# Enabled FFmpeg dependency source requirements

## Current audit status: source mirror complete

The exact official BtbN dependency-source cache for the external
`win64-lgpl-shared` build is retained in the matching Karuiya source companion.
The strict verifier checks its expected byte length, SHA-256 digest, ZIP
integrity, workflow run, artifact identity and required contents before the
source package can be created.

- BtbN/FFmpeg-Builds workflow run: `30699573846`
- build-script commit: `a99e8230eae00d1cee38f23076a7a1f55cd984e2`
- artifact: `download-cache` / ID `8818410413`
- retained size: `2,019,378,946` bytes
- SHA-256: `b9e17c3a60b2a4c572e6995c20b1feef7b175240ec131a21d373b172707fef2d`

The external CLI used `madler/zlib@e3dc0a85b7032e98380dec011bc8f2c2ee0d8fca`.
That exact dependency is covered by the retained BtbN cache. The separately
listed zlib 1.3.1 archive belongs to Qt Multimedia's preview FFmpeg and is not
represented as the external CLI's zlib source.

The shipped configure output enables independently licensed third-party
libraries in addition to FFmpeg itself. The authoritative dependency source
set is the retained official cache; the authoritative selected options are in
`configure.txt`. Disabled high-risk/non-standard options include
`--disable-libfdk-aac`, `--disable-libx264`, and `--disable-libx265`; the build
has no `--enable-gpl` or `--enable-nonfree`.

## Historical pre-remediation finding

The initial 2026-08-07 staging tree contained the exact FFmpeg and BtbN source
archives but did not yet contain the dependency-source cache. That condition
was remediated on 2026-08-08 before the completed source companion was created.
Any earlier document describing the cache as missing is superseded by the
strict verifier result and `PACKAGE_STATUS.json` in the matching source
companion.

## Remaining release review

Source retention is complete, but each public release must still:

1. preserve the exact source companion and its published SHA-256;
2. keep a machine-readable inventory of enabled dependencies and revisions;
3. include all required copyright and redistribution notices for the final
   binary dependency graph;
4. keep source access available for the retention period stated on the release
   page; and
5. obtain qualified review of licenses, notices and codec-patent exposure.

This engineering record is not legal advice or a certification of compliance.
