gramps
4fcf76289c
Store policy 10.2.2 forbids dynamic code inclusion, and this was the only third-party binary the app ever downloaded and ran. It had already failed in production: the pin aged out of BtbN's 14-day retention and the download 404'd on the creator's first real recording attempt (2026-09-01). Bundling kills that failure class permanently and deletes the startup network dependency. - scripts/fetch-ffmpeg.sh populates a gitignored ./ffmpeg from a pinned month-end BtbN LGPL-shared artifact, SHA-256 verified before extraction, idempotent, FFMPEG_ZIP= override. 135 MB of DLLs in git would tax every commit on this 9p tree; the URL + hash are the audit trail LGPL §6 wants. - ytLive.csproj copies ffmpeg\** to output and publish (Always), and a GuardBundledFfmpeg target fails the BUILD if the folder is missing, so a fresh clone finds out before a take rather than during one. - FfmpegLocator loses the downloader, the zip extraction and the %APPDATA%\ytLlive\tools cache. Order is now bundle -> PATH, deliberately inverted: a PATH ffmpeg may be a different major version or a GPL build, and the bundle is what was pinned, license-vetted and tested. A missing bundle throws loudly; the old "found something on disk" path could satisfy a missing bundle with a stale copy, and silent drift is the worst failure mode for a dependency certification inspects. - ffplay.exe (18 MB) is not shipped; nothing calls it. - THIRD-PARTY-NOTICES.txt: "downloads" -> "bundled" throughout, and the stale build tag autobuild-2026-08-09-13-03 — the tag that 404'd — corrected to autobuild-2026-08-31-13-27 with the exact artifact name and archive hash. OpenH264 made precise: compiled INTO avcodec-63.dll, no separate binary. Checked whether other third-party binaries needed bundling: no. e_sqlite3.dll and WebView2Loader.dll already ship via NuGet into runtimes\win-x64\native\, OpenH264 is inside avcodec-63.dll, the rest are managed. Two gaps remain that bundling cannot fix, recorded in the map: the WebView2 Evergreen runtime is a machine prerequisite (TASK 48 item 2), and Velopack's updater downloads and executes, so its teardown is a compliance action. Tests: 16 locator facts, suite 379/379, 0 warnings. The integration test runs the bundled ffmpeg -version, which is the only assertion that proves the sibling libav*.dll resolved — presence checks pass with the DLLs missing and a shared build then fails to start. TheLocatorCarriesNoNetworkCapability keeps 10.2.2 from rotting back. Analysis: TASKS/research-store-certification.md §4.
128 lines
6.8 KiB
Plaintext
128 lines
6.8 KiB
Plaintext
ytLlive — Third-Party Notices
|
|
================================
|
|
|
|
ytLlive is a paid, closed-source product. This file lists every third-party
|
|
component the product distributes, its license, and where to get
|
|
its source, so the LGPL/BSD/MIT obligations are met. Distribution obligations
|
|
are NOT optional: they attach because this product ships these components.
|
|
|
|
Note on FFmpeg (items 1-2): it used to be DOWNLOADED at first run. As of
|
|
TASK 48 item 1 (2026-09-28) it is BUNDLED — the exact pinned build is fetched
|
|
at BUILD time by scripts/fetch-ffmpeg.sh, verified against a SHA-256, and
|
|
shipped inside the package. The product fetches no executable at runtime.
|
|
|
|
If this file changes, update it here AND in the app's About screen (the About
|
|
overlay's licensing panel surfaces this file in-app). See TASKS.md (TASK 4) and
|
|
ai.md ("Licensing — do not violate") for the guardrails — the "never do" list is
|
|
there on purpose.
|
|
|
|
--------------------------------------------------------------------------------
|
|
|
|
1. FFmpeg (dynamic libraries + ffmpeg.exe, LGPL v2.1+)
|
|
Copyright (c) 2000-2026 the FFmpeg developers
|
|
License: GNU Lesser General Public License v2.1 or later
|
|
Home: https://ffmpeg.org/
|
|
Source: https://git.ffmpeg.org/ffmpeg.git
|
|
Used as: the streaming encoder/RTMP subprocess. This product distributes the
|
|
UNMODIFIED binaries; it never links FFmpeg into its own code (it is
|
|
launched as a separate process fed raw frames over a pipe).
|
|
Bundled: ffmpeg.exe, ffprobe.exe and the libav*.dll family, unmodified, in a
|
|
single `ffmpeg\` folder beside the application executable. They are the
|
|
lgpl-SHARED build, so the DLLs must stay siblings of the exe — Windows
|
|
resolves them from the executable's own directory.
|
|
Why LGPL (not GPL): a GPL build (e.g. gyan.dev, or BtbN's "gpl" variant)
|
|
would contaminate this proprietary product. Do NOT use one.
|
|
Why "shared" (not static): LGPL v2.1 §6 requires "relinkable" materials for
|
|
statically-linked libraries. The shared build links dynamically, so
|
|
the user can replace the DLLs — compliance is this notice plus the
|
|
source offer below, with no relink material required.
|
|
Compliance supplied by this product:
|
|
- The license text: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
|
|
- The corresponding source / written offer to obtain it:
|
|
FFmpeg source https://ffmpeg.org/download.html
|
|
Exact binary https://github.com/BtbN/FFmpeg-Builds
|
|
Exact artifact ffmpeg-N-126342-gf88b741dbf-win64-lgpl-shared.zip
|
|
Build tag: autobuild-2026-08-31-13-27 (variant lgpl-shared)
|
|
Archive SHA-256: 46ea6521ed3877689d2ff0bd03640ac2637104415f6237d42625d13408767146
|
|
- The binaries are unmodified and the LGPL notices therein are intact.
|
|
- The SHA-256 above is the integrity record for the bundled copy; it is
|
|
asserted by scripts/fetch-ffmpeg.sh before extraction and re-derivable
|
|
from the artifact URL in that script.
|
|
|
|
2. BtbN FFmpeg-Builds (the build system that produced the bundled binary)
|
|
License: MIT (build scripts + repository) — the produced binaries are
|
|
covered by FFmpeg's LGPL (item 1).
|
|
Home: https://github.com/BtbN/FFmpeg-Builds
|
|
|
|
3. OpenH264 (the H.264 software fallback encoder, libopenh264)
|
|
Copyright (c) 2010-2026 Cisco Systems, Inc. (and contributors)
|
|
License: BSD 2-Clause + Cisco's H.264 patent grant
|
|
Home: https://www.openh264.org/
|
|
Note: Cisco grants the patent license for its own H.264 implementation;
|
|
it is COMPILED INTO avcodec-63.dll in the bundled build above (verified
|
|
2026-09-28: the encoder is registered in that DLL; there is no separate
|
|
openh264 binary to ship). So item 1's LGPL obligations apply to the FFmpeg
|
|
code and Cisco's BSD terms plus its patent grant apply to the OpenH264
|
|
code inside it. This is the product's software H.264 fallback when no
|
|
hardware encoder (NVENC/QSV/AMF) is available — it is deliberately never
|
|
libx264, which would be GPL.
|
|
|
|
4. SQLite (bundled via SQLitePCLRaw's e_sqlite3 native bundle)
|
|
License: public domain (no rights reserved)
|
|
Home: https://www.sqlite.org/
|
|
|
|
5. Microsoft.Data.Sqlite (.NET data provider, statically linked into this app)
|
|
Copyright (c) .NET Foundation and contributors
|
|
License: MIT
|
|
Home: https://github.com/dotnet/efcore
|
|
|
|
6. SQLitePCLRaw (raw SQLite bindings + bundles)
|
|
Copyright (c) 2012-2026 Eric Sink and contributors
|
|
License: Apache-2.0
|
|
Home: https://github.com/ericstj/SQLitePCLRaw
|
|
|
|
7. .NET runtime / WPF / Windows SDK projections, incl.
|
|
System.Security.Cryptography.ProtectedData
|
|
Copyright (c) .NET Foundation and contributors
|
|
License: MIT
|
|
Home: https://github.com/dotnet/
|
|
|
|
8. Simple Icons (bundled SVG logo path data for the social bar, e.g. the
|
|
mastodon/peertube/pixelfed fediverse logos)
|
|
Copyright (c) Simple Icons contributors (public domain dedication)
|
|
License: CC0 1.0 Universal (no rights reserved, no attribution required)
|
|
Home: https://simpleicons.org/
|
|
Source: https://github.com/simple-icons/simple-icons
|
|
Used as: path data compiled into the app's `SocialServiceIcons` so each
|
|
social entry renders the service's real logo. CC0 imposes no
|
|
obligations; it is listed here per this file's "list everything"
|
|
policy.
|
|
|
|
9. NAudio (WASAPI audio capture — loopback + mic)
|
|
Copyright (c) Mark Heath and contributors
|
|
License: MIT
|
|
Home: https://github.com/naudio/NAudio
|
|
Used as: the WASAPI loopback (desktop/game audio) and mic capture sources
|
|
behind the `IAudioSource` seam (TASK 4 ship step 4). MIT imposes
|
|
no source offer; this notice is kept per this file's policy.
|
|
|
|
10. Notification.Wpf + Notification.CoreUI (toast notifications, TASK 24)
|
|
Copyright (c) Platonenkov and contributors
|
|
License: MIT
|
|
Home: https://github.com/Platonenkov/Notification.Wpf
|
|
Used as: the in-window toast area (bottom-right) behind the
|
|
`INotificationService` seam — non-blocking user-facing messages.
|
|
Transitive dependencies (Microsoft.Xaml.Behaviors.Wpf,
|
|
Microsoft.Extensions.DependencyInjection.Abstractions) are MIT,
|
|
covered by item 7's .NET notice policy; this notice is kept per
|
|
this file's "list everything" policy.
|
|
|
|
--------------------------------------------------------------------------------
|
|
|
|
MISCELLANEOUS
|
|
- The full text of every license named above is available at the linked
|
|
canonical locations. The v1 (GA) release MUST additionally bundle the full
|
|
license texts alongside this file (a `licenses/` folder beside it, still
|
|
reachable from the About screen) — TASK 4 requirement 9, a release blocker.
|
|
- No warranty is expressed or implied for any third-party component.
|