Skip to content

Original build provenance for FFmpegBuild 3.7.1 and LibDovi 2.1.0 tvOS libraries #8

Open

Description

@tenzen1869

I am preparing an independent Jellyfin client, Dadflix, for a possible Apple TV App Store release. I want to preserve its current playback and satisfy the applicable source and notice obligations. This is a request for build facts, not a request to waive third-party terms.

The selected packaging commits are FFmpegBuild 013c48b (tag 3.7.1) and LibDovi 0d7cce1d6836a30d13a3a2326e50a153af53f014 (tag 2.1.0). The ten tvOS device inputs below match the bytes tracked at those commits. We have collected the implementation trees, patches and library lockfile described by the recipes, but cannot yet establish that they correspond to the actual prebuilt libraries.

Could you provide or point to the original build records for these exact hashes?

  1. Exact implementation and patch revisions for FFmpeg, dav1d, zimg, libzvbi and dolby_vision, including any local/generated changes.
  2. Original commands, environment/configuration, compiler/linker/SDK versions and generated FFmpeg config headers/config.log, Meson cross files/logs and libzvbi/zimg configure results. Include the actual libzvbi source exclusions and stub used to keep the selected build LGPL-compatible.
  3. The Cargo.lock actually resolved during the LibDovi build (the recipe did not use --locked), Rust/cargo/cargo-c versions, target/default/features and dependency tree, build logs and runtime/linked component attribution records.
  4. A build manifest or attestation that binds those inputs and steps to the output hashes. We queried two GitHub digest attestation endpoints and received 404; we do not infer that no other provenance exists.
  5. The historical derivation/source revision and attribution for AetherEngine’s bundled silent-atmos reference MP4, including its container-generation step. The current generator reproduces its elementary payload, which is narrower than proving complete resource provenance.

If original records are unavailable, please say so and identify any inputs necessary for a controlled rebuild. Please do not reconstruct or guess the original dependency resolution. A new rebuilt binary can be evaluated separately rather than described as the old one.

We have not installed, published or submitted the app, agreed to new terms or claimed Dolby/DTS certification. No request here grants permission to publish Dadflix source.

Exact tvOS device input SHA-256 values:

  • Frameworks/AetherLibavcodec.framework/AetherLibavcodec: fee75babaadfc7ef1ce8f88c2f41fc3a4344e7ecf4b47b3298d04c494d7201d3
  • Frameworks/AetherLibavfilter.framework/AetherLibavfilter: fd2e89c3db1ad7360167785a471e78b57562e35a30ee13028144bca0d6e1b7de
  • Frameworks/AetherLibavformat.framework/AetherLibavformat: 735f7b786de1839c82082fd4f8562ad5b1504ceeafb6582576bdfc16ca3fc293
  • Frameworks/AetherLibavutil.framework/AetherLibavutil: 237bb1b35bcb241533144773df72f1cf7ac9d262493e433c3fd3fbf72584b5b2
  • Frameworks/AetherLibdav1d.framework/AetherLibdav1d: 8d3adedf1c30bc3292a6849d18ff8ff8296eb7f0eefeb6c2d887c6f17fda1a99
  • Frameworks/AetherLibswresample.framework/AetherLibswresample: a76246b429b5136ff9eb3f3210f56cad018403477f0a8aa5c8ad6a980d1d8512
  • Frameworks/AetherLibswscale.framework/AetherLibswscale: 5571d7c8e38e20d13fc383dec2ca4c76c0b8afe6612888ccb3d6032d62a4dcd6
  • Frameworks/AetherLibzimg.framework/AetherLibzimg: 6be2e0ef4934630c8c604a55190c65da674a2fb235f7d708309b67975295c521
  • Frameworks/AetherLibzvbi.framework/AetherLibzvbi: 3cab0b61f73711f59ec6e9fdcd1913157e46a04c69484ae23eedc3a15804f23c
  • static/libdovi.a: 3d4a89cfc8f4b3bf1fc9285e07684db1b7d75ced7dc6657c37cb879129c515b6

Activity

  1. superuser404notfound commented on Oct 20, 2026

    @superuser404notfound
    Owner

    Thanks for the precise request. Short answer: the original build records for those exact outputs no longer exist, and I won't reconstruct them.

    What exists and is authoritative

    • Both repos are built locally on my Mac with no CI and no attestation, so the 404s are expected. There is no other provenance store.
    • The build working directories (config.log, Meson logs, cross files, cargo target dir) were overwritten by later releases (FFmpegBuild) or deleted (LibDovi build/ is gitignored). The resolved Cargo.lock, the cargo/cargo-c/rustc versions and the build logs from that run were not retained.
    • Inputs, as recorded in build.sh at the tagged commits: FFmpeg n8.1.3, dav1d 1.5.4, zimg release-3.0.6, libzvbi v0.2.45, dovi_tool libdovi-3.4.0 (crate dolby_vision, cargo cbuild --release --features capi). Every source modification is a function in build.sh (patch_ffmpeg*, patch_zvbi). The libzvbi GPL file exclusions and LGPL stubs are patch_zvbi, described in LICENSES/README.md. There are no other local changes.
    • Toolchain facts embedded in the shipped binaries themselves: LC_BUILD_VERSION gives tvOS SDK 27.0, minos 16.0, ld 27037.1, and DW_AT_producer in the bundled dSYM gives Apple clang 21.0.0 (clang-2100.3.34.2). These are read from the artifacts, not from a record.
    • dolby_vision/ ships its own Cargo.lock at libdovi-3.4.0, but the build did not pass --locked, so I can't attest that it was used unchanged.

    silent-atmos.mp4: added once, in AetherEngine 8a5a04e3, with no earlier revision. The elementary stream is written bit by bit by Scripts/make-silent-atmos.swift (derived from SpatialAudioBridge, Apache-2.0, attributed in the script header). The container step is the ffmpeg -c copy -fflags +bitexact -map_metadata -1 command documented in that header. The ffmpeg version used for that remux was not recorded.

    Controlled rebuild: the inputs above plus Xcode with the tvOS 27.0 SDK are everything build.sh needs. A rebuild will not be byte-identical to the shipped binaries and should be evaluated as a new artifact, as you suggest.

  2. superuser404notfound commented on Oct 20, 2026

    @superuser404notfound
    Owner

    A follow-up on LibDovi. I added --locked to its build and rebuilt 2.1.0 today from libdovi-3.4.0 (d1abe0e) against the Cargo.lock that the dolby_vision crate ships at that tag. Every libdovi.a it produced is byte-identical to the one committed at 0d7cce1, including tvos-arm64/libdovi.a = 3d4a89cfc8f4b3bf1fc9285e07684db1b7d75ced7dc6657c37cb879129c515b6.

    This is not the original build record, and I am not presenting it as one. It is a fresh build whose output matches the shipped bytes, so its inputs are demonstrably sufficient to produce them. Its full record (toolchain, the resolved dependency tree, the lock used and output hashes) is in LibDovi 9a064ab: BUILD-INFO.txt and BUILD-INFO.Cargo.lock.

    Going forward, both repos write a build record on every build (FFmpegBuild eb76d42, LibDovi 9a064ab), committed with the binaries it describes: upstream commits, a hash of the changes the patch functions made, toolchain and SDK versions, FFmpeg's configure line per slice, and the SHA-256 of every shipped binary. For FFmpegBuild this begins with the next release; 3.7.1 stays as described above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions