REDA APPS AUDIO TOOLS v1.1.0 - CORRESPONDING SOURCE AND BUILD
=================================================================

Runtime provenance
------------------
The shipped codec is the official npm @ffmpeg/core 0.12.10 single-thread UMD
release: https://registry.npmjs.org/@ffmpeg/core/-/core-0.12.10.tgz
The NPM SHA-512 integrity value and original JavaScript/WASM SHA-256 values are
in SOURCE_MANIFEST.json. The JavaScript is unmodified. Concatenate part1.bin and
part2.bin in that order to recover the unmodified upstream WASM. The worker and
application adapters are provided as ordinary JavaScript in this deployment.

The executed binary reports FFmpeg 5.1.4, Emscripten 3.1.40 (commit
5c27e79dd0a9c4e27ef2326841698cdd4f6b5784), GPL v2 or later, and the linked
libraries/configuration preserved in source-rebuild-tools-v1.0.0.tar.gz.

Sources supplied alongside the runtime
-------------------------------------
Download every archive linked by SOURCE_INDEX.html. SOURCE_MANIFEST.json lists
the source archives, exact official upstream/fork commit, original recipe ref,
download URL and SHA-256 checksum. The full original sources and upstream
licence files are retained, including tests and optional files not linked.
HarfBuzz and Emscripten are losslessly recompressed as .tar.xz to stay below
the hosting limit. All other source archives are upstream codeload .tar.gz.

The build/binding archive is the official ffmpeg.wasm tag v12.15, whose core
package version is 0.12.10. Its Dockerfile, Makefile, build/, src/bind/ and
src/fftools/ files were verified byte-for-byte against the last upstream commit
before NPM publication (4ace9e8a702cfc72d8958046d4e169ee0c174c10). Only the core
package version field differs (0.12.9 versus 0.12.10). The mutable x264/x265/lame
fork branches resolve to commits unchanged since before that release; all
other dependencies use the recipe's named release refs. See each manifest
entry's resolution and commit date.

SDL2 2.24.2 is the exact SDL port used by Emscripten 3.1.40's -sUSE_SDL=2.
The full Emscripten 3.1.40 tree includes the runtime JavaScript and linked system
library sources. LLVM/Clang, Docker and base-image operating-system packages
are general build-tool prerequisites, rather than modifications to this codec.
The zimg googletest submodule is included at its exact gitlink commit.

Prepare and rebuild (Linux or a Linux Docker environment)
-------------------------------------------------------
1. Install Python 3.12 or newer and Docker with buildx support. Allow enough
   disk space for the source trees and Docker build layers (several GB).
2. Extract source-rebuild-tools-v1.0.0.tar.gz into a working directory. Keep
   SOURCE_MANIFEST.json and all 20 source archives in a separate ARCHIVES folder.
3. Verify the supplied archive checksums without changing files:
      python prepare-source.py --archives /path/to/ARCHIVES
4. Prepare a NEW, nonexistent build-context directory:
      python prepare-source.py --archives /path/to/ARCHIVES --output /path/to/new-context
   The helper performs no downloads and never deletes or overwrites an existing
   build context. The original Dockerfile, Makefile and build scripts are kept.
   Dockerfile.local uses the supplied pinned sources instead of mutable network
   Git clones, including a local SDL port and the exact zimg test submodule.
5. In that new build context run:
      docker buildx build -f Dockerfile.local --build-arg FFMPEG_ST=yes --build-arg "EXTRA_CFLAGS=-O3 -msimd128" -o ./rebuilt-core .
   This is the single-thread production configuration of upstream `make prd`.
   Docker may download emscripten/emsdk:3.1.40 and operating-system/build packages.
   It uses the unchanged upstream compilation scripts and configuration.
   The source snapshot of Emscripten is included for inspecting/rebuilding the
   runtime and system libraries; the base image already supplies that version.
6. Output UMD and ESM core files appear in rebuilt-core/dist/. For this app use
   the UMD ffmpeg-core.js and ffmpeg-core.wasm. If replacing the codec, split the
   new WASM into chunks no larger than 20 MiB and update the application loader's
   part filenames/byte totals and this source provenance together.

This package supplies source and build instructions; a complete Docker rebuild
has not been run on the release workstation. Matching source/configuration is
verified, but no byte-for-byte reproducible-build claim is made. Docker image
digests, OS package versions and build timestamps can affect generated bytes.

Deployment
----------
Keep SOURCE_INDEX.html, this document, SOURCE_MANIFEST.json, notices and every
source archive in the same static deployment directory as the codec. Source
downloads are ordinary same-origin files and do not upload or process user
audio. These files are not needed to edit audio, but accompany the distributed
GPL codec so recipients can obtain its corresponding source and modify it.