# MPVKit dynamic third-party materials

This directory records the inputs and outputs of the issue #153 spike and the issue #154 macOS production supply-chain extension. It is engineering evidence for review and is not legal advice; distribution terms and source-offer obligations require professional review before production use.

## Reproduction

```bash
MPVKitDynamic/build.sh
xcodegen generate --spec MPVKitSpike.yml
tests/issue-153-mpv-spike/dynamic_artifact_checks.sh \
  --xcframework MPVKitDynamicPackage/Artifacts/Libmpv.xcframework \
  --materials MPVKitDynamic/Materials
```

The build script pins MPVKit `0.41.0` at `613c0ccc3acf70e136aaff880a9b5fe8fdfaf5b8`, applies the tracked dynamic-linking patch and the tracked tvOS AudioUnit stereo-layout fallback, and invokes MPVKit's official Swift build entry point with `platform=macos,ios,tvos enable-dynamic enable-arm64-only version=0.41.0`. `enable-arm64-only` is scoped to non-macOS platforms by the patch, so the macOS dynamic slice remains universal `arm64` + `x86_64` and records a macOS 14.0 minimum deployment target. `build-versions.txt`, `upstream-input-checksums.sha256`, and `artifact-checksums.sha256` capture the source revisions, both patch checksums, fetched archives, toolchain, and generated XCFramework archives.

## License mode

- MPVKit is built from its `MPVKit` LGPL source path; the `MPVKit-GPL` product and `*-GPL` binary targets are absent from the local package.
- mpv is configured with `-Dgpl=false` on macOS, iOS, iOS Simulator, tvOS, and tvOS Simulator slices. The exported Meson option files preserve that evidence.
- FFmpeg is configured with `--enable-shared --disable-static --disable-nonfree`; its generated config has `CONFIG_GPL 0` and `CONFIG_NONFREE 0` on every recorded build configuration.
- The exported FFmpeg AAC decoder summaries record `CONFIG_AAC_DECODER 1` on every recorded build configuration. The tvOS AudioUnit patch changes mpv's existing LGPL source and bypasses an unsupported channel-layout query only when the requested layout is stereo.
- The official build's libsmbclient step is conditional on `enable-gpl` and is skipped. x264, x265, and fdk-aac are not build inputs or load commands.
- The official script restores LuaJIT as a build input, while mpv is configured with `-Dlua=disabled` for these Apple builds; the produced Libmpv load commands contain no LuaJIT dependency.

## Components

The SPDX file enumerates MPVKit, mpv, FFmpeg, and every archive restored by the official builder. The three core license texts are copied verbatim from the pinned source trees by `build.sh`. License conclusions for restored third-party binary archives remain `NOASSERTION`; their notices, corresponding source availability, static-link implications inside the dynamic FFmpeg/mpv frameworks, App Store terms, and LGPL relinking/source-offer procedure require professional review before shipping.

## Publication and disposition (LIFF-328, 2026-07-27)

- The three LGPL license texts now ship inside every app bundle (`ConfluxCore_ConfluxCore.bundle/OpenSource/`) and are reachable offline in-app from Settings → 关于 → 开源许可 on macOS, iOS, and tvOS. The same content, plus corresponding-source and relinking instructions, is published at the stable public URL `https://conflux.kami.asia/licenses.html` (source: `website/licenses.html`, license texts mirrored under `website/licenses/`). App and website share a single data source: `ConfluxCore/Sources/ConfluxCore/Resources/OpenSource/components.json`, guarded by `ConfluxCore/Tests/ConfluxCoreTests/OpenSourceLicensesTests.swift` and `tests/licenses-page-check.sh`.
- `NOASSERTION` disposition: the 18 restored third-party archives (LuaJIT excluded from the produced binaries by `-Dlua=disabled`) are statically linked inside the 8 dynamic frameworks. They are disclosed by name, version, upstream project, and build-archive URL both in-app and on the website, explicitly flagged as pending professional review. This is a disclosure disposition, not a legal conclusion; `licenseConcluded` stays `NOASSERTION` here until that review completes. Any change to these conclusions requires the professional review, not an engineering edit.
- Historical direct-download versions: this page and the Materials directory (per commit) are the stable public material entry points; users of older direct-download builds are directed to `licenses.html` or `support@kami.asia` for the materials corresponding to their version.