# Open-source audit — Video to GIF / 2026-10-22

## Exact bundled runtime

- `@ffmpeg/ffmpeg` **0.12.15**, MIT. Copied ESM wrapper compared to official npm 0.12.15 (classes.js identical). Official metadata included.
- `@ffmpeg/core` **0.12.10**, GPL-2.0-or-later. Both ESM core JS and WASM match the official npm archive. Actual engine: FFmpeg 5.1.4, Emscripten 3.1.40, single thread, `--enable-gpl`, libx264 and libx265 enabled.
- WASM SHA-256: `9f57947a5bd530d8f00c5b3f2cb2a3492faa7e5d823315342d6a8656d0a6b7b7`.
- No other external application library, CDN, fonts, analytics or paid service. Unused @ffmpeg/util has been removed from this fourth tool only.
- App HTML/CSS/JS are supplied in readable form. Existing Software Kingdom visual assets/styles are reused locally.

## Linked dependencies

The following upstream license texts were retrieved and included. Versions/branches in `upstream-Dockerfile` are upstream recipe evidence, not a claim that every historical dependency commit has been reconstructed from this binary.

| Component | License family | Included text |
|---|---|---|
| FFmpeg (GPL build) | GPL v2 or later; base LGPL v2.1+ | GPL-2.0.txt, LGPL-2.1.txt, ffmpeg-LICENSE.md |
| ffmpeg JS wrapper | MIT | wrapper-MIT.txt |
| x264, x265 | GPL v2 or later (open-source option) | x264.txt, x265.txt |
| LAME | LGPL v2 or later | lame.txt |
| libvpx | BSD-style | libvpx.txt |
| Ogg, Theora, Vorbis | BSD-style | ogg.txt, theora.txt, vorbis.txt |
| Opus | BSD-style, associated patent terms | opus.txt |
| zlib | zlib | zlib.txt |
| WebP | BSD-style | libwebp.txt |
| FreeType | FTL / GPL dual option; FTL text retained | freetype.txt |
| FriBidi | LGPL v2.1+ | fribidi.txt |
| HarfBuzz | Old MIT and per-file notices | harfbuzz.txt |
| libass | ISC | libass.txt |
| zimg | WTFPL (upstream COPYING) | zimg.txt |
| Emscripten toolchain/runtime | MIT / University of Illinois-NCSA and included third-party terms | emscripten.txt |

## Corresponding source provision (updated after initial test)

The exact core release source is ffmpeg.wasm commit `71aa99d37c02a7b4c435275ca9ef50e612f6efa1` (2025-01-07), not the older tag `v0.12.10`. The full release source, all 16 linked-library source snapshots, the zimg GoogleTest submodule, SDL2 2.24.2, and Emscripten 3.1.40 source are now supplied in `sources/ffmpeg-corresponding-source.zip`.

The source bundle contains full per-file notices, license/PATENTS files, exact commit/hash manifest, original Dockerfile/Makefile/bindings, an inspected build guide, source-preparation script, and a local-source Dockerfile. Source preparation has passed. x264 and LAME branch tips predate the release; recipe tags and binary build configuration were cross-checked. All wrapper ESM files match npm 0.12.15; core JS/WASM match npm 0.12.10.

Additional dependencies: SDL2 (zlib license), GoogleTest (BSD-3-Clause; zimg test dependency, not a GIF runtime requirement), and Emscripten bundled runtime/system-library notices are preserved in their complete source trees. Existing upstream library copyright notices have not been replaced by the wrapper's MIT notice.

The page footer links to a visible license/source page and a same-directory complete source download. If publishing the binary in future, retain the corresponding-source download with equivalent access alongside the binary and preserve all notices; a general GitHub homepage link alone is not our source-provision mechanism. No three-year source-offer promise is invented.

**Verification boundary:** this host has no available Docker/emcc. Clean compilation and bit-for-bit reproducible-build comparison were not executed. Complete upstream source material, archive checksums, source preparation, and upstream build-command correspondence were verified; this is a technical inventory and source-access implementation, not a legal certification. The tool remains noindex/local-test-only and has not been published. A production release must explicitly review outstanding test/rebuild gates.

Sources:
- https://registry.npmjs.org/@ffmpeg/core/0.12.10
- https://registry.npmjs.org/@ffmpeg/ffmpeg/0.12.15
- https://github.com/ffmpegwasm/ffmpeg.wasm/commit/71aa99d37c02a7b4c435275ca9ef50e612f6efa1
- https://ffmpeg.org/legal.html
- `license-retrieval.json` gives the retrieved dependency-license URLs; the exact corresponding source trees and all their per-file notices are in the source download.