# FFmpeg 9.0 commercial corresponding-source inventory

This source set rebuilds Neocodec's arm64 commercial/default `ffmpeg` and `ffprobe`
helpers. It intentionally contains only source code compiled into that helper pair plus the
official FFmpeg signing material used to authenticate the upstream release.

| Component | Exact pin | Upstream archive |
|---|---|---|
| FFmpeg | 9.0 (`n9.0`, “Lei”) | `ffmpeg-9.0.tar.xz` |
| x264 | `0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee` | `libs/x264-0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee.tar.gz` |
| SVT-AV1 | 3.1.2 | `libs/SVT-AV1-3.1.2.tar.gz` |
| libvpx | 1.16.0 | `libs/libvpx-1.16.0.tar.gz` |
| Opus | 1.6.1 | `libs/opus-1.6.1.tar.gz` |

`SHA256SUMS` pins every archive and the FFmpeg detached-signature inputs.
`SOURCE-URLS.tsv` records immutable HTTPS recovery locations. Run `fetch-sources.sh
--verify` for an offline inventory/checksum gate or `fetch-sources.sh --fetch` to recover
the full set into a fresh staging tree before promotion.

The FFmpeg archive was independently authenticated with the official release key. Run
`verify-ffmpeg-signature.sh`; it imports the included key into a disposable GnuPG home,
requires fingerprint `FCF986EA15E6E293A5644F10B4322F04D67658D8`, and verifies the detached
signature. The signature timestamp, `1785797913` (2026-08-03 UTC), is also the build and
archive `SOURCE_DATE_EPOCH`.

The build does not extract or compile x265. It disables FFmpeg's HEVC VideoToolbox encoder
and native HEVC decoder. Apple system libraries and the host build tools are excluded under
the normal system/build-tool boundaries; they are not copied or statically linked into the
helpers.
