# FFmpeg 8.1.2 (build 1783011502) — corresponding source inventory

**Helper binaries covered:** `ffmpeg`, `ffprobe` (one static build, both binaries).
**Build:** martin-riedl.de build server, build id `1783011502`, ffmpeg **8.1.2**.
**Build pipeline:** `git.martin-riedl.de/ffmpeg/build-script` @ commit
`bb1d6db29cee948f9685bcd69e6caf17d960662b` (Apache-2.0). Every pinned library version
below is read from that commit's `version/` directory; the source URLs are the exact
`download …` targets in that commit's `script/build-*.sh` (version substituted).
**License basis:** the binary is built `--enable-gpl --enable-version3` and its banner
declares "version 3 of the License, or (at your option) any later version" → the whole
work is **GPLv3-or-later**, so complete corresponding source is provided under **GPLv3
§6(d)** (hosted next to the binary, free of charge, for as long as the binary is served).

## How the inventory was reconciled

1. `Vendor/ffmpeg -version` gives the exact configure line: **25 `--enable-lib*`
   libraries + `--enable-fontconfig` + `--enable-openssl`** (the non-lib flags
   `--enable-gray --enable-version3 --enable-gpl` carry no external source).
2. Each of those 27 maps 1:1 to a `build-*.sh` in the pinned build-script commit — no
   `--enable-lib*` in the configure line lacks a build script (no "vice versa" strays).
3. **Transitive static libraries** the build script compiles and statically links into
   the ffmpeg/ffprobe binaries, even though they are not their own `--enable-lib*` flag,
   are added: **fribidi** (libass dep), **libogg** (libvorbis + libtheora dep), **zlib**
   (libxml2/freetype/fontconfig/openssl/etc. dep).
4. **Excluded — built by the script's defaults but NOT linked into THIS release binary**
   (proven by the configure line, see "Flagged" below): libbluray, SDL2, libiconv, and
   the pure build tools (nasm, cmake, ninja, pkg-config).

## A. Directly enabled libraries (25 `--enable-lib*` + fontconfig + openssl)

| # | Configure flag | Library | Pinned version | Source tarball URL |
|---|---|---|---|---|
| 1 | `--enable-libxml2` | libxml2 | 2.15.3 | https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.3.tar.xz |
| 2 | `--enable-libfreetype` | FreeType | 2.13.0 | https://download.savannah.gnu.org/releases/freetype/freetype-2.13.0.tar.gz |
| 3 | `--enable-fontconfig` | fontconfig | 2.17.1 | https://gitlab.freedesktop.org/api/v4/projects/890/packages/generic/fontconfig/2.17.1/fontconfig-2.17.1.tar.xz |
| 4 | `--enable-libharfbuzz` | HarfBuzz | 14.2.1 | https://github.com/harfbuzz/harfbuzz/releases/download/14.2.1/harfbuzz-14.2.1.tar.xz |
| 5 | `--enable-libsnappy` | snappy | 1.2.2 | https://github.com/google/snappy/archive/refs/tags/1.2.2.tar.gz |
| 6 | `--enable-libsrt` | SRT | 1.5.5 | https://github.com/Haivision/srt/archive/refs/tags/v1.5.5.tar.gz |
| 7 | `--enable-libvmaf` | libvmaf (VMAF) | 3.1.0 | https://github.com/Netflix/vmaf/archive/refs/tags/v3.1.0.tar.gz |
| 8 | `--enable-libass` | libass | 0.17.4 | https://github.com/libass/libass/releases/download/0.17.4/libass-0.17.4.tar.gz |
| 9 | `--enable-libklvanc` | libklvanc | 1.6.0 | https://github.com/stoth68000/libklvanc/archive/refs/tags/vid.obe.1.6.0.tar.gz |
| 10 | `--enable-libzimg` | zimg | 3.0.6 | https://github.com/sekrit-twc/zimg/archive/refs/tags/release-3.0.6.tar.gz |
| 11 | `--enable-libzvbi` | libzvbi | 0.2.35 | https://sourceforge.net/projects/zapping/files/zvbi/0.2.35/zvbi-0.2.35.tar.bz2/download |
| 12 | `--enable-libaom` | libaom (AV1) | 3.14.1 | https://storage.googleapis.com/aom-releases/libaom-3.14.1.tar.gz |
| 13 | `--enable-libdav1d` | dav1d | 1.5.3 | https://code.videolan.org/videolan/dav1d/-/archive/1.5.3/dav1d-1.5.3.tar.gz |
| 14 | `--enable-libopenh264` | OpenH264 | 2.6.0 | https://github.com/cisco/openh264/archive/v2.6.0.tar.gz |
| 15 | `--enable-libopenjpeg` | OpenJPEG | 2.5.4 | https://github.com/uclouvain/openjpeg/archive/refs/tags/v2.5.4.tar.gz |
| 16 | `--enable-librav1e` | rav1e | 0.8.1 | https://github.com/xiph/rav1e/archive/refs/tags/v0.8.1.tar.gz |
| 17 | `--enable-libsvtav1` | SVT-AV1 | 3.1.2 | https://gitlab.com/AOMediaCodec/SVT-AV1/-/archive/v3.1.2/SVT-AV1-v3.1.2.tar.gz |
| 18 | `--enable-libvpx` | libvpx (VP8/VP9) | 1.16.0 | https://github.com/webmproject/libvpx/archive/v1.16.0.tar.gz |
| 19 | `--enable-libvvenc` | vvenc (H.266) | 1.14.0 | https://github.com/fraunhoferhhi/vvenc/archive/refs/tags/v1.14.0.tar.gz |
| 20 | `--enable-libwebp` | libwebp | 1.6.0 | https://github.com/webmproject/libwebp/archive/refs/tags/v1.6.0.tar.gz |
| 21 | `--enable-libx264` | x264 | master @ `0480cb05` (2025-09-10; core 165 — see "x264 pinning" note) | https://code.videolan.org/videolan/x264/-/archive/0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee/x264-0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee.tar.gz |
| 22 | `--enable-libx265` | x265 | 4.2 | https://bitbucket.org/multicoreware/x265_git/get/4.2.tar.gz |
| 23 | `--enable-libmp3lame` | LAME | 3.100 | https://sourceforge.net/projects/lame/files/lame/3.100/lame-3.100.tar.gz/download |
| 24 | `--enable-libopus` | Opus | 1.6.1 | https://downloads.xiph.org/releases/opus/opus-1.6.1.tar.gz |
| 25 | `--enable-libvorbis` | libvorbis | 1.3.7 | https://ftp.osuosl.org/pub/xiph/releases/vorbis/libvorbis-1.3.7.tar.gz |
| 26 | `--enable-libtheora` | libtheora | 1.2.0 | https://downloads.xiph.org/releases/theora/libtheora-1.2.0.tar.gz |
| 27 | `--enable-openssl` | OpenSSL | 3.6.1 | https://github.com/openssl/openssl/releases/download/openssl-3.6.1/openssl-3.6.1.tar.gz |

## B. Transitive static dependencies (linked in, not their own configure flag)

| Library | Pinned version | Pulled in by | Source tarball URL |
|---|---|---|---|
| fribidi | 1.0.16 | libass | https://github.com/fribidi/fribidi/releases/download/v1.0.16/fribidi-1.0.16.tar.xz |
| libogg | 1.3.6 | libvorbis, libtheora | https://ftp.osuosl.org/pub/xiph/releases/ogg/libogg-1.3.6.tar.gz |
| zlib | 1.3.2 | libxml2, freetype, fontconfig, openssl, x265, … | https://www.zlib.net/fossils/zlib-1.3.2.tar.gz |

## C. FFmpeg itself + build pipeline

| Item | Version / ref | URL |
|---|---|---|
| FFmpeg source | 8.1.2 | https://ffmpeg.org/releases/ffmpeg-8.1.2.tar.bz2 |
| build-script snapshot | commit `bb1d6db29cee948f9685bcd69e6caf17d960662b` | https://git.martin-riedl.de/ffmpeg/build-script/archive/bb1d6db29cee948f9685bcd69e6caf17d960662b.tar.gz |

All recovery URLs are duplicated in machine-readable `SOURCE-URLS.tsv`. The Xiph Foundation's
[official downloads page](https://xiph.org/downloads/) publishes libtheora 1.2.0 at the HTTPS
URL above and publishes SHA-256
`279327339903b544c28a92aeada7d0dcfd0397b59c2f368cc698ac56f515906e`, matching the immutable
`SHA256SUMS` entry.

## Flagged reconciliation notes (build-script builds vs. configure line)

- **libbluray 1.3.3 — built by the script's default (`SKIP_LIBBLURAY=NO`, `build.sh:330-336`)
  but the RELEASE binary omits `--enable-libbluray`** (absent from this build's configure
  line → the martin-riedl macOS/arm64 release invoked the script with `-SKIP_LIBBLURAY YES`).
  Not linked into `ffmpeg`/`ffprobe`, therefore NOT part of corresponding source. Excluded.
- **SDL2 2.32.10 — compiled unconditionally by the script (`build.sh:325-327`) to enable
  the separate `ffplay` binary.** VidConvert ships only `ffmpeg` + `ffprobe`; SDL is not a
  `--enable-lib*` and is not statically linked into them. Excluded.
- **libiconv 1.17 — the script's `build-libiconv.sh` invocation is commented out
  (`build.sh:248`)**, so the build links the macOS system libiconv, not a bundled copy.
  Nothing to ship. Excluded.
- **Build tools nasm 2.16.03, ninja 1.13.2, pkg-config 0.29.2, cmake** — host build tools,
  not linked into the binaries. Their recipes are inside the build-script snapshot; no
  separate tarballs are required for corresponding source. Excluded.
- **No "vice versa" strays:** every `--enable-lib*` in the configure line has a matching
  `build-*.sh`; the configure line does NOT contain the research draft's phantom
  `--enable-libbluray` — settling the earlier "~31 libs incl. libbluray" over-count.

## x264 pinning — RESOLVED (2026-07-14)

**Status: pinned to commit `0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee`.** The moving
`master` placeholder has been replaced by a fixed-commit archive URL in both the table
(item 21) and `fetch-sources.sh`.

x264 upstream ships no version tag; the martin-riedl build script fetches
`…/x264/-/archive/master/x264-master.tar.gz` at build time, so byte-exact corresponding
source requires the commit that was `master` HEAD when build `1783011502` ran.

How the commit was resolved (SOURCES.md "option 2" was attempted first, then the
build-date-window fallback):

- **Banner extraction (option 2) — attempted, insufficient.** Encoding a probe clip with
  the vendored binary
  (`Vendor/ffmpeg … -c:v libx264 -f h264 out.h264`) and reading the x264 SEI user-data
  yields exactly: **`x264 - core 165 - H.264/MPEG-4 AVC codec - Copyleft 2003-2025 - …`**.
  The banner carries **no `r<REV> <shorthash>`** — the martin-riedl pipeline builds x264
  from a `.tar.gz` archive (no `.git`), so `version.sh` embeds no git revision. Option 2
  (pin the commit from the banner hash) is therefore not possible; only `core 165` and the
  `Copyleft 2003-2025` year are available from the binary.
- **Build-date-window fallback (used).** Build id `1783011502` is the build's Unix
  timestamp = **2026-07-02 16:58:22 UTC**. The VideoLAN GitLab API
  (`/api/v4/projects/videolan%2Fx264/repository/commits?ref_name=master&until=2026-07-02T16:58:22Z`)
  returns, as the newest master commit at/before that instant,
  **`0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee`** ("riscv64: add compile support",
  committed 2025-09-10) — with no intervening commits between 2025-09-10 and the build
  date, this was `master` HEAD when the build ran. The `core 165` banner is consistent
  with this commit's era.
- **Archive verified:** `…/x264/-/archive/0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee/x264-0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee.tar.gz`
  returns HTTP 200 and a valid ~1.04 MB gzip tarball (GitLab HEAD reports
  `content-length: 0` because archives are generated on the fly; a full GET confirms the
  content).

**Residual caveat (honest completeness note):** this is a *best-effort exact* pin, not a
proven byte-for-byte match to the tarball the build server actually downloaded. The martin-
riedl build published no x264 commit hash in its artifacts/logs and the binary embeds no
revision, so the strongest available evidence is "newest `master` commit at the build
timestamp." If the martin-riedl build artifacts for build `1783011502` are later recovered
and pin a different commit, update item 21, `fetch-sources.sh`, and this note accordingly.

## Licenses

Full license texts live in `../licenses/` (GPL-3.0, GPL-2.0, LGPL-2.1, AOM Patent
License 1.0). The authoritative per-component license is the license/COPYING file inside
each source tarball above; the whole binary is distributed under **GPLv3-or-later**
because `--enable-gpl` pulls in GPL components (x264, x265, and GPL-licensed filters).
libsvtav1 (item 17) additionally carries the AOM Patent License 1.0 (reproduced in
`../licenses/AOM-Patent-License-1.0.txt`) per its binary-distribution condition.