CPython source is the [Python 3.13.12 release](https://www.python.org/downloads/release/python-31312/) and permanent source archive [`Python-3.13.12.tar.xz`](https://www.python.org/ftp/python/3.13.12/Python-3.13.12.tar.xz) (release-page SHA-256 `2a84cd31dd8d8ea8aaff75de66fc1b4b0127dd5799aa50a64ae9a313885b4593`). The checked-in `libpython.so` files and `python313.zip` are Android/custom bundles, not that source tarball. This tree does not contain a complete CPython Android cross-build recipe or a hash-pinned source-to-bundle mapping; do not claim reproducibility. A replacement must supply its own Android build recipe, standard-library packaging step, ABI coverage, and verification before changing these files.

## Replacement, relink, and debugging rights

For an LGPL-covered binary, replacement means: obtain the corresponding source at the pinned revision/archive, apply the repository's documented patches, rebuild with equivalent configure/Meson options, preserve the library's normal dynamic-link boundary, and ship the modified source and required notices with the app. Validate ABI/API compatibility and update the exact hash table. Do not replace an AAR by merely changing a URL or by relinking against an unknown binary.

LGPL reverse-engineering permissions for **debugging modifications** and the ability to modify and relink the covered library are intentionally preserved. In particular, do not strip away the application's ability to debug, replace, or relink LGPL MPV/FFmpeg/libplacebo/libbluray/libudfread components when distributing a modified app. The AAR verifier and MPVFlow checks are build safeguards, not legal guarantees. The notices alone are insufficient: the source, patches, build instructions, and any required relinkable application material still need to accompany a distribution as required by the applicable LGPL version.

## Distribution checklist and reproducibility limitations

* For each LGPL binary release, keep the corresponding source, local patches, build instructions, and any required relinkable application materials available to recipients under that component's terms. Source does not have to be embedded inside the AAR itself; use a compliant source-distribution method and verify the documented links and revision pins when publishing. The AAR and MPVFlow entry points above identify the repository's native build inputs.
* The helper repository's published layout differs from the app's renamed `.so` helpers, and no exact upstream commit or local rename/strip recipe is recorded here. This limits reproducibility; it does not establish that the upstream source was modified. Verify and retain the corresponding FFmpeg source and any actual modifications when distributing these LGPL helpers.
* The CPython Android libraries/zip are labelled `3.13.12`, but no complete source-to-bundle Android recipe is checked in. CPython's permissive PSF licence requires its notices and applicable attribution to be preserved; it does not impose LGPL-style corresponding-source or relinking obligations. A missing CPython build recipe is a reproducibility limitation, not by itself a PolyForm incompatibility.

This manifest is an acquisition and replacement guide—not a claim that every distributed binary is byte-for-byte reproducible or a legal certification of a particular release. The project's noncommercial restriction applies only to Covered Code; the independent third-party grants and recipients' rights under them remain intact.