# Rebuilding and replacing the LGPL components

These are technical instructions, not legal advice. Work on a copy of an installation, stop PatrolSafe first and preserve backups. A modified component is not Vesoft-signed or supported merely because it can be loaded by the application.

## Installed layout and replacement mechanism

PatrolSafe is packaged with Electron Forge/Squirrel using `asar: false`. The relevant files remain ordinary files below the versioned installed application's `resources/app/node_modules` tree. No PatrolSafe runtime hash check or signature-enforcement check for these dependency files was found.

The Sharp addon imports `libvips-42.dll` and `libvips-cpp-8.18.6.dll` by fixed filename. The C++ DLL imports `libvips-42.dll`. The node-webpmux Emscripten loader resolves `libwebp.wasm` as a sibling file at runtime. This provides a technical replacement path for an interface-compatible build.

An application update installs a new versioned application directory and may replace these files. A user who relies on modified components must repeat the replacement and compatibility testing after an update.

## Rebuild the Windows libvips dependency set

The official build is represented by:

- `build-win64-mxe-8.18.6-source.tar.gz`;
- `mxe-llvm-mingw-20260605-source.tar.gz`;
- the exact dependency archives in `SOURCES/`; and
- the patches and package recipes inside the build snapshots.

On a supported Linux/WSL build host with Docker or Podman, extract the build snapshot and follow its `README.md`. The upstream command for the relevant target and dependency group is:

```sh
./build.sh --without-prebuilt -t x86_64-w64-mingw32.static vips-web
```

The build uses the exact versions and checksums recorded in `SOURCE-MANIFEST.md`. To rebuild with a modified LGPL component, substitute that component's modified source, update only the relevant local package recipe/checksum, retain all applicable patches and run the same target. The resulting `libvips-42.dll` must retain the ABI imported by Sharp.

The original official upstream `libvips-42.dll` SHA-256 is `E6CC51BBC763E7DEDA536C6F56CE96B4C51EA769690CE4F4ED07607527B81DAE`. The source bundle contains every source archive used by the DLL, including the permissive/MPL dependencies required for a complete relink, rather than depending only on live upstream download links.

## Rebuild the Sharp addon and C++ binding

Extract `sharp-0.35.4-source.tar.gz`. Its exact upstream Windows x64 build workflow uses Node.js 22 on Windows and the `@img/sharp-libvips-*` 1.3.3 development packages. The source tree contains `src/binding.gyp`, which builds:

- `libvips-cpp-8.18.6.dll` from the libvips C++ sources; and
- `sharp-win32-x64-0.35.4.node` linked to the separate C and C++ DLLs.

The upstream build sequence is:

```text
npm install
npm run build:dist
npm run build
npm run package-from-local-build
```

An interface-compatible modification confined inside `libvips-42.dll` can normally be tested by replacing that DLL alone. A libvips C++ ABI change requires rebuilding/replacing `libvips-cpp-8.18.6.dll` and possibly the Sharp addon. Preserve the exact filenames because they are the import names recorded in the PE binaries.

Copy replacements into a disposable copy of:

```text
resources/app/node_modules/@img/sharp-win32-x64/lib/
```

The certified Vesoft files carry Authenticode signatures. A replacement build will not validate as Vesoft Services Limited and must not be described as publisher-signed.

## Rebuild node-webpmux and libwebp.wasm

Extract:

- `node-webpmux-3.2.1-source.tar.gz`; and
- `libwebp-613be8fc-source.tar.gz`.

Place the extracted libwebp source as `node-webpmux-3.2.1/libwebp/libwebp`, then run the command recorded by node-webpmux from `node-webpmux-3.2.1/libwebp` with an Emscripten toolchain:

```sh
emcc -O3 -s WASM=1 -s MODULARIZE -s EXPORTED_RUNTIME_METHODS='[cwrap]' -s ALLOW_MEMORY_GROWTH=1 -s EXPORT_NAME=LibWebP -DHAVE_CONFIG_H -I libwebp binding.cpp libwebp/src/{dec,dsp,demux,enc,mux,utils}/*.c libwebp/sharpyuv/*.c --bind -o libwebp.js
```

This produces `libwebp.js` and `libwebp.wasm`. Replace both generated sibling files together in a disposable copy of:

```text
resources/app/node_modules/node-webpmux/libwebp/
```

The top-level node-webpmux JavaScript is already distributed in source form and can be replaced independently if modified. A replacement WASM build must preserve the exports expected by `libwebp.js`.

The upstream project did not record the exact Emscripten release used for the distributed 3.2.1 WASM. The source commit, binding source and exact command are recorded, so an interface-compatible rebuild is possible, but a bit-for-bit reproducible WASM build is not currently established. Counsel must decide whether this build-tool version gap affects the approved distribution treatment.

## Validation performed

- The unsigned upstream Sharp/libvips binaries load successfully with Sharp 0.35.4 and libvips 8.18.6; a synthetic 2x2 PNG operation completed.
- `node-webpmux` 3.2.1 loaded its separately shipped WASM successfully through `Image.initLib()`.
- PE import tables and the Emscripten loader were inspected directly; replacement does not require proxying or changing the proprietary PatrolSafe executable.
- The certified installer was not changed.