# PatrolSafe v1.0.2 LGPL source manifest

All hashes are SHA-256. Archives marked **recipe verified** matched the checksum in the exact upstream Windows build recipe. Git snapshots were generated with `git archive` from the pinned commit shown and are separately hashed here.

## LGPL-relevant component identity

| Distributed component | Version/source | Licence fact from exact source | Incorporation |
|---|---|---|---|
| `node-webpmux` | 3.2.1; commit `f9c554d359d52c0787599fdb999b20e34fcdf332` | `LGPL-3.0-or-later` | Unpacked JS/source plus generated glue and separate WASM |
| `libwebp` used by node-webpmux | commit `613be8fc6135281f148a0819f9a64cb08f98c648` | New BSD licence | Statically compiled into `libwebp.wasm`; separate from the JS loader |
| `sharp` Windows addon | 0.35.4; commit `7f1a0a22cc285fe180766f4935d50b55af6e8432` | Sharp source is Apache-2.0; Windows package declares `Apache-2.0 AND LGPL-3.0-or-later` for its combined contents | Node-API addon dynamically imports separate libvips DLLs |
| libvips C/C++ | 8.18.6 | `LGPL-2.1-or-later` | `libvips-42.dll`; C++ binding is separate `libvips-cpp-8.18.6.dll` |
| fribidi | 1.0.16 | `LGPL-2.1-or-later` | Statically incorporated into `libvips-42.dll` |
| GLib | 2.89.4 | `LGPL-2.1-or-later` | Statically incorporated into `libvips-42.dll` |
| libexif | 0.6.26 | Source files declare `LGPL-2.0-or-later`; source archive carries LGPL 2.1 text | Statically incorporated into `libvips-42.dll` |
| libheif | 1.23.2 | LGPL 3.0 (source archive also carries GPL 3.0 text) | Statically incorporated into `libvips-42.dll`; HEVC codec options disabled by the build recipe |
| librsvg | 2.62.91 | `LGPL-2.1-or-later` | Statically incorporated into `libvips-42.dll` |
| Pango | 1.58.2 | Project metadata declares `LGPL-2.1-or-later`; archive also retains an older Library GPL v2 text | Statically incorporated into `libvips-42.dll` |
| proxy-libintl | 0.5 | Source headers state GNU Library GPL v2 or later | Statically incorporated into `libvips-42.dll` in `STUB_ONLY` mode |

The `@img/sharp-win32-x64` notice treats the LGPL-2.x-or-later libraries under LGPLv3. Whether that election and the proposed notice/source/relink delivery satisfy the applicable licences is for counsel.

## Source and build archive inventory

| Archive | Version/ref | SHA-256 | Purpose/provenance |
|---|---|---|---|
| `build-win64-mxe-8.18.6-source.tar.gz` | `09cfccf20b91b441fbe97fa7a7ed8a597e55e830` | `56B59B6AF29B4E5506AD8567950827C7DBE3486A43A02DBEF4EA19D2543CA3E2` | Official Windows build, patches and packaging scripts |
| `mxe-llvm-mingw-20260605-source.tar.gz` | `d973945bb92c7783d5afa41bb2b8d2e1a04eaba3` | `65375EBEBB0E78D08625E12BFA424520B584EB5BC0AAF98FA6A504ABCC441D9E` | Exact MXE branch named by the build container |
| `sharp-libvips-1.3.3-source.tar.gz` | `6e5971d333377743163edc3ad9e5d0b897abcbc9` | `040F95E4C4891BC205CDB29B9A15ACD3EE9C9BBD5F832DE15E3BD97E99DC4ABE` | Official `@img` libvips packaging scripts |
| `sharp-0.35.4-source.tar.gz` | `7f1a0a22cc285fe180766f4935d50b55af6e8432` | `58ACB1F48E557C0673DDE2E6494CABD439A0BDD26776C94D723E109BAED455EF` | Sharp addon and Windows C++ binding build source |
| `node-webpmux-3.2.1-source.tar.gz` | `f9c554d359d52c0787599fdb999b20e34fcdf332` | `28060C2AE8E0A84E753910E4FB15768E9189F7922841DDB5DACBC946B70A09C7` | Exact node-webpmux source |
| `libwebp-613be8fc-source.tar.gz` | `613be8fc6135281f148a0819f9a64cb08f98c648` | `080748B548A7A40F6F308C4EB8121F6675239E3519B3D8923B662364AA2013EC` | Exact libwebp source used for node-webpmux WASM |
| `libaom-3.14.1.tar.gz` | 3.14.1 | `44BF90DBD23E734D50E70A8C41C285193922938BD0D3BC2EE56764D181D55EF5` | Recipe verified |
| `libarchive-3.8.9.tar.xz` | 3.8.9 | `888C934F9D95648ECB9163DC8E23AB80A476ECB81A8F1154704A227B5B676DDE` | Recipe verified |
| `cairo-1.18.4.tar.xz` | 1.18.4 | `445ED8208A6E4823DE1226A74CA319D3600E83F6369F99B14265006599C32CCB` | Recipe verified |
| `cgif-0.5.3.tar.gz` | 0.5.3 | `DCC7731E974EE77DB75DF26C99ACA4D95F11CA2D267D870D42BCE1E0D1E1E75F` | Recipe verified |
| `expat-2.8.3.tar.xz` | 2.8.3 | `F6256DF90C906773D344DA084402B7D3E4F22ED41B1A59C989098A83D3EA0C85` | Recipe verified |
| `libffi-3.8.0.tar.gz` | 3.8.0 | `7DA3E2D9A171EB0A038F592ECAD3FF2BB2550F3496D87B3B29AD0CF4430C0DB4` | Recipe verified |
| `fontconfig-2.18.3.tar.xz` | 2.18.3 | `4F7B554A38CDF78C033F666C8871F3749E14A094F65A07F630C91ED0B43D35E3` | Recipe verified |
| `freetype-2.14.3.tar.xz` | 2.14.3 | `36BC4F1CC413335368EE656C42AFCA65C5A3987E8768CC28CF11BA775E785A5F` | Recipe verified |
| `fribidi-1.0.16.tar.xz` | 1.0.16 | `1B1CDE5B235D40479E91BE2F0E88A309E3214C8AB470EC8A2744D82A5A9EA05C` | Recipe verified; LGPL source |
| `glib-2.89.4.tar.xz` | 2.89.4 | `1CDBB799F558832E6F14B8337B5FD599C6918AB144977B55E05E00A5E2E84A2C` | Recipe verified; LGPL source |
| `harfbuzz-14.3.1.tar.xz` | 14.3.1 | `9DAE9538AAE2FFDF70CEC31F2C27BF68E2AAEEAE3112688467697D5FAF6194F7` | Recipe verified |
| `highway-1.4.0.tar.gz` | 1.4.0 | `36F672AB48DDB3C8555E9E89E16FE400CD7D16C6EB455A1A3D0C146A63ABABDC` | Recipe verified |
| `lcms2-2.19.1.tar.gz` | 2.19.1 | `BFC54F7BAB59FBC921012014A8032E4CBA4ABD46DB47D46B76416A8C0B2815C8` | Recipe verified |
| `libexif-0.6.26.tar.xz` | 0.6.26 | `4A055ED6575E61CA46C3172BE3C753CC16C9BECD0F99EC71D58DD0E471476C0C` | Recipe verified; LGPL source |
| `libheif-1.23.2.tar.gz` | 1.23.2 | `8BD5D41D19DC84536D118B04774709F244DF6104EF66D623DAD5FA4650143405` | Recipe verified; LGPL source |
| `libimagequant-2.4.1.tar.gz` | 2.4.1 fork | `47D2A84B7B1052975C9D50A3D4E3CACBF57B43D84A4C3131210848EAD9964DFB` | Recipe verified |
| `libpng-1.6.58.tar.xz` | 1.6.58 | `28EB403F51F0F7405249132CECFE82EA5C0EF97F1B32C5A65828814AE0D34775` | Recipe verified |
| `librsvg-2.62.91.tar.xz` | 2.62.91 | `6CAEAE129D40DD88F8EC49436FD89BFE4ADA716A125187A7FA0DEF8FCAA0B250` | Recipe verified; LGPL source |
| `libultrahdr-2.0.2.tar.gz` | 2.0.2 | `AA8D193BB887C348C419780511DD03B374F4E07AF8812B6D3F80C8537CF1EF2C` | Recipe verified |
| `libwebp-1.6.0.tar.gz` | 1.6.0 | `E4AB7009BF0629FD11982D4C2AA83964CF244CFFBA7347ECD39019A9E38C4564` | Recipe verified; libvips dependency (not node-webpmux WASM source) |
| `libxml2-2.15.3.tar.xz` | 2.15.3 | `78262A6E7AC170D6528EBFE2EFCCDF220191A5AF6A6CD61EA4A9A9A5042C7A07` | Recipe verified |
| `mozjpeg-0826579.tar.gz` | commit `08265790774cd0714832c9e675522acbe5581437` | `375D19302F09DFA267651DCFD3DDB62862AB3A488862B6168CE755BB1A925860` | Recipe verified |
| `pango-1.58.2.tar.xz` | 1.58.2 | `342385B6CA3B7C73455D7C80A13B7DBE4489E00BC3BD4C5BD6ED4DCE421E374A` | Recipe verified; LGPL source |
| `pixman-0.46.4.tar.gz` | 0.46.4 | `D09C44EBC3BD5BEE7021C79F922FE8FB2FB57F7320F55E97FF9914D2346A591C` | Recipe verified |
| `proxy-libintl-0.5.tar.gz` | 0.5 | `F7A1CBD7579BAAF575C66F9D99FB6295E9B0684A28B095967CFDA17857595303` | Recipe verified; LGPL source |
| `tiff-4.7.2.tar.xz` | 4.7.2 | `4996F0C4F93094719B1CA5C6279B20E588773BA8A247533E486416FB662DDB88` | Recipe verified |
| `vips-8.18.6.tar.xz` | 8.18.6 | `3C41E1D5458081BFA4A5BC54E116C46259C75C6760A18027764555632B9DDA3E` | Recipe verified; LGPL source |
| `zlib-ng-2.3.3.tar.gz` | 2.3.3 | `F9C65AA9C852EB8255B636FD9F07CE1C406F061EC19A2E7D508B318CA0C907D1` | Recipe verified |

## Upstream repositories

- sharp: <https://github.com/lovell/sharp/tree/v0.35.4>
- sharp-libvips: <https://github.com/lovell/sharp-libvips/tree/v1.3.3>
- libvips Windows build: <https://github.com/libvips/build-win64-mxe/tree/v8.18.6>
- MXE fork/build branch: <https://github.com/kleisauke/mxe/tree/llvm-mingw-20260605>
- node-webpmux: <https://github.com/ApeironTsuka/node-webpmux/tree/f9c554d359d52c0787599fdb999b20e34fcdf332>
- libwebp WASM source: <https://github.com/webmproject/libwebp/tree/613be8fc6135281f148a0819f9a64cb08f98c648>

The archive copies, not mutable branch or `latest` URLs, are the controlled source for this v1.0.2 package. They are the same exact upstream source versions technically verified for v1.0.1; the v1.0.2 binary association and signed-file hashes are recorded separately in `BINARY-MANIFEST.json`.