Homie media runtime — corresponding source for FFmpeg 9.0.1 (macOS, arm64)
==========================================================================

This directory is the complete corresponding source for the ffmpeg and
ffprobe executables Homie ships at runtime/dependencies/ffmpeg/bin inside
every macOS release. The build enables libx264, so the executables are
distributed under GPL-2.0-or-later. --enable-nonfree is never used.

Shipped executables (Developer ID signed, arm64-only, macOS 14.0+):
  bin/ffmpeg   25252752 bytes  sha256 182771dfa481fd04cfc1310dd48b5ce5f59532ca8fabbb137cf620789bf608a0
  bin/ffprobe  25062112 bytes  sha256 8e3fb61d2fe070eb6cc6460f74266671d648559e72f31e4756f4eeaf51adfe92

What ffmpeg -version reports:
  ffmpeg version 9.0.1
  built with Apple clang version 17.0.0 (clang-1700.6.4.2)
  configuration: --enable-gpl --enable-libx264 --enable-libvpx --disable-nonfree
    --disable-autodetect --disable-debug --disable-doc --disable-ffplay
    --disable-network --enable-avfoundation --enable-audiotoolbox
    --enable-videotoolbox --enable-zlib --prefix=/homie-runtime/ffmpeg
    --pkg-config-flags=--static
    --extra-cflags='-arch arm64 -mmacosx-version-min=14.0 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX26.2.sdk -ffile-prefix-map=/homie-build=/homie-build -fdebug-prefix-map=/homie-build=/homie-build -I../../prefix/include'
    --extra-ldflags='-arch arm64 -mmacosx-version-min=14.0 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX26.2.sdk -L../../prefix/lib'
    --extra-libs=-lpthread

Everything statically linked into the executables comes from the three
archives below. The only dynamic libraries are macOS system frameworks
(Foundation, AVFoundation, AudioToolbox, VideoToolbox, CoreMedia, CoreVideo,
CoreGraphics, CoreServices, CoreFoundation, CoreAudio, libSystem, libobjc)
and the system /usr/lib/libz.1.dylib.

Upstream sources (unmodified — see changes.diff)
------------------------------------------------
  ffmpeg-9.0.1.tar.xz   FFmpeg 9.0.1        https://ffmpeg.org/releases/ffmpeg-9.0.1.tar.xz
                        signed by the FFmpeg release key, fingerprint
                        FCF986EA15E6E293A5644F10B4322F04D67658D8
                        (ffmpeg-9.0.1.tar.xz.asc, key in ffmpeg-devel.asc)
  x264-b35605ace3ddf7c1a5d67a2eb553f034aef41d55.tar.bz2
                        x264 stable @ b35605ace3ddf7c1a5d67a2eb553f034aef41d55 (GPL-2.0-or-later)
                        https://code.videolan.org/videolan/x264/-/archive/b35605ace3ddf7c1a5d67a2eb553f034aef41d55/x264-b35605ace3ddf7c1a5d67a2eb553f034aef41d55.tar.bz2
  libvpx-1.17.0.tar.gz  libvpx 1.17.0 (BSD-3-Clause)
                        https://storage.googleapis.com/downloads.webmproject.org/releases/webm/libvpx-1.17.0.tar.gz

Exact sha256 of every file here is in SHA256SUMS.

Recipe
------
build-runtime.mjs in this directory is the exact script that produced the
shipped executables (it is copied into the handoff by the build itself). It
reads source-lock.json, verifies each archive's sha256 and the FFmpeg PGP
signature, records toolchain.json, and then runs, in order:

  1. x264:    ./configure --enable-static --disable-cli --disable-opencl --enable-pic --prefix=../../prefix --host=aarch64-darwin
              make -jN && make install
  2. libvpx:  ./configure --target=arm64-darwin23-gcc --disable-shared --enable-static --disable-examples --disable-tools --disable-docs --disable-unit-tests --enable-vp8 --enable-vp9 --enable-pic --prefix=../../prefix
              make -jN && make install
  3. ffmpeg:  ./configure <the configuration line above>      (PKG_CONFIG_PATH=../../prefix/lib/pkgconfig)
              make -jN
     then copies ffmpeg and ffprobe out of the build tree.

Each archive is extracted with `tar -xf ARCHIVE -C scratch/source/NAME
--strip-components 1`, so ../../prefix is scratch/prefix for all three.
configure.json holds the exact argv of each configure call and the
environment (CC, SDKROOT, MACOSX_DEPLOYMENT_TARGET, CFLAGS, CXXFLAGS,
LDFLAGS) they ran under; toolchain.json records the Xcode (26.3, 17C529),
SDK (MacOSX26.2), clang, make, pkg-config and gpg used; source-lock.json is
the pinned source manifest; changes.diff is empty ("No source changes.")
because no upstream file was patched.

Build environment, from build-runtime.mjs:
  PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin LANG=C LC_ALL=C TERM=dumb
  SOURCE_DATE_EPOCH=1786505771 ZERO_AR_DATE=1
  CC/AR/RANLIB/STRIP = the Xcode toolchain binaries named in toolchain.json
  PKG_CONFIG=/opt/homebrew/bin/pkg-config

To rebuild:
  node build-runtime.mjs --out /absolute/output/dir [--source-cache DIR] [--gpg /path/to/gpg] [--jobs N]
The script expects to live at packaging/media/build-runtime.mjs inside the
Homie tree with source-lock.json at config/runtime-dependencies/
ffmpeg-darwin-arm64.source.json (the same bytes as source-lock.json here).
Hand-running the three configure/make steps above with the same archives,
environment and toolchain produces the same executables before code signing.
The shipped binaries are additionally Developer ID signed with hardened
runtime and a secure timestamp; the signature is the only difference
between the build output and what ships.

Licence texts shipped beside the executables: FFmpeg's COPYING.GPLv2, x264's
COPYING, libvpx's LICENSE — they are inside the upstream archives above.

Homie: https://homie.rocks/   FFmpeg: https://ffmpeg.org/
x264: https://www.videolan.org/developers/x264.html
libvpx: https://chromium.googlesource.com/webm/libvpx/